11da177e4SLinus Torvalds /* scm.c - Socket level control messages processing. 21da177e4SLinus Torvalds * 31da177e4SLinus Torvalds * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 41da177e4SLinus Torvalds * Alignment and value checking mods by Craig Metz 51da177e4SLinus Torvalds * 61da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or 71da177e4SLinus Torvalds * modify it under the terms of the GNU General Public License 81da177e4SLinus Torvalds * as published by the Free Software Foundation; either version 91da177e4SLinus Torvalds * 2 of the License, or (at your option) any later version. 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/module.h> 131da177e4SLinus Torvalds #include <linux/signal.h> 144fc268d2SRandy Dunlap #include <linux/capability.h> 151da177e4SLinus Torvalds #include <linux/errno.h> 161da177e4SLinus Torvalds #include <linux/sched.h> 171da177e4SLinus Torvalds #include <linux/mm.h> 181da177e4SLinus Torvalds #include <linux/kernel.h> 191da177e4SLinus Torvalds #include <linux/stat.h> 201da177e4SLinus Torvalds #include <linux/socket.h> 211da177e4SLinus Torvalds #include <linux/file.h> 221da177e4SLinus Torvalds #include <linux/fcntl.h> 231da177e4SLinus Torvalds #include <linux/net.h> 241da177e4SLinus Torvalds #include <linux/interrupt.h> 251da177e4SLinus Torvalds #include <linux/netdevice.h> 261da177e4SLinus Torvalds #include <linux/security.h> 27b488893aSPavel Emelyanov #include <linux/pid.h> 28b488893aSPavel Emelyanov #include <linux/nsproxy.h> 295a0e3ad6STejun Heo #include <linux/slab.h> 301da177e4SLinus Torvalds 311da177e4SLinus Torvalds #include <asm/system.h> 321da177e4SLinus Torvalds #include <asm/uaccess.h> 331da177e4SLinus Torvalds 341da177e4SLinus Torvalds #include <net/protocol.h> 351da177e4SLinus Torvalds #include <linux/skbuff.h> 361da177e4SLinus Torvalds #include <net/sock.h> 371da177e4SLinus Torvalds #include <net/compat.h> 381da177e4SLinus Torvalds #include <net/scm.h> 391da177e4SLinus Torvalds 401da177e4SLinus Torvalds 411da177e4SLinus Torvalds /* 421da177e4SLinus Torvalds * Only allow a user to send credentials, that they could set with 431da177e4SLinus Torvalds * setu(g)id. 441da177e4SLinus Torvalds */ 451da177e4SLinus Torvalds 461da177e4SLinus Torvalds static __inline__ int scm_check_creds(struct ucred *creds) 471da177e4SLinus Torvalds { 4886a264abSDavid Howells const struct cred *cred = current_cred(); 49b6dff3ecSDavid Howells 50b488893aSPavel Emelyanov if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) && 51b6dff3ecSDavid Howells ((creds->uid == cred->uid || creds->uid == cred->euid || 52b6dff3ecSDavid Howells creds->uid == cred->suid) || capable(CAP_SETUID)) && 53b6dff3ecSDavid Howells ((creds->gid == cred->gid || creds->gid == cred->egid || 54b6dff3ecSDavid Howells creds->gid == cred->sgid) || capable(CAP_SETGID))) { 551da177e4SLinus Torvalds return 0; 561da177e4SLinus Torvalds } 571da177e4SLinus Torvalds return -EPERM; 581da177e4SLinus Torvalds } 591da177e4SLinus Torvalds 601da177e4SLinus Torvalds static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 611da177e4SLinus Torvalds { 621da177e4SLinus Torvalds int *fdp = (int*)CMSG_DATA(cmsg); 631da177e4SLinus Torvalds struct scm_fp_list *fpl = *fplp; 641da177e4SLinus Torvalds struct file **fpp; 651da177e4SLinus Torvalds int i, num; 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int); 681da177e4SLinus Torvalds 691da177e4SLinus Torvalds if (num <= 0) 701da177e4SLinus Torvalds return 0; 711da177e4SLinus Torvalds 721da177e4SLinus Torvalds if (num > SCM_MAX_FD) 731da177e4SLinus Torvalds return -EINVAL; 741da177e4SLinus Torvalds 751da177e4SLinus Torvalds if (!fpl) 761da177e4SLinus Torvalds { 771da177e4SLinus Torvalds fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL); 781da177e4SLinus Torvalds if (!fpl) 791da177e4SLinus Torvalds return -ENOMEM; 801da177e4SLinus Torvalds *fplp = fpl; 811da177e4SLinus Torvalds fpl->count = 0; 82bba14de9SEric Dumazet fpl->max = SCM_MAX_FD; 831da177e4SLinus Torvalds } 841da177e4SLinus Torvalds fpp = &fpl->fp[fpl->count]; 851da177e4SLinus Torvalds 86bba14de9SEric Dumazet if (fpl->count + num > fpl->max) 871da177e4SLinus Torvalds return -EINVAL; 881da177e4SLinus Torvalds 891da177e4SLinus Torvalds /* 901da177e4SLinus Torvalds * Verify the descriptors and increment the usage count. 911da177e4SLinus Torvalds */ 921da177e4SLinus Torvalds 931da177e4SLinus Torvalds for (i=0; i< num; i++) 941da177e4SLinus Torvalds { 951da177e4SLinus Torvalds int fd = fdp[i]; 961da177e4SLinus Torvalds struct file *file; 971da177e4SLinus Torvalds 98*326be7b4SAl Viro if (fd < 0 || !(file = fget_raw(fd))) 991da177e4SLinus Torvalds return -EBADF; 1001da177e4SLinus Torvalds *fpp++ = file; 1011da177e4SLinus Torvalds fpl->count++; 1021da177e4SLinus Torvalds } 1031da177e4SLinus Torvalds return num; 1041da177e4SLinus Torvalds } 1051da177e4SLinus Torvalds 1061da177e4SLinus Torvalds void __scm_destroy(struct scm_cookie *scm) 1071da177e4SLinus Torvalds { 1081da177e4SLinus Torvalds struct scm_fp_list *fpl = scm->fp; 1091da177e4SLinus Torvalds int i; 1101da177e4SLinus Torvalds 1111da177e4SLinus Torvalds if (fpl) { 1121da177e4SLinus Torvalds scm->fp = NULL; 113f8d570a4SDavid Miller if (current->scm_work_list) { 114f8d570a4SDavid Miller list_add_tail(&fpl->list, current->scm_work_list); 115f8d570a4SDavid Miller } else { 116f8d570a4SDavid Miller LIST_HEAD(work_list); 117f8d570a4SDavid Miller 118f8d570a4SDavid Miller current->scm_work_list = &work_list; 119f8d570a4SDavid Miller 120f8d570a4SDavid Miller list_add(&fpl->list, &work_list); 121f8d570a4SDavid Miller while (!list_empty(&work_list)) { 122f8d570a4SDavid Miller fpl = list_first_entry(&work_list, struct scm_fp_list, list); 123f8d570a4SDavid Miller 124f8d570a4SDavid Miller list_del(&fpl->list); 1251da177e4SLinus Torvalds for (i=fpl->count-1; i>=0; i--) 1261da177e4SLinus Torvalds fput(fpl->fp[i]); 1271da177e4SLinus Torvalds kfree(fpl); 1281da177e4SLinus Torvalds } 129f8d570a4SDavid Miller 130f8d570a4SDavid Miller current->scm_work_list = NULL; 131f8d570a4SDavid Miller } 132f8d570a4SDavid Miller } 1331da177e4SLinus Torvalds } 1349e34a5b5SEric Dumazet EXPORT_SYMBOL(__scm_destroy); 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvalds int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) 1371da177e4SLinus Torvalds { 1381da177e4SLinus Torvalds struct cmsghdr *cmsg; 1391da177e4SLinus Torvalds int err; 1401da177e4SLinus Torvalds 1411da177e4SLinus Torvalds for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) 1421da177e4SLinus Torvalds { 1431da177e4SLinus Torvalds err = -EINVAL; 1441da177e4SLinus Torvalds 1451da177e4SLinus Torvalds /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */ 1461da177e4SLinus Torvalds /* The first check was omitted in <= 2.2.5. The reasoning was 1471da177e4SLinus Torvalds that parser checks cmsg_len in any case, so that 1481da177e4SLinus Torvalds additional check would be work duplication. 1491da177e4SLinus Torvalds But if cmsg_level is not SOL_SOCKET, we do not check 1501da177e4SLinus Torvalds for too short ancillary data object at all! Oops. 1511da177e4SLinus Torvalds OK, let's add it... 1521da177e4SLinus Torvalds */ 1531da177e4SLinus Torvalds if (!CMSG_OK(msg, cmsg)) 1541da177e4SLinus Torvalds goto error; 1551da177e4SLinus Torvalds 1561da177e4SLinus Torvalds if (cmsg->cmsg_level != SOL_SOCKET) 1571da177e4SLinus Torvalds continue; 1581da177e4SLinus Torvalds 1591da177e4SLinus Torvalds switch (cmsg->cmsg_type) 1601da177e4SLinus Torvalds { 1611da177e4SLinus Torvalds case SCM_RIGHTS: 16276dadd76SEric W. Biederman if (!sock->ops || sock->ops->family != PF_UNIX) 16376dadd76SEric W. Biederman goto error; 1641da177e4SLinus Torvalds err=scm_fp_copy(cmsg, &p->fp); 1651da177e4SLinus Torvalds if (err<0) 1661da177e4SLinus Torvalds goto error; 1671da177e4SLinus Torvalds break; 1681da177e4SLinus Torvalds case SCM_CREDENTIALS: 1691da177e4SLinus Torvalds if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) 1701da177e4SLinus Torvalds goto error; 1711da177e4SLinus Torvalds memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred)); 1721da177e4SLinus Torvalds err = scm_check_creds(&p->creds); 1731da177e4SLinus Torvalds if (err) 1741da177e4SLinus Torvalds goto error; 175257b5358SEric W. Biederman 176257b5358SEric W. Biederman if (pid_vnr(p->pid) != p->creds.pid) { 177257b5358SEric W. Biederman struct pid *pid; 178257b5358SEric W. Biederman err = -ESRCH; 179257b5358SEric W. Biederman pid = find_get_pid(p->creds.pid); 180257b5358SEric W. Biederman if (!pid) 181257b5358SEric W. Biederman goto error; 182257b5358SEric W. Biederman put_pid(p->pid); 183257b5358SEric W. Biederman p->pid = pid; 184257b5358SEric W. Biederman } 185257b5358SEric W. Biederman 186257b5358SEric W. Biederman if ((p->cred->euid != p->creds.uid) || 187257b5358SEric W. Biederman (p->cred->egid != p->creds.gid)) { 188257b5358SEric W. Biederman struct cred *cred; 189257b5358SEric W. Biederman err = -ENOMEM; 190257b5358SEric W. Biederman cred = prepare_creds(); 191257b5358SEric W. Biederman if (!cred) 192257b5358SEric W. Biederman goto error; 193257b5358SEric W. Biederman 194257b5358SEric W. Biederman cred->uid = cred->euid = p->creds.uid; 195257b5358SEric W. Biederman cred->gid = cred->egid = p->creds.uid; 196257b5358SEric W. Biederman put_cred(p->cred); 197257b5358SEric W. Biederman p->cred = cred; 198257b5358SEric W. Biederman } 1991da177e4SLinus Torvalds break; 2001da177e4SLinus Torvalds default: 2011da177e4SLinus Torvalds goto error; 2021da177e4SLinus Torvalds } 2031da177e4SLinus Torvalds } 2041da177e4SLinus Torvalds 2051da177e4SLinus Torvalds if (p->fp && !p->fp->count) 2061da177e4SLinus Torvalds { 2071da177e4SLinus Torvalds kfree(p->fp); 2081da177e4SLinus Torvalds p->fp = NULL; 2091da177e4SLinus Torvalds } 2101da177e4SLinus Torvalds return 0; 2111da177e4SLinus Torvalds 2121da177e4SLinus Torvalds error: 2131da177e4SLinus Torvalds scm_destroy(p); 2141da177e4SLinus Torvalds return err; 2151da177e4SLinus Torvalds } 2169e34a5b5SEric Dumazet EXPORT_SYMBOL(__scm_send); 2171da177e4SLinus Torvalds 2181da177e4SLinus Torvalds int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) 2191da177e4SLinus Torvalds { 220cfcabdccSStephen Hemminger struct cmsghdr __user *cm 221cfcabdccSStephen Hemminger = (__force struct cmsghdr __user *)msg->msg_control; 2221da177e4SLinus Torvalds struct cmsghdr cmhdr; 2231da177e4SLinus Torvalds int cmlen = CMSG_LEN(len); 2241da177e4SLinus Torvalds int err; 2251da177e4SLinus Torvalds 2261da177e4SLinus Torvalds if (MSG_CMSG_COMPAT & msg->msg_flags) 2271da177e4SLinus Torvalds return put_cmsg_compat(msg, level, type, len, data); 2281da177e4SLinus Torvalds 2291da177e4SLinus Torvalds if (cm==NULL || msg->msg_controllen < sizeof(*cm)) { 2301da177e4SLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 2311da177e4SLinus Torvalds return 0; /* XXX: return error? check spec. */ 2321da177e4SLinus Torvalds } 2331da177e4SLinus Torvalds if (msg->msg_controllen < cmlen) { 2341da177e4SLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 2351da177e4SLinus Torvalds cmlen = msg->msg_controllen; 2361da177e4SLinus Torvalds } 2371da177e4SLinus Torvalds cmhdr.cmsg_level = level; 2381da177e4SLinus Torvalds cmhdr.cmsg_type = type; 2391da177e4SLinus Torvalds cmhdr.cmsg_len = cmlen; 2401da177e4SLinus Torvalds 2411da177e4SLinus Torvalds err = -EFAULT; 2421da177e4SLinus Torvalds if (copy_to_user(cm, &cmhdr, sizeof cmhdr)) 2431da177e4SLinus Torvalds goto out; 2441da177e4SLinus Torvalds if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) 2451da177e4SLinus Torvalds goto out; 2461da177e4SLinus Torvalds cmlen = CMSG_SPACE(len); 2471ac70e7aSWei Yongjun if (msg->msg_controllen < cmlen) 2481ac70e7aSWei Yongjun cmlen = msg->msg_controllen; 2491da177e4SLinus Torvalds msg->msg_control += cmlen; 2501da177e4SLinus Torvalds msg->msg_controllen -= cmlen; 2511da177e4SLinus Torvalds err = 0; 2521da177e4SLinus Torvalds out: 2531da177e4SLinus Torvalds return err; 2541da177e4SLinus Torvalds } 2559e34a5b5SEric Dumazet EXPORT_SYMBOL(put_cmsg); 2561da177e4SLinus Torvalds 2571da177e4SLinus Torvalds void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) 2581da177e4SLinus Torvalds { 259cfcabdccSStephen Hemminger struct cmsghdr __user *cm 260cfcabdccSStephen Hemminger = (__force struct cmsghdr __user*)msg->msg_control; 2611da177e4SLinus Torvalds 2621da177e4SLinus Torvalds int fdmax = 0; 2631da177e4SLinus Torvalds int fdnum = scm->fp->count; 2641da177e4SLinus Torvalds struct file **fp = scm->fp->fp; 2651da177e4SLinus Torvalds int __user *cmfptr; 2661da177e4SLinus Torvalds int err = 0, i; 2671da177e4SLinus Torvalds 2681da177e4SLinus Torvalds if (MSG_CMSG_COMPAT & msg->msg_flags) { 2691da177e4SLinus Torvalds scm_detach_fds_compat(msg, scm); 2701da177e4SLinus Torvalds return; 2711da177e4SLinus Torvalds } 2721da177e4SLinus Torvalds 2731da177e4SLinus Torvalds if (msg->msg_controllen > sizeof(struct cmsghdr)) 2741da177e4SLinus Torvalds fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr)) 2751da177e4SLinus Torvalds / sizeof(int)); 2761da177e4SLinus Torvalds 2771da177e4SLinus Torvalds if (fdnum < fdmax) 2781da177e4SLinus Torvalds fdmax = fdnum; 2791da177e4SLinus Torvalds 280cfcabdccSStephen Hemminger for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax; 281cfcabdccSStephen Hemminger i++, cmfptr++) 2821da177e4SLinus Torvalds { 2831da177e4SLinus Torvalds int new_fd; 2841da177e4SLinus Torvalds err = security_file_receive(fp[i]); 2851da177e4SLinus Torvalds if (err) 2861da177e4SLinus Torvalds break; 2874a19542eSUlrich Drepper err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags 2884a19542eSUlrich Drepper ? O_CLOEXEC : 0); 2891da177e4SLinus Torvalds if (err < 0) 2901da177e4SLinus Torvalds break; 2911da177e4SLinus Torvalds new_fd = err; 2921da177e4SLinus Torvalds err = put_user(new_fd, cmfptr); 2931da177e4SLinus Torvalds if (err) { 2941da177e4SLinus Torvalds put_unused_fd(new_fd); 2951da177e4SLinus Torvalds break; 2961da177e4SLinus Torvalds } 2971da177e4SLinus Torvalds /* Bump the usage count and install the file. */ 2981da177e4SLinus Torvalds get_file(fp[i]); 2991da177e4SLinus Torvalds fd_install(new_fd, fp[i]); 3001da177e4SLinus Torvalds } 3011da177e4SLinus Torvalds 3021da177e4SLinus Torvalds if (i > 0) 3031da177e4SLinus Torvalds { 3041da177e4SLinus Torvalds int cmlen = CMSG_LEN(i*sizeof(int)); 3051da177e4SLinus Torvalds err = put_user(SOL_SOCKET, &cm->cmsg_level); 3061da177e4SLinus Torvalds if (!err) 3071da177e4SLinus Torvalds err = put_user(SCM_RIGHTS, &cm->cmsg_type); 3081da177e4SLinus Torvalds if (!err) 3091da177e4SLinus Torvalds err = put_user(cmlen, &cm->cmsg_len); 3101da177e4SLinus Torvalds if (!err) { 3111da177e4SLinus Torvalds cmlen = CMSG_SPACE(i*sizeof(int)); 3121da177e4SLinus Torvalds msg->msg_control += cmlen; 3131da177e4SLinus Torvalds msg->msg_controllen -= cmlen; 3141da177e4SLinus Torvalds } 3151da177e4SLinus Torvalds } 3161da177e4SLinus Torvalds if (i < fdnum || (fdnum && fdmax <= 0)) 3171da177e4SLinus Torvalds msg->msg_flags |= MSG_CTRUNC; 3181da177e4SLinus Torvalds 3191da177e4SLinus Torvalds /* 3201da177e4SLinus Torvalds * All of the files that fit in the message have had their 3211da177e4SLinus Torvalds * usage counts incremented, so we just free the list. 3221da177e4SLinus Torvalds */ 3231da177e4SLinus Torvalds __scm_destroy(scm); 3241da177e4SLinus Torvalds } 3259e34a5b5SEric Dumazet EXPORT_SYMBOL(scm_detach_fds); 3261da177e4SLinus Torvalds 3271da177e4SLinus Torvalds struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) 3281da177e4SLinus Torvalds { 3291da177e4SLinus Torvalds struct scm_fp_list *new_fpl; 3301da177e4SLinus Torvalds int i; 3311da177e4SLinus Torvalds 3321da177e4SLinus Torvalds if (!fpl) 3331da177e4SLinus Torvalds return NULL; 3341da177e4SLinus Torvalds 335bba14de9SEric Dumazet new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]), 336bba14de9SEric Dumazet GFP_KERNEL); 3371da177e4SLinus Torvalds if (new_fpl) { 338bba14de9SEric Dumazet for (i = 0; i < fpl->count; i++) 3391da177e4SLinus Torvalds get_file(fpl->fp[i]); 340bba14de9SEric Dumazet new_fpl->max = new_fpl->count; 3411da177e4SLinus Torvalds } 3421da177e4SLinus Torvalds return new_fpl; 3431da177e4SLinus Torvalds } 3441da177e4SLinus Torvalds EXPORT_SYMBOL(scm_fp_dup); 345