xref: /openbmc/linux/net/core/scm.c (revision 326be7b484843988afe57566b627fb7a70beac56)
11da177e4SLinus Torvalds /* scm.c - Socket level control messages processing.
21da177e4SLinus Torvalds  *
31da177e4SLinus Torvalds  * Author:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
41da177e4SLinus Torvalds  *              Alignment and value checking mods by Craig Metz
51da177e4SLinus Torvalds  *
61da177e4SLinus Torvalds  *		This program is free software; you can redistribute it and/or
71da177e4SLinus Torvalds  *		modify it under the terms of the GNU General Public License
81da177e4SLinus Torvalds  *		as published by the Free Software Foundation; either version
91da177e4SLinus Torvalds  *		2 of the License, or (at your option) any later version.
101da177e4SLinus Torvalds  */
111da177e4SLinus Torvalds 
121da177e4SLinus Torvalds #include <linux/module.h>
131da177e4SLinus Torvalds #include <linux/signal.h>
144fc268d2SRandy Dunlap #include <linux/capability.h>
151da177e4SLinus Torvalds #include <linux/errno.h>
161da177e4SLinus Torvalds #include <linux/sched.h>
171da177e4SLinus Torvalds #include <linux/mm.h>
181da177e4SLinus Torvalds #include <linux/kernel.h>
191da177e4SLinus Torvalds #include <linux/stat.h>
201da177e4SLinus Torvalds #include <linux/socket.h>
211da177e4SLinus Torvalds #include <linux/file.h>
221da177e4SLinus Torvalds #include <linux/fcntl.h>
231da177e4SLinus Torvalds #include <linux/net.h>
241da177e4SLinus Torvalds #include <linux/interrupt.h>
251da177e4SLinus Torvalds #include <linux/netdevice.h>
261da177e4SLinus Torvalds #include <linux/security.h>
27b488893aSPavel Emelyanov #include <linux/pid.h>
28b488893aSPavel Emelyanov #include <linux/nsproxy.h>
295a0e3ad6STejun Heo #include <linux/slab.h>
301da177e4SLinus Torvalds 
311da177e4SLinus Torvalds #include <asm/system.h>
321da177e4SLinus Torvalds #include <asm/uaccess.h>
331da177e4SLinus Torvalds 
341da177e4SLinus Torvalds #include <net/protocol.h>
351da177e4SLinus Torvalds #include <linux/skbuff.h>
361da177e4SLinus Torvalds #include <net/sock.h>
371da177e4SLinus Torvalds #include <net/compat.h>
381da177e4SLinus Torvalds #include <net/scm.h>
391da177e4SLinus Torvalds 
401da177e4SLinus Torvalds 
411da177e4SLinus Torvalds /*
421da177e4SLinus Torvalds  *	Only allow a user to send credentials, that they could set with
431da177e4SLinus Torvalds  *	setu(g)id.
441da177e4SLinus Torvalds  */
451da177e4SLinus Torvalds 
461da177e4SLinus Torvalds static __inline__ int scm_check_creds(struct ucred *creds)
471da177e4SLinus Torvalds {
4886a264abSDavid Howells 	const struct cred *cred = current_cred();
49b6dff3ecSDavid Howells 
50b488893aSPavel Emelyanov 	if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
51b6dff3ecSDavid Howells 	    ((creds->uid == cred->uid   || creds->uid == cred->euid ||
52b6dff3ecSDavid Howells 	      creds->uid == cred->suid) || capable(CAP_SETUID)) &&
53b6dff3ecSDavid Howells 	    ((creds->gid == cred->gid   || creds->gid == cred->egid ||
54b6dff3ecSDavid Howells 	      creds->gid == cred->sgid) || capable(CAP_SETGID))) {
551da177e4SLinus Torvalds 	       return 0;
561da177e4SLinus Torvalds 	}
571da177e4SLinus Torvalds 	return -EPERM;
581da177e4SLinus Torvalds }
591da177e4SLinus Torvalds 
601da177e4SLinus Torvalds static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
611da177e4SLinus Torvalds {
621da177e4SLinus Torvalds 	int *fdp = (int*)CMSG_DATA(cmsg);
631da177e4SLinus Torvalds 	struct scm_fp_list *fpl = *fplp;
641da177e4SLinus Torvalds 	struct file **fpp;
651da177e4SLinus Torvalds 	int i, num;
661da177e4SLinus Torvalds 
671da177e4SLinus Torvalds 	num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);
681da177e4SLinus Torvalds 
691da177e4SLinus Torvalds 	if (num <= 0)
701da177e4SLinus Torvalds 		return 0;
711da177e4SLinus Torvalds 
721da177e4SLinus Torvalds 	if (num > SCM_MAX_FD)
731da177e4SLinus Torvalds 		return -EINVAL;
741da177e4SLinus Torvalds 
751da177e4SLinus Torvalds 	if (!fpl)
761da177e4SLinus Torvalds 	{
771da177e4SLinus Torvalds 		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
781da177e4SLinus Torvalds 		if (!fpl)
791da177e4SLinus Torvalds 			return -ENOMEM;
801da177e4SLinus Torvalds 		*fplp = fpl;
811da177e4SLinus Torvalds 		fpl->count = 0;
82bba14de9SEric Dumazet 		fpl->max = SCM_MAX_FD;
831da177e4SLinus Torvalds 	}
841da177e4SLinus Torvalds 	fpp = &fpl->fp[fpl->count];
851da177e4SLinus Torvalds 
86bba14de9SEric Dumazet 	if (fpl->count + num > fpl->max)
871da177e4SLinus Torvalds 		return -EINVAL;
881da177e4SLinus Torvalds 
891da177e4SLinus Torvalds 	/*
901da177e4SLinus Torvalds 	 *	Verify the descriptors and increment the usage count.
911da177e4SLinus Torvalds 	 */
921da177e4SLinus Torvalds 
931da177e4SLinus Torvalds 	for (i=0; i< num; i++)
941da177e4SLinus Torvalds 	{
951da177e4SLinus Torvalds 		int fd = fdp[i];
961da177e4SLinus Torvalds 		struct file *file;
971da177e4SLinus Torvalds 
98*326be7b4SAl Viro 		if (fd < 0 || !(file = fget_raw(fd)))
991da177e4SLinus Torvalds 			return -EBADF;
1001da177e4SLinus Torvalds 		*fpp++ = file;
1011da177e4SLinus Torvalds 		fpl->count++;
1021da177e4SLinus Torvalds 	}
1031da177e4SLinus Torvalds 	return num;
1041da177e4SLinus Torvalds }
1051da177e4SLinus Torvalds 
1061da177e4SLinus Torvalds void __scm_destroy(struct scm_cookie *scm)
1071da177e4SLinus Torvalds {
1081da177e4SLinus Torvalds 	struct scm_fp_list *fpl = scm->fp;
1091da177e4SLinus Torvalds 	int i;
1101da177e4SLinus Torvalds 
1111da177e4SLinus Torvalds 	if (fpl) {
1121da177e4SLinus Torvalds 		scm->fp = NULL;
113f8d570a4SDavid Miller 		if (current->scm_work_list) {
114f8d570a4SDavid Miller 			list_add_tail(&fpl->list, current->scm_work_list);
115f8d570a4SDavid Miller 		} else {
116f8d570a4SDavid Miller 			LIST_HEAD(work_list);
117f8d570a4SDavid Miller 
118f8d570a4SDavid Miller 			current->scm_work_list = &work_list;
119f8d570a4SDavid Miller 
120f8d570a4SDavid Miller 			list_add(&fpl->list, &work_list);
121f8d570a4SDavid Miller 			while (!list_empty(&work_list)) {
122f8d570a4SDavid Miller 				fpl = list_first_entry(&work_list, struct scm_fp_list, list);
123f8d570a4SDavid Miller 
124f8d570a4SDavid Miller 				list_del(&fpl->list);
1251da177e4SLinus Torvalds 				for (i=fpl->count-1; i>=0; i--)
1261da177e4SLinus Torvalds 					fput(fpl->fp[i]);
1271da177e4SLinus Torvalds 				kfree(fpl);
1281da177e4SLinus Torvalds 			}
129f8d570a4SDavid Miller 
130f8d570a4SDavid Miller 			current->scm_work_list = NULL;
131f8d570a4SDavid Miller 		}
132f8d570a4SDavid Miller 	}
1331da177e4SLinus Torvalds }
1349e34a5b5SEric Dumazet EXPORT_SYMBOL(__scm_destroy);
1351da177e4SLinus Torvalds 
1361da177e4SLinus Torvalds int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
1371da177e4SLinus Torvalds {
1381da177e4SLinus Torvalds 	struct cmsghdr *cmsg;
1391da177e4SLinus Torvalds 	int err;
1401da177e4SLinus Torvalds 
1411da177e4SLinus Torvalds 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))
1421da177e4SLinus Torvalds 	{
1431da177e4SLinus Torvalds 		err = -EINVAL;
1441da177e4SLinus Torvalds 
1451da177e4SLinus Torvalds 		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
1461da177e4SLinus Torvalds 		/* The first check was omitted in <= 2.2.5. The reasoning was
1471da177e4SLinus Torvalds 		   that parser checks cmsg_len in any case, so that
1481da177e4SLinus Torvalds 		   additional check would be work duplication.
1491da177e4SLinus Torvalds 		   But if cmsg_level is not SOL_SOCKET, we do not check
1501da177e4SLinus Torvalds 		   for too short ancillary data object at all! Oops.
1511da177e4SLinus Torvalds 		   OK, let's add it...
1521da177e4SLinus Torvalds 		 */
1531da177e4SLinus Torvalds 		if (!CMSG_OK(msg, cmsg))
1541da177e4SLinus Torvalds 			goto error;
1551da177e4SLinus Torvalds 
1561da177e4SLinus Torvalds 		if (cmsg->cmsg_level != SOL_SOCKET)
1571da177e4SLinus Torvalds 			continue;
1581da177e4SLinus Torvalds 
1591da177e4SLinus Torvalds 		switch (cmsg->cmsg_type)
1601da177e4SLinus Torvalds 		{
1611da177e4SLinus Torvalds 		case SCM_RIGHTS:
16276dadd76SEric W. Biederman 			if (!sock->ops || sock->ops->family != PF_UNIX)
16376dadd76SEric W. Biederman 				goto error;
1641da177e4SLinus Torvalds 			err=scm_fp_copy(cmsg, &p->fp);
1651da177e4SLinus Torvalds 			if (err<0)
1661da177e4SLinus Torvalds 				goto error;
1671da177e4SLinus Torvalds 			break;
1681da177e4SLinus Torvalds 		case SCM_CREDENTIALS:
1691da177e4SLinus Torvalds 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
1701da177e4SLinus Torvalds 				goto error;
1711da177e4SLinus Torvalds 			memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
1721da177e4SLinus Torvalds 			err = scm_check_creds(&p->creds);
1731da177e4SLinus Torvalds 			if (err)
1741da177e4SLinus Torvalds 				goto error;
175257b5358SEric W. Biederman 
176257b5358SEric W. Biederman 			if (pid_vnr(p->pid) != p->creds.pid) {
177257b5358SEric W. Biederman 				struct pid *pid;
178257b5358SEric W. Biederman 				err = -ESRCH;
179257b5358SEric W. Biederman 				pid = find_get_pid(p->creds.pid);
180257b5358SEric W. Biederman 				if (!pid)
181257b5358SEric W. Biederman 					goto error;
182257b5358SEric W. Biederman 				put_pid(p->pid);
183257b5358SEric W. Biederman 				p->pid = pid;
184257b5358SEric W. Biederman 			}
185257b5358SEric W. Biederman 
186257b5358SEric W. Biederman 			if ((p->cred->euid != p->creds.uid) ||
187257b5358SEric W. Biederman 				(p->cred->egid != p->creds.gid)) {
188257b5358SEric W. Biederman 				struct cred *cred;
189257b5358SEric W. Biederman 				err = -ENOMEM;
190257b5358SEric W. Biederman 				cred = prepare_creds();
191257b5358SEric W. Biederman 				if (!cred)
192257b5358SEric W. Biederman 					goto error;
193257b5358SEric W. Biederman 
194257b5358SEric W. Biederman 				cred->uid = cred->euid = p->creds.uid;
195257b5358SEric W. Biederman 				cred->gid = cred->egid = p->creds.uid;
196257b5358SEric W. Biederman 				put_cred(p->cred);
197257b5358SEric W. Biederman 				p->cred = cred;
198257b5358SEric W. Biederman 			}
1991da177e4SLinus Torvalds 			break;
2001da177e4SLinus Torvalds 		default:
2011da177e4SLinus Torvalds 			goto error;
2021da177e4SLinus Torvalds 		}
2031da177e4SLinus Torvalds 	}
2041da177e4SLinus Torvalds 
2051da177e4SLinus Torvalds 	if (p->fp && !p->fp->count)
2061da177e4SLinus Torvalds 	{
2071da177e4SLinus Torvalds 		kfree(p->fp);
2081da177e4SLinus Torvalds 		p->fp = NULL;
2091da177e4SLinus Torvalds 	}
2101da177e4SLinus Torvalds 	return 0;
2111da177e4SLinus Torvalds 
2121da177e4SLinus Torvalds error:
2131da177e4SLinus Torvalds 	scm_destroy(p);
2141da177e4SLinus Torvalds 	return err;
2151da177e4SLinus Torvalds }
2169e34a5b5SEric Dumazet EXPORT_SYMBOL(__scm_send);
2171da177e4SLinus Torvalds 
2181da177e4SLinus Torvalds int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
2191da177e4SLinus Torvalds {
220cfcabdccSStephen Hemminger 	struct cmsghdr __user *cm
221cfcabdccSStephen Hemminger 		= (__force struct cmsghdr __user *)msg->msg_control;
2221da177e4SLinus Torvalds 	struct cmsghdr cmhdr;
2231da177e4SLinus Torvalds 	int cmlen = CMSG_LEN(len);
2241da177e4SLinus Torvalds 	int err;
2251da177e4SLinus Torvalds 
2261da177e4SLinus Torvalds 	if (MSG_CMSG_COMPAT & msg->msg_flags)
2271da177e4SLinus Torvalds 		return put_cmsg_compat(msg, level, type, len, data);
2281da177e4SLinus Torvalds 
2291da177e4SLinus Torvalds 	if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
2301da177e4SLinus Torvalds 		msg->msg_flags |= MSG_CTRUNC;
2311da177e4SLinus Torvalds 		return 0; /* XXX: return error? check spec. */
2321da177e4SLinus Torvalds 	}
2331da177e4SLinus Torvalds 	if (msg->msg_controllen < cmlen) {
2341da177e4SLinus Torvalds 		msg->msg_flags |= MSG_CTRUNC;
2351da177e4SLinus Torvalds 		cmlen = msg->msg_controllen;
2361da177e4SLinus Torvalds 	}
2371da177e4SLinus Torvalds 	cmhdr.cmsg_level = level;
2381da177e4SLinus Torvalds 	cmhdr.cmsg_type = type;
2391da177e4SLinus Torvalds 	cmhdr.cmsg_len = cmlen;
2401da177e4SLinus Torvalds 
2411da177e4SLinus Torvalds 	err = -EFAULT;
2421da177e4SLinus Torvalds 	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
2431da177e4SLinus Torvalds 		goto out;
2441da177e4SLinus Torvalds 	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
2451da177e4SLinus Torvalds 		goto out;
2461da177e4SLinus Torvalds 	cmlen = CMSG_SPACE(len);
2471ac70e7aSWei Yongjun 	if (msg->msg_controllen < cmlen)
2481ac70e7aSWei Yongjun 		cmlen = msg->msg_controllen;
2491da177e4SLinus Torvalds 	msg->msg_control += cmlen;
2501da177e4SLinus Torvalds 	msg->msg_controllen -= cmlen;
2511da177e4SLinus Torvalds 	err = 0;
2521da177e4SLinus Torvalds out:
2531da177e4SLinus Torvalds 	return err;
2541da177e4SLinus Torvalds }
2559e34a5b5SEric Dumazet EXPORT_SYMBOL(put_cmsg);
2561da177e4SLinus Torvalds 
2571da177e4SLinus Torvalds void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
2581da177e4SLinus Torvalds {
259cfcabdccSStephen Hemminger 	struct cmsghdr __user *cm
260cfcabdccSStephen Hemminger 		= (__force struct cmsghdr __user*)msg->msg_control;
2611da177e4SLinus Torvalds 
2621da177e4SLinus Torvalds 	int fdmax = 0;
2631da177e4SLinus Torvalds 	int fdnum = scm->fp->count;
2641da177e4SLinus Torvalds 	struct file **fp = scm->fp->fp;
2651da177e4SLinus Torvalds 	int __user *cmfptr;
2661da177e4SLinus Torvalds 	int err = 0, i;
2671da177e4SLinus Torvalds 
2681da177e4SLinus Torvalds 	if (MSG_CMSG_COMPAT & msg->msg_flags) {
2691da177e4SLinus Torvalds 		scm_detach_fds_compat(msg, scm);
2701da177e4SLinus Torvalds 		return;
2711da177e4SLinus Torvalds 	}
2721da177e4SLinus Torvalds 
2731da177e4SLinus Torvalds 	if (msg->msg_controllen > sizeof(struct cmsghdr))
2741da177e4SLinus Torvalds 		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
2751da177e4SLinus Torvalds 			 / sizeof(int));
2761da177e4SLinus Torvalds 
2771da177e4SLinus Torvalds 	if (fdnum < fdmax)
2781da177e4SLinus Torvalds 		fdmax = fdnum;
2791da177e4SLinus Torvalds 
280cfcabdccSStephen Hemminger 	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
281cfcabdccSStephen Hemminger 	     i++, cmfptr++)
2821da177e4SLinus Torvalds 	{
2831da177e4SLinus Torvalds 		int new_fd;
2841da177e4SLinus Torvalds 		err = security_file_receive(fp[i]);
2851da177e4SLinus Torvalds 		if (err)
2861da177e4SLinus Torvalds 			break;
2874a19542eSUlrich Drepper 		err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
2884a19542eSUlrich Drepper 					  ? O_CLOEXEC : 0);
2891da177e4SLinus Torvalds 		if (err < 0)
2901da177e4SLinus Torvalds 			break;
2911da177e4SLinus Torvalds 		new_fd = err;
2921da177e4SLinus Torvalds 		err = put_user(new_fd, cmfptr);
2931da177e4SLinus Torvalds 		if (err) {
2941da177e4SLinus Torvalds 			put_unused_fd(new_fd);
2951da177e4SLinus Torvalds 			break;
2961da177e4SLinus Torvalds 		}
2971da177e4SLinus Torvalds 		/* Bump the usage count and install the file. */
2981da177e4SLinus Torvalds 		get_file(fp[i]);
2991da177e4SLinus Torvalds 		fd_install(new_fd, fp[i]);
3001da177e4SLinus Torvalds 	}
3011da177e4SLinus Torvalds 
3021da177e4SLinus Torvalds 	if (i > 0)
3031da177e4SLinus Torvalds 	{
3041da177e4SLinus Torvalds 		int cmlen = CMSG_LEN(i*sizeof(int));
3051da177e4SLinus Torvalds 		err = put_user(SOL_SOCKET, &cm->cmsg_level);
3061da177e4SLinus Torvalds 		if (!err)
3071da177e4SLinus Torvalds 			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
3081da177e4SLinus Torvalds 		if (!err)
3091da177e4SLinus Torvalds 			err = put_user(cmlen, &cm->cmsg_len);
3101da177e4SLinus Torvalds 		if (!err) {
3111da177e4SLinus Torvalds 			cmlen = CMSG_SPACE(i*sizeof(int));
3121da177e4SLinus Torvalds 			msg->msg_control += cmlen;
3131da177e4SLinus Torvalds 			msg->msg_controllen -= cmlen;
3141da177e4SLinus Torvalds 		}
3151da177e4SLinus Torvalds 	}
3161da177e4SLinus Torvalds 	if (i < fdnum || (fdnum && fdmax <= 0))
3171da177e4SLinus Torvalds 		msg->msg_flags |= MSG_CTRUNC;
3181da177e4SLinus Torvalds 
3191da177e4SLinus Torvalds 	/*
3201da177e4SLinus Torvalds 	 * All of the files that fit in the message have had their
3211da177e4SLinus Torvalds 	 * usage counts incremented, so we just free the list.
3221da177e4SLinus Torvalds 	 */
3231da177e4SLinus Torvalds 	__scm_destroy(scm);
3241da177e4SLinus Torvalds }
3259e34a5b5SEric Dumazet EXPORT_SYMBOL(scm_detach_fds);
3261da177e4SLinus Torvalds 
3271da177e4SLinus Torvalds struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
3281da177e4SLinus Torvalds {
3291da177e4SLinus Torvalds 	struct scm_fp_list *new_fpl;
3301da177e4SLinus Torvalds 	int i;
3311da177e4SLinus Torvalds 
3321da177e4SLinus Torvalds 	if (!fpl)
3331da177e4SLinus Torvalds 		return NULL;
3341da177e4SLinus Torvalds 
335bba14de9SEric Dumazet 	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
336bba14de9SEric Dumazet 			  GFP_KERNEL);
3371da177e4SLinus Torvalds 	if (new_fpl) {
338bba14de9SEric Dumazet 		for (i = 0; i < fpl->count; i++)
3391da177e4SLinus Torvalds 			get_file(fpl->fp[i]);
340bba14de9SEric Dumazet 		new_fpl->max = new_fpl->count;
3411da177e4SLinus Torvalds 	}
3421da177e4SLinus Torvalds 	return new_fpl;
3431da177e4SLinus Torvalds }
3441da177e4SLinus Torvalds EXPORT_SYMBOL(scm_fp_dup);
345