1 /* Task credentials management - see Documentation/credentials.txt 2 * 3 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public Licence 8 * as published by the Free Software Foundation; either version 9 * 2 of the Licence, or (at your option) any later version. 10 */ 11 #include <linux/module.h> 12 #include <linux/cred.h> 13 #include <linux/slab.h> 14 #include <linux/sched.h> 15 #include <linux/key.h> 16 #include <linux/keyctl.h> 17 #include <linux/init_task.h> 18 #include <linux/security.h> 19 #include <linux/cn_proc.h> 20 21 #if 0 22 #define kdebug(FMT, ...) \ 23 printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__) 24 #else 25 static inline __attribute__((format(printf, 1, 2))) 26 void no_printk(const char *fmt, ...) 27 { 28 } 29 #define kdebug(FMT, ...) \ 30 no_printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__) 31 #endif 32 33 static struct kmem_cache *cred_jar; 34 35 /* 36 * The common credentials for the initial task's thread group 37 */ 38 #ifdef CONFIG_KEYS 39 static struct thread_group_cred init_tgcred = { 40 .usage = ATOMIC_INIT(2), 41 .tgid = 0, 42 .lock = SPIN_LOCK_UNLOCKED, 43 }; 44 #endif 45 46 /* 47 * The initial credentials for the initial task 48 */ 49 struct cred init_cred = { 50 .usage = ATOMIC_INIT(4), 51 #ifdef CONFIG_DEBUG_CREDENTIALS 52 .subscribers = ATOMIC_INIT(2), 53 .magic = CRED_MAGIC, 54 #endif 55 .securebits = SECUREBITS_DEFAULT, 56 .cap_inheritable = CAP_INIT_INH_SET, 57 .cap_permitted = CAP_FULL_SET, 58 .cap_effective = CAP_INIT_EFF_SET, 59 .cap_bset = CAP_INIT_BSET, 60 .user = INIT_USER, 61 .group_info = &init_groups, 62 #ifdef CONFIG_KEYS 63 .tgcred = &init_tgcred, 64 #endif 65 }; 66 67 static inline void set_cred_subscribers(struct cred *cred, int n) 68 { 69 #ifdef CONFIG_DEBUG_CREDENTIALS 70 atomic_set(&cred->subscribers, n); 71 #endif 72 } 73 74 static inline int read_cred_subscribers(const struct cred *cred) 75 { 76 #ifdef CONFIG_DEBUG_CREDENTIALS 77 return atomic_read(&cred->subscribers); 78 #else 79 return 0; 80 #endif 81 } 82 83 static inline void alter_cred_subscribers(const struct cred *_cred, int n) 84 { 85 #ifdef CONFIG_DEBUG_CREDENTIALS 86 struct cred *cred = (struct cred *) _cred; 87 88 atomic_add(n, &cred->subscribers); 89 #endif 90 } 91 92 /* 93 * Dispose of the shared task group credentials 94 */ 95 #ifdef CONFIG_KEYS 96 static void release_tgcred_rcu(struct rcu_head *rcu) 97 { 98 struct thread_group_cred *tgcred = 99 container_of(rcu, struct thread_group_cred, rcu); 100 101 BUG_ON(atomic_read(&tgcred->usage) != 0); 102 103 key_put(tgcred->session_keyring); 104 key_put(tgcred->process_keyring); 105 kfree(tgcred); 106 } 107 #endif 108 109 /* 110 * Release a set of thread group credentials. 111 */ 112 static void release_tgcred(struct cred *cred) 113 { 114 #ifdef CONFIG_KEYS 115 struct thread_group_cred *tgcred = cred->tgcred; 116 117 if (atomic_dec_and_test(&tgcred->usage)) 118 call_rcu(&tgcred->rcu, release_tgcred_rcu); 119 #endif 120 } 121 122 /* 123 * The RCU callback to actually dispose of a set of credentials 124 */ 125 static void put_cred_rcu(struct rcu_head *rcu) 126 { 127 struct cred *cred = container_of(rcu, struct cred, rcu); 128 129 kdebug("put_cred_rcu(%p)", cred); 130 131 #ifdef CONFIG_DEBUG_CREDENTIALS 132 if (cred->magic != CRED_MAGIC_DEAD || 133 atomic_read(&cred->usage) != 0 || 134 read_cred_subscribers(cred) != 0) 135 panic("CRED: put_cred_rcu() sees %p with" 136 " mag %x, put %p, usage %d, subscr %d\n", 137 cred, cred->magic, cred->put_addr, 138 atomic_read(&cred->usage), 139 read_cred_subscribers(cred)); 140 #else 141 if (atomic_read(&cred->usage) != 0) 142 panic("CRED: put_cred_rcu() sees %p with usage %d\n", 143 cred, atomic_read(&cred->usage)); 144 #endif 145 146 security_cred_free(cred); 147 key_put(cred->thread_keyring); 148 key_put(cred->request_key_auth); 149 release_tgcred(cred); 150 if (cred->group_info) 151 put_group_info(cred->group_info); 152 free_uid(cred->user); 153 kmem_cache_free(cred_jar, cred); 154 } 155 156 /** 157 * __put_cred - Destroy a set of credentials 158 * @cred: The record to release 159 * 160 * Destroy a set of credentials on which no references remain. 161 */ 162 void __put_cred(struct cred *cred) 163 { 164 kdebug("__put_cred(%p{%d,%d})", cred, 165 atomic_read(&cred->usage), 166 read_cred_subscribers(cred)); 167 168 BUG_ON(atomic_read(&cred->usage) != 0); 169 #ifdef CONFIG_DEBUG_CREDENTIALS 170 BUG_ON(read_cred_subscribers(cred) != 0); 171 cred->magic = CRED_MAGIC_DEAD; 172 cred->put_addr = __builtin_return_address(0); 173 #endif 174 BUG_ON(cred == current->cred); 175 BUG_ON(cred == current->real_cred); 176 177 call_rcu(&cred->rcu, put_cred_rcu); 178 } 179 EXPORT_SYMBOL(__put_cred); 180 181 /* 182 * Clean up a task's credentials when it exits 183 */ 184 void exit_creds(struct task_struct *tsk) 185 { 186 struct cred *cred; 187 188 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred, 189 atomic_read(&tsk->cred->usage), 190 read_cred_subscribers(tsk->cred)); 191 192 cred = (struct cred *) tsk->real_cred; 193 tsk->real_cred = NULL; 194 validate_creds(cred); 195 alter_cred_subscribers(cred, -1); 196 put_cred(cred); 197 198 cred = (struct cred *) tsk->cred; 199 tsk->cred = NULL; 200 validate_creds(cred); 201 alter_cred_subscribers(cred, -1); 202 put_cred(cred); 203 204 cred = (struct cred *) tsk->replacement_session_keyring; 205 if (cred) { 206 tsk->replacement_session_keyring = NULL; 207 validate_creds(cred); 208 put_cred(cred); 209 } 210 } 211 212 /* 213 * Allocate blank credentials, such that the credentials can be filled in at a 214 * later date without risk of ENOMEM. 215 */ 216 struct cred *cred_alloc_blank(void) 217 { 218 struct cred *new; 219 220 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL); 221 if (!new) 222 return NULL; 223 224 #ifdef CONFIG_KEYS 225 new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL); 226 if (!new->tgcred) { 227 kmem_cache_free(cred_jar, new); 228 return NULL; 229 } 230 atomic_set(&new->tgcred->usage, 1); 231 #endif 232 233 atomic_set(&new->usage, 1); 234 235 if (security_cred_alloc_blank(new, GFP_KERNEL) < 0) 236 goto error; 237 238 #ifdef CONFIG_DEBUG_CREDENTIALS 239 new->magic = CRED_MAGIC; 240 #endif 241 return new; 242 243 error: 244 abort_creds(new); 245 return NULL; 246 } 247 248 /** 249 * prepare_creds - Prepare a new set of credentials for modification 250 * 251 * Prepare a new set of task credentials for modification. A task's creds 252 * shouldn't generally be modified directly, therefore this function is used to 253 * prepare a new copy, which the caller then modifies and then commits by 254 * calling commit_creds(). 255 * 256 * Preparation involves making a copy of the objective creds for modification. 257 * 258 * Returns a pointer to the new creds-to-be if successful, NULL otherwise. 259 * 260 * Call commit_creds() or abort_creds() to clean up. 261 */ 262 struct cred *prepare_creds(void) 263 { 264 struct task_struct *task = current; 265 const struct cred *old; 266 struct cred *new; 267 268 validate_process_creds(); 269 270 new = kmem_cache_alloc(cred_jar, GFP_KERNEL); 271 if (!new) 272 return NULL; 273 274 kdebug("prepare_creds() alloc %p", new); 275 276 old = task->cred; 277 memcpy(new, old, sizeof(struct cred)); 278 279 atomic_set(&new->usage, 1); 280 set_cred_subscribers(new, 0); 281 get_group_info(new->group_info); 282 get_uid(new->user); 283 284 #ifdef CONFIG_KEYS 285 key_get(new->thread_keyring); 286 key_get(new->request_key_auth); 287 atomic_inc(&new->tgcred->usage); 288 #endif 289 290 #ifdef CONFIG_SECURITY 291 new->security = NULL; 292 #endif 293 294 if (security_prepare_creds(new, old, GFP_KERNEL) < 0) 295 goto error; 296 validate_creds(new); 297 return new; 298 299 error: 300 abort_creds(new); 301 return NULL; 302 } 303 EXPORT_SYMBOL(prepare_creds); 304 305 /* 306 * Prepare credentials for current to perform an execve() 307 * - The caller must hold current->cred_guard_mutex 308 */ 309 struct cred *prepare_exec_creds(void) 310 { 311 struct thread_group_cred *tgcred = NULL; 312 struct cred *new; 313 314 #ifdef CONFIG_KEYS 315 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL); 316 if (!tgcred) 317 return NULL; 318 #endif 319 320 new = prepare_creds(); 321 if (!new) { 322 kfree(tgcred); 323 return new; 324 } 325 326 #ifdef CONFIG_KEYS 327 /* newly exec'd tasks don't get a thread keyring */ 328 key_put(new->thread_keyring); 329 new->thread_keyring = NULL; 330 331 /* create a new per-thread-group creds for all this set of threads to 332 * share */ 333 memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred)); 334 335 atomic_set(&tgcred->usage, 1); 336 spin_lock_init(&tgcred->lock); 337 338 /* inherit the session keyring; new process keyring */ 339 key_get(tgcred->session_keyring); 340 tgcred->process_keyring = NULL; 341 342 release_tgcred(new); 343 new->tgcred = tgcred; 344 #endif 345 346 return new; 347 } 348 349 /* 350 * Copy credentials for the new process created by fork() 351 * 352 * We share if we can, but under some circumstances we have to generate a new 353 * set. 354 * 355 * The new process gets the current process's subjective credentials as its 356 * objective and subjective credentials 357 */ 358 int copy_creds(struct task_struct *p, unsigned long clone_flags) 359 { 360 #ifdef CONFIG_KEYS 361 struct thread_group_cred *tgcred; 362 #endif 363 struct cred *new; 364 int ret; 365 366 mutex_init(&p->cred_guard_mutex); 367 368 if ( 369 #ifdef CONFIG_KEYS 370 !p->cred->thread_keyring && 371 #endif 372 clone_flags & CLONE_THREAD 373 ) { 374 p->real_cred = get_cred(p->cred); 375 get_cred(p->cred); 376 alter_cred_subscribers(p->cred, 2); 377 kdebug("share_creds(%p{%d,%d})", 378 p->cred, atomic_read(&p->cred->usage), 379 read_cred_subscribers(p->cred)); 380 atomic_inc(&p->cred->user->processes); 381 return 0; 382 } 383 384 new = prepare_creds(); 385 if (!new) 386 return -ENOMEM; 387 388 if (clone_flags & CLONE_NEWUSER) { 389 ret = create_user_ns(new); 390 if (ret < 0) 391 goto error_put; 392 } 393 394 #ifdef CONFIG_KEYS 395 /* new threads get their own thread keyrings if their parent already 396 * had one */ 397 if (new->thread_keyring) { 398 key_put(new->thread_keyring); 399 new->thread_keyring = NULL; 400 if (clone_flags & CLONE_THREAD) 401 install_thread_keyring_to_cred(new); 402 } 403 404 /* we share the process and session keyrings between all the threads in 405 * a process - this is slightly icky as we violate COW credentials a 406 * bit */ 407 if (!(clone_flags & CLONE_THREAD)) { 408 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL); 409 if (!tgcred) { 410 ret = -ENOMEM; 411 goto error_put; 412 } 413 atomic_set(&tgcred->usage, 1); 414 spin_lock_init(&tgcred->lock); 415 tgcred->process_keyring = NULL; 416 tgcred->session_keyring = key_get(new->tgcred->session_keyring); 417 418 release_tgcred(new); 419 new->tgcred = tgcred; 420 } 421 #endif 422 423 atomic_inc(&new->user->processes); 424 p->cred = p->real_cred = get_cred(new); 425 alter_cred_subscribers(new, 2); 426 validate_creds(new); 427 return 0; 428 429 error_put: 430 put_cred(new); 431 return ret; 432 } 433 434 /** 435 * commit_creds - Install new credentials upon the current task 436 * @new: The credentials to be assigned 437 * 438 * Install a new set of credentials to the current task, using RCU to replace 439 * the old set. Both the objective and the subjective credentials pointers are 440 * updated. This function may not be called if the subjective credentials are 441 * in an overridden state. 442 * 443 * This function eats the caller's reference to the new credentials. 444 * 445 * Always returns 0 thus allowing this function to be tail-called at the end 446 * of, say, sys_setgid(). 447 */ 448 int commit_creds(struct cred *new) 449 { 450 struct task_struct *task = current; 451 const struct cred *old = task->real_cred; 452 453 kdebug("commit_creds(%p{%d,%d})", new, 454 atomic_read(&new->usage), 455 read_cred_subscribers(new)); 456 457 BUG_ON(task->cred != old); 458 #ifdef CONFIG_DEBUG_CREDENTIALS 459 BUG_ON(read_cred_subscribers(old) < 2); 460 validate_creds(old); 461 validate_creds(new); 462 #endif 463 BUG_ON(atomic_read(&new->usage) < 1); 464 465 get_cred(new); /* we will require a ref for the subj creds too */ 466 467 /* dumpability changes */ 468 if (old->euid != new->euid || 469 old->egid != new->egid || 470 old->fsuid != new->fsuid || 471 old->fsgid != new->fsgid || 472 !cap_issubset(new->cap_permitted, old->cap_permitted)) { 473 if (task->mm) 474 set_dumpable(task->mm, suid_dumpable); 475 task->pdeath_signal = 0; 476 smp_wmb(); 477 } 478 479 /* alter the thread keyring */ 480 if (new->fsuid != old->fsuid) 481 key_fsuid_changed(task); 482 if (new->fsgid != old->fsgid) 483 key_fsgid_changed(task); 484 485 /* do it 486 * - What if a process setreuid()'s and this brings the 487 * new uid over his NPROC rlimit? We can check this now 488 * cheaply with the new uid cache, so if it matters 489 * we should be checking for it. -DaveM 490 */ 491 alter_cred_subscribers(new, 2); 492 if (new->user != old->user) 493 atomic_inc(&new->user->processes); 494 rcu_assign_pointer(task->real_cred, new); 495 rcu_assign_pointer(task->cred, new); 496 if (new->user != old->user) 497 atomic_dec(&old->user->processes); 498 alter_cred_subscribers(old, -2); 499 500 /* send notifications */ 501 if (new->uid != old->uid || 502 new->euid != old->euid || 503 new->suid != old->suid || 504 new->fsuid != old->fsuid) 505 proc_id_connector(task, PROC_EVENT_UID); 506 507 if (new->gid != old->gid || 508 new->egid != old->egid || 509 new->sgid != old->sgid || 510 new->fsgid != old->fsgid) 511 proc_id_connector(task, PROC_EVENT_GID); 512 513 /* release the old obj and subj refs both */ 514 put_cred(old); 515 put_cred(old); 516 return 0; 517 } 518 EXPORT_SYMBOL(commit_creds); 519 520 /** 521 * abort_creds - Discard a set of credentials and unlock the current task 522 * @new: The credentials that were going to be applied 523 * 524 * Discard a set of credentials that were under construction and unlock the 525 * current task. 526 */ 527 void abort_creds(struct cred *new) 528 { 529 kdebug("abort_creds(%p{%d,%d})", new, 530 atomic_read(&new->usage), 531 read_cred_subscribers(new)); 532 533 #ifdef CONFIG_DEBUG_CREDENTIALS 534 BUG_ON(read_cred_subscribers(new) != 0); 535 #endif 536 BUG_ON(atomic_read(&new->usage) < 1); 537 put_cred(new); 538 } 539 EXPORT_SYMBOL(abort_creds); 540 541 /** 542 * override_creds - Override the current process's subjective credentials 543 * @new: The credentials to be assigned 544 * 545 * Install a set of temporary override subjective credentials on the current 546 * process, returning the old set for later reversion. 547 */ 548 const struct cred *override_creds(const struct cred *new) 549 { 550 const struct cred *old = current->cred; 551 552 kdebug("override_creds(%p{%d,%d})", new, 553 atomic_read(&new->usage), 554 read_cred_subscribers(new)); 555 556 validate_creds(old); 557 validate_creds(new); 558 get_cred(new); 559 alter_cred_subscribers(new, 1); 560 rcu_assign_pointer(current->cred, new); 561 alter_cred_subscribers(old, -1); 562 563 kdebug("override_creds() = %p{%d,%d}", old, 564 atomic_read(&old->usage), 565 read_cred_subscribers(old)); 566 return old; 567 } 568 EXPORT_SYMBOL(override_creds); 569 570 /** 571 * revert_creds - Revert a temporary subjective credentials override 572 * @old: The credentials to be restored 573 * 574 * Revert a temporary set of override subjective credentials to an old set, 575 * discarding the override set. 576 */ 577 void revert_creds(const struct cred *old) 578 { 579 const struct cred *override = current->cred; 580 581 kdebug("revert_creds(%p{%d,%d})", old, 582 atomic_read(&old->usage), 583 read_cred_subscribers(old)); 584 585 validate_creds(old); 586 validate_creds(override); 587 alter_cred_subscribers(old, 1); 588 rcu_assign_pointer(current->cred, old); 589 alter_cred_subscribers(override, -1); 590 put_cred(override); 591 } 592 EXPORT_SYMBOL(revert_creds); 593 594 /* 595 * initialise the credentials stuff 596 */ 597 void __init cred_init(void) 598 { 599 /* allocate a slab in which we can store credentials */ 600 cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 601 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); 602 } 603 604 /** 605 * prepare_kernel_cred - Prepare a set of credentials for a kernel service 606 * @daemon: A userspace daemon to be used as a reference 607 * 608 * Prepare a set of credentials for a kernel service. This can then be used to 609 * override a task's own credentials so that work can be done on behalf of that 610 * task that requires a different subjective context. 611 * 612 * @daemon is used to provide a base for the security record, but can be NULL. 613 * If @daemon is supplied, then the security data will be derived from that; 614 * otherwise they'll be set to 0 and no groups, full capabilities and no keys. 615 * 616 * The caller may change these controls afterwards if desired. 617 * 618 * Returns the new credentials or NULL if out of memory. 619 * 620 * Does not take, and does not return holding current->cred_replace_mutex. 621 */ 622 struct cred *prepare_kernel_cred(struct task_struct *daemon) 623 { 624 const struct cred *old; 625 struct cred *new; 626 627 new = kmem_cache_alloc(cred_jar, GFP_KERNEL); 628 if (!new) 629 return NULL; 630 631 kdebug("prepare_kernel_cred() alloc %p", new); 632 633 if (daemon) 634 old = get_task_cred(daemon); 635 else 636 old = get_cred(&init_cred); 637 638 validate_creds(old); 639 640 *new = *old; 641 get_uid(new->user); 642 get_group_info(new->group_info); 643 644 #ifdef CONFIG_KEYS 645 atomic_inc(&init_tgcred.usage); 646 new->tgcred = &init_tgcred; 647 new->request_key_auth = NULL; 648 new->thread_keyring = NULL; 649 new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; 650 #endif 651 652 #ifdef CONFIG_SECURITY 653 new->security = NULL; 654 #endif 655 if (security_prepare_creds(new, old, GFP_KERNEL) < 0) 656 goto error; 657 658 atomic_set(&new->usage, 1); 659 set_cred_subscribers(new, 0); 660 put_cred(old); 661 validate_creds(new); 662 return new; 663 664 error: 665 put_cred(new); 666 put_cred(old); 667 return NULL; 668 } 669 EXPORT_SYMBOL(prepare_kernel_cred); 670 671 /** 672 * set_security_override - Set the security ID in a set of credentials 673 * @new: The credentials to alter 674 * @secid: The LSM security ID to set 675 * 676 * Set the LSM security ID in a set of credentials so that the subjective 677 * security is overridden when an alternative set of credentials is used. 678 */ 679 int set_security_override(struct cred *new, u32 secid) 680 { 681 return security_kernel_act_as(new, secid); 682 } 683 EXPORT_SYMBOL(set_security_override); 684 685 /** 686 * set_security_override_from_ctx - Set the security ID in a set of credentials 687 * @new: The credentials to alter 688 * @secctx: The LSM security context to generate the security ID from. 689 * 690 * Set the LSM security ID in a set of credentials so that the subjective 691 * security is overridden when an alternative set of credentials is used. The 692 * security ID is specified in string form as a security context to be 693 * interpreted by the LSM. 694 */ 695 int set_security_override_from_ctx(struct cred *new, const char *secctx) 696 { 697 u32 secid; 698 int ret; 699 700 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid); 701 if (ret < 0) 702 return ret; 703 704 return set_security_override(new, secid); 705 } 706 EXPORT_SYMBOL(set_security_override_from_ctx); 707 708 /** 709 * set_create_files_as - Set the LSM file create context in a set of credentials 710 * @new: The credentials to alter 711 * @inode: The inode to take the context from 712 * 713 * Change the LSM file creation context in a set of credentials to be the same 714 * as the object context of the specified inode, so that the new inodes have 715 * the same MAC context as that inode. 716 */ 717 int set_create_files_as(struct cred *new, struct inode *inode) 718 { 719 new->fsuid = inode->i_uid; 720 new->fsgid = inode->i_gid; 721 return security_kernel_create_files_as(new, inode); 722 } 723 EXPORT_SYMBOL(set_create_files_as); 724 725 #ifdef CONFIG_DEBUG_CREDENTIALS 726 727 bool creds_are_invalid(const struct cred *cred) 728 { 729 if (cred->magic != CRED_MAGIC) 730 return true; 731 #ifdef CONFIG_SECURITY_SELINUX 732 if (selinux_is_enabled()) { 733 if ((unsigned long) cred->security < PAGE_SIZE) 734 return true; 735 if ((*(u32 *)cred->security & 0xffffff00) == 736 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)) 737 return true; 738 } 739 #endif 740 return false; 741 } 742 EXPORT_SYMBOL(creds_are_invalid); 743 744 /* 745 * dump invalid credentials 746 */ 747 static void dump_invalid_creds(const struct cred *cred, const char *label, 748 const struct task_struct *tsk) 749 { 750 printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n", 751 label, cred, 752 cred == &init_cred ? "[init]" : "", 753 cred == tsk->real_cred ? "[real]" : "", 754 cred == tsk->cred ? "[eff]" : ""); 755 printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n", 756 cred->magic, cred->put_addr); 757 printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n", 758 atomic_read(&cred->usage), 759 read_cred_subscribers(cred)); 760 printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n", 761 cred->uid, cred->euid, cred->suid, cred->fsuid); 762 printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n", 763 cred->gid, cred->egid, cred->sgid, cred->fsgid); 764 #ifdef CONFIG_SECURITY 765 printk(KERN_ERR "CRED: ->security is %p\n", cred->security); 766 if ((unsigned long) cred->security >= PAGE_SIZE && 767 (((unsigned long) cred->security & 0xffffff00) != 768 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))) 769 printk(KERN_ERR "CRED: ->security {%x, %x}\n", 770 ((u32*)cred->security)[0], 771 ((u32*)cred->security)[1]); 772 #endif 773 } 774 775 /* 776 * report use of invalid credentials 777 */ 778 void __invalid_creds(const struct cred *cred, const char *file, unsigned line) 779 { 780 printk(KERN_ERR "CRED: Invalid credentials\n"); 781 printk(KERN_ERR "CRED: At %s:%u\n", file, line); 782 dump_invalid_creds(cred, "Specified", current); 783 BUG(); 784 } 785 EXPORT_SYMBOL(__invalid_creds); 786 787 /* 788 * check the credentials on a process 789 */ 790 void __validate_process_creds(struct task_struct *tsk, 791 const char *file, unsigned line) 792 { 793 if (tsk->cred == tsk->real_cred) { 794 if (unlikely(read_cred_subscribers(tsk->cred) < 2 || 795 creds_are_invalid(tsk->cred))) 796 goto invalid_creds; 797 } else { 798 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 || 799 read_cred_subscribers(tsk->cred) < 1 || 800 creds_are_invalid(tsk->real_cred) || 801 creds_are_invalid(tsk->cred))) 802 goto invalid_creds; 803 } 804 return; 805 806 invalid_creds: 807 printk(KERN_ERR "CRED: Invalid process credentials\n"); 808 printk(KERN_ERR "CRED: At %s:%u\n", file, line); 809 810 dump_invalid_creds(tsk->real_cred, "Real", tsk); 811 if (tsk->cred != tsk->real_cred) 812 dump_invalid_creds(tsk->cred, "Effective", tsk); 813 else 814 printk(KERN_ERR "CRED: Effective creds == Real creds\n"); 815 BUG(); 816 } 817 EXPORT_SYMBOL(__validate_process_creds); 818 819 /* 820 * check creds for do_exit() 821 */ 822 void validate_creds_for_do_exit(struct task_struct *tsk) 823 { 824 kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})", 825 tsk->real_cred, tsk->cred, 826 atomic_read(&tsk->cred->usage), 827 read_cred_subscribers(tsk->cred)); 828 829 __validate_process_creds(tsk, __FILE__, __LINE__); 830 } 831 832 #endif /* CONFIG_DEBUG_CREDENTIALS */ 833