1b2441318SGreg Kroah-Hartman // SPDX-License-Identifier: GPL-2.0
21da177e4SLinus Torvalds /*
31da177e4SLinus Torvalds * linux/net/sunrpc/auth_unix.c
41da177e4SLinus Torvalds *
51da177e4SLinus Torvalds * UNIX-style authentication; no AUTH_SHORT support
61da177e4SLinus Torvalds *
71da177e4SLinus Torvalds * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
81da177e4SLinus Torvalds */
91da177e4SLinus Torvalds
105a0e3ad6STejun Heo #include <linux/slab.h>
111da177e4SLinus Torvalds #include <linux/types.h>
121da177e4SLinus Torvalds #include <linux/sched.h>
131da177e4SLinus Torvalds #include <linux/module.h>
142edd8d74SNeilBrown #include <linux/mempool.h>
151da177e4SLinus Torvalds #include <linux/sunrpc/clnt.h>
161da177e4SLinus Torvalds #include <linux/sunrpc/auth.h>
17ae2975bcSEric W. Biederman #include <linux/user_namespace.h>
181da177e4SLinus Torvalds
191da177e4SLinus Torvalds
20f895b252SJeff Layton #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
211da177e4SLinus Torvalds # define RPCDBG_FACILITY RPCDBG_AUTH
221da177e4SLinus Torvalds #endif
231da177e4SLinus Torvalds
241da177e4SLinus Torvalds static struct rpc_auth unix_auth;
25f1c0a861STrond Myklebust static const struct rpc_credops unix_credops;
262edd8d74SNeilBrown static mempool_t *unix_pool;
271da177e4SLinus Torvalds
281da177e4SLinus Torvalds static struct rpc_auth *
unx_create(const struct rpc_auth_create_args * args,struct rpc_clnt * clnt)2982b98ca5SSargun Dhillon unx_create(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt)
301da177e4SLinus Torvalds {
31331bc71cSTrond Myklebust refcount_inc(&unix_auth.au_count);
321da177e4SLinus Torvalds return &unix_auth;
331da177e4SLinus Torvalds }
341da177e4SLinus Torvalds
351da177e4SLinus Torvalds static void
unx_destroy(struct rpc_auth * auth)361da177e4SLinus Torvalds unx_destroy(struct rpc_auth *auth)
371da177e4SLinus Torvalds {
381e035d06SFrank Sorenson }
391e035d06SFrank Sorenson
401da177e4SLinus Torvalds /*
411da177e4SLinus Torvalds * Lookup AUTH_UNIX creds for current process
421da177e4SLinus Torvalds */
unx_lookup_cred(struct rpc_auth * auth,struct auth_cred * acred,int flags)43*059ee82bSTrond Myklebust static struct rpc_cred *unx_lookup_cred(struct rpc_auth *auth,
44*059ee82bSTrond Myklebust struct auth_cred *acred, int flags)
451da177e4SLinus Torvalds {
46a41b05edSNeilBrown struct rpc_cred *ret;
471da177e4SLinus Torvalds
48*059ee82bSTrond Myklebust ret = kmalloc(sizeof(*ret), rpc_task_gfp_mask());
49*059ee82bSTrond Myklebust if (!ret) {
50*059ee82bSTrond Myklebust if (!(flags & RPCAUTH_LOOKUP_ASYNC))
51*059ee82bSTrond Myklebust return ERR_PTR(-ENOMEM);
52*059ee82bSTrond Myklebust ret = mempool_alloc(unix_pool, GFP_NOWAIT);
53a41b05edSNeilBrown if (!ret)
54a41b05edSNeilBrown return ERR_PTR(-ENOMEM);
55*059ee82bSTrond Myklebust }
562edd8d74SNeilBrown rpcauth_init_cred(ret, acred, auth, &unix_credops);
572edd8d74SNeilBrown ret->cr_flags = 1UL << RPCAUTH_CRED_UPTODATE;
582edd8d74SNeilBrown return ret;
5931be5bf1STrond Myklebust }
60696e38dfSTrond Myklebust
6131be5bf1STrond Myklebust static void
unx_free_cred_callback(struct rcu_head * head)6231be5bf1STrond Myklebust unx_free_cred_callback(struct rcu_head *head)
6331be5bf1STrond Myklebust {
642edd8d74SNeilBrown struct rpc_cred *rpc_cred = container_of(head, struct rpc_cred, cr_rcu);
6580125d4aSChuck Lever
662edd8d74SNeilBrown put_cred(rpc_cred->cr_cred);
672edd8d74SNeilBrown mempool_free(rpc_cred, unix_pool);
6831be5bf1STrond Myklebust }
6931be5bf1STrond Myklebust
7031be5bf1STrond Myklebust static void
unx_destroy_cred(struct rpc_cred * cred)7131be5bf1STrond Myklebust unx_destroy_cred(struct rpc_cred *cred)
7231be5bf1STrond Myklebust {
7331be5bf1STrond Myklebust call_rcu(&cred->cr_rcu, unx_free_cred_callback);
741da177e4SLinus Torvalds }
751da177e4SLinus Torvalds
761da177e4SLinus Torvalds /*
772edd8d74SNeilBrown * Match credentials against current the auth_cred.
781da177e4SLinus Torvalds */
791da177e4SLinus Torvalds static int
unx_match(struct auth_cred * acred,struct rpc_cred * cred,int flags)802edd8d74SNeilBrown unx_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
811da177e4SLinus Torvalds {
82af093835STrond Myklebust unsigned int groups = 0;
83af093835STrond Myklebust unsigned int i;
841da177e4SLinus Torvalds
852edd8d74SNeilBrown if (cred->cr_cred == acred->cred)
862edd8d74SNeilBrown return 1;
871da177e4SLinus Torvalds
882edd8d74SNeilBrown if (!uid_eq(cred->cr_cred->fsuid, acred->cred->fsuid) || !gid_eq(cred->cr_cred->fsgid, acred->cred->fsgid))
891da177e4SLinus Torvalds return 0;
901da177e4SLinus Torvalds
91e3735c89SNeilBrown if (acred->cred->group_info != NULL)
92fc0664fdSNeilBrown groups = acred->cred->group_info->ngroups;
935786461bSKinglong Mee if (groups > UNX_NGROUPS)
945786461bSKinglong Mee groups = UNX_NGROUPS;
952edd8d74SNeilBrown if (cred->cr_cred->group_info == NULL)
962edd8d74SNeilBrown return groups == 0;
972edd8d74SNeilBrown if (groups != cred->cr_cred->group_info->ngroups)
981da177e4SLinus Torvalds return 0;
992edd8d74SNeilBrown
1002edd8d74SNeilBrown for (i = 0; i < groups ; i++)
1012edd8d74SNeilBrown if (!gid_eq(cred->cr_cred->group_info->gid[i], acred->cred->group_info->gid[i]))
102dc6f55e9SNeilBrown return 0;
1031da177e4SLinus Torvalds return 1;
1041da177e4SLinus Torvalds }
1051da177e4SLinus Torvalds
1061da177e4SLinus Torvalds /*
1071da177e4SLinus Torvalds * Marshal credentials.
1081da177e4SLinus Torvalds * Maybe we should keep a cached credential for performance reasons.
1091da177e4SLinus Torvalds */
110e8680a24SChuck Lever static int
unx_marshal(struct rpc_task * task,struct xdr_stream * xdr)111e8680a24SChuck Lever unx_marshal(struct rpc_task *task, struct xdr_stream *xdr)
1121da177e4SLinus Torvalds {
1131da177e4SLinus Torvalds struct rpc_clnt *clnt = task->tk_client;
1142edd8d74SNeilBrown struct rpc_cred *cred = task->tk_rqstp->rq_cred;
115e8680a24SChuck Lever __be32 *p, *cred_len, *gidarr_len;
1161da177e4SLinus Torvalds int i;
1172edd8d74SNeilBrown struct group_info *gi = cred->cr_cred->group_info;
118283ebe3eSTrond Myklebust struct user_namespace *userns = clnt->cl_cred ?
119283ebe3eSTrond Myklebust clnt->cl_cred->user_ns : &init_user_ns;
1201da177e4SLinus Torvalds
121e8680a24SChuck Lever /* Credential */
1221da177e4SLinus Torvalds
123e8680a24SChuck Lever p = xdr_reserve_space(xdr, 3 * sizeof(*p));
124e8680a24SChuck Lever if (!p)
125e8680a24SChuck Lever goto marshal_failed;
126e8680a24SChuck Lever *p++ = rpc_auth_unix;
127e8680a24SChuck Lever cred_len = p++;
128e8680a24SChuck Lever *p++ = xdr_zero; /* stamp */
129e8680a24SChuck Lever if (xdr_stream_encode_opaque(xdr, clnt->cl_nodename,
130e8680a24SChuck Lever clnt->cl_nodelen) < 0)
131e8680a24SChuck Lever goto marshal_failed;
132e8680a24SChuck Lever p = xdr_reserve_space(xdr, 3 * sizeof(*p));
133e8680a24SChuck Lever if (!p)
134e8680a24SChuck Lever goto marshal_failed;
135283ebe3eSTrond Myklebust *p++ = cpu_to_be32(from_kuid_munged(userns, cred->cr_cred->fsuid));
136283ebe3eSTrond Myklebust *p++ = cpu_to_be32(from_kgid_munged(userns, cred->cr_cred->fsgid));
1371da177e4SLinus Torvalds
138e8680a24SChuck Lever gidarr_len = p++;
1392edd8d74SNeilBrown if (gi)
1402edd8d74SNeilBrown for (i = 0; i < UNX_NGROUPS && i < gi->ngroups; i++)
141283ebe3eSTrond Myklebust *p++ = cpu_to_be32(from_kgid_munged(userns, gi->gid[i]));
142e8680a24SChuck Lever *gidarr_len = cpu_to_be32(p - gidarr_len - 1);
143e8680a24SChuck Lever *cred_len = cpu_to_be32((p - cred_len - 1) << 2);
144e8680a24SChuck Lever p = xdr_reserve_space(xdr, (p - gidarr_len - 1) << 2);
145e8680a24SChuck Lever if (!p)
146e8680a24SChuck Lever goto marshal_failed;
1471da177e4SLinus Torvalds
148e8680a24SChuck Lever /* Verifier */
1491da177e4SLinus Torvalds
150e8680a24SChuck Lever p = xdr_reserve_space(xdr, 2 * sizeof(*p));
151e8680a24SChuck Lever if (!p)
152e8680a24SChuck Lever goto marshal_failed;
153e8680a24SChuck Lever *p++ = rpc_auth_null;
154e8680a24SChuck Lever *p = xdr_zero;
155e8680a24SChuck Lever
156e8680a24SChuck Lever return 0;
157e8680a24SChuck Lever
158e8680a24SChuck Lever marshal_failed:
159e8680a24SChuck Lever return -EMSGSIZE;
1601da177e4SLinus Torvalds }
1611da177e4SLinus Torvalds
1621da177e4SLinus Torvalds /*
1631da177e4SLinus Torvalds * Refresh credentials. This is a no-op for AUTH_UNIX
1641da177e4SLinus Torvalds */
1651da177e4SLinus Torvalds static int
unx_refresh(struct rpc_task * task)1661da177e4SLinus Torvalds unx_refresh(struct rpc_task *task)
1671da177e4SLinus Torvalds {
168a17c2153STrond Myklebust set_bit(RPCAUTH_CRED_UPTODATE, &task->tk_rqstp->rq_cred->cr_flags);
1691da177e4SLinus Torvalds return 0;
1701da177e4SLinus Torvalds }
1711da177e4SLinus Torvalds
172a0584ee9SChuck Lever static int
unx_validate(struct rpc_task * task,struct xdr_stream * xdr)173a0584ee9SChuck Lever unx_validate(struct rpc_task *task, struct xdr_stream *xdr)
1741da177e4SLinus Torvalds {
175a00275baSChuck Lever struct rpc_auth *auth = task->tk_rqstp->rq_cred->cr_auth;
176a0584ee9SChuck Lever __be32 *p;
1771da177e4SLinus Torvalds u32 size;
1781da177e4SLinus Torvalds
179a0584ee9SChuck Lever p = xdr_inline_decode(xdr, 2 * sizeof(*p));
180a0584ee9SChuck Lever if (!p)
181a0584ee9SChuck Lever return -EIO;
182a0584ee9SChuck Lever switch (*p++) {
183a0584ee9SChuck Lever case rpc_auth_null:
184a0584ee9SChuck Lever case rpc_auth_unix:
185a0584ee9SChuck Lever case rpc_auth_short:
186a0584ee9SChuck Lever break;
187a0584ee9SChuck Lever default:
188a0584ee9SChuck Lever return -EIO;
1891da177e4SLinus Torvalds }
190a0584ee9SChuck Lever size = be32_to_cpup(p);
191a0584ee9SChuck Lever if (size > RPC_MAX_AUTH_SIZE)
192a0584ee9SChuck Lever return -EIO;
193a0584ee9SChuck Lever p = xdr_inline_decode(xdr, size);
194a0584ee9SChuck Lever if (!p)
195a0584ee9SChuck Lever return -EIO;
1961da177e4SLinus Torvalds
197a00275baSChuck Lever auth->au_verfsize = XDR_QUADLEN(size) + 2;
198a00275baSChuck Lever auth->au_rslack = XDR_QUADLEN(size) + 2;
19935e77d21SChuck Lever auth->au_ralign = XDR_QUADLEN(size) + 2;
200a0584ee9SChuck Lever return 0;
2011da177e4SLinus Torvalds }
2021da177e4SLinus Torvalds
rpc_init_authunix(void)2035d8d9a4dSTrond Myklebust int __init rpc_init_authunix(void)
2049499b434STrond Myklebust {
2052edd8d74SNeilBrown unix_pool = mempool_create_kmalloc_pool(16, sizeof(struct rpc_cred));
2062edd8d74SNeilBrown return unix_pool ? 0 : -ENOMEM;
2075d8d9a4dSTrond Myklebust }
2085d8d9a4dSTrond Myklebust
rpc_destroy_authunix(void)2095d8d9a4dSTrond Myklebust void rpc_destroy_authunix(void)
2105d8d9a4dSTrond Myklebust {
2112edd8d74SNeilBrown mempool_destroy(unix_pool);
2129499b434STrond Myklebust }
2139499b434STrond Myklebust
214f1c0a861STrond Myklebust const struct rpc_authops authunix_ops = {
2151da177e4SLinus Torvalds .owner = THIS_MODULE,
2161da177e4SLinus Torvalds .au_flavor = RPC_AUTH_UNIX,
2171da177e4SLinus Torvalds .au_name = "UNIX",
2181da177e4SLinus Torvalds .create = unx_create,
2191da177e4SLinus Torvalds .destroy = unx_destroy,
2201da177e4SLinus Torvalds .lookup_cred = unx_lookup_cred,
2211da177e4SLinus Torvalds };
2221da177e4SLinus Torvalds
2231da177e4SLinus Torvalds static
2241da177e4SLinus Torvalds struct rpc_auth unix_auth = {
2254500632fSChuck Lever .au_cslack = UNX_CALLSLACK,
2264500632fSChuck Lever .au_rslack = NUL_REPLYSLACK,
227a00275baSChuck Lever .au_verfsize = NUL_REPLYSLACK,
2281da177e4SLinus Torvalds .au_ops = &authunix_ops,
22981039f1fSTrond Myklebust .au_flavor = RPC_AUTH_UNIX,
230331bc71cSTrond Myklebust .au_count = REFCOUNT_INIT(1),
2311da177e4SLinus Torvalds };
2321da177e4SLinus Torvalds
2331da177e4SLinus Torvalds static
234f1c0a861STrond Myklebust const struct rpc_credops unix_credops = {
2351da177e4SLinus Torvalds .cr_name = "AUTH_UNIX",
2361da177e4SLinus Torvalds .crdestroy = unx_destroy_cred,
2371da177e4SLinus Torvalds .crmatch = unx_match,
2381da177e4SLinus Torvalds .crmarshal = unx_marshal,
239e8680a24SChuck Lever .crwrap_req = rpcauth_wrap_req_encode,
2401da177e4SLinus Torvalds .crrefresh = unx_refresh,
2411da177e4SLinus Torvalds .crvalidate = unx_validate,
242a0584ee9SChuck Lever .crunwrap_resp = rpcauth_unwrap_resp_decode,
2431da177e4SLinus Torvalds };
244