1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* scm.c - Socket level control messages processing.
4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 * Alignment and value checking mods by Craig Metz
8 #include <linux/module.h>
9 #include <linux/signal.h>
10 #include <linux/capability.h>
11 #include <linux/errno.h>
12 #include <linux/sched.h>
13 #include <linux/sched/user.h>
15 #include <linux/kernel.h>
16 #include <linux/stat.h>
17 #include <linux/socket.h>
18 #include <linux/file.h>
19 #include <linux/fcntl.h>
20 #include <linux/net.h>
21 #include <linux/interrupt.h>
22 #include <linux/netdevice.h>
23 #include <linux/security.h>
24 #include <linux/pid_namespace.h>
25 #include <linux/pid.h>
26 #include <linux/nsproxy.h>
27 #include <linux/slab.h>
28 #include <linux/errqueue.h>
30 #include <linux/uaccess.h>
32 #include <net/protocol.h>
33 #include <linux/skbuff.h>
35 #include <net/compat.h>
37 #include <net/cls_cgroup.h>
41 * Only allow a user to send credentials, that they could set with
45 static __inline__
int scm_check_creds(struct ucred
*creds
)
47 const struct cred
*cred
= current_cred();
48 kuid_t uid
= make_kuid(cred
->user_ns
, creds
->uid
);
49 kgid_t gid
= make_kgid(cred
->user_ns
, creds
->gid
);
51 if (!uid_valid(uid
) || !gid_valid(gid
))
54 if ((creds
->pid
== task_tgid_vnr(current
) ||
55 ns_capable(task_active_pid_ns(current
)->user_ns
, CAP_SYS_ADMIN
)) &&
56 ((uid_eq(uid
, cred
->uid
) || uid_eq(uid
, cred
->euid
) ||
57 uid_eq(uid
, cred
->suid
)) || ns_capable(cred
->user_ns
, CAP_SETUID
)) &&
58 ((gid_eq(gid
, cred
->gid
) || gid_eq(gid
, cred
->egid
) ||
59 gid_eq(gid
, cred
->sgid
)) || ns_capable(cred
->user_ns
, CAP_SETGID
))) {
65 static int scm_fp_copy(struct cmsghdr
*cmsg
, struct scm_fp_list
**fplp
)
67 int *fdp
= (int*)CMSG_DATA(cmsg
);
68 struct scm_fp_list
*fpl
= *fplp
;
72 num
= (cmsg
->cmsg_len
- sizeof(struct cmsghdr
))/sizeof(int);
82 fpl
= kmalloc(sizeof(struct scm_fp_list
), GFP_KERNEL_ACCOUNT
);
87 fpl
->max
= SCM_MAX_FD
;
90 fpp
= &fpl
->fp
[fpl
->count
];
92 if (fpl
->count
+ num
> fpl
->max
)
96 * Verify the descriptors and increment the usage count.
99 for (i
=0; i
< num
; i
++)
104 if (fd
< 0 || !(file
= fget_raw(fd
)))
111 fpl
->user
= get_uid(current_user());
116 void __scm_destroy(struct scm_cookie
*scm
)
118 struct scm_fp_list
*fpl
= scm
->fp
;
123 for (i
=fpl
->count
-1; i
>=0; i
--)
129 EXPORT_SYMBOL(__scm_destroy
);
131 int __scm_send(struct socket
*sock
, struct msghdr
*msg
, struct scm_cookie
*p
)
133 const struct proto_ops
*ops
= READ_ONCE(sock
->ops
);
134 struct cmsghdr
*cmsg
;
137 for_each_cmsghdr(cmsg
, msg
) {
140 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
141 /* The first check was omitted in <= 2.2.5. The reasoning was
142 that parser checks cmsg_len in any case, so that
143 additional check would be work duplication.
144 But if cmsg_level is not SOL_SOCKET, we do not check
145 for too short ancillary data object at all! Oops.
148 if (!CMSG_OK(msg
, cmsg
))
151 if (cmsg
->cmsg_level
!= SOL_SOCKET
)
154 switch (cmsg
->cmsg_type
)
157 if (!ops
|| ops
->family
!= PF_UNIX
)
159 err
=scm_fp_copy(cmsg
, &p
->fp
);
163 case SCM_CREDENTIALS
:
168 if (cmsg
->cmsg_len
!= CMSG_LEN(sizeof(struct ucred
)))
170 memcpy(&creds
, CMSG_DATA(cmsg
), sizeof(struct ucred
));
171 err
= scm_check_creds(&creds
);
175 p
->creds
.pid
= creds
.pid
;
176 if (!p
->pid
|| pid_vnr(p
->pid
) != creds
.pid
) {
179 pid
= find_get_pid(creds
.pid
);
187 uid
= make_kuid(current_user_ns(), creds
.uid
);
188 gid
= make_kgid(current_user_ns(), creds
.gid
);
189 if (!uid_valid(uid
) || !gid_valid(gid
))
201 if (p
->fp
&& !p
->fp
->count
)
212 EXPORT_SYMBOL(__scm_send
);
214 int put_cmsg(struct msghdr
* msg
, int level
, int type
, int len
, void *data
)
216 int cmlen
= CMSG_LEN(len
);
218 if (msg
->msg_flags
& MSG_CMSG_COMPAT
)
219 return put_cmsg_compat(msg
, level
, type
, len
, data
);
221 if (!msg
->msg_control
|| msg
->msg_controllen
< sizeof(struct cmsghdr
)) {
222 msg
->msg_flags
|= MSG_CTRUNC
;
223 return 0; /* XXX: return error? check spec. */
225 if (msg
->msg_controllen
< cmlen
) {
226 msg
->msg_flags
|= MSG_CTRUNC
;
227 cmlen
= msg
->msg_controllen
;
230 if (msg
->msg_control_is_user
) {
231 struct cmsghdr __user
*cm
= msg
->msg_control_user
;
233 check_object_size(data
, cmlen
- sizeof(*cm
), true);
235 if (!user_write_access_begin(cm
, cmlen
))
238 unsafe_put_user(cmlen
, &cm
->cmsg_len
, efault_end
);
239 unsafe_put_user(level
, &cm
->cmsg_level
, efault_end
);
240 unsafe_put_user(type
, &cm
->cmsg_type
, efault_end
);
241 unsafe_copy_to_user(CMSG_USER_DATA(cm
), data
,
242 cmlen
- sizeof(*cm
), efault_end
);
243 user_write_access_end();
245 struct cmsghdr
*cm
= msg
->msg_control
;
247 cm
->cmsg_level
= level
;
248 cm
->cmsg_type
= type
;
249 cm
->cmsg_len
= cmlen
;
250 memcpy(CMSG_DATA(cm
), data
, cmlen
- sizeof(*cm
));
253 cmlen
= min(CMSG_SPACE(len
), msg
->msg_controllen
);
254 if (msg
->msg_control_is_user
)
255 msg
->msg_control_user
+= cmlen
;
257 msg
->msg_control
+= cmlen
;
258 msg
->msg_controllen
-= cmlen
;
262 user_write_access_end();
266 EXPORT_SYMBOL(put_cmsg
);
268 void put_cmsg_scm_timestamping64(struct msghdr
*msg
, struct scm_timestamping_internal
*tss_internal
)
270 struct scm_timestamping64 tss
;
273 for (i
= 0; i
< ARRAY_SIZE(tss
.ts
); i
++) {
274 tss
.ts
[i
].tv_sec
= tss_internal
->ts
[i
].tv_sec
;
275 tss
.ts
[i
].tv_nsec
= tss_internal
->ts
[i
].tv_nsec
;
278 put_cmsg(msg
, SOL_SOCKET
, SO_TIMESTAMPING_NEW
, sizeof(tss
), &tss
);
280 EXPORT_SYMBOL(put_cmsg_scm_timestamping64
);
282 void put_cmsg_scm_timestamping(struct msghdr
*msg
, struct scm_timestamping_internal
*tss_internal
)
284 struct scm_timestamping tss
;
287 for (i
= 0; i
< ARRAY_SIZE(tss
.ts
); i
++) {
288 tss
.ts
[i
].tv_sec
= tss_internal
->ts
[i
].tv_sec
;
289 tss
.ts
[i
].tv_nsec
= tss_internal
->ts
[i
].tv_nsec
;
292 put_cmsg(msg
, SOL_SOCKET
, SO_TIMESTAMPING_OLD
, sizeof(tss
), &tss
);
294 EXPORT_SYMBOL(put_cmsg_scm_timestamping
);
296 static int scm_max_fds(struct msghdr
*msg
)
298 if (msg
->msg_controllen
<= sizeof(struct cmsghdr
))
300 return (msg
->msg_controllen
- sizeof(struct cmsghdr
)) / sizeof(int);
303 void scm_detach_fds(struct msghdr
*msg
, struct scm_cookie
*scm
)
305 struct cmsghdr __user
*cm
=
306 (__force
struct cmsghdr __user
*)msg
->msg_control_user
;
307 unsigned int o_flags
= (msg
->msg_flags
& MSG_CMSG_CLOEXEC
) ? O_CLOEXEC
: 0;
308 int fdmax
= min_t(int, scm_max_fds(msg
), scm
->fp
->count
);
309 int __user
*cmsg_data
= CMSG_USER_DATA(cm
);
312 /* no use for FD passing from kernel space callers */
313 if (WARN_ON_ONCE(!msg
->msg_control_is_user
))
316 if (msg
->msg_flags
& MSG_CMSG_COMPAT
) {
317 scm_detach_fds_compat(msg
, scm
);
321 for (i
= 0; i
< fdmax
; i
++) {
322 err
= scm_recv_one_fd(scm
->fp
->fp
[i
], cmsg_data
+ i
, o_flags
);
328 int cmlen
= CMSG_LEN(i
* sizeof(int));
330 err
= put_user(SOL_SOCKET
, &cm
->cmsg_level
);
332 err
= put_user(SCM_RIGHTS
, &cm
->cmsg_type
);
334 err
= put_user(cmlen
, &cm
->cmsg_len
);
336 cmlen
= CMSG_SPACE(i
* sizeof(int));
337 if (msg
->msg_controllen
< cmlen
)
338 cmlen
= msg
->msg_controllen
;
339 msg
->msg_control_user
+= cmlen
;
340 msg
->msg_controllen
-= cmlen
;
344 if (i
< scm
->fp
->count
|| (scm
->fp
->count
&& fdmax
<= 0))
345 msg
->msg_flags
|= MSG_CTRUNC
;
348 * All of the files that fit in the message have had their usage counts
349 * incremented, so we just free the list.
353 EXPORT_SYMBOL(scm_detach_fds
);
355 struct scm_fp_list
*scm_fp_dup(struct scm_fp_list
*fpl
)
357 struct scm_fp_list
*new_fpl
;
363 new_fpl
= kmemdup(fpl
, offsetof(struct scm_fp_list
, fp
[fpl
->count
]),
366 for (i
= 0; i
< fpl
->count
; i
++)
367 get_file(fpl
->fp
[i
]);
368 new_fpl
->max
= new_fpl
->count
;
369 new_fpl
->user
= get_uid(fpl
->user
);
373 EXPORT_SYMBOL(scm_fp_dup
);