1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* scm.c - Socket level control messages processing.
4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 * Alignment and value checking mods by Craig Metz
8 #include <linux/module.h>
9 #include <linux/signal.h>
10 #include <linux/capability.h>
11 #include <linux/errno.h>
12 #include <linux/sched.h>
13 #include <linux/sched/user.h>
15 #include <linux/kernel.h>
16 #include <linux/stat.h>
17 #include <linux/socket.h>
18 #include <linux/file.h>
19 #include <linux/fcntl.h>
20 #include <linux/net.h>
21 #include <linux/interrupt.h>
22 #include <linux/netdevice.h>
23 #include <linux/security.h>
24 #include <linux/pid_namespace.h>
25 #include <linux/pid.h>
26 #include <linux/nsproxy.h>
27 #include <linux/slab.h>
28 #include <linux/errqueue.h>
30 #include <linux/uaccess.h>
32 #include <net/protocol.h>
33 #include <linux/skbuff.h>
35 #include <net/compat.h>
37 #include <net/cls_cgroup.h>
41 * Only allow a user to send credentials, that they could set with
45 static __inline__
int scm_check_creds(struct ucred
*creds
)
47 const struct cred
*cred
= current_cred();
48 kuid_t uid
= make_kuid(cred
->user_ns
, creds
->uid
);
49 kgid_t gid
= make_kgid(cred
->user_ns
, creds
->gid
);
51 if (!uid_valid(uid
) || !gid_valid(gid
))
54 if ((creds
->pid
== task_tgid_vnr(current
) ||
55 ns_capable(task_active_pid_ns(current
)->user_ns
, CAP_SYS_ADMIN
)) &&
56 ((uid_eq(uid
, cred
->uid
) || uid_eq(uid
, cred
->euid
) ||
57 uid_eq(uid
, cred
->suid
)) || ns_capable(cred
->user_ns
, CAP_SETUID
)) &&
58 ((gid_eq(gid
, cred
->gid
) || gid_eq(gid
, cred
->egid
) ||
59 gid_eq(gid
, cred
->sgid
)) || ns_capable(cred
->user_ns
, CAP_SETGID
))) {
65 static int scm_fp_copy(struct cmsghdr
*cmsg
, struct scm_fp_list
**fplp
)
67 int *fdp
= (int*)CMSG_DATA(cmsg
);
68 struct scm_fp_list
*fpl
= *fplp
;
72 num
= (cmsg
->cmsg_len
- sizeof(struct cmsghdr
))/sizeof(int);
82 fpl
= kmalloc(sizeof(struct scm_fp_list
), GFP_KERNEL
);
87 fpl
->max
= SCM_MAX_FD
;
90 fpp
= &fpl
->fp
[fpl
->count
];
92 if (fpl
->count
+ num
> fpl
->max
)
96 * Verify the descriptors and increment the usage count.
99 for (i
=0; i
< num
; i
++)
104 if (fd
< 0 || !(file
= fget_raw(fd
)))
111 fpl
->user
= get_uid(current_user());
116 void __scm_destroy(struct scm_cookie
*scm
)
118 struct scm_fp_list
*fpl
= scm
->fp
;
123 for (i
=fpl
->count
-1; i
>=0; i
--)
129 EXPORT_SYMBOL(__scm_destroy
);
131 int __scm_send(struct socket
*sock
, struct msghdr
*msg
, struct scm_cookie
*p
)
133 struct cmsghdr
*cmsg
;
136 for_each_cmsghdr(cmsg
, msg
) {
139 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
140 /* The first check was omitted in <= 2.2.5. The reasoning was
141 that parser checks cmsg_len in any case, so that
142 additional check would be work duplication.
143 But if cmsg_level is not SOL_SOCKET, we do not check
144 for too short ancillary data object at all! Oops.
147 if (!CMSG_OK(msg
, cmsg
))
150 if (cmsg
->cmsg_level
!= SOL_SOCKET
)
153 switch (cmsg
->cmsg_type
)
156 if (!sock
->ops
|| sock
->ops
->family
!= PF_UNIX
)
158 err
=scm_fp_copy(cmsg
, &p
->fp
);
162 case SCM_CREDENTIALS
:
167 if (cmsg
->cmsg_len
!= CMSG_LEN(sizeof(struct ucred
)))
169 memcpy(&creds
, CMSG_DATA(cmsg
), sizeof(struct ucred
));
170 err
= scm_check_creds(&creds
);
174 p
->creds
.pid
= creds
.pid
;
175 if (!p
->pid
|| pid_vnr(p
->pid
) != creds
.pid
) {
178 pid
= find_get_pid(creds
.pid
);
186 uid
= make_kuid(current_user_ns(), creds
.uid
);
187 gid
= make_kgid(current_user_ns(), creds
.gid
);
188 if (!uid_valid(uid
) || !gid_valid(gid
))
200 if (p
->fp
&& !p
->fp
->count
)
211 EXPORT_SYMBOL(__scm_send
);
213 int put_cmsg(struct msghdr
* msg
, int level
, int type
, int len
, void *data
)
215 int cmlen
= CMSG_LEN(len
);
217 if (msg
->msg_flags
& MSG_CMSG_COMPAT
)
218 return put_cmsg_compat(msg
, level
, type
, len
, data
);
220 if (!msg
->msg_control
|| msg
->msg_controllen
< sizeof(struct cmsghdr
)) {
221 msg
->msg_flags
|= MSG_CTRUNC
;
222 return 0; /* XXX: return error? check spec. */
224 if (msg
->msg_controllen
< cmlen
) {
225 msg
->msg_flags
|= MSG_CTRUNC
;
226 cmlen
= msg
->msg_controllen
;
229 if (msg
->msg_control_is_user
) {
230 struct cmsghdr __user
*cm
= msg
->msg_control_user
;
231 struct cmsghdr cmhdr
;
233 cmhdr
.cmsg_level
= level
;
234 cmhdr
.cmsg_type
= type
;
235 cmhdr
.cmsg_len
= cmlen
;
236 if (copy_to_user(cm
, &cmhdr
, sizeof cmhdr
) ||
237 copy_to_user(CMSG_USER_DATA(cm
), data
, cmlen
- sizeof(*cm
)))
240 struct cmsghdr
*cm
= msg
->msg_control
;
242 cm
->cmsg_level
= level
;
243 cm
->cmsg_type
= type
;
244 cm
->cmsg_len
= cmlen
;
245 memcpy(CMSG_DATA(cm
), data
, cmlen
- sizeof(*cm
));
248 cmlen
= min(CMSG_SPACE(len
), msg
->msg_controllen
);
249 msg
->msg_control
+= cmlen
;
250 msg
->msg_controllen
-= cmlen
;
253 EXPORT_SYMBOL(put_cmsg
);
255 void put_cmsg_scm_timestamping64(struct msghdr
*msg
, struct scm_timestamping_internal
*tss_internal
)
257 struct scm_timestamping64 tss
;
260 for (i
= 0; i
< ARRAY_SIZE(tss
.ts
); i
++) {
261 tss
.ts
[i
].tv_sec
= tss_internal
->ts
[i
].tv_sec
;
262 tss
.ts
[i
].tv_nsec
= tss_internal
->ts
[i
].tv_nsec
;
265 put_cmsg(msg
, SOL_SOCKET
, SO_TIMESTAMPING_NEW
, sizeof(tss
), &tss
);
267 EXPORT_SYMBOL(put_cmsg_scm_timestamping64
);
269 void put_cmsg_scm_timestamping(struct msghdr
*msg
, struct scm_timestamping_internal
*tss_internal
)
271 struct scm_timestamping tss
;
274 for (i
= 0; i
< ARRAY_SIZE(tss
.ts
); i
++) {
275 tss
.ts
[i
].tv_sec
= tss_internal
->ts
[i
].tv_sec
;
276 tss
.ts
[i
].tv_nsec
= tss_internal
->ts
[i
].tv_nsec
;
279 put_cmsg(msg
, SOL_SOCKET
, SO_TIMESTAMPING_OLD
, sizeof(tss
), &tss
);
281 EXPORT_SYMBOL(put_cmsg_scm_timestamping
);
283 static int scm_max_fds(struct msghdr
*msg
)
285 if (msg
->msg_controllen
<= sizeof(struct cmsghdr
))
287 return (msg
->msg_controllen
- sizeof(struct cmsghdr
)) / sizeof(int);
290 void scm_detach_fds(struct msghdr
*msg
, struct scm_cookie
*scm
)
292 struct cmsghdr __user
*cm
=
293 (__force
struct cmsghdr __user
*)msg
->msg_control
;
294 unsigned int o_flags
= (msg
->msg_flags
& MSG_CMSG_CLOEXEC
) ? O_CLOEXEC
: 0;
295 int fdmax
= min_t(int, scm_max_fds(msg
), scm
->fp
->count
);
296 int __user
*cmsg_data
= CMSG_USER_DATA(cm
);
299 /* no use for FD passing from kernel space callers */
300 if (WARN_ON_ONCE(!msg
->msg_control_is_user
))
303 if (msg
->msg_flags
& MSG_CMSG_COMPAT
) {
304 scm_detach_fds_compat(msg
, scm
);
308 for (i
= 0; i
< fdmax
; i
++) {
309 err
= receive_fd_user(scm
->fp
->fp
[i
], cmsg_data
+ i
, o_flags
);
315 int cmlen
= CMSG_LEN(i
* sizeof(int));
317 err
= put_user(SOL_SOCKET
, &cm
->cmsg_level
);
319 err
= put_user(SCM_RIGHTS
, &cm
->cmsg_type
);
321 err
= put_user(cmlen
, &cm
->cmsg_len
);
323 cmlen
= CMSG_SPACE(i
* sizeof(int));
324 if (msg
->msg_controllen
< cmlen
)
325 cmlen
= msg
->msg_controllen
;
326 msg
->msg_control
+= cmlen
;
327 msg
->msg_controllen
-= cmlen
;
331 if (i
< scm
->fp
->count
|| (scm
->fp
->count
&& fdmax
<= 0))
332 msg
->msg_flags
|= MSG_CTRUNC
;
335 * All of the files that fit in the message have had their usage counts
336 * incremented, so we just free the list.
340 EXPORT_SYMBOL(scm_detach_fds
);
342 struct scm_fp_list
*scm_fp_dup(struct scm_fp_list
*fpl
)
344 struct scm_fp_list
*new_fpl
;
350 new_fpl
= kmemdup(fpl
, offsetof(struct scm_fp_list
, fp
[fpl
->count
]),
353 for (i
= 0; i
< fpl
->count
; i
++)
354 get_file(fpl
->fp
[i
]);
355 new_fpl
->max
= new_fpl
->count
;
356 new_fpl
->user
= get_uid(fpl
->user
);
360 EXPORT_SYMBOL(scm_fp_dup
);