Release 4.14 net/core/scm.c

/* scm.c - Socket level control messages processing.
 *
 * Author:      Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
 *              Alignment and value checking mods by Craig Metz
 *
 *              This program is free software; you can redistribute it and/or
 *              modify it under the terms of the GNU General Public License
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/signal.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/sched/user.h>
#include <linux/mm.h>
#include <linux/kernel.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>
#include <linux/security.h>
#include <linux/pid_namespace.h>
#include <linux/pid.h>
#include <linux/nsproxy.h>
#include <linux/slab.h>

#include <linux/uaccess.h>

#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/compat.h>
#include <net/scm.h>
#include <net/cls_cgroup.h>


/*
 *      Only allow a user to send credentials, that they could set with
 *      setu(g)id.
 */



static __inline__ int scm_check_creds(struct ucred *creds)
{
	const struct cred *cred = current_cred();
	kuid_t uid = make_kuid(cred->user_ns, creds->uid);
	kgid_t gid = make_kgid(cred->user_ns, creds->gid);

	if (!uid_valid(uid) || !gid_valid(gid))
		return -EINVAL;

	if ((creds->pid == task_tgid_vnr(current) ||
	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
	      gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
	       return 0;
	}
	return -EPERM;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
Eric W. Biedermann
85
46.96%
3
33.33%
Linus Torvalds (pre-git)
63
34.81%
2
22.22%
David Howells
27
14.92%
2
22.22%
Pavel Emelyanov
3
1.66%
1
11.11%
Andrew Lutomirski
3
1.66%
1
11.11%
Total
181
100.00%
9
100.00%



static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
	int *fdp = (int*)CMSG_DATA(cmsg);
	struct scm_fp_list *fpl = *fplp;
	struct file **fpp;
	int i, num;

	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);

	if (num <= 0)
		return 0;

	if (num > SCM_MAX_FD)
		return -EINVAL;

	if (!fpl)
	{
		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
		if (!fpl)
			return -ENOMEM;
		*fplp = fpl;
		fpl->count = 0;
		fpl->max = SCM_MAX_FD;
		fpl->user = NULL;
	}
	fpp = &fpl->fp[fpl->count];

	if (fpl->count + num > fpl->max)
		return -EINVAL;

	/*
         *      Verify the descriptors and increment the usage count.
         */

	for (i=0; i< num; i++)
	{
		int fd = fdp[i];
		struct file *file;

		if (fd < 0 || !(file = fget_raw(fd)))
			return -EBADF;
		*fpp++ = file;
		fpl->count++;
	}

	if (!fpl->user)
		fpl->user = get_uid(current_user());

	return num;
}

Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
214
86.64%
4
57.14%
Hannes Frederic Sowa
23
9.31%
1
14.29%
Eric Dumazet
9
3.64%
1
14.29%
Al Viro
1
0.40%
1
14.29%
Total
247
100.00%
7
100.00%



void __scm_destroy(struct scm_cookie *scm)
{
	struct scm_fp_list *fpl = scm->fp;
	int i;

	if (fpl) {
		scm->fp = NULL;
		for (i=fpl->count-1; i>=0; i--)
			fput(fpl->fp[i]);
		free_uid(fpl->user);
		kfree(fpl);
	}
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
66
90.41%
3
75.00%
Hannes Frederic Sowa
7
9.59%
1
25.00%
Total
73
100.00%
4
100.00%


EXPORT_SYMBOL(__scm_destroy);



int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
{
	struct cmsghdr *cmsg;
	int err;

	for_each_cmsghdr(cmsg, msg) {
		err = -EINVAL;

		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
		/* The first check was omitted in <= 2.2.5. The reasoning was
                   that parser checks cmsg_len in any case, so that
                   additional check would be work duplication.
                   But if cmsg_level is not SOL_SOCKET, we do not check
                   for too short ancillary data object at all! Oops.
                   OK, let's add it...
                 */
		if (!CMSG_OK(msg, cmsg))
			goto error;

		if (cmsg->cmsg_level != SOL_SOCKET)
			continue;

		switch (cmsg->cmsg_type)
		{
		case SCM_RIGHTS:
			if (!sock->ops || sock->ops->family != PF_UNIX)
				goto error;
			err=scm_fp_copy(cmsg, &p->fp);
			if (err<0)
				goto error;
			break;
		case SCM_CREDENTIALS:
		{
			struct ucred creds;
			kuid_t uid;
			kgid_t gid;
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
				goto error;
			memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
			err = scm_check_creds(&creds);
			if (err)
				goto error;

			p->creds.pid = creds.pid;
			if (!p->pid || pid_vnr(p->pid) != creds.pid) {
				struct pid *pid;
				err = -ESRCH;
				pid = find_get_pid(creds.pid);
				if (!pid)
					goto error;
				put_pid(p->pid);
				p->pid = pid;
			}

			err = -EINVAL;
			uid = make_kuid(current_user_ns(), creds.uid);
			gid = make_kgid(current_user_ns(), creds.gid);
			if (!uid_valid(uid) || !gid_valid(gid))
				goto error;

			p->creds.uid = uid;
			p->creds.gid = gid;
			break;
		}
		default:
			goto error;
		}
	}

	if (p->fp && !p->fp->count)
	{
		kfree(p->fp);
		p->fp = NULL;
	}
	return 0;

error:
	scm_destroy(p);
	return err;
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
190
52.92%
6
42.86%
Eric W. Biedermann
157
43.73%
4
28.57%
Eric Dumazet
5
1.39%
1
7.14%
Gu Zheng
3
0.84%
1
7.14%
Herbert Xu
3
0.84%
1
7.14%
Hideaki Yoshifuji / 吉藤英明
1
0.28%
1
7.14%
Total
359
100.00%
14
100.00%


EXPORT_SYMBOL(__scm_send);



int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user *)msg->msg_control;
	struct cmsghdr cmhdr;
	int cmlen = CMSG_LEN(len);
	int err;

	if (MSG_CMSG_COMPAT & msg->msg_flags)
		return put_cmsg_compat(msg, level, type, len, data);

	if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
		msg->msg_flags |= MSG_CTRUNC;
		return 0; /* XXX: return error? check spec. */
	}
	if (msg->msg_controllen < cmlen) {
		msg->msg_flags |= MSG_CTRUNC;
		cmlen = msg->msg_controllen;
	}
	cmhdr.cmsg_level = level;
	cmhdr.cmsg_type = type;
	cmhdr.cmsg_len = cmlen;

	err = -EFAULT;
	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
		goto out;
	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
		goto out;
	cmlen = CMSG_SPACE(len);
	if (msg->msg_controllen < cmlen)
		cmlen = msg->msg_controllen;
	msg->msg_control += cmlen;
	msg->msg_controllen -= cmlen;
	err = 0;
out:
	return err;
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
192
83.12%
5
55.56%
Benjamin LaHaise
22
9.52%
1
11.11%
Wei Yongjun
14
6.06%
1
11.11%
Al Viro
2
0.87%
1
11.11%
Stephen Hemminger
1
0.43%
1
11.11%
Total
231
100.00%
9
100.00%


EXPORT_SYMBOL(put_cmsg);



void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user*)msg->msg_control;

	int fdmax = 0;
	int fdnum = scm->fp->count;
	struct file **fp = scm->fp->fp;
	int __user *cmfptr;
	int err = 0, i;

	if (MSG_CMSG_COMPAT & msg->msg_flags) {
		scm_detach_fds_compat(msg, scm);
		return;
	}

	if (msg->msg_controllen > sizeof(struct cmsghdr))
		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
			 / sizeof(int));

	if (fdnum < fdmax)
		fdmax = fdnum;

	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
	     i++, cmfptr++)
	{
		struct socket *sock;
		int new_fd;
		err = security_file_receive(fp[i]);
		if (err)
			break;
		err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
					  ? O_CLOEXEC : 0);
		if (err < 0)
			break;
		new_fd = err;
		err = put_user(new_fd, cmfptr);
		if (err) {
			put_unused_fd(new_fd);
			break;
		}
		/* Bump the usage count and install the file. */
		sock = sock_from_file(fp[i], &err);
		if (sock) {
			sock_update_netprioidx(&sock->sk->sk_cgrp_data);
			sock_update_classid(&sock->sk->sk_cgrp_data);
		}
		fd_install(new_fd, get_file(fp[i]));
	}

	if (i > 0)
	{
		int cmlen = CMSG_LEN(i*sizeof(int));
		err = put_user(SOL_SOCKET, &cm->cmsg_level);
		if (!err)
			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
		if (!err)
			err = put_user(cmlen, &cm->cmsg_len);
		if (!err) {
			cmlen = CMSG_SPACE(i*sizeof(int));
			if (msg->msg_controllen < cmlen)
				cmlen = msg->msg_controllen;
			msg->msg_control += cmlen;
			msg->msg_controllen -= cmlen;
		}
	}
	if (i < fdnum || (fdnum && fdmax <= 0))
		msg->msg_flags |= MSG_CTRUNC;

	/*
         * All of the files that fit in the message have had their
         * usage counts incremented, so we just free the list.
         */
	__scm_destroy(scm);
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
311
73.52%
7
36.84%
John Fastabend
29
6.86%
1
5.26%
Benjamin LaHaise
14
3.31%
1
5.26%
Daniel Borkmann
14
3.31%
1
5.26%
Ulrich Drepper
12
2.84%
1
5.26%
Al Viro
11
2.60%
2
10.53%
Stephen D. Smalley
10
2.36%
1
5.26%
Daniel Wagner
9
2.13%
1
5.26%
Tejun Heo
6
1.42%
1
5.26%
Greg Kroah-Hartman
5
1.18%
2
10.53%
Stephen Hemminger
2
0.47%
1
5.26%
Total
423
100.00%
19
100.00%


EXPORT_SYMBOL(scm_detach_fds);



struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
{
	struct scm_fp_list *new_fpl;
	int i;

	if (!fpl)
		return NULL;

	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
			  GFP_KERNEL);
	if (new_fpl) {
		for (i = 0; i < fpl->count; i++)
			get_file(fpl->fp[i]);
		new_fpl->max = new_fpl->count;
		new_fpl->user = get_uid(fpl->user);
	}
	return new_fpl;
}
Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
69
66.99%
4
66.67%
Eric Dumazet
23
22.33%
1
16.67%
Hannes Frederic Sowa
11
10.68%
1
16.67%
Total
103
100.00%
6
100.00%


EXPORT_SYMBOL(scm_fp_dup);
Overall Contributors
Person
Tokens
Prop
Commits
CommitProp
Linus Torvalds (pre-git)
1156
67.01%
14
27.45%
Eric W. Biedermann
245
14.20%
6
11.76%
Eric Dumazet
57
3.30%
3
5.88%
Hannes Frederic Sowa
41
2.38%
1
1.96%
Benjamin LaHaise
36
2.09%
1
1.96%
John Fastabend
29
1.68%
1
1.96%
David Howells
27
1.57%
2
3.92%
Wei Yongjun
14
0.81%
1
1.96%
Al Viro
14
0.81%
3
5.88%
Daniel Borkmann
14
0.81%
1
1.96%
Stephen D. Smalley
13
0.75%
1
1.96%
Daniel Wagner
12
0.70%
1
1.96%
Ulrich Drepper
12
0.70%
1
1.96%
Pavel Emelyanov
9
0.52%
1
1.96%
Tejun Heo
9
0.52%
2
3.92%
Arnaldo Carvalho de Melo
8
0.46%
1
1.96%
Greg Kroah-Hartman
5
0.29%
2
3.92%
Stephen Hemminger
3
0.17%
1
1.96%
Herbert Xu
3
0.17%
1
1.96%
Gu Zheng
3
0.17%
1
1.96%
Ingo Molnar
3
0.17%
1
1.96%
Randy Dunlap
3
0.17%
1
1.96%
Stephen Rothwell
3
0.17%
1
1.96%
Andrew Lutomirski
3
0.17%
1
1.96%
Hideaki Yoshifuji / 吉藤英明
2
0.12%
1
1.96%
Linus Torvalds
1
0.06%
1
1.96%
Total
1725
100.00%
51
100.00%
Directory: net/core

Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.