[net-next-2.6.git] / net / core / scm.c

/* scm.c - Socket level control messages processing.
 *
 * Author:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
 *              Alignment and value checking mods by Craig Metz
 *
 *		This program is free software; you can redistribute it and/or
 *		modify it under the terms of the GNU General Public License
 *		as published by the Free Software Foundation; either version
 *		2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/signal.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/kernel.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>
#include <linux/security.h>
#include <linux/pid.h>
#include <linux/nsproxy.h>
#include <linux/slab.h>

#include <asm/system.h>
#include <asm/uaccess.h>

#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/compat.h>
#include <net/scm.h>


/*
 *	Only allow a user to send credentials, that they could set with
 *	setu(g)id.
 */

static __inline__ int scm_check_creds(struct ucred *creds)
{
	const struct cred *cred = current_cred();

	if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
	    ((creds->uid == cred->uid   || creds->uid == cred->euid ||
	      creds->uid == cred->suid) || capable(CAP_SETUID)) &&
	    ((creds->gid == cred->gid   || creds->gid == cred->egid ||
	      creds->gid == cred->sgid) || capable(CAP_SETGID))) {
	       return 0;
	}
	return -EPERM;
}

static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
	int *fdp = (int*)CMSG_DATA(cmsg);
	struct scm_fp_list *fpl = *fplp;
	struct file **fpp;
	int i, num;

	num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);

	if (num <= 0)
		return 0;

	if (num > SCM_MAX_FD)
		return -EINVAL;

	if (!fpl)
	{
		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
		if (!fpl)
			return -ENOMEM;
		*fplp = fpl;
		fpl->count = 0;
	}
	fpp = &fpl->fp[fpl->count];

	if (fpl->count + num > SCM_MAX_FD)
		return -EINVAL;

	/*
	 *	Verify the descriptors and increment the usage count.
	 */

	for (i=0; i< num; i++)
	{
		int fd = fdp[i];
		struct file *file;

		if (fd < 0 || !(file = fget(fd)))
			return -EBADF;
		*fpp++ = file;
		fpl->count++;
	}
	return num;
}

void __scm_destroy(struct scm_cookie *scm)
{
	struct scm_fp_list *fpl = scm->fp;
	int i;

	if (fpl) {
		scm->fp = NULL;
		if (current->scm_work_list) {
			list_add_tail(&fpl->list, current->scm_work_list);
		} else {
			LIST_HEAD(work_list);

			current->scm_work_list = &work_list;

			list_add(&fpl->list, &work_list);
			while (!list_empty(&work_list)) {
				fpl = list_first_entry(&work_list, struct scm_fp_list, list);

				list_del(&fpl->list);
				for (i=fpl->count-1; i>=0; i--)
					fput(fpl->fp[i]);
				kfree(fpl);
			}

			current->scm_work_list = NULL;
		}
	}
}

int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
{
	struct cmsghdr *cmsg;
	int err;

	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))
	{
		err = -EINVAL;

		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
		/* The first check was omitted in <= 2.2.5. The reasoning was
		   that parser checks cmsg_len in any case, so that
		   additional check would be work duplication.
		   But if cmsg_level is not SOL_SOCKET, we do not check
		   for too short ancillary data object at all! Oops.
		   OK, let's add it...
		 */
		if (!CMSG_OK(msg, cmsg))
			goto error;

		if (cmsg->cmsg_level != SOL_SOCKET)
			continue;

		switch (cmsg->cmsg_type)
		{
		case SCM_RIGHTS:
			if (!sock->ops || sock->ops->family != PF_UNIX)
				goto error;
			err=scm_fp_copy(cmsg, &p->fp);
			if (err<0)
				goto error;
			break;
		case SCM_CREDENTIALS:
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
				goto error;
			memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
			err = scm_check_creds(&p->creds);
			if (err)
				goto error;

			if (pid_vnr(p->pid) != p->creds.pid) {
				struct pid *pid;
				err = -ESRCH;
				pid = find_get_pid(p->creds.pid);
				if (!pid)
					goto error;
				put_pid(p->pid);
				p->pid = pid;
			}

			if ((p->cred->euid != p->creds.uid) ||
				(p->cred->egid != p->creds.gid)) {
				struct cred *cred;
				err = -ENOMEM;
				cred = prepare_creds();
				if (!cred)
					goto error;

				cred->uid = cred->euid = p->creds.uid;
				cred->gid = cred->egid = p->creds.uid;
				put_cred(p->cred);
				p->cred = cred;
			}
			break;
		default:
			goto error;
		}
	}

	if (p->fp && !p->fp->count)
	{
		kfree(p->fp);
		p->fp = NULL;
	}
	return 0;

error:
	scm_destroy(p);
	return err;
}

int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user *)msg->msg_control;
	struct cmsghdr cmhdr;
	int cmlen = CMSG_LEN(len);
	int err;

	if (MSG_CMSG_COMPAT & msg->msg_flags)
		return put_cmsg_compat(msg, level, type, len, data);

	if (cm==NULL || msg->msg_controllen < sizeof(*cm)) {
		msg->msg_flags |= MSG_CTRUNC;
		return 0; /* XXX: return error? check spec. */
	}
	if (msg->msg_controllen < cmlen) {
		msg->msg_flags |= MSG_CTRUNC;
		cmlen = msg->msg_controllen;
	}
	cmhdr.cmsg_level = level;
	cmhdr.cmsg_type = type;
	cmhdr.cmsg_len = cmlen;

	err = -EFAULT;
	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
		goto out;
	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
		goto out;
	cmlen = CMSG_SPACE(len);
	if (msg->msg_controllen < cmlen)
		cmlen = msg->msg_controllen;
	msg->msg_control += cmlen;
	msg->msg_controllen -= cmlen;
	err = 0;
out:
	return err;
}

void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{
	struct cmsghdr __user *cm
		= (__force struct cmsghdr __user*)msg->msg_control;

	int fdmax = 0;
	int fdnum = scm->fp->count;
	struct file **fp = scm->fp->fp;
	int __user *cmfptr;
	int err = 0, i;

	if (MSG_CMSG_COMPAT & msg->msg_flags) {
		scm_detach_fds_compat(msg, scm);
		return;
	}

	if (msg->msg_controllen > sizeof(struct cmsghdr))
		fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
			 / sizeof(int));

	if (fdnum < fdmax)
		fdmax = fdnum;

	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
	     i++, cmfptr++)
	{
		int new_fd;
		err = security_file_receive(fp[i]);
		if (err)
			break;
		err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
					  ? O_CLOEXEC : 0);
		if (err < 0)
			break;
		new_fd = err;
		err = put_user(new_fd, cmfptr);
		if (err) {
			put_unused_fd(new_fd);
			break;
		}
		/* Bump the usage count and install the file. */
		get_file(fp[i]);
		fd_install(new_fd, fp[i]);
	}

	if (i > 0)
	{
		int cmlen = CMSG_LEN(i*sizeof(int));
		err = put_user(SOL_SOCKET, &cm->cmsg_level);
		if (!err)
			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
		if (!err)
			err = put_user(cmlen, &cm->cmsg_len);
		if (!err) {
			cmlen = CMSG_SPACE(i*sizeof(int));
			msg->msg_control += cmlen;
			msg->msg_controllen -= cmlen;
		}
	}
	if (i < fdnum || (fdnum && fdmax <= 0))
		msg->msg_flags |= MSG_CTRUNC;

	/*
	 * All of the files that fit in the message have had their
	 * usage counts incremented, so we just free the list.
	 */
	__scm_destroy(scm);
}

struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
{
	struct scm_fp_list *new_fpl;
	int i;

	if (!fpl)
		return NULL;

	new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
	if (new_fpl) {
		for (i=fpl->count-1; i>=0; i--)
			get_file(fpl->fp[i]);
		memcpy(new_fpl, fpl, sizeof(*fpl));
	}
	return new_fpl;
}

EXPORT_SYMBOL(__scm_destroy);
EXPORT_SYMBOL(__scm_send);
EXPORT_SYMBOL(put_cmsg);
EXPORT_SYMBOL(scm_detach_fds);
EXPORT_SYMBOL(scm_fp_dup);
Commit	Line	Data
1da177e4 LT	1	/* scm.c - Socket level control messages processing.
	2	*
	3	* Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
	4	* Alignment and value checking mods by Craig Metz
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the License, or (at your option) any later version.
	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/signal.h>
4fc268d2	14	#include <linux/capability.h>
1da177e4 LT	15	#include <linux/errno.h>
	16	#include <linux/sched.h>
	17	#include <linux/mm.h>
	18	#include <linux/kernel.h>
1da177e4 LT	19	#include <linux/stat.h>
	20	#include <linux/socket.h>
	21	#include <linux/file.h>
	22	#include <linux/fcntl.h>
	23	#include <linux/net.h>
	24	#include <linux/interrupt.h>
	25	#include <linux/netdevice.h>
	26	#include <linux/security.h>
b488893a PE	27	#include <linux/pid.h>
b488893a PE	28	#include <linux/nsproxy.h>
5a0e3ad6	29	#include <linux/slab.h>
1da177e4 LT	30
	31	#include <asm/system.h>
	32	#include <asm/uaccess.h>
	33
	34	#include <net/protocol.h>
	35	#include <linux/skbuff.h>
	36	#include <net/sock.h>
	37	#include <net/compat.h>
	38	#include <net/scm.h>
	39
	40
	41	/*
4ec93edb	42	* Only allow a user to send credentials, that they could set with
1da177e4 LT	43	* setu(g)id.
	44	*/
	45
	46	static __inline__ int scm_check_creds(struct ucred *creds)
	47	{
86a264ab	48	const struct cred *cred = current_cred();
b6dff3ec	49
b488893a	50	if ((creds->pid == task_tgid_vnr(current) \|\| capable(CAP_SYS_ADMIN)) &&
b6dff3ec DH	51	((creds->uid == cred->uid \|\| creds->uid == cred->euid \|\|
	52	creds->uid == cred->suid) \|\| capable(CAP_SETUID)) &&
	53	((creds->gid == cred->gid \|\| creds->gid == cred->egid \|\|
	54	creds->gid == cred->sgid) \|\| capable(CAP_SETGID))) {
1da177e4 LT	55	return 0;
	56	}
	57	return -EPERM;
	58	}
	59
	60	static int scm_fp_copy(struct cmsghdr cmsg, struct scm_fp_list *fplp)
	61	{
	62	int fdp = (int)CMSG_DATA(cmsg);
	63	struct scm_fp_list fpl = fplp;
	64	struct file **fpp;
	65	int i, num;
	66
	67	num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int);
	68
	69	if (num <= 0)
	70	return 0;
	71
	72	if (num > SCM_MAX_FD)
	73	return -EINVAL;
	74
	75	if (!fpl)
	76	{
	77	fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
	78	if (!fpl)
	79	return -ENOMEM;
	80	*fplp = fpl;
	81	fpl->count = 0;
	82	}
	83	fpp = &fpl->fp[fpl->count];
	84
	85	if (fpl->count + num > SCM_MAX_FD)
	86	return -EINVAL;
4ec93edb	87
1da177e4 LT	88	/*
	89	* Verify the descriptors and increment the usage count.
	90	*/
4ec93edb	91
1da177e4 LT	92	for (i=0; i< num; i++)
	93	{
	94	int fd = fdp[i];
	95	struct file *file;
	96
	97	if (fd < 0 \|\| !(file = fget(fd)))
	98	return -EBADF;
	99	*fpp++ = file;
	100	fpl->count++;
	101	}
	102	return num;
	103	}
	104
	105	void __scm_destroy(struct scm_cookie *scm)
	106	{
	107	struct scm_fp_list *fpl = scm->fp;
	108	int i;
	109
	110	if (fpl) {
	111	scm->fp = NULL;
f8d570a4 DM	112	if (current->scm_work_list) {
	113	list_add_tail(&fpl->list, current->scm_work_list);
	114	} else {
	115	LIST_HEAD(work_list);
	116
	117	current->scm_work_list = &work_list;
	118
	119	list_add(&fpl->list, &work_list);
	120	while (!list_empty(&work_list)) {
	121	fpl = list_first_entry(&work_list, struct scm_fp_list, list);
	122
	123	list_del(&fpl->list);
	124	for (i=fpl->count-1; i>=0; i--)
	125	fput(fpl->fp[i]);
	126	kfree(fpl);
	127	}
	128
	129	current->scm_work_list = NULL;
	130	}
1da177e4 LT	131	}
	132	}
	133
	134	int __scm_send(struct socket sock, struct msghdr msg, struct scm_cookie *p)
	135	{
	136	struct cmsghdr *cmsg;
	137	int err;
	138
	139	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg))
	140	{
	141	err = -EINVAL;
	142
	143	/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
	144	/* The first check was omitted in <= 2.2.5. The reasoning was
	145	that parser checks cmsg_len in any case, so that
	146	additional check would be work duplication.
4ec93edb	147	But if cmsg_level is not SOL_SOCKET, we do not check
1da177e4 LT	148	for too short ancillary data object at all! Oops.
	149	OK, let's add it...
	150	*/
	151	if (!CMSG_OK(msg, cmsg))
	152	goto error;
	153
	154	if (cmsg->cmsg_level != SOL_SOCKET)
	155	continue;
	156
	157	switch (cmsg->cmsg_type)
	158	{
	159	case SCM_RIGHTS:
76dadd76 EB	160	if (!sock->ops \|\| sock->ops->family != PF_UNIX)
76dadd76 EB	161	goto error;
1da177e4 LT	162	err=scm_fp_copy(cmsg, &p->fp);
	163	if (err<0)
	164	goto error;
	165	break;
	166	case SCM_CREDENTIALS:
	167	if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
	168	goto error;
	169	memcpy(&p->creds, CMSG_DATA(cmsg), sizeof(struct ucred));
	170	err = scm_check_creds(&p->creds);
	171	if (err)
	172	goto error;
257b5358 EB	173
	174	if (pid_vnr(p->pid) != p->creds.pid) {
	175	struct pid *pid;
	176	err = -ESRCH;
	177	pid = find_get_pid(p->creds.pid);
	178	if (!pid)
	179	goto error;
	180	put_pid(p->pid);
	181	p->pid = pid;
	182	}
	183
	184	if ((p->cred->euid != p->creds.uid) \|\|
	185	(p->cred->egid != p->creds.gid)) {
	186	struct cred *cred;
	187	err = -ENOMEM;
	188	cred = prepare_creds();
	189	if (!cred)
	190	goto error;
	191
	192	cred->uid = cred->euid = p->creds.uid;
	193	cred->gid = cred->egid = p->creds.uid;
	194	put_cred(p->cred);
	195	p->cred = cred;
	196	}
1da177e4 LT	197	break;
	198	default:
	199	goto error;
	200	}
	201	}
	202
	203	if (p->fp && !p->fp->count)
	204	{
	205	kfree(p->fp);
	206	p->fp = NULL;
	207	}
	208	return 0;
4ec93edb	209
1da177e4 LT	210	error:
	211	scm_destroy(p);
	212	return err;
	213	}
	214
	215	int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
	216	{
cfcabdcc SH	217	struct cmsghdr __user *cm
cfcabdcc SH	218	= (__force struct cmsghdr __user *)msg->msg_control;
1da177e4 LT	219	struct cmsghdr cmhdr;
	220	int cmlen = CMSG_LEN(len);
	221	int err;
	222
	223	if (MSG_CMSG_COMPAT & msg->msg_flags)
	224	return put_cmsg_compat(msg, level, type, len, data);
	225
	226	if (cm==NULL \|\| msg->msg_controllen < sizeof(*cm)) {
	227	msg->msg_flags \|= MSG_CTRUNC;
	228	return 0; /* XXX: return error? check spec. */
	229	}
	230	if (msg->msg_controllen < cmlen) {
	231	msg->msg_flags \|= MSG_CTRUNC;
	232	cmlen = msg->msg_controllen;
	233	}
	234	cmhdr.cmsg_level = level;
	235	cmhdr.cmsg_type = type;
	236	cmhdr.cmsg_len = cmlen;
	237
	238	err = -EFAULT;
	239	if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
4ec93edb	240	goto out;
1da177e4 LT	241	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
	242	goto out;
	243	cmlen = CMSG_SPACE(len);
1ac70e7a WY	244	if (msg->msg_controllen < cmlen)
1ac70e7a WY	245	cmlen = msg->msg_controllen;
1da177e4 LT	246	msg->msg_control += cmlen;
	247	msg->msg_controllen -= cmlen;
	248	err = 0;
	249	out:
	250	return err;
	251	}
	252
	253	void scm_detach_fds(struct msghdr msg, struct scm_cookie scm)
	254	{
cfcabdcc SH	255	struct cmsghdr __user *cm
cfcabdcc SH	256	= (__force struct cmsghdr __user*)msg->msg_control;
1da177e4 LT	257
	258	int fdmax = 0;
	259	int fdnum = scm->fp->count;
	260	struct file **fp = scm->fp->fp;
	261	int __user *cmfptr;
	262	int err = 0, i;
	263
	264	if (MSG_CMSG_COMPAT & msg->msg_flags) {
	265	scm_detach_fds_compat(msg, scm);
	266	return;
	267	}
	268
	269	if (msg->msg_controllen > sizeof(struct cmsghdr))
	270	fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr))
	271	/ sizeof(int));
	272
	273	if (fdnum < fdmax)
	274	fdmax = fdnum;
	275
cfcabdcc SH	276	for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
cfcabdcc SH	277	i++, cmfptr++)
1da177e4 LT	278	{
	279	int new_fd;
	280	err = security_file_receive(fp[i]);
	281	if (err)
	282	break;
4a19542e UD	283	err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags
4a19542e UD	284	? O_CLOEXEC : 0);
1da177e4 LT	285	if (err < 0)
	286	break;
	287	new_fd = err;
	288	err = put_user(new_fd, cmfptr);
	289	if (err) {
	290	put_unused_fd(new_fd);
	291	break;
	292	}
	293	/* Bump the usage count and install the file. */
	294	get_file(fp[i]);
	295	fd_install(new_fd, fp[i]);
	296	}
	297
	298	if (i > 0)
	299	{
	300	int cmlen = CMSG_LEN(i*sizeof(int));
effee6a0	301	err = put_user(SOL_SOCKET, &cm->cmsg_level);
1da177e4 LT	302	if (!err)
	303	err = put_user(SCM_RIGHTS, &cm->cmsg_type);
	304	if (!err)
	305	err = put_user(cmlen, &cm->cmsg_len);
	306	if (!err) {
	307	cmlen = CMSG_SPACE(i*sizeof(int));
	308	msg->msg_control += cmlen;
	309	msg->msg_controllen -= cmlen;
	310	}
	311	}
	312	if (i < fdnum \|\| (fdnum && fdmax <= 0))
	313	msg->msg_flags \|= MSG_CTRUNC;
	314
	315	/*
	316	* All of the files that fit in the message have had their
	317	* usage counts incremented, so we just free the list.
	318	*/
	319	__scm_destroy(scm);
	320	}
	321
	322	struct scm_fp_list scm_fp_dup(struct scm_fp_list fpl)
	323	{
	324	struct scm_fp_list *new_fpl;
	325	int i;
	326
	327	if (!fpl)
	328	return NULL;
	329
	330	new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
	331	if (new_fpl) {
	332	for (i=fpl->count-1; i>=0; i--)
	333	get_file(fpl->fp[i]);
	334	memcpy(new_fpl, fpl, sizeof(*fpl));
	335	}
	336	return new_fpl;
	337	}
	338
	339	EXPORT_SYMBOL(__scm_destroy);
	340	EXPORT_SYMBOL(__scm_send);
	341	EXPORT_SYMBOL(put_cmsg);
	342	EXPORT_SYMBOL(scm_detach_fds);
	343	EXPORT_SYMBOL(scm_fp_dup);