Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0-or-later
2 : /* scm.c - Socket level control messages processing.
3 : *
4 : * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 : * Alignment and value checking mods by Craig Metz
6 : */
7 :
8 : #include <linux/module.h>
9 : #include <linux/signal.h>
10 : #include <linux/capability.h>
11 : #include <linux/errno.h>
12 : #include <linux/sched.h>
13 : #include <linux/sched/user.h>
14 : #include <linux/mm.h>
15 : #include <linux/kernel.h>
16 : #include <linux/stat.h>
17 : #include <linux/socket.h>
18 : #include <linux/file.h>
19 : #include <linux/fcntl.h>
20 : #include <linux/net.h>
21 : #include <linux/interrupt.h>
22 : #include <linux/netdevice.h>
23 : #include <linux/security.h>
24 : #include <linux/pid_namespace.h>
25 : #include <linux/pid.h>
26 : #include <linux/nsproxy.h>
27 : #include <linux/slab.h>
28 : #include <linux/errqueue.h>
29 :
30 : #include <linux/uaccess.h>
31 :
32 : #include <net/protocol.h>
33 : #include <linux/skbuff.h>
34 : #include <net/sock.h>
35 : #include <net/compat.h>
36 : #include <net/scm.h>
37 : #include <net/cls_cgroup.h>
38 :
39 :
40 : /*
41 : * Only allow a user to send credentials, that they could set with
42 : * setu(g)id.
43 : */
44 :
45 269 : static __inline__ int scm_check_creds(struct ucred *creds)
46 : {
47 269 : const struct cred *cred = current_cred();
48 269 : kuid_t uid = make_kuid(cred->user_ns, creds->uid);
49 269 : kgid_t gid = make_kgid(cred->user_ns, creds->gid);
50 :
51 269 : if (!uid_valid(uid) || !gid_valid(gid))
52 : return -EINVAL;
53 :
54 537 : if ((creds->pid == task_tgid_vnr(current) ||
55 268 : ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
56 269 : ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
57 1 : uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
58 269 : ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
59 1 : gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
60 269 : return 0;
61 : }
62 : return -EPERM;
63 : }
64 :
65 54 : static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
66 : {
67 54 : int *fdp = (int*)CMSG_DATA(cmsg);
68 54 : struct scm_fp_list *fpl = *fplp;
69 54 : struct file **fpp;
70 54 : int i, num;
71 :
72 54 : num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);
73 :
74 54 : if (num <= 0)
75 : return 0;
76 :
77 54 : if (num > SCM_MAX_FD)
78 : return -EINVAL;
79 :
80 54 : if (!fpl)
81 : {
82 54 : fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL);
83 54 : if (!fpl)
84 : return -ENOMEM;
85 54 : *fplp = fpl;
86 54 : fpl->count = 0;
87 54 : fpl->max = SCM_MAX_FD;
88 54 : fpl->user = NULL;
89 : }
90 54 : fpp = &fpl->fp[fpl->count];
91 :
92 54 : if (fpl->count + num > fpl->max)
93 : return -EINVAL;
94 :
95 : /*
96 : * Verify the descriptors and increment the usage count.
97 : */
98 :
99 108 : for (i=0; i< num; i++)
100 : {
101 54 : int fd = fdp[i];
102 54 : struct file *file;
103 :
104 54 : if (fd < 0 || !(file = fget_raw(fd)))
105 0 : return -EBADF;
106 54 : *fpp++ = file;
107 54 : fpl->count++;
108 : }
109 :
110 54 : if (!fpl->user)
111 54 : fpl->user = get_uid(current_user());
112 :
113 : return num;
114 : }
115 :
116 108 : void __scm_destroy(struct scm_cookie *scm)
117 : {
118 108 : struct scm_fp_list *fpl = scm->fp;
119 108 : int i;
120 :
121 108 : if (fpl) {
122 108 : scm->fp = NULL;
123 216 : for (i=fpl->count-1; i>=0; i--)
124 108 : fput(fpl->fp[i]);
125 108 : free_uid(fpl->user);
126 108 : kfree(fpl);
127 : }
128 108 : }
129 : EXPORT_SYMBOL(__scm_destroy);
130 :
131 323 : int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
132 : {
133 323 : struct cmsghdr *cmsg;
134 323 : int err;
135 :
136 968 : for_each_cmsghdr(cmsg, msg) {
137 323 : err = -EINVAL;
138 :
139 : /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
140 : /* The first check was omitted in <= 2.2.5. The reasoning was
141 : that parser checks cmsg_len in any case, so that
142 : additional check would be work duplication.
143 : But if cmsg_level is not SOL_SOCKET, we do not check
144 : for too short ancillary data object at all! Oops.
145 : OK, let's add it...
146 : */
147 323 : if (!CMSG_OK(msg, cmsg))
148 0 : goto error;
149 :
150 323 : if (cmsg->cmsg_level != SOL_SOCKET)
151 0 : continue;
152 :
153 323 : switch (cmsg->cmsg_type)
154 : {
155 54 : case SCM_RIGHTS:
156 54 : if (!sock->ops || sock->ops->family != PF_UNIX)
157 0 : goto error;
158 54 : err=scm_fp_copy(cmsg, &p->fp);
159 54 : if (err<0)
160 0 : goto error;
161 : break;
162 269 : case SCM_CREDENTIALS:
163 : {
164 269 : struct ucred creds;
165 269 : kuid_t uid;
166 269 : kgid_t gid;
167 269 : if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
168 1 : goto error;
169 269 : memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
170 269 : err = scm_check_creds(&creds);
171 269 : if (err)
172 0 : goto error;
173 :
174 269 : p->creds.pid = creds.pid;
175 269 : if (!p->pid || pid_vnr(p->pid) != creds.pid) {
176 269 : struct pid *pid;
177 269 : err = -ESRCH;
178 269 : pid = find_get_pid(creds.pid);
179 269 : if (!pid)
180 1 : goto error;
181 268 : put_pid(p->pid);
182 268 : p->pid = pid;
183 : }
184 :
185 268 : err = -EINVAL;
186 268 : uid = make_kuid(current_user_ns(), creds.uid);
187 268 : gid = make_kgid(current_user_ns(), creds.gid);
188 268 : if (!uid_valid(uid) || !gid_valid(gid))
189 0 : goto error;
190 :
191 268 : p->creds.uid = uid;
192 268 : p->creds.gid = gid;
193 268 : break;
194 : }
195 0 : default:
196 0 : goto error;
197 : }
198 : }
199 :
200 322 : if (p->fp && !p->fp->count)
201 : {
202 0 : kfree(p->fp);
203 0 : p->fp = NULL;
204 : }
205 : return 0;
206 :
207 1 : error:
208 1 : scm_destroy(p);
209 1 : return err;
210 : }
211 : EXPORT_SYMBOL(__scm_send);
212 :
213 1682 : int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
214 : {
215 1682 : int cmlen = CMSG_LEN(len);
216 :
217 1682 : if (msg->msg_flags & MSG_CMSG_COMPAT)
218 0 : return put_cmsg_compat(msg, level, type, len, data);
219 :
220 1682 : if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) {
221 0 : msg->msg_flags |= MSG_CTRUNC;
222 0 : return 0; /* XXX: return error? check spec. */
223 : }
224 1682 : if (msg->msg_controllen < cmlen) {
225 0 : msg->msg_flags |= MSG_CTRUNC;
226 0 : cmlen = msg->msg_controllen;
227 : }
228 :
229 1682 : if (msg->msg_control_is_user) {
230 1682 : struct cmsghdr __user *cm = msg->msg_control_user;
231 1682 : struct cmsghdr cmhdr;
232 :
233 1682 : cmhdr.cmsg_level = level;
234 1682 : cmhdr.cmsg_type = type;
235 1682 : cmhdr.cmsg_len = cmlen;
236 1682 : if (copy_to_user(cm, &cmhdr, sizeof cmhdr) ||
237 3362 : copy_to_user(CMSG_USER_DATA(cm), data, cmlen - sizeof(*cm)))
238 0 : return -EFAULT;
239 : } else {
240 0 : struct cmsghdr *cm = msg->msg_control;
241 :
242 0 : cm->cmsg_level = level;
243 0 : cm->cmsg_type = type;
244 0 : cm->cmsg_len = cmlen;
245 0 : memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm));
246 : }
247 :
248 1681 : cmlen = min(CMSG_SPACE(len), msg->msg_controllen);
249 1681 : msg->msg_control += cmlen;
250 1681 : msg->msg_controllen -= cmlen;
251 1681 : return 0;
252 : }
253 : EXPORT_SYMBOL(put_cmsg);
254 :
255 0 : void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
256 : {
257 0 : struct scm_timestamping64 tss;
258 0 : int i;
259 :
260 0 : for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
261 0 : tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
262 0 : tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
263 : }
264 :
265 0 : put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss);
266 0 : }
267 : EXPORT_SYMBOL(put_cmsg_scm_timestamping64);
268 :
269 0 : void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
270 : {
271 0 : struct scm_timestamping tss;
272 0 : int i;
273 :
274 0 : for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
275 0 : tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
276 0 : tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
277 : }
278 :
279 0 : put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss);
280 0 : }
281 : EXPORT_SYMBOL(put_cmsg_scm_timestamping);
282 :
283 54 : static int scm_max_fds(struct msghdr *msg)
284 : {
285 54 : if (msg->msg_controllen <= sizeof(struct cmsghdr))
286 : return 0;
287 54 : return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
288 : }
289 :
290 54 : void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
291 : {
292 54 : struct cmsghdr __user *cm =
293 : (__force struct cmsghdr __user *)msg->msg_control;
294 54 : unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
295 54 : int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);
296 54 : int __user *cmsg_data = CMSG_USER_DATA(cm);
297 54 : int err = 0, i;
298 :
299 : /* no use for FD passing from kernel space callers */
300 54 : if (WARN_ON_ONCE(!msg->msg_control_is_user))
301 : return;
302 :
303 54 : if (msg->msg_flags & MSG_CMSG_COMPAT) {
304 0 : scm_detach_fds_compat(msg, scm);
305 0 : return;
306 : }
307 :
308 108 : for (i = 0; i < fdmax; i++) {
309 54 : err = receive_fd_user(scm->fp->fp[i], cmsg_data + i, o_flags);
310 54 : if (err < 0)
311 : break;
312 : }
313 :
314 54 : if (i > 0) {
315 54 : int cmlen = CMSG_LEN(i * sizeof(int));
316 :
317 54 : err = put_user(SOL_SOCKET, &cm->cmsg_level);
318 54 : if (!err)
319 54 : err = put_user(SCM_RIGHTS, &cm->cmsg_type);
320 54 : if (!err)
321 54 : err = put_user(cmlen, &cm->cmsg_len);
322 54 : if (!err) {
323 54 : cmlen = CMSG_SPACE(i * sizeof(int));
324 54 : if (msg->msg_controllen < cmlen)
325 0 : cmlen = msg->msg_controllen;
326 54 : msg->msg_control += cmlen;
327 54 : msg->msg_controllen -= cmlen;
328 : }
329 : }
330 :
331 54 : if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))
332 0 : msg->msg_flags |= MSG_CTRUNC;
333 :
334 : /*
335 : * All of the files that fit in the message have had their usage counts
336 : * incremented, so we just free the list.
337 : */
338 54 : __scm_destroy(scm);
339 : }
340 : EXPORT_SYMBOL(scm_detach_fds);
341 :
342 54 : struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
343 : {
344 54 : struct scm_fp_list *new_fpl;
345 54 : int i;
346 :
347 54 : if (!fpl)
348 : return NULL;
349 :
350 54 : new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
351 : GFP_KERNEL);
352 54 : if (new_fpl) {
353 108 : for (i = 0; i < fpl->count; i++)
354 54 : get_file(fpl->fp[i]);
355 54 : new_fpl->max = new_fpl->count;
356 54 : new_fpl->user = get_uid(fpl->user);
357 : }
358 : return new_fpl;
359 : }
360 : EXPORT_SYMBOL(scm_fp_dup);
|
