scm.c 8.78 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4 5 6 7 8 9
/* scm.c - Socket level control messages processing.
 *
 * Author:	Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
 *              Alignment and value checking mods by Craig Metz
 */

#include <linux/module.h>
#include <linux/signal.h>
10
#include <linux/capability.h>
Linus Torvalds's avatar
Linus Torvalds committed
11 12
#include <linux/errno.h>
#include <linux/sched.h>
13
#include <linux/sched/user.h>
Linus Torvalds's avatar
Linus Torvalds committed
14 15 16 17 18 19 20 21 22 23
#include <linux/mm.h>
#include <linux/kernel.h>
#include <linux/stat.h>
#include <linux/socket.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/net.h>
#include <linux/interrupt.h>
#include <linux/netdevice.h>
#include <linux/security.h>
24
#include <linux/pid_namespace.h>
25 26
#include <linux/pid.h>
#include <linux/nsproxy.h>
27
#include <linux/slab.h>
28
#include <linux/errqueue.h>
29
#include <linux/io_uring.h>
Linus Torvalds's avatar
Linus Torvalds committed
30

31
#include <linux/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
32 33 34 35 36 37

#include <net/protocol.h>
#include <linux/skbuff.h>
#include <net/sock.h>
#include <net/compat.h>
#include <net/scm.h>
38
#include <net/cls_cgroup.h>
Linus Torvalds's avatar
Linus Torvalds committed
39 40 41


/*
42
 *	Only allow a user to send credentials, that they could set with
Linus Torvalds's avatar
Linus Torvalds committed
43 44 45 46 47
 *	setu(g)id.
 */

static __inline__ int scm_check_creds(struct ucred *creds)
{
48
	const struct cred *cred = current_cred();
49 50 51 52 53
	kuid_t uid = make_kuid(cred->user_ns, creds->uid);
	kgid_t gid = make_kgid(cred->user_ns, creds->gid);

	if (!uid_valid(uid) || !gid_valid(gid))
		return -EINVAL;
54

55
	if ((creds->pid == task_tgid_vnr(current) ||
56
	     ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
57
	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
58
	      uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) &&
59
	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
60
	      gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) {
Linus Torvalds's avatar
Linus Torvalds committed
61 62 63 64 65 66 67 68 69 70 71 72
	       return 0;
	}
	return -EPERM;
}

static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
{
	int *fdp = (int*)CMSG_DATA(cmsg);
	struct scm_fp_list *fpl = *fplp;
	struct file **fpp;
	int i, num;

73
	num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);
Linus Torvalds's avatar
Linus Torvalds committed
74 75 76 77 78 79 80 81 82

	if (num <= 0)
		return 0;

	if (num > SCM_MAX_FD)
		return -EINVAL;

	if (!fpl)
	{
83
		fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL_ACCOUNT);
Linus Torvalds's avatar
Linus Torvalds committed
84 85 86 87
		if (!fpl)
			return -ENOMEM;
		*fplp = fpl;
		fpl->count = 0;
Eric Dumazet's avatar
Eric Dumazet committed
88
		fpl->max = SCM_MAX_FD;
89
		fpl->user = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
90 91 92
	}
	fpp = &fpl->fp[fpl->count];

Eric Dumazet's avatar
Eric Dumazet committed
93
	if (fpl->count + num > fpl->max)
Linus Torvalds's avatar
Linus Torvalds committed
94
		return -EINVAL;
95

Linus Torvalds's avatar
Linus Torvalds committed
96 97 98
	/*
	 *	Verify the descriptors and increment the usage count.
	 */
99

Linus Torvalds's avatar
Linus Torvalds committed
100 101 102 103 104
	for (i=0; i< num; i++)
	{
		int fd = fdp[i];
		struct file *file;

105
		if (fd < 0 || !(file = fget_raw(fd)))
Linus Torvalds's avatar
Linus Torvalds committed
106
			return -EBADF;
107 108 109 110 111
		/* don't allow io_uring files */
		if (io_uring_get_socket(file)) {
			fput(file);
			return -EINVAL;
		}
Linus Torvalds's avatar
Linus Torvalds committed
112 113 114
		*fpp++ = file;
		fpl->count++;
	}
115 116 117 118

	if (!fpl->user)
		fpl->user = get_uid(current_user());

Linus Torvalds's avatar
Linus Torvalds committed
119 120 121 122 123 124 125 126 127 128
	return num;
}

void __scm_destroy(struct scm_cookie *scm)
{
	struct scm_fp_list *fpl = scm->fp;
	int i;

	if (fpl) {
		scm->fp = NULL;
Al Viro's avatar
Al Viro committed
129 130
		for (i=fpl->count-1; i>=0; i--)
			fput(fpl->fp[i]);
131
		free_uid(fpl->user);
Al Viro's avatar
Al Viro committed
132
		kfree(fpl);
Linus Torvalds's avatar
Linus Torvalds committed
133 134
	}
}
135
EXPORT_SYMBOL(__scm_destroy);
Linus Torvalds's avatar
Linus Torvalds committed
136 137 138

int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
{
139
	const struct proto_ops *ops = READ_ONCE(sock->ops);
Linus Torvalds's avatar
Linus Torvalds committed
140 141 142
	struct cmsghdr *cmsg;
	int err;

143
	for_each_cmsghdr(cmsg, msg) {
Linus Torvalds's avatar
Linus Torvalds committed
144 145 146 147 148 149
		err = -EINVAL;

		/* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
		/* The first check was omitted in <= 2.2.5. The reasoning was
		   that parser checks cmsg_len in any case, so that
		   additional check would be work duplication.
150
		   But if cmsg_level is not SOL_SOCKET, we do not check
Linus Torvalds's avatar
Linus Torvalds committed
151 152 153 154 155 156 157 158 159 160 161 162
		   for too short ancillary data object at all! Oops.
		   OK, let's add it...
		 */
		if (!CMSG_OK(msg, cmsg))
			goto error;

		if (cmsg->cmsg_level != SOL_SOCKET)
			continue;

		switch (cmsg->cmsg_type)
		{
		case SCM_RIGHTS:
163
			if (!ops || ops->family != PF_UNIX)
164
				goto error;
Linus Torvalds's avatar
Linus Torvalds committed
165 166 167 168 169
			err=scm_fp_copy(cmsg, &p->fp);
			if (err<0)
				goto error;
			break;
		case SCM_CREDENTIALS:
170
		{
171
			struct ucred creds;
172 173
			kuid_t uid;
			kgid_t gid;
Linus Torvalds's avatar
Linus Torvalds committed
174 175
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
				goto error;
176 177
			memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred));
			err = scm_check_creds(&creds);
Linus Torvalds's avatar
Linus Torvalds committed
178 179
			if (err)
				goto error;
180

181 182
			p->creds.pid = creds.pid;
			if (!p->pid || pid_vnr(p->pid) != creds.pid) {
183 184
				struct pid *pid;
				err = -ESRCH;
185
				pid = find_get_pid(creds.pid);
186 187 188 189 190 191
				if (!pid)
					goto error;
				put_pid(p->pid);
				p->pid = pid;
			}

192
			err = -EINVAL;
193 194
			uid = make_kuid(current_user_ns(), creds.uid);
			gid = make_kgid(current_user_ns(), creds.gid);
195 196 197
			if (!uid_valid(uid) || !gid_valid(gid))
				goto error;

198 199
			p->creds.uid = uid;
			p->creds.gid = gid;
Linus Torvalds's avatar
Linus Torvalds committed
200
			break;
201
		}
Linus Torvalds's avatar
Linus Torvalds committed
202 203 204 205 206 207 208 209 210 211 212
		default:
			goto error;
		}
	}

	if (p->fp && !p->fp->count)
	{
		kfree(p->fp);
		p->fp = NULL;
	}
	return 0;
213

Linus Torvalds's avatar
Linus Torvalds committed
214 215 216 217
error:
	scm_destroy(p);
	return err;
}
218
EXPORT_SYMBOL(__scm_send);
Linus Torvalds's avatar
Linus Torvalds committed
219 220 221 222 223

int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
{
	int cmlen = CMSG_LEN(len);

224
	if (msg->msg_flags & MSG_CMSG_COMPAT)
Linus Torvalds's avatar
Linus Torvalds committed
225 226
		return put_cmsg_compat(msg, level, type, len, data);

227
	if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) {
Linus Torvalds's avatar
Linus Torvalds committed
228 229 230 231 232 233 234
		msg->msg_flags |= MSG_CTRUNC;
		return 0; /* XXX: return error? check spec. */
	}
	if (msg->msg_controllen < cmlen) {
		msg->msg_flags |= MSG_CTRUNC;
		cmlen = msg->msg_controllen;
	}
235 236 237

	if (msg->msg_control_is_user) {
		struct cmsghdr __user *cm = msg->msg_control_user;
Eric Dumazet's avatar
Eric Dumazet committed
238

239 240
		check_object_size(data, cmlen - sizeof(*cm), true);

Eric Dumazet's avatar
Eric Dumazet committed
241 242 243
		if (!user_write_access_begin(cm, cmlen))
			goto efault;

244
		unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);
Eric Dumazet's avatar
Eric Dumazet committed
245 246 247 248 249
		unsafe_put_user(level, &cm->cmsg_level, efault_end);
		unsafe_put_user(type, &cm->cmsg_type, efault_end);
		unsafe_copy_to_user(CMSG_USER_DATA(cm), data,
				    cmlen - sizeof(*cm), efault_end);
		user_write_access_end();
250 251 252 253 254 255 256 257 258 259
	} else {
		struct cmsghdr *cm = msg->msg_control;

		cm->cmsg_level = level;
		cm->cmsg_type = type;
		cm->cmsg_len = cmlen;
		memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm));
	}

	cmlen = min(CMSG_SPACE(len), msg->msg_controllen);
260 261 262 263
	if (msg->msg_control_is_user)
		msg->msg_control_user += cmlen;
	else
		msg->msg_control += cmlen;
Linus Torvalds's avatar
Linus Torvalds committed
264
	msg->msg_controllen -= cmlen;
265
	return 0;
Eric Dumazet's avatar
Eric Dumazet committed
266 267 268 269 270

efault_end:
	user_write_access_end();
efault:
	return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
271
}
272
EXPORT_SYMBOL(put_cmsg);
Linus Torvalds's avatar
Linus Torvalds committed
273

274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292
void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
{
	struct scm_timestamping64 tss;
	int i;

	for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
	}

	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss);
}
EXPORT_SYMBOL(put_cmsg_scm_timestamping64);

void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
{
	struct scm_timestamping tss;
	int i;

293 294 295 296
	for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
		tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
		tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
	}
297 298 299 300 301

	put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss);
}
EXPORT_SYMBOL(put_cmsg_scm_timestamping);

302 303 304 305 306 307 308
static int scm_max_fds(struct msghdr *msg)
{
	if (msg->msg_controllen <= sizeof(struct cmsghdr))
		return 0;
	return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
}

Linus Torvalds's avatar
Linus Torvalds committed
309 310
void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
{
311
	struct cmsghdr __user *cm =
312
		(__force struct cmsghdr __user *)msg->msg_control_user;
313
	unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
314 315
	int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);
	int __user *cmsg_data = CMSG_USER_DATA(cm);
Linus Torvalds's avatar
Linus Torvalds committed
316 317
	int err = 0, i;

318 319 320 321
	/* no use for FD passing from kernel space callers */
	if (WARN_ON_ONCE(!msg->msg_control_is_user))
		return;

322
	if (msg->msg_flags & MSG_CMSG_COMPAT) {
Linus Torvalds's avatar
Linus Torvalds committed
323 324 325 326
		scm_detach_fds_compat(msg, scm);
		return;
	}

327
	for (i = 0; i < fdmax; i++) {
328
		err = receive_fd_user(scm->fp->fp[i], cmsg_data + i, o_flags);
329
		if (err < 0)
Linus Torvalds's avatar
Linus Torvalds committed
330 331 332
			break;
	}

333
	if (i > 0) {
334 335
		int cmlen = CMSG_LEN(i * sizeof(int));

336
		err = put_user(SOL_SOCKET, &cm->cmsg_level);
Linus Torvalds's avatar
Linus Torvalds committed
337 338 339 340 341
		if (!err)
			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
		if (!err)
			err = put_user(cmlen, &cm->cmsg_len);
		if (!err) {
342
			cmlen = CMSG_SPACE(i * sizeof(int));
343 344
			if (msg->msg_controllen < cmlen)
				cmlen = msg->msg_controllen;
345
			msg->msg_control_user += cmlen;
Linus Torvalds's avatar
Linus Torvalds committed
346 347 348
			msg->msg_controllen -= cmlen;
		}
	}
349 350

	if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))
Linus Torvalds's avatar
Linus Torvalds committed
351 352 353
		msg->msg_flags |= MSG_CTRUNC;

	/*
354 355
	 * All of the files that fit in the message have had their usage counts
	 * incremented, so we just free the list.
Linus Torvalds's avatar
Linus Torvalds committed
356 357 358
	 */
	__scm_destroy(scm);
}
359
EXPORT_SYMBOL(scm_detach_fds);
Linus Torvalds's avatar
Linus Torvalds committed
360 361 362 363 364 365 366 367 368

struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
{
	struct scm_fp_list *new_fpl;
	int i;

	if (!fpl)
		return NULL;

Eric Dumazet's avatar
Eric Dumazet committed
369
	new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
370
			  GFP_KERNEL_ACCOUNT);
Linus Torvalds's avatar
Linus Torvalds committed
371
	if (new_fpl) {
Eric Dumazet's avatar
Eric Dumazet committed
372
		for (i = 0; i < fpl->count; i++)
Linus Torvalds's avatar
Linus Torvalds committed
373
			get_file(fpl->fp[i]);
Eric Dumazet's avatar
Eric Dumazet committed
374
		new_fpl->max = new_fpl->count;
375
		new_fpl->user = get_uid(fpl->user);
Linus Torvalds's avatar
Linus Torvalds committed
376 377 378 379
	}
	return new_fpl;
}
EXPORT_SYMBOL(scm_fp_dup);