kernel/cred.c

   1 /* Task credentials management - see Documentation/security/credentials.rst
   2  *
   3  * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11 #include <linux/export.h>
  12 #include <linux/cred.h>
  13 #include <linux/slab.h>
  14 #include <linux/sched.h>
  15 #include <linux/sched/coredump.h>
  16 #include <linux/key.h>
  17 #include <linux/keyctl.h>
  18 #include <linux/init_task.h>
  19 #include <linux/security.h>
  20 #include <linux/binfmts.h>
  21 #include <linux/cn_proc.h>
  22 #include <linux/uidgid.h>
  23
  24 #if 0
  25 #define kdebug(FMT, ...)                                                \
  26         printk("[%-5.5s%5u] " FMT "\n",                                 \
  27                current->comm, current->pid, ##__VA_ARGS__)
  28 #else
  29 #define kdebug(FMT, ...)                                                \
  30 do {                                                                    \
  31         if (0)                                                          \
  32                 no_printk("[%-5.5s%5u] " FMT "\n",                      \
  33                           current->comm, current->pid, ##__VA_ARGS__);  \
  34 } while (0)
  35 #endif
  36
  37 static struct kmem_cache *cred_jar;
  38
  39 /* init to 2 - one for init_task, one to ensure it is never freed */
  40 struct group_info init_groups = { .usage = ATOMIC_INIT(2) };
  41
  42 /*
  43  * The initial credentials for the initial task
  44  */
  45 struct cred init_cred = {
  46         .usage                  = ATOMIC_INIT(4),
  47 #ifdef CONFIG_DEBUG_CREDENTIALS
  48         .subscribers            = ATOMIC_INIT(2),
  49         .magic                  = CRED_MAGIC,
  50 #endif
  51         .uid                    = GLOBAL_ROOT_UID,
  52         .gid                    = GLOBAL_ROOT_GID,
  53         .suid                   = GLOBAL_ROOT_UID,
  54         .sgid                   = GLOBAL_ROOT_GID,
  55         .euid                   = GLOBAL_ROOT_UID,
  56         .egid                   = GLOBAL_ROOT_GID,
  57         .fsuid                  = GLOBAL_ROOT_UID,
  58         .fsgid                  = GLOBAL_ROOT_GID,
  59         .securebits             = SECUREBITS_DEFAULT,
  60         .cap_inheritable        = CAP_EMPTY_SET,
  61         .cap_permitted          = CAP_FULL_SET,
  62         .cap_effective          = CAP_FULL_SET,
  63         .cap_bset               = CAP_FULL_SET,
  64         .user                   = INIT_USER,
  65         .user_ns                = &init_user_ns,
  66         .group_info             = &init_groups,
  67 };
  68
  69 static inline void set_cred_subscribers(struct cred *cred, int n)
  70 {
  71 #ifdef CONFIG_DEBUG_CREDENTIALS
  72         atomic_set(&cred->subscribers, n);
  73 #endif
  74 }
  75
  76 static inline int read_cred_subscribers(const struct cred *cred)
  77 {
  78 #ifdef CONFIG_DEBUG_CREDENTIALS
  79         return atomic_read(&cred->subscribers);
  80 #else
  81         return 0;
  82 #endif
  83 }
  84
  85 static inline void alter_cred_subscribers(const struct cred *_cred, int n)
  86 {
  87 #ifdef CONFIG_DEBUG_CREDENTIALS
  88         struct cred *cred = (struct cred *) _cred;
  89
  90         atomic_add(n, &cred->subscribers);
  91 #endif
  92 }
  93
  94 /*
  95  * The RCU callback to actually dispose of a set of credentials
  96  */
  97 static void put_cred_rcu(struct rcu_head *rcu)
  98 {
  99         struct cred *cred = container_of(rcu, struct cred, rcu);
 100
 101         kdebug("put_cred_rcu(%p)", cred);
 102
 103 #ifdef CONFIG_DEBUG_CREDENTIALS
 104         if (cred->magic != CRED_MAGIC_DEAD ||
 105             atomic_read(&cred->usage) != 0 ||
 106             read_cred_subscribers(cred) != 0)
 107                 panic("CRED: put_cred_rcu() sees %p with"
 108                       " mag %x, put %p, usage %d, subscr %d\n",
 109                       cred, cred->magic, cred->put_addr,
 110                       atomic_read(&cred->usage),
 111                       read_cred_subscribers(cred));
 112 #else
 113         if (atomic_read(&cred->usage) != 0)
 114                 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
 115                       cred, atomic_read(&cred->usage));
 116 #endif
 117
 118         security_cred_free(cred);
 119         key_put(cred->session_keyring);
 120         key_put(cred->process_keyring);
 121         key_put(cred->thread_keyring);
 122         key_put(cred->request_key_auth);
 123         if (cred->group_info)
 124                 put_group_info(cred->group_info);
 125         free_uid(cred->user);
 126         put_user_ns(cred->user_ns);
 127         kmem_cache_free(cred_jar, cred);
 128 }
 129
 130 /**
 131  * __put_cred - Destroy a set of credentials
 132  * @cred: The record to release
 133  *
 134  * Destroy a set of credentials on which no references remain.
 135  */
 136 void __put_cred(struct cred *cred)
 137 {
 138         kdebug("__put_cred(%p{%d,%d})", cred,
 139                atomic_read(&cred->usage),
 140                read_cred_subscribers(cred));
 141
 142         BUG_ON(atomic_read(&cred->usage) != 0);
 143 #ifdef CONFIG_DEBUG_CREDENTIALS
 144         BUG_ON(read_cred_subscribers(cred) != 0);
 145         cred->magic = CRED_MAGIC_DEAD;
 146         cred->put_addr = __builtin_return_address(0);
 147 #endif
 148         BUG_ON(cred == current->cred);
 149         BUG_ON(cred == current->real_cred);
 150
 151         call_rcu(&cred->rcu, put_cred_rcu);
 152 }
 153 EXPORT_SYMBOL(__put_cred);
 154
 155 /*
 156  * Clean up a task's credentials when it exits
 157  */
 158 void exit_creds(struct task_struct *tsk)
 159 {
 160         struct cred *cred;
 161
 162         kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
 163                atomic_read(&tsk->cred->usage),
 164                read_cred_subscribers(tsk->cred));
 165
 166         cred = (struct cred *) tsk->real_cred;
 167         tsk->real_cred = NULL;
 168         validate_creds(cred);
 169         alter_cred_subscribers(cred, -1);
 170         put_cred(cred);
 171
 172         cred = (struct cred *) tsk->cred;
 173         tsk->cred = NULL;
 174         validate_creds(cred);
 175         alter_cred_subscribers(cred, -1);
 176         put_cred(cred);
 177 }
 178
 179 /**
 180  * get_task_cred - Get another task's objective credentials
 181  * @task: The task to query
 182  *
 183  * Get the objective credentials of a task, pinning them so that they can't go
 184  * away.  Accessing a task's credentials directly is not permitted.
 185  *
 186  * The caller must also make sure task doesn't get deleted, either by holding a
 187  * ref on task or by holding tasklist_lock to prevent it from being unlinked.
 188  */
 189 const struct cred *get_task_cred(struct task_struct *task)
 190 {
 191         const struct cred *cred;
 192
 193         rcu_read_lock();
 194
 195         do {
 196                 cred = __task_cred((task));
 197                 BUG_ON(!cred);
 198         } while (!get_cred_rcu(cred));
 199
 200         rcu_read_unlock();
 201         return cred;
 202 }
 203 EXPORT_SYMBOL(get_task_cred);
 204
 205 /*
 206  * Allocate blank credentials, such that the credentials can be filled in at a
 207  * later date without risk of ENOMEM.
 208  */
 209 struct cred *cred_alloc_blank(void)
 210 {
 211         struct cred *new;
 212
 213         new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
 214         if (!new)
 215                 return NULL;
 216
 217         atomic_set(&new->usage, 1);
 218 #ifdef CONFIG_DEBUG_CREDENTIALS
 219         new->magic = CRED_MAGIC;
 220 #endif
 221
 222         if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
 223                 goto error;
 224
 225         return new;
 226
 227 error:
 228         abort_creds(new);
 229         return NULL;
 230 }
 231
 232 /**
 233  * prepare_creds - Prepare a new set of credentials for modification
 234  *
 235  * Prepare a new set of task credentials for modification.  A task's creds
 236  * shouldn't generally be modified directly, therefore this function is used to
 237  * prepare a new copy, which the caller then modifies and then commits by
 238  * calling commit_creds().
 239  *
 240  * Preparation involves making a copy of the objective creds for modification.
 241  *
 242  * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
 243  *
 244  * Call commit_creds() or abort_creds() to clean up.
 245  */
 246 struct cred *prepare_creds(void)
 247 {
 248         struct task_struct *task = current;
 249         const struct cred *old;
 250         struct cred *new;
 251
 252         validate_process_creds();
 253
 254         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 255         if (!new)
 256                 return NULL;
 257
 258         kdebug("prepare_creds() alloc %p", new);
 259
 260         old = task->cred;
 261         memcpy(new, old, sizeof(struct cred));
 262
 263         atomic_set(&new->usage, 1);
 264         set_cred_subscribers(new, 0);
 265         get_group_info(new->group_info);
 266         get_uid(new->user);
 267         get_user_ns(new->user_ns);
 268
 269 #ifdef CONFIG_KEYS
 270         key_get(new->session_keyring);
 271         key_get(new->process_keyring);
 272         key_get(new->thread_keyring);
 273         key_get(new->request_key_auth);
 274 #endif
 275
 276 #ifdef CONFIG_SECURITY
 277         new->security = NULL;
 278 #endif
 279
 280         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
 281                 goto error;
 282         validate_creds(new);
 283         return new;
 284
 285 error:
 286         abort_creds(new);
 287         return NULL;
 288 }
 289 EXPORT_SYMBOL(prepare_creds);
 290
 291 /*
 292  * Prepare credentials for current to perform an execve()
 293  * - The caller must hold ->cred_guard_mutex
 294  */
 295 struct cred *prepare_exec_creds(void)
 296 {
 297         struct cred *new;
 298
 299         new = prepare_creds();
 300         if (!new)
 301                 return new;
 302
 303 #ifdef CONFIG_KEYS
 304         /* newly exec'd tasks don't get a thread keyring */
 305         key_put(new->thread_keyring);
 306         new->thread_keyring = NULL;
 307
 308         /* inherit the session keyring; new process keyring */
 309         key_put(new->process_keyring);
 310         new->process_keyring = NULL;
 311 #endif
 312
 313         return new;
 314 }
 315
 316 /*
 317  * Copy credentials for the new process created by fork()
 318  *
 319  * We share if we can, but under some circumstances we have to generate a new
 320  * set.
 321  *
 322  * The new process gets the current process's subjective credentials as its
 323  * objective and subjective credentials
 324  */
 325 int copy_creds(struct task_struct *p, unsigned long clone_flags)
 326 {
 327         struct cred *new;
 328         int ret;
 329
 330         if (
 331 #ifdef CONFIG_KEYS
 332                 !p->cred->thread_keyring &&
 333 #endif
 334                 clone_flags & CLONE_THREAD
 335             ) {
 336                 p->real_cred = get_cred(p->cred);
 337                 get_cred(p->cred);
 338                 alter_cred_subscribers(p->cred, 2);
 339                 kdebug("share_creds(%p{%d,%d})",
 340                        p->cred, atomic_read(&p->cred->usage),
 341                        read_cred_subscribers(p->cred));
 342                 atomic_inc(&p->cred->user->processes);
 343                 return 0;
 344         }
 345
 346         new = prepare_creds();
 347         if (!new)
 348                 return -ENOMEM;
 349
 350         if (clone_flags & CLONE_NEWUSER) {
 351                 ret = create_user_ns(new);
 352                 if (ret < 0)
 353                         goto error_put;
 354         }
 355
 356 #ifdef CONFIG_KEYS
 357         /* new threads get their own thread keyrings if their parent already
 358          * had one */
 359         if (new->thread_keyring) {
 360                 key_put(new->thread_keyring);
 361                 new->thread_keyring = NULL;
 362                 if (clone_flags & CLONE_THREAD)
 363                         install_thread_keyring_to_cred(new);
 364         }
 365
 366         /* The process keyring is only shared between the threads in a process;
 367          * anything outside of those threads doesn't inherit.
 368          */
 369         if (!(clone_flags & CLONE_THREAD)) {
 370                 key_put(new->process_keyring);
 371                 new->process_keyring = NULL;
 372         }
 373 #endif
 374
 375         atomic_inc(&new->user->processes);
 376         p->cred = p->real_cred = get_cred(new);
 377         alter_cred_subscribers(new, 2);
 378         validate_creds(new);
 379         return 0;
 380
 381 error_put:
 382         put_cred(new);
 383         return ret;
 384 }
 385
 386 static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
 387 {
 388         const struct user_namespace *set_ns = set->user_ns;
 389         const struct user_namespace *subset_ns = subset->user_ns;
 390
 391         /* If the two credentials are in the same user namespace see if
 392          * the capabilities of subset are a subset of set.
 393          */
 394         if (set_ns == subset_ns)
 395                 return cap_issubset(subset->cap_permitted, set->cap_permitted);
 396
 397         /* The credentials are in a different user namespaces
 398          * therefore one is a subset of the other only if a set is an
 399          * ancestor of subset and set->euid is owner of subset or one
 400          * of subsets ancestors.
 401          */
 402         for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
 403                 if ((set_ns == subset_ns->parent)  &&
 404                     uid_eq(subset_ns->owner, set->euid))
 405                         return true;
 406         }
 407
 408         return false;
 409 }
 410
 411 /**
 412  * commit_creds - Install new credentials upon the current task
 413  * @new: The credentials to be assigned
 414  *
 415  * Install a new set of credentials to the current task, using RCU to replace
 416  * the old set.  Both the objective and the subjective credentials pointers are
 417  * updated.  This function may not be called if the subjective credentials are
 418  * in an overridden state.
 419  *
 420  * This function eats the caller's reference to the new credentials.
 421  *
 422  * Always returns 0 thus allowing this function to be tail-called at the end
 423  * of, say, sys_setgid().
 424  */
 425 int commit_creds(struct cred *new)
 426 {
 427         struct task_struct *task = current;
 428         const struct cred *old = task->real_cred;
 429
 430         kdebug("commit_creds(%p{%d,%d})", new,
 431                atomic_read(&new->usage),
 432                read_cred_subscribers(new));
 433
 434         BUG_ON(task->cred != old);
 435 #ifdef CONFIG_DEBUG_CREDENTIALS
 436         BUG_ON(read_cred_subscribers(old) < 2);
 437         validate_creds(old);
 438         validate_creds(new);
 439 #endif
 440         BUG_ON(atomic_read(&new->usage) < 1);
 441
 442         get_cred(new); /* we will require a ref for the subj creds too */
 443
 444         /* dumpability changes */
 445         if (!uid_eq(old->euid, new->euid) ||
 446             !gid_eq(old->egid, new->egid) ||
 447             !uid_eq(old->fsuid, new->fsuid) ||
 448             !gid_eq(old->fsgid, new->fsgid) ||
 449             !cred_cap_issubset(old, new)) {
 450                 if (task->mm)
 451                         set_dumpable(task->mm, suid_dumpable);
 452                 task->pdeath_signal = 0;
 453                 /*
 454                  * If a task drops privileges and becomes nondumpable,
 455                  * the dumpability change must become visible before
 456                  * the credential change; otherwise, a __ptrace_may_access()
 457                  * racing with this change may be able to attach to a task it
 458                  * shouldn't be able to attach to (as if the task had dropped
 459                  * privileges without becoming nondumpable).
 460                  * Pairs with a read barrier in __ptrace_may_access().
 461                  */
 462                 smp_wmb();
 463         }
 464
 465         /* alter the thread keyring */
 466         if (!uid_eq(new->fsuid, old->fsuid))
 467                 key_fsuid_changed(task);
 468         if (!gid_eq(new->fsgid, old->fsgid))
 469                 key_fsgid_changed(task);
 470
 471         /* do it
 472          * RLIMIT_NPROC limits on user->processes have already been checked
 473          * in set_user().
 474          */
 475         alter_cred_subscribers(new, 2);
 476         if (new->user != old->user)
 477                 atomic_inc(&new->user->processes);
 478         rcu_assign_pointer(task->real_cred, new);
 479         rcu_assign_pointer(task->cred, new);
 480         if (new->user != old->user)
 481                 atomic_dec(&old->user->processes);
 482         alter_cred_subscribers(old, -2);
 483
 484         /* send notifications */
 485         if (!uid_eq(new->uid,   old->uid)  ||
 486             !uid_eq(new->euid,  old->euid) ||
 487             !uid_eq(new->suid,  old->suid) ||
 488             !uid_eq(new->fsuid, old->fsuid))
 489                 proc_id_connector(task, PROC_EVENT_UID);
 490
 491         if (!gid_eq(new->gid,   old->gid)  ||
 492             !gid_eq(new->egid,  old->egid) ||
 493             !gid_eq(new->sgid,  old->sgid) ||
 494             !gid_eq(new->fsgid, old->fsgid))
 495                 proc_id_connector(task, PROC_EVENT_GID);
 496
 497         /* release the old obj and subj refs both */
 498         put_cred(old);
 499         put_cred(old);
 500         return 0;
 501 }
 502 EXPORT_SYMBOL(commit_creds);
 503
 504 /**
 505  * abort_creds - Discard a set of credentials and unlock the current task
 506  * @new: The credentials that were going to be applied
 507  *
 508  * Discard a set of credentials that were under construction and unlock the
 509  * current task.
 510  */
 511 void abort_creds(struct cred *new)
 512 {
 513         kdebug("abort_creds(%p{%d,%d})", new,
 514                atomic_read(&new->usage),
 515                read_cred_subscribers(new));
 516
 517 #ifdef CONFIG_DEBUG_CREDENTIALS
 518         BUG_ON(read_cred_subscribers(new) != 0);
 519 #endif
 520         BUG_ON(atomic_read(&new->usage) < 1);
 521         put_cred(new);
 522 }
 523 EXPORT_SYMBOL(abort_creds);
 524
 525 /**
 526  * override_creds - Override the current process's subjective credentials
 527  * @new: The credentials to be assigned
 528  *
 529  * Install a set of temporary override subjective credentials on the current
 530  * process, returning the old set for later reversion.
 531  */
 532 const struct cred *override_creds(const struct cred *new)
 533 {
 534         const struct cred *old = current->cred;
 535
 536         kdebug("override_creds(%p{%d,%d})", new,
 537                atomic_read(&new->usage),
 538                read_cred_subscribers(new));
 539
 540         validate_creds(old);
 541         validate_creds(new);
 542         get_cred(new);
 543         alter_cred_subscribers(new, 1);
 544         rcu_assign_pointer(current->cred, new);
 545         alter_cred_subscribers(old, -1);
 546
 547         kdebug("override_creds() = %p{%d,%d}", old,
 548                atomic_read(&old->usage),
 549                read_cred_subscribers(old));
 550         return old;
 551 }
 552 EXPORT_SYMBOL(override_creds);
 553
 554 /**
 555  * revert_creds - Revert a temporary subjective credentials override
 556  * @old: The credentials to be restored
 557  *
 558  * Revert a temporary set of override subjective credentials to an old set,
 559  * discarding the override set.
 560  */
 561 void revert_creds(const struct cred *old)
 562 {
 563         const struct cred *override = current->cred;
 564
 565         kdebug("revert_creds(%p{%d,%d})", old,
 566                atomic_read(&old->usage),
 567                read_cred_subscribers(old));
 568
 569         validate_creds(old);
 570         validate_creds(override);
 571         alter_cred_subscribers(old, 1);
 572         rcu_assign_pointer(current->cred, old);
 573         alter_cred_subscribers(override, -1);
 574         put_cred(override);
 575 }
 576 EXPORT_SYMBOL(revert_creds);
 577
 578 /**
 579  * cred_fscmp - Compare two credentials with respect to filesystem access.
 580  * @a: The first credential
 581  * @b: The second credential
 582  *
 583  * cred_cmp() will return zero if both credentials have the same
 584  * fsuid, fsgid, and supplementary groups.  That is, if they will both
 585  * provide the same access to files based on mode/uid/gid.
 586  * If the credentials are different, then either -1 or 1 will
 587  * be returned depending on whether @a comes before or after @b
 588  * respectively in an arbitrary, but stable, ordering of credentials.
 589  *
 590  * Return: -1, 0, or 1 depending on comparison
 591  */
 592 int cred_fscmp(const struct cred *a, const struct cred *b)
 593 {
 594         struct group_info *ga, *gb;
 595         int g;
 596
 597         if (a == b)
 598                 return 0;
 599         if (uid_lt(a->fsuid, b->fsuid))
 600                 return -1;
 601         if (uid_gt(a->fsuid, b->fsuid))
 602                 return 1;
 603
 604         if (gid_lt(a->fsgid, b->fsgid))
 605                 return -1;
 606         if (gid_gt(a->fsgid, b->fsgid))
 607                 return 1;
 608
 609         ga = a->group_info;
 610         gb = b->group_info;
 611         if (ga == gb)
 612                 return 0;
 613         if (ga == NULL)
 614                 return -1;
 615         if (gb == NULL)
 616                 return 1;
 617         if (ga->ngroups < gb->ngroups)
 618                 return -1;
 619         if (ga->ngroups > gb->ngroups)
 620                 return 1;
 621
 622         for (g = 0; g < ga->ngroups; g++) {
 623                 if (gid_lt(ga->gid[g], gb->gid[g]))
 624                         return -1;
 625                 if (gid_gt(ga->gid[g], gb->gid[g]))
 626                         return 1;
 627         }
 628         return 0;
 629 }
 630 EXPORT_SYMBOL(cred_fscmp);
 631
 632 /*
 633  * initialise the credentials stuff
 634  */
 635 void __init cred_init(void)
 636 {
 637         /* allocate a slab in which we can store credentials */
 638         cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
 639                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
 640 }
 641
 642 /**
 643  * prepare_kernel_cred - Prepare a set of credentials for a kernel service
 644  * @daemon: A userspace daemon to be used as a reference
 645  *
 646  * Prepare a set of credentials for a kernel service.  This can then be used to
 647  * override a task's own credentials so that work can be done on behalf of that
 648  * task that requires a different subjective context.
 649  *
 650  * @daemon is used to provide a base for the security record, but can be NULL.
 651  * If @daemon is supplied, then the security data will be derived from that;
 652  * otherwise they'll be set to 0 and no groups, full capabilities and no keys.
 653  *
 654  * The caller may change these controls afterwards if desired.
 655  *
 656  * Returns the new credentials or NULL if out of memory.
 657  *
 658  * Does not take, and does not return holding current->cred_replace_mutex.
 659  */
 660 struct cred *prepare_kernel_cred(struct task_struct *daemon)
 661 {
 662         const struct cred *old;
 663         struct cred *new;
 664
 665         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 666         if (!new)
 667                 return NULL;
 668
 669         kdebug("prepare_kernel_cred() alloc %p", new);
 670
 671         if (daemon)
 672                 old = get_task_cred(daemon);
 673         else
 674                 old = get_cred(&init_cred);
 675
 676         validate_creds(old);
 677
 678         *new = *old;
 679         atomic_set(&new->usage, 1);
 680         set_cred_subscribers(new, 0);
 681         get_uid(new->user);
 682         get_user_ns(new->user_ns);
 683         get_group_info(new->group_info);
 684
 685 #ifdef CONFIG_KEYS
 686         new->session_keyring = NULL;
 687         new->process_keyring = NULL;
 688         new->thread_keyring = NULL;
 689         new->request_key_auth = NULL;
 690         new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
 691 #endif
 692
 693 #ifdef CONFIG_SECURITY
 694         new->security = NULL;
 695 #endif
 696         if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
 697                 goto error;
 698
 699         put_cred(old);
 700         validate_creds(new);
 701         return new;
 702
 703 error:
 704         put_cred(new);
 705         put_cred(old);
 706         return NULL;
 707 }
 708 EXPORT_SYMBOL(prepare_kernel_cred);
 709
 710 /**
 711  * set_security_override - Set the security ID in a set of credentials
 712  * @new: The credentials to alter
 713  * @secid: The LSM security ID to set
 714  *
 715  * Set the LSM security ID in a set of credentials so that the subjective
 716  * security is overridden when an alternative set of credentials is used.
 717  */
 718 int set_security_override(struct cred *new, u32 secid)
 719 {
 720         return security_kernel_act_as(new, secid);
 721 }
 722 EXPORT_SYMBOL(set_security_override);
 723
 724 /**
 725  * set_security_override_from_ctx - Set the security ID in a set of credentials
 726  * @new: The credentials to alter
 727  * @secctx: The LSM security context to generate the security ID from.
 728  *
 729  * Set the LSM security ID in a set of credentials so that the subjective
 730  * security is overridden when an alternative set of credentials is used.  The
 731  * security ID is specified in string form as a security context to be
 732  * interpreted by the LSM.
 733  */
 734 int set_security_override_from_ctx(struct cred *new, const char *secctx)
 735 {
 736         u32 secid;
 737         int ret;
 738
 739         ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
 740         if (ret < 0)
 741                 return ret;
 742
 743         return set_security_override(new, secid);
 744 }
 745 EXPORT_SYMBOL(set_security_override_from_ctx);
 746
 747 /**
 748  * set_create_files_as - Set the LSM file create context in a set of credentials
 749  * @new: The credentials to alter
 750  * @inode: The inode to take the context from
 751  *
 752  * Change the LSM file creation context in a set of credentials to be the same
 753  * as the object context of the specified inode, so that the new inodes have
 754  * the same MAC context as that inode.
 755  */
 756 int set_create_files_as(struct cred *new, struct inode *inode)
 757 {
 758         if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
 759                 return -EINVAL;
 760         new->fsuid = inode->i_uid;
 761         new->fsgid = inode->i_gid;
 762         return security_kernel_create_files_as(new, inode);
 763 }
 764 EXPORT_SYMBOL(set_create_files_as);
 765
 766 #ifdef CONFIG_DEBUG_CREDENTIALS
 767
 768 bool creds_are_invalid(const struct cred *cred)
 769 {
 770         if (cred->magic != CRED_MAGIC)
 771                 return true;
 772         return false;
 773 }
 774 EXPORT_SYMBOL(creds_are_invalid);
 775
 776 /*
 777  * dump invalid credentials
 778  */
 779 static void dump_invalid_creds(const struct cred *cred, const char *label,
 780                                const struct task_struct *tsk)
 781 {
 782         printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
 783                label, cred,
 784                cred == &init_cred ? "[init]" : "",
 785                cred == tsk->real_cred ? "[real]" : "",
 786                cred == tsk->cred ? "[eff]" : "");
 787         printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
 788                cred->magic, cred->put_addr);
 789         printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
 790                atomic_read(&cred->usage),
 791                read_cred_subscribers(cred));
 792         printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
 793                 from_kuid_munged(&init_user_ns, cred->uid),
 794                 from_kuid_munged(&init_user_ns, cred->euid),
 795                 from_kuid_munged(&init_user_ns, cred->suid),
 796                 from_kuid_munged(&init_user_ns, cred->fsuid));
 797         printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
 798                 from_kgid_munged(&init_user_ns, cred->gid),
 799                 from_kgid_munged(&init_user_ns, cred->egid),
 800                 from_kgid_munged(&init_user_ns, cred->sgid),
 801                 from_kgid_munged(&init_user_ns, cred->fsgid));
 802 #ifdef CONFIG_SECURITY
 803         printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
 804         if ((unsigned long) cred->security >= PAGE_SIZE &&
 805             (((unsigned long) cred->security & 0xffffff00) !=
 806              (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
 807                 printk(KERN_ERR "CRED: ->security {%x, %x}\n",
 808                        ((u32*)cred->security)[0],
 809                        ((u32*)cred->security)[1]);
 810 #endif
 811 }
 812
 813 /*
 814  * report use of invalid credentials
 815  */
 816 void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
 817 {
 818         printk(KERN_ERR "CRED: Invalid credentials\n");
 819         printk(KERN_ERR "CRED: At %s:%u\n", file, line);
 820         dump_invalid_creds(cred, "Specified", current);
 821         BUG();
 822 }
 823 EXPORT_SYMBOL(__invalid_creds);
 824
 825 /*
 826  * check the credentials on a process
 827  */
 828 void __validate_process_creds(struct task_struct *tsk,
 829                               const char *file, unsigned line)
 830 {
 831         if (tsk->cred == tsk->real_cred) {
 832                 if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
 833                              creds_are_invalid(tsk->cred)))
 834                         goto invalid_creds;
 835         } else {
 836                 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
 837                              read_cred_subscribers(tsk->cred) < 1 ||
 838                              creds_are_invalid(tsk->real_cred) ||
 839                              creds_are_invalid(tsk->cred)))
 840                         goto invalid_creds;
 841         }
 842         return;
 843
 844 invalid_creds:
 845         printk(KERN_ERR "CRED: Invalid process credentials\n");
 846         printk(KERN_ERR "CRED: At %s:%u\n", file, line);
 847
 848         dump_invalid_creds(tsk->real_cred, "Real", tsk);
 849         if (tsk->cred != tsk->real_cred)
 850                 dump_invalid_creds(tsk->cred, "Effective", tsk);
 851         else
 852                 printk(KERN_ERR "CRED: Effective creds == Real creds\n");
 853         BUG();
 854 }
 855 EXPORT_SYMBOL(__validate_process_creds);
 856
 857 /*
 858  * check creds for do_exit()
 859  */
 860 void validate_creds_for_do_exit(struct task_struct *tsk)
 861 {
 862         kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
 863                tsk->real_cred, tsk->cred,
 864                atomic_read(&tsk->cred->usage),
 865                read_cred_subscribers(tsk->cred));
 866
 867         __validate_process_creds(tsk, __FILE__, __LINE__);
 868 }
 869
 870 #endif /* CONFIG_DEBUG_CREDENTIALS */