1 // SPDX-License-Identifier: GPL-2.0
3 * Supplementary group IDs
5 #include <linux/cred.h>
6 #include <linux/export.h>
7 #include <linux/slab.h>
8 #include <linux/security.h>
9 #include <linux/sort.h>
10 #include <linux/syscalls.h>
11 #include <linux/user_namespace.h>
12 #include <linux/vmalloc.h>
13 #include <linux/uaccess.h>
15 struct group_info *groups_alloc(int gidsetsize)
17 struct group_info *gi;
20 len = sizeof(struct group_info) + sizeof(kgid_t) * gidsetsize;
21 gi = kmalloc(len, GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_NORETRY);
23 gi = __vmalloc(len, GFP_KERNEL_ACCOUNT);
27 atomic_set(&gi->usage, 1);
28 gi->ngroups = gidsetsize;
32 EXPORT_SYMBOL(groups_alloc);
34 void groups_free(struct group_info *group_info)
39 EXPORT_SYMBOL(groups_free);
41 /* export the group_info to a user-space array */
42 static int groups_to_user(gid_t __user *grouplist,
43 const struct group_info *group_info)
45 struct user_namespace *user_ns = current_user_ns();
47 unsigned int count = group_info->ngroups;
49 for (i = 0; i < count; i++) {
51 gid = from_kgid_munged(user_ns, group_info->gid[i]);
52 if (put_user(gid, grouplist+i))
58 /* fill a group_info from a user-space array - it must be allocated already */
59 static int groups_from_user(struct group_info *group_info,
60 gid_t __user *grouplist)
62 struct user_namespace *user_ns = current_user_ns();
64 unsigned int count = group_info->ngroups;
66 for (i = 0; i < count; i++) {
69 if (get_user(gid, grouplist+i))
72 kgid = make_kgid(user_ns, gid);
76 group_info->gid[i] = kgid;
81 static int gid_cmp(const void *_a, const void *_b)
83 kgid_t a = *(kgid_t *)_a;
84 kgid_t b = *(kgid_t *)_b;
86 return gid_gt(a, b) - gid_lt(a, b);
89 void groups_sort(struct group_info *group_info)
91 sort(group_info->gid, group_info->ngroups, sizeof(*group_info->gid),
94 EXPORT_SYMBOL(groups_sort);
96 /* a simple bsearch */
97 int groups_search(const struct group_info *group_info, kgid_t grp)
99 unsigned int left, right;
105 right = group_info->ngroups;
106 while (left < right) {
107 unsigned int mid = (left+right)/2;
108 if (gid_gt(grp, group_info->gid[mid]))
110 else if (gid_lt(grp, group_info->gid[mid]))
119 * set_groups - Change a group subscription in a set of credentials
120 * @new: The newly prepared set of credentials to alter
121 * @group_info: The group list to install
123 void set_groups(struct cred *new, struct group_info *group_info)
125 put_group_info(new->group_info);
126 get_group_info(group_info);
127 new->group_info = group_info;
130 EXPORT_SYMBOL(set_groups);
133 * set_current_groups - Change current's group subscription
134 * @group_info: The group list to impose
136 * Validate a group subscription and, if valid, impose it upon current's task
139 int set_current_groups(struct group_info *group_info)
143 new = prepare_creds();
147 set_groups(new, group_info);
148 return commit_creds(new);
151 EXPORT_SYMBOL(set_current_groups);
153 SYSCALL_DEFINE2(getgroups, int, gidsetsize, gid_t __user *, grouplist)
155 const struct cred *cred = current_cred();
161 /* no need to grab task_lock here; it cannot change */
162 i = cred->group_info->ngroups;
164 if (i > gidsetsize) {
168 if (groups_to_user(grouplist, cred->group_info)) {
177 bool may_setgroups(void)
179 struct user_namespace *user_ns = current_user_ns();
181 return ns_capable_setid(user_ns, CAP_SETGID) &&
182 userns_may_setgroups(user_ns);
186 * SMP: Our groups are copy-on-write. We can set them safely
187 * without another task interfering.
190 SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
192 struct group_info *group_info;
195 if (!may_setgroups())
197 if ((unsigned)gidsetsize > NGROUPS_MAX)
200 group_info = groups_alloc(gidsetsize);
203 retval = groups_from_user(group_info, grouplist);
205 put_group_info(group_info);
209 groups_sort(group_info);
210 retval = set_current_groups(group_info);
211 put_group_info(group_info);
217 * Check whether we're fsgid/egid or in the supplemental group..
219 int in_group_p(kgid_t grp)
221 const struct cred *cred = current_cred();
224 if (!gid_eq(grp, cred->fsgid))
225 retval = groups_search(cred->group_info, grp);
229 EXPORT_SYMBOL(in_group_p);
231 int in_egroup_p(kgid_t grp)
233 const struct cred *cred = current_cred();
236 if (!gid_eq(grp, cred->egid))
237 retval = groups_search(cred->group_info, grp);
241 EXPORT_SYMBOL(in_egroup_p);