1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993 5 * The Regents of the University of California. 6 * (c) UNIX System Laboratories, Inc. 7 * Copyright (c) 2000-2001 Robert N. M. Watson. 8 * All rights reserved. 9 * 10 * All or some portions of this file are derived from material licensed 11 * to the University of California by American Telephone and Telegraph 12 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 13 * the permission of UNIX System Laboratories, Inc. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. Neither the name of the University nor the names of its contributors 24 * may be used to endorse or promote products derived from this software 25 * without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94 40 */ 41 42 /* 43 * System calls related to processes and protection 44 */ 45 46 #include <sys/cdefs.h> 47 #include "opt_inet.h" 48 #include "opt_inet6.h" 49 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/acct.h> 53 #include <sys/kdb.h> 54 #include <sys/kernel.h> 55 #include <sys/lock.h> 56 #include <sys/loginclass.h> 57 #include <sys/malloc.h> 58 #include <sys/mutex.h> 59 #include <sys/ptrace.h> 60 #include <sys/refcount.h> 61 #include <sys/sx.h> 62 #include <sys/priv.h> 63 #include <sys/proc.h> 64 #ifdef COMPAT_43 65 #include <sys/sysent.h> 66 #endif 67 #include <sys/sysproto.h> 68 #include <sys/jail.h> 69 #include <sys/racct.h> 70 #include <sys/rctl.h> 71 #include <sys/resourcevar.h> 72 #include <sys/socket.h> 73 #include <sys/socketvar.h> 74 #include <sys/syscallsubr.h> 75 #include <sys/sysctl.h> 76 77 #ifdef REGRESSION 78 FEATURE(regression, 79 "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)"); 80 #endif 81 82 #include <security/audit/audit.h> 83 #include <security/mac/mac_framework.h> 84 85 static MALLOC_DEFINE(M_CRED, "cred", "credentials"); 86 87 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 88 "BSD security policy"); 89 90 static void crfree_final(struct ucred *cr); 91 static void crsetgroups_locked(struct ucred *cr, int ngrp, 92 gid_t *groups); 93 94 #ifndef _SYS_SYSPROTO_H_ 95 struct getpid_args { 96 int dummy; 97 }; 98 #endif 99 /* ARGSUSED */ 100 int 101 sys_getpid(struct thread *td, struct getpid_args *uap) 102 { 103 struct proc *p = td->td_proc; 104 105 td->td_retval[0] = p->p_pid; 106 #if defined(COMPAT_43) 107 if (SV_PROC_FLAG(p, SV_AOUT)) 108 td->td_retval[1] = kern_getppid(td); 109 #endif 110 return (0); 111 } 112 113 #ifndef _SYS_SYSPROTO_H_ 114 struct getppid_args { 115 int dummy; 116 }; 117 #endif 118 /* ARGSUSED */ 119 int 120 sys_getppid(struct thread *td, struct getppid_args *uap) 121 { 122 123 td->td_retval[0] = kern_getppid(td); 124 return (0); 125 } 126 127 int 128 kern_getppid(struct thread *td) 129 { 130 struct proc *p = td->td_proc; 131 132 return (p->p_oppid); 133 } 134 135 /* 136 * Get process group ID; note that POSIX getpgrp takes no parameter. 137 */ 138 #ifndef _SYS_SYSPROTO_H_ 139 struct getpgrp_args { 140 int dummy; 141 }; 142 #endif 143 int 144 sys_getpgrp(struct thread *td, struct getpgrp_args *uap) 145 { 146 struct proc *p = td->td_proc; 147 148 PROC_LOCK(p); 149 td->td_retval[0] = p->p_pgrp->pg_id; 150 PROC_UNLOCK(p); 151 return (0); 152 } 153 154 /* Get an arbitrary pid's process group id */ 155 #ifndef _SYS_SYSPROTO_H_ 156 struct getpgid_args { 157 pid_t pid; 158 }; 159 #endif 160 int 161 sys_getpgid(struct thread *td, struct getpgid_args *uap) 162 { 163 struct proc *p; 164 int error; 165 166 if (uap->pid == 0) { 167 p = td->td_proc; 168 PROC_LOCK(p); 169 } else { 170 p = pfind(uap->pid); 171 if (p == NULL) 172 return (ESRCH); 173 error = p_cansee(td, p); 174 if (error) { 175 PROC_UNLOCK(p); 176 return (error); 177 } 178 } 179 td->td_retval[0] = p->p_pgrp->pg_id; 180 PROC_UNLOCK(p); 181 return (0); 182 } 183 184 /* 185 * Get an arbitrary pid's session id. 186 */ 187 #ifndef _SYS_SYSPROTO_H_ 188 struct getsid_args { 189 pid_t pid; 190 }; 191 #endif 192 int 193 sys_getsid(struct thread *td, struct getsid_args *uap) 194 { 195 196 return (kern_getsid(td, uap->pid)); 197 } 198 199 int 200 kern_getsid(struct thread *td, pid_t pid) 201 { 202 struct proc *p; 203 int error; 204 205 if (pid == 0) { 206 p = td->td_proc; 207 PROC_LOCK(p); 208 } else { 209 p = pfind(pid); 210 if (p == NULL) 211 return (ESRCH); 212 error = p_cansee(td, p); 213 if (error) { 214 PROC_UNLOCK(p); 215 return (error); 216 } 217 } 218 td->td_retval[0] = p->p_session->s_sid; 219 PROC_UNLOCK(p); 220 return (0); 221 } 222 223 #ifndef _SYS_SYSPROTO_H_ 224 struct getuid_args { 225 int dummy; 226 }; 227 #endif 228 /* ARGSUSED */ 229 int 230 sys_getuid(struct thread *td, struct getuid_args *uap) 231 { 232 233 td->td_retval[0] = td->td_ucred->cr_ruid; 234 #if defined(COMPAT_43) 235 td->td_retval[1] = td->td_ucred->cr_uid; 236 #endif 237 return (0); 238 } 239 240 #ifndef _SYS_SYSPROTO_H_ 241 struct geteuid_args { 242 int dummy; 243 }; 244 #endif 245 /* ARGSUSED */ 246 int 247 sys_geteuid(struct thread *td, struct geteuid_args *uap) 248 { 249 250 td->td_retval[0] = td->td_ucred->cr_uid; 251 return (0); 252 } 253 254 #ifndef _SYS_SYSPROTO_H_ 255 struct getgid_args { 256 int dummy; 257 }; 258 #endif 259 /* ARGSUSED */ 260 int 261 sys_getgid(struct thread *td, struct getgid_args *uap) 262 { 263 264 td->td_retval[0] = td->td_ucred->cr_rgid; 265 #if defined(COMPAT_43) 266 td->td_retval[1] = td->td_ucred->cr_groups[0]; 267 #endif 268 return (0); 269 } 270 271 /* 272 * Get effective group ID. The "egid" is groups[0], and could be obtained 273 * via getgroups. This syscall exists because it is somewhat painful to do 274 * correctly in a library function. 275 */ 276 #ifndef _SYS_SYSPROTO_H_ 277 struct getegid_args { 278 int dummy; 279 }; 280 #endif 281 /* ARGSUSED */ 282 int 283 sys_getegid(struct thread *td, struct getegid_args *uap) 284 { 285 286 td->td_retval[0] = td->td_ucred->cr_groups[0]; 287 return (0); 288 } 289 290 #ifndef _SYS_SYSPROTO_H_ 291 struct getgroups_args { 292 int gidsetsize; 293 gid_t *gidset; 294 }; 295 #endif 296 int 297 sys_getgroups(struct thread *td, struct getgroups_args *uap) 298 { 299 struct ucred *cred; 300 int ngrp, error; 301 302 cred = td->td_ucred; 303 ngrp = cred->cr_ngroups; 304 305 if (uap->gidsetsize == 0) { 306 error = 0; 307 goto out; 308 } 309 if (uap->gidsetsize < ngrp) 310 return (EINVAL); 311 312 error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t)); 313 out: 314 td->td_retval[0] = ngrp; 315 return (error); 316 } 317 318 #ifndef _SYS_SYSPROTO_H_ 319 struct setsid_args { 320 int dummy; 321 }; 322 #endif 323 /* ARGSUSED */ 324 int 325 sys_setsid(struct thread *td, struct setsid_args *uap) 326 { 327 struct pgrp *pgrp; 328 int error; 329 struct proc *p = td->td_proc; 330 struct pgrp *newpgrp; 331 struct session *newsess; 332 333 pgrp = NULL; 334 335 newpgrp = uma_zalloc(pgrp_zone, M_WAITOK); 336 newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO); 337 338 again: 339 error = 0; 340 sx_xlock(&proctree_lock); 341 342 if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) { 343 if (pgrp != NULL) 344 PGRP_UNLOCK(pgrp); 345 error = EPERM; 346 } else { 347 error = enterpgrp(p, p->p_pid, newpgrp, newsess); 348 if (error == ERESTART) 349 goto again; 350 MPASS(error == 0); 351 td->td_retval[0] = p->p_pid; 352 newpgrp = NULL; 353 newsess = NULL; 354 } 355 356 sx_xunlock(&proctree_lock); 357 358 uma_zfree(pgrp_zone, newpgrp); 359 free(newsess, M_SESSION); 360 361 return (error); 362 } 363 364 /* 365 * set process group (setpgid/old setpgrp) 366 * 367 * caller does setpgid(targpid, targpgid) 368 * 369 * pid must be caller or child of caller (ESRCH) 370 * if a child 371 * pid must be in same session (EPERM) 372 * pid can't have done an exec (EACCES) 373 * if pgid != pid 374 * there must exist some pid in same session having pgid (EPERM) 375 * pid must not be session leader (EPERM) 376 */ 377 #ifndef _SYS_SYSPROTO_H_ 378 struct setpgid_args { 379 int pid; /* target process id */ 380 int pgid; /* target pgrp id */ 381 }; 382 #endif 383 /* ARGSUSED */ 384 int 385 sys_setpgid(struct thread *td, struct setpgid_args *uap) 386 { 387 struct proc *curp = td->td_proc; 388 struct proc *targp; /* target process */ 389 struct pgrp *pgrp; /* target pgrp */ 390 int error; 391 struct pgrp *newpgrp; 392 393 if (uap->pgid < 0) 394 return (EINVAL); 395 396 newpgrp = uma_zalloc(pgrp_zone, M_WAITOK); 397 398 again: 399 error = 0; 400 401 sx_xlock(&proctree_lock); 402 if (uap->pid != 0 && uap->pid != curp->p_pid) { 403 if ((targp = pfind(uap->pid)) == NULL) { 404 error = ESRCH; 405 goto done; 406 } 407 if (!inferior(targp)) { 408 PROC_UNLOCK(targp); 409 error = ESRCH; 410 goto done; 411 } 412 if ((error = p_cansee(td, targp))) { 413 PROC_UNLOCK(targp); 414 goto done; 415 } 416 if (targp->p_pgrp == NULL || 417 targp->p_session != curp->p_session) { 418 PROC_UNLOCK(targp); 419 error = EPERM; 420 goto done; 421 } 422 if (targp->p_flag & P_EXEC) { 423 PROC_UNLOCK(targp); 424 error = EACCES; 425 goto done; 426 } 427 PROC_UNLOCK(targp); 428 } else 429 targp = curp; 430 if (SESS_LEADER(targp)) { 431 error = EPERM; 432 goto done; 433 } 434 if (uap->pgid == 0) 435 uap->pgid = targp->p_pid; 436 if ((pgrp = pgfind(uap->pgid)) == NULL) { 437 if (uap->pgid == targp->p_pid) { 438 error = enterpgrp(targp, uap->pgid, newpgrp, 439 NULL); 440 if (error == 0) 441 newpgrp = NULL; 442 } else 443 error = EPERM; 444 } else { 445 if (pgrp == targp->p_pgrp) { 446 PGRP_UNLOCK(pgrp); 447 goto done; 448 } 449 if (pgrp->pg_id != targp->p_pid && 450 pgrp->pg_session != curp->p_session) { 451 PGRP_UNLOCK(pgrp); 452 error = EPERM; 453 goto done; 454 } 455 PGRP_UNLOCK(pgrp); 456 error = enterthispgrp(targp, pgrp); 457 } 458 done: 459 KASSERT(error == 0 || newpgrp != NULL, 460 ("setpgid failed and newpgrp is NULL")); 461 if (error == ERESTART) 462 goto again; 463 sx_xunlock(&proctree_lock); 464 uma_zfree(pgrp_zone, newpgrp); 465 return (error); 466 } 467 468 /* 469 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD 470 * compatible. It says that setting the uid/gid to euid/egid is a special 471 * case of "appropriate privilege". Once the rules are expanded out, this 472 * basically means that setuid(nnn) sets all three id's, in all permitted 473 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid()) 474 * does not set the saved id - this is dangerous for traditional BSD 475 * programs. For this reason, we *really* do not want to set 476 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2. 477 */ 478 #define POSIX_APPENDIX_B_4_2_2 479 480 #ifndef _SYS_SYSPROTO_H_ 481 struct setuid_args { 482 uid_t uid; 483 }; 484 #endif 485 /* ARGSUSED */ 486 int 487 sys_setuid(struct thread *td, struct setuid_args *uap) 488 { 489 struct proc *p = td->td_proc; 490 struct ucred *newcred, *oldcred; 491 uid_t uid; 492 struct uidinfo *uip; 493 int error; 494 495 uid = uap->uid; 496 AUDIT_ARG_UID(uid); 497 newcred = crget(); 498 uip = uifind(uid); 499 PROC_LOCK(p); 500 /* 501 * Copy credentials so other references do not see our changes. 502 */ 503 oldcred = crcopysafe(p, newcred); 504 505 #ifdef MAC 506 error = mac_cred_check_setuid(oldcred, uid); 507 if (error) 508 goto fail; 509 #endif 510 511 /* 512 * See if we have "permission" by POSIX 1003.1 rules. 513 * 514 * Note that setuid(geteuid()) is a special case of 515 * "appropriate privileges" in appendix B.4.2.2. We need 516 * to use this clause to be compatible with traditional BSD 517 * semantics. Basically, it means that "setuid(xx)" sets all 518 * three id's (assuming you have privs). 519 * 520 * Notes on the logic. We do things in three steps. 521 * 1: We determine if the euid is going to change, and do EPERM 522 * right away. We unconditionally change the euid later if this 523 * test is satisfied, simplifying that part of the logic. 524 * 2: We determine if the real and/or saved uids are going to 525 * change. Determined by compile options. 526 * 3: Change euid last. (after tests in #2 for "appropriate privs") 527 */ 528 if (uid != oldcred->cr_ruid && /* allow setuid(getuid()) */ 529 #ifdef _POSIX_SAVED_IDS 530 uid != oldcred->cr_svuid && /* allow setuid(saved gid) */ 531 #endif 532 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 533 uid != oldcred->cr_uid && /* allow setuid(geteuid()) */ 534 #endif 535 (error = priv_check_cred(oldcred, PRIV_CRED_SETUID)) != 0) 536 goto fail; 537 538 #ifdef _POSIX_SAVED_IDS 539 /* 540 * Do we have "appropriate privileges" (are we root or uid == euid) 541 * If so, we are changing the real uid and/or saved uid. 542 */ 543 if ( 544 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */ 545 uid == oldcred->cr_uid || 546 #endif 547 /* We are using privs. */ 548 priv_check_cred(oldcred, PRIV_CRED_SETUID) == 0) 549 #endif 550 { 551 /* 552 * Set the real uid and transfer proc count to new user. 553 */ 554 if (uid != oldcred->cr_ruid) { 555 change_ruid(newcred, uip); 556 setsugid(p); 557 } 558 /* 559 * Set saved uid 560 * 561 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as 562 * the security of seteuid() depends on it. B.4.2.2 says it 563 * is important that we should do this. 564 */ 565 if (uid != oldcred->cr_svuid) { 566 change_svuid(newcred, uid); 567 setsugid(p); 568 } 569 } 570 571 /* 572 * In all permitted cases, we are changing the euid. 573 */ 574 if (uid != oldcred->cr_uid) { 575 change_euid(newcred, uip); 576 setsugid(p); 577 } 578 proc_set_cred(p, newcred); 579 #ifdef RACCT 580 racct_proc_ucred_changed(p, oldcred, newcred); 581 crhold(newcred); 582 #endif 583 PROC_UNLOCK(p); 584 #ifdef RCTL 585 rctl_proc_ucred_changed(p, newcred); 586 crfree(newcred); 587 #endif 588 uifree(uip); 589 crfree(oldcred); 590 return (0); 591 592 fail: 593 PROC_UNLOCK(p); 594 uifree(uip); 595 crfree(newcred); 596 return (error); 597 } 598 599 #ifndef _SYS_SYSPROTO_H_ 600 struct seteuid_args { 601 uid_t euid; 602 }; 603 #endif 604 /* ARGSUSED */ 605 int 606 sys_seteuid(struct thread *td, struct seteuid_args *uap) 607 { 608 struct proc *p = td->td_proc; 609 struct ucred *newcred, *oldcred; 610 uid_t euid; 611 struct uidinfo *euip; 612 int error; 613 614 euid = uap->euid; 615 AUDIT_ARG_EUID(euid); 616 newcred = crget(); 617 euip = uifind(euid); 618 PROC_LOCK(p); 619 /* 620 * Copy credentials so other references do not see our changes. 621 */ 622 oldcred = crcopysafe(p, newcred); 623 624 #ifdef MAC 625 error = mac_cred_check_seteuid(oldcred, euid); 626 if (error) 627 goto fail; 628 #endif 629 630 if (euid != oldcred->cr_ruid && /* allow seteuid(getuid()) */ 631 euid != oldcred->cr_svuid && /* allow seteuid(saved uid) */ 632 (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID)) != 0) 633 goto fail; 634 635 /* 636 * Everything's okay, do it. 637 */ 638 if (oldcred->cr_uid != euid) { 639 change_euid(newcred, euip); 640 setsugid(p); 641 } 642 proc_set_cred(p, newcred); 643 PROC_UNLOCK(p); 644 uifree(euip); 645 crfree(oldcred); 646 return (0); 647 648 fail: 649 PROC_UNLOCK(p); 650 uifree(euip); 651 crfree(newcred); 652 return (error); 653 } 654 655 #ifndef _SYS_SYSPROTO_H_ 656 struct setgid_args { 657 gid_t gid; 658 }; 659 #endif 660 /* ARGSUSED */ 661 int 662 sys_setgid(struct thread *td, struct setgid_args *uap) 663 { 664 struct proc *p = td->td_proc; 665 struct ucred *newcred, *oldcred; 666 gid_t gid; 667 int error; 668 669 gid = uap->gid; 670 AUDIT_ARG_GID(gid); 671 newcred = crget(); 672 PROC_LOCK(p); 673 oldcred = crcopysafe(p, newcred); 674 675 #ifdef MAC 676 error = mac_cred_check_setgid(oldcred, gid); 677 if (error) 678 goto fail; 679 #endif 680 681 /* 682 * See if we have "permission" by POSIX 1003.1 rules. 683 * 684 * Note that setgid(getegid()) is a special case of 685 * "appropriate privileges" in appendix B.4.2.2. We need 686 * to use this clause to be compatible with traditional BSD 687 * semantics. Basically, it means that "setgid(xx)" sets all 688 * three id's (assuming you have privs). 689 * 690 * For notes on the logic here, see setuid() above. 691 */ 692 if (gid != oldcred->cr_rgid && /* allow setgid(getgid()) */ 693 #ifdef _POSIX_SAVED_IDS 694 gid != oldcred->cr_svgid && /* allow setgid(saved gid) */ 695 #endif 696 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 697 gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */ 698 #endif 699 (error = priv_check_cred(oldcred, PRIV_CRED_SETGID)) != 0) 700 goto fail; 701 702 #ifdef _POSIX_SAVED_IDS 703 /* 704 * Do we have "appropriate privileges" (are we root or gid == egid) 705 * If so, we are changing the real uid and saved gid. 706 */ 707 if ( 708 #ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */ 709 gid == oldcred->cr_groups[0] || 710 #endif 711 /* We are using privs. */ 712 priv_check_cred(oldcred, PRIV_CRED_SETGID) == 0) 713 #endif 714 { 715 /* 716 * Set real gid 717 */ 718 if (oldcred->cr_rgid != gid) { 719 change_rgid(newcred, gid); 720 setsugid(p); 721 } 722 /* 723 * Set saved gid 724 * 725 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as 726 * the security of setegid() depends on it. B.4.2.2 says it 727 * is important that we should do this. 728 */ 729 if (oldcred->cr_svgid != gid) { 730 change_svgid(newcred, gid); 731 setsugid(p); 732 } 733 } 734 /* 735 * In all cases permitted cases, we are changing the egid. 736 * Copy credentials so other references do not see our changes. 737 */ 738 if (oldcred->cr_groups[0] != gid) { 739 change_egid(newcred, gid); 740 setsugid(p); 741 } 742 proc_set_cred(p, newcred); 743 PROC_UNLOCK(p); 744 crfree(oldcred); 745 return (0); 746 747 fail: 748 PROC_UNLOCK(p); 749 crfree(newcred); 750 return (error); 751 } 752 753 #ifndef _SYS_SYSPROTO_H_ 754 struct setegid_args { 755 gid_t egid; 756 }; 757 #endif 758 /* ARGSUSED */ 759 int 760 sys_setegid(struct thread *td, struct setegid_args *uap) 761 { 762 struct proc *p = td->td_proc; 763 struct ucred *newcred, *oldcred; 764 gid_t egid; 765 int error; 766 767 egid = uap->egid; 768 AUDIT_ARG_EGID(egid); 769 newcred = crget(); 770 PROC_LOCK(p); 771 oldcred = crcopysafe(p, newcred); 772 773 #ifdef MAC 774 error = mac_cred_check_setegid(oldcred, egid); 775 if (error) 776 goto fail; 777 #endif 778 779 if (egid != oldcred->cr_rgid && /* allow setegid(getgid()) */ 780 egid != oldcred->cr_svgid && /* allow setegid(saved gid) */ 781 (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID)) != 0) 782 goto fail; 783 784 if (oldcred->cr_groups[0] != egid) { 785 change_egid(newcred, egid); 786 setsugid(p); 787 } 788 proc_set_cred(p, newcred); 789 PROC_UNLOCK(p); 790 crfree(oldcred); 791 return (0); 792 793 fail: 794 PROC_UNLOCK(p); 795 crfree(newcred); 796 return (error); 797 } 798 799 #ifndef _SYS_SYSPROTO_H_ 800 struct setgroups_args { 801 int gidsetsize; 802 gid_t *gidset; 803 }; 804 #endif 805 /* ARGSUSED */ 806 int 807 sys_setgroups(struct thread *td, struct setgroups_args *uap) 808 { 809 gid_t smallgroups[XU_NGROUPS]; 810 gid_t *groups; 811 int gidsetsize, error; 812 813 gidsetsize = uap->gidsetsize; 814 if (gidsetsize > ngroups_max + 1 || gidsetsize < 0) 815 return (EINVAL); 816 817 if (gidsetsize > XU_NGROUPS) 818 groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK); 819 else 820 groups = smallgroups; 821 822 error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t)); 823 if (error == 0) 824 error = kern_setgroups(td, gidsetsize, groups); 825 826 if (gidsetsize > XU_NGROUPS) 827 free(groups, M_TEMP); 828 return (error); 829 } 830 831 int 832 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups) 833 { 834 struct proc *p = td->td_proc; 835 struct ucred *newcred, *oldcred; 836 int error; 837 838 MPASS(ngrp <= ngroups_max + 1); 839 AUDIT_ARG_GROUPSET(groups, ngrp); 840 newcred = crget(); 841 crextend(newcred, ngrp); 842 PROC_LOCK(p); 843 oldcred = crcopysafe(p, newcred); 844 845 #ifdef MAC 846 error = mac_cred_check_setgroups(oldcred, ngrp, groups); 847 if (error) 848 goto fail; 849 #endif 850 851 error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS); 852 if (error) 853 goto fail; 854 855 if (ngrp == 0) { 856 /* 857 * setgroups(0, NULL) is a legitimate way of clearing the 858 * groups vector on non-BSD systems (which generally do not 859 * have the egid in the groups[0]). We risk security holes 860 * when running non-BSD software if we do not do the same. 861 */ 862 newcred->cr_ngroups = 1; 863 } else { 864 crsetgroups_locked(newcred, ngrp, groups); 865 } 866 setsugid(p); 867 proc_set_cred(p, newcred); 868 PROC_UNLOCK(p); 869 crfree(oldcred); 870 return (0); 871 872 fail: 873 PROC_UNLOCK(p); 874 crfree(newcred); 875 return (error); 876 } 877 878 #ifndef _SYS_SYSPROTO_H_ 879 struct setreuid_args { 880 uid_t ruid; 881 uid_t euid; 882 }; 883 #endif 884 /* ARGSUSED */ 885 int 886 sys_setreuid(struct thread *td, struct setreuid_args *uap) 887 { 888 struct proc *p = td->td_proc; 889 struct ucred *newcred, *oldcred; 890 uid_t euid, ruid; 891 struct uidinfo *euip, *ruip; 892 int error; 893 894 euid = uap->euid; 895 ruid = uap->ruid; 896 AUDIT_ARG_EUID(euid); 897 AUDIT_ARG_RUID(ruid); 898 newcred = crget(); 899 euip = uifind(euid); 900 ruip = uifind(ruid); 901 PROC_LOCK(p); 902 oldcred = crcopysafe(p, newcred); 903 904 #ifdef MAC 905 error = mac_cred_check_setreuid(oldcred, ruid, euid); 906 if (error) 907 goto fail; 908 #endif 909 910 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 911 ruid != oldcred->cr_svuid) || 912 (euid != (uid_t)-1 && euid != oldcred->cr_uid && 913 euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) && 914 (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID)) != 0) 915 goto fail; 916 917 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 918 change_euid(newcred, euip); 919 setsugid(p); 920 } 921 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 922 change_ruid(newcred, ruip); 923 setsugid(p); 924 } 925 if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) && 926 newcred->cr_svuid != newcred->cr_uid) { 927 change_svuid(newcred, newcred->cr_uid); 928 setsugid(p); 929 } 930 proc_set_cred(p, newcred); 931 #ifdef RACCT 932 racct_proc_ucred_changed(p, oldcred, newcred); 933 crhold(newcred); 934 #endif 935 PROC_UNLOCK(p); 936 #ifdef RCTL 937 rctl_proc_ucred_changed(p, newcred); 938 crfree(newcred); 939 #endif 940 uifree(ruip); 941 uifree(euip); 942 crfree(oldcred); 943 return (0); 944 945 fail: 946 PROC_UNLOCK(p); 947 uifree(ruip); 948 uifree(euip); 949 crfree(newcred); 950 return (error); 951 } 952 953 #ifndef _SYS_SYSPROTO_H_ 954 struct setregid_args { 955 gid_t rgid; 956 gid_t egid; 957 }; 958 #endif 959 /* ARGSUSED */ 960 int 961 sys_setregid(struct thread *td, struct setregid_args *uap) 962 { 963 struct proc *p = td->td_proc; 964 struct ucred *newcred, *oldcred; 965 gid_t egid, rgid; 966 int error; 967 968 egid = uap->egid; 969 rgid = uap->rgid; 970 AUDIT_ARG_EGID(egid); 971 AUDIT_ARG_RGID(rgid); 972 newcred = crget(); 973 PROC_LOCK(p); 974 oldcred = crcopysafe(p, newcred); 975 976 #ifdef MAC 977 error = mac_cred_check_setregid(oldcred, rgid, egid); 978 if (error) 979 goto fail; 980 #endif 981 982 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 983 rgid != oldcred->cr_svgid) || 984 (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] && 985 egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) && 986 (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID)) != 0) 987 goto fail; 988 989 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 990 change_egid(newcred, egid); 991 setsugid(p); 992 } 993 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 994 change_rgid(newcred, rgid); 995 setsugid(p); 996 } 997 if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) && 998 newcred->cr_svgid != newcred->cr_groups[0]) { 999 change_svgid(newcred, newcred->cr_groups[0]); 1000 setsugid(p); 1001 } 1002 proc_set_cred(p, newcred); 1003 PROC_UNLOCK(p); 1004 crfree(oldcred); 1005 return (0); 1006 1007 fail: 1008 PROC_UNLOCK(p); 1009 crfree(newcred); 1010 return (error); 1011 } 1012 1013 /* 1014 * setresuid(ruid, euid, suid) is like setreuid except control over the saved 1015 * uid is explicit. 1016 */ 1017 #ifndef _SYS_SYSPROTO_H_ 1018 struct setresuid_args { 1019 uid_t ruid; 1020 uid_t euid; 1021 uid_t suid; 1022 }; 1023 #endif 1024 /* ARGSUSED */ 1025 int 1026 sys_setresuid(struct thread *td, struct setresuid_args *uap) 1027 { 1028 struct proc *p = td->td_proc; 1029 struct ucred *newcred, *oldcred; 1030 uid_t euid, ruid, suid; 1031 struct uidinfo *euip, *ruip; 1032 int error; 1033 1034 euid = uap->euid; 1035 ruid = uap->ruid; 1036 suid = uap->suid; 1037 AUDIT_ARG_EUID(euid); 1038 AUDIT_ARG_RUID(ruid); 1039 AUDIT_ARG_SUID(suid); 1040 newcred = crget(); 1041 euip = uifind(euid); 1042 ruip = uifind(ruid); 1043 PROC_LOCK(p); 1044 oldcred = crcopysafe(p, newcred); 1045 1046 #ifdef MAC 1047 error = mac_cred_check_setresuid(oldcred, ruid, euid, suid); 1048 if (error) 1049 goto fail; 1050 #endif 1051 1052 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 1053 ruid != oldcred->cr_svuid && 1054 ruid != oldcred->cr_uid) || 1055 (euid != (uid_t)-1 && euid != oldcred->cr_ruid && 1056 euid != oldcred->cr_svuid && 1057 euid != oldcred->cr_uid) || 1058 (suid != (uid_t)-1 && suid != oldcred->cr_ruid && 1059 suid != oldcred->cr_svuid && 1060 suid != oldcred->cr_uid)) && 1061 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID)) != 0) 1062 goto fail; 1063 1064 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 1065 change_euid(newcred, euip); 1066 setsugid(p); 1067 } 1068 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 1069 change_ruid(newcred, ruip); 1070 setsugid(p); 1071 } 1072 if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) { 1073 change_svuid(newcred, suid); 1074 setsugid(p); 1075 } 1076 proc_set_cred(p, newcred); 1077 #ifdef RACCT 1078 racct_proc_ucred_changed(p, oldcred, newcred); 1079 crhold(newcred); 1080 #endif 1081 PROC_UNLOCK(p); 1082 #ifdef RCTL 1083 rctl_proc_ucred_changed(p, newcred); 1084 crfree(newcred); 1085 #endif 1086 uifree(ruip); 1087 uifree(euip); 1088 crfree(oldcred); 1089 return (0); 1090 1091 fail: 1092 PROC_UNLOCK(p); 1093 uifree(ruip); 1094 uifree(euip); 1095 crfree(newcred); 1096 return (error); 1097 1098 } 1099 1100 /* 1101 * setresgid(rgid, egid, sgid) is like setregid except control over the saved 1102 * gid is explicit. 1103 */ 1104 #ifndef _SYS_SYSPROTO_H_ 1105 struct setresgid_args { 1106 gid_t rgid; 1107 gid_t egid; 1108 gid_t sgid; 1109 }; 1110 #endif 1111 /* ARGSUSED */ 1112 int 1113 sys_setresgid(struct thread *td, struct setresgid_args *uap) 1114 { 1115 struct proc *p = td->td_proc; 1116 struct ucred *newcred, *oldcred; 1117 gid_t egid, rgid, sgid; 1118 int error; 1119 1120 egid = uap->egid; 1121 rgid = uap->rgid; 1122 sgid = uap->sgid; 1123 AUDIT_ARG_EGID(egid); 1124 AUDIT_ARG_RGID(rgid); 1125 AUDIT_ARG_SGID(sgid); 1126 newcred = crget(); 1127 PROC_LOCK(p); 1128 oldcred = crcopysafe(p, newcred); 1129 1130 #ifdef MAC 1131 error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid); 1132 if (error) 1133 goto fail; 1134 #endif 1135 1136 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 1137 rgid != oldcred->cr_svgid && 1138 rgid != oldcred->cr_groups[0]) || 1139 (egid != (gid_t)-1 && egid != oldcred->cr_rgid && 1140 egid != oldcred->cr_svgid && 1141 egid != oldcred->cr_groups[0]) || 1142 (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid && 1143 sgid != oldcred->cr_svgid && 1144 sgid != oldcred->cr_groups[0])) && 1145 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID)) != 0) 1146 goto fail; 1147 1148 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 1149 change_egid(newcred, egid); 1150 setsugid(p); 1151 } 1152 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 1153 change_rgid(newcred, rgid); 1154 setsugid(p); 1155 } 1156 if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) { 1157 change_svgid(newcred, sgid); 1158 setsugid(p); 1159 } 1160 proc_set_cred(p, newcred); 1161 PROC_UNLOCK(p); 1162 crfree(oldcred); 1163 return (0); 1164 1165 fail: 1166 PROC_UNLOCK(p); 1167 crfree(newcred); 1168 return (error); 1169 } 1170 1171 #ifndef _SYS_SYSPROTO_H_ 1172 struct getresuid_args { 1173 uid_t *ruid; 1174 uid_t *euid; 1175 uid_t *suid; 1176 }; 1177 #endif 1178 /* ARGSUSED */ 1179 int 1180 sys_getresuid(struct thread *td, struct getresuid_args *uap) 1181 { 1182 struct ucred *cred; 1183 int error1 = 0, error2 = 0, error3 = 0; 1184 1185 cred = td->td_ucred; 1186 if (uap->ruid) 1187 error1 = copyout(&cred->cr_ruid, 1188 uap->ruid, sizeof(cred->cr_ruid)); 1189 if (uap->euid) 1190 error2 = copyout(&cred->cr_uid, 1191 uap->euid, sizeof(cred->cr_uid)); 1192 if (uap->suid) 1193 error3 = copyout(&cred->cr_svuid, 1194 uap->suid, sizeof(cred->cr_svuid)); 1195 return (error1 ? error1 : error2 ? error2 : error3); 1196 } 1197 1198 #ifndef _SYS_SYSPROTO_H_ 1199 struct getresgid_args { 1200 gid_t *rgid; 1201 gid_t *egid; 1202 gid_t *sgid; 1203 }; 1204 #endif 1205 /* ARGSUSED */ 1206 int 1207 sys_getresgid(struct thread *td, struct getresgid_args *uap) 1208 { 1209 struct ucred *cred; 1210 int error1 = 0, error2 = 0, error3 = 0; 1211 1212 cred = td->td_ucred; 1213 if (uap->rgid) 1214 error1 = copyout(&cred->cr_rgid, 1215 uap->rgid, sizeof(cred->cr_rgid)); 1216 if (uap->egid) 1217 error2 = copyout(&cred->cr_groups[0], 1218 uap->egid, sizeof(cred->cr_groups[0])); 1219 if (uap->sgid) 1220 error3 = copyout(&cred->cr_svgid, 1221 uap->sgid, sizeof(cred->cr_svgid)); 1222 return (error1 ? error1 : error2 ? error2 : error3); 1223 } 1224 1225 #ifndef _SYS_SYSPROTO_H_ 1226 struct issetugid_args { 1227 int dummy; 1228 }; 1229 #endif 1230 /* ARGSUSED */ 1231 int 1232 sys_issetugid(struct thread *td, struct issetugid_args *uap) 1233 { 1234 struct proc *p = td->td_proc; 1235 1236 /* 1237 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time, 1238 * we use P_SUGID because we consider changing the owners as 1239 * "tainting" as well. 1240 * This is significant for procs that start as root and "become" 1241 * a user without an exec - programs cannot know *everything* 1242 * that libc *might* have put in their data segment. 1243 */ 1244 td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0; 1245 return (0); 1246 } 1247 1248 int 1249 sys___setugid(struct thread *td, struct __setugid_args *uap) 1250 { 1251 #ifdef REGRESSION 1252 struct proc *p; 1253 1254 p = td->td_proc; 1255 switch (uap->flag) { 1256 case 0: 1257 PROC_LOCK(p); 1258 p->p_flag &= ~P_SUGID; 1259 PROC_UNLOCK(p); 1260 return (0); 1261 case 1: 1262 PROC_LOCK(p); 1263 p->p_flag |= P_SUGID; 1264 PROC_UNLOCK(p); 1265 return (0); 1266 default: 1267 return (EINVAL); 1268 } 1269 #else /* !REGRESSION */ 1270 1271 return (ENOSYS); 1272 #endif /* REGRESSION */ 1273 } 1274 1275 /* 1276 * Check if gid is a member of the group set. 1277 */ 1278 int 1279 groupmember(gid_t gid, struct ucred *cred) 1280 { 1281 int l; 1282 int h; 1283 int m; 1284 1285 if (cred->cr_groups[0] == gid) 1286 return(1); 1287 1288 /* 1289 * If gid was not our primary group, perform a binary search 1290 * of the supplemental groups. This is possible because we 1291 * sort the groups in crsetgroups(). 1292 */ 1293 l = 1; 1294 h = cred->cr_ngroups; 1295 while (l < h) { 1296 m = l + ((h - l) / 2); 1297 if (cred->cr_groups[m] < gid) 1298 l = m + 1; 1299 else 1300 h = m; 1301 } 1302 if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid)) 1303 return (1); 1304 1305 return (0); 1306 } 1307 1308 /* 1309 * Test the active securelevel against a given level. securelevel_gt() 1310 * implements (securelevel > level). securelevel_ge() implements 1311 * (securelevel >= level). Note that the logic is inverted -- these 1312 * functions return EPERM on "success" and 0 on "failure". 1313 * 1314 * Due to care taken when setting the securelevel, we know that no jail will 1315 * be less secure that its parent (or the physical system), so it is sufficient 1316 * to test the current jail only. 1317 * 1318 * XXXRW: Possibly since this has to do with privilege, it should move to 1319 * kern_priv.c. 1320 */ 1321 int 1322 securelevel_gt(struct ucred *cr, int level) 1323 { 1324 1325 return (cr->cr_prison->pr_securelevel > level ? EPERM : 0); 1326 } 1327 1328 int 1329 securelevel_ge(struct ucred *cr, int level) 1330 { 1331 1332 return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0); 1333 } 1334 1335 /* 1336 * 'see_other_uids' determines whether or not visibility of processes 1337 * and sockets with credentials holding different real uids is possible 1338 * using a variety of system MIBs. 1339 * XXX: data declarations should be together near the beginning of the file. 1340 */ 1341 static int see_other_uids = 1; 1342 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW, 1343 &see_other_uids, 0, 1344 "Unprivileged processes may see subjects/objects with different real uid"); 1345 1346 /*- 1347 * Determine if u1 "can see" the subject specified by u2, according to the 1348 * 'see_other_uids' policy. 1349 * Returns: 0 for permitted, ESRCH otherwise 1350 * Locks: none 1351 * References: *u1 and *u2 must not change during the call 1352 * u1 may equal u2, in which case only one reference is required 1353 */ 1354 int 1355 cr_canseeotheruids(struct ucred *u1, struct ucred *u2) 1356 { 1357 1358 if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) { 1359 if (priv_check_cred(u1, PRIV_SEEOTHERUIDS) != 0) 1360 return (ESRCH); 1361 } 1362 return (0); 1363 } 1364 1365 /* 1366 * 'see_other_gids' determines whether or not visibility of processes 1367 * and sockets with credentials holding different real gids is possible 1368 * using a variety of system MIBs. 1369 * XXX: data declarations should be together near the beginning of the file. 1370 */ 1371 static int see_other_gids = 1; 1372 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW, 1373 &see_other_gids, 0, 1374 "Unprivileged processes may see subjects/objects with different real gid"); 1375 1376 /* 1377 * Determine if u1 can "see" the subject specified by u2, according to the 1378 * 'see_other_gids' policy. 1379 * Returns: 0 for permitted, ESRCH otherwise 1380 * Locks: none 1381 * References: *u1 and *u2 must not change during the call 1382 * u1 may equal u2, in which case only one reference is required 1383 */ 1384 int 1385 cr_canseeothergids(struct ucred *u1, struct ucred *u2) 1386 { 1387 int i, match; 1388 1389 if (!see_other_gids) { 1390 match = 0; 1391 for (i = 0; i < u1->cr_ngroups; i++) { 1392 if (groupmember(u1->cr_groups[i], u2)) 1393 match = 1; 1394 if (match) 1395 break; 1396 } 1397 if (!match) { 1398 if (priv_check_cred(u1, PRIV_SEEOTHERGIDS) != 0) 1399 return (ESRCH); 1400 } 1401 } 1402 return (0); 1403 } 1404 1405 /* 1406 * 'see_jail_proc' determines whether or not visibility of processes and 1407 * sockets with credentials holding different jail ids is possible using a 1408 * variety of system MIBs. 1409 * 1410 * XXX: data declarations should be together near the beginning of the file. 1411 */ 1412 1413 static int see_jail_proc = 1; 1414 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW, 1415 &see_jail_proc, 0, 1416 "Unprivileged processes may see subjects/objects with different jail ids"); 1417 1418 /*- 1419 * Determine if u1 "can see" the subject specified by u2, according to the 1420 * 'see_jail_proc' policy. 1421 * Returns: 0 for permitted, ESRCH otherwise 1422 * Locks: none 1423 * References: *u1 and *u2 must not change during the call 1424 * u1 may equal u2, in which case only one reference is required 1425 */ 1426 int 1427 cr_canseejailproc(struct ucred *u1, struct ucred *u2) 1428 { 1429 if (u1->cr_uid == 0) 1430 return (0); 1431 return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0); 1432 } 1433 1434 /*- 1435 * Determine if u1 "can see" the subject specified by u2. 1436 * Returns: 0 for permitted, an errno value otherwise 1437 * Locks: none 1438 * References: *u1 and *u2 must not change during the call 1439 * u1 may equal u2, in which case only one reference is required 1440 */ 1441 int 1442 cr_cansee(struct ucred *u1, struct ucred *u2) 1443 { 1444 int error; 1445 1446 if ((error = prison_check(u1, u2))) 1447 return (error); 1448 #ifdef MAC 1449 if ((error = mac_cred_check_visible(u1, u2))) 1450 return (error); 1451 #endif 1452 if ((error = cr_canseeotheruids(u1, u2))) 1453 return (error); 1454 if ((error = cr_canseeothergids(u1, u2))) 1455 return (error); 1456 if ((error = cr_canseejailproc(u1, u2))) 1457 return (error); 1458 return (0); 1459 } 1460 1461 /*- 1462 * Determine if td "can see" the subject specified by p. 1463 * Returns: 0 for permitted, an errno value otherwise 1464 * Locks: Sufficient locks to protect p->p_ucred must be held. td really 1465 * should be curthread. 1466 * References: td and p must be valid for the lifetime of the call 1467 */ 1468 int 1469 p_cansee(struct thread *td, struct proc *p) 1470 { 1471 /* Wrap cr_cansee() for all functionality. */ 1472 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1473 PROC_LOCK_ASSERT(p, MA_OWNED); 1474 1475 if (td->td_proc == p) 1476 return (0); 1477 return (cr_cansee(td->td_ucred, p->p_ucred)); 1478 } 1479 1480 /* 1481 * 'conservative_signals' prevents the delivery of a broad class of 1482 * signals by unprivileged processes to processes that have changed their 1483 * credentials since the last invocation of execve(). This can prevent 1484 * the leakage of cached information or retained privileges as a result 1485 * of a common class of signal-related vulnerabilities. However, this 1486 * may interfere with some applications that expect to be able to 1487 * deliver these signals to peer processes after having given up 1488 * privilege. 1489 */ 1490 static int conservative_signals = 1; 1491 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW, 1492 &conservative_signals, 0, "Unprivileged processes prevented from " 1493 "sending certain signals to processes whose credentials have changed"); 1494 /*- 1495 * Determine whether cred may deliver the specified signal to proc. 1496 * Returns: 0 for permitted, an errno value otherwise. 1497 * Locks: A lock must be held for proc. 1498 * References: cred and proc must be valid for the lifetime of the call. 1499 */ 1500 int 1501 cr_cansignal(struct ucred *cred, struct proc *proc, int signum) 1502 { 1503 int error; 1504 1505 PROC_LOCK_ASSERT(proc, MA_OWNED); 1506 /* 1507 * Jail semantics limit the scope of signalling to proc in the 1508 * same jail as cred, if cred is in jail. 1509 */ 1510 error = prison_check(cred, proc->p_ucred); 1511 if (error) 1512 return (error); 1513 #ifdef MAC 1514 if ((error = mac_proc_check_signal(cred, proc, signum))) 1515 return (error); 1516 #endif 1517 if ((error = cr_canseeotheruids(cred, proc->p_ucred))) 1518 return (error); 1519 if ((error = cr_canseeothergids(cred, proc->p_ucred))) 1520 return (error); 1521 1522 /* 1523 * UNIX signal semantics depend on the status of the P_SUGID 1524 * bit on the target process. If the bit is set, then additional 1525 * restrictions are placed on the set of available signals. 1526 */ 1527 if (conservative_signals && (proc->p_flag & P_SUGID)) { 1528 switch (signum) { 1529 case 0: 1530 case SIGKILL: 1531 case SIGINT: 1532 case SIGTERM: 1533 case SIGALRM: 1534 case SIGSTOP: 1535 case SIGTTIN: 1536 case SIGTTOU: 1537 case SIGTSTP: 1538 case SIGHUP: 1539 case SIGUSR1: 1540 case SIGUSR2: 1541 /* 1542 * Generally, permit job and terminal control 1543 * signals. 1544 */ 1545 break; 1546 default: 1547 /* Not permitted without privilege. */ 1548 error = priv_check_cred(cred, PRIV_SIGNAL_SUGID); 1549 if (error) 1550 return (error); 1551 } 1552 } 1553 1554 /* 1555 * Generally, the target credential's ruid or svuid must match the 1556 * subject credential's ruid or euid. 1557 */ 1558 if (cred->cr_ruid != proc->p_ucred->cr_ruid && 1559 cred->cr_ruid != proc->p_ucred->cr_svuid && 1560 cred->cr_uid != proc->p_ucred->cr_ruid && 1561 cred->cr_uid != proc->p_ucred->cr_svuid) { 1562 error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED); 1563 if (error) 1564 return (error); 1565 } 1566 1567 return (0); 1568 } 1569 1570 /*- 1571 * Determine whether td may deliver the specified signal to p. 1572 * Returns: 0 for permitted, an errno value otherwise 1573 * Locks: Sufficient locks to protect various components of td and p 1574 * must be held. td must be curthread, and a lock must be 1575 * held for p. 1576 * References: td and p must be valid for the lifetime of the call 1577 */ 1578 int 1579 p_cansignal(struct thread *td, struct proc *p, int signum) 1580 { 1581 1582 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1583 PROC_LOCK_ASSERT(p, MA_OWNED); 1584 if (td->td_proc == p) 1585 return (0); 1586 1587 /* 1588 * UNIX signalling semantics require that processes in the same 1589 * session always be able to deliver SIGCONT to one another, 1590 * overriding the remaining protections. 1591 */ 1592 /* XXX: This will require an additional lock of some sort. */ 1593 if (signum == SIGCONT && td->td_proc->p_session == p->p_session) 1594 return (0); 1595 /* 1596 * Some compat layers use SIGTHR and higher signals for 1597 * communication between different kernel threads of the same 1598 * process, so that they expect that it's always possible to 1599 * deliver them, even for suid applications where cr_cansignal() can 1600 * deny such ability for security consideration. It should be 1601 * pretty safe to do since the only way to create two processes 1602 * with the same p_leader is via rfork(2). 1603 */ 1604 if (td->td_proc->p_leader != NULL && signum >= SIGTHR && 1605 signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader) 1606 return (0); 1607 1608 return (cr_cansignal(td->td_ucred, p, signum)); 1609 } 1610 1611 /*- 1612 * Determine whether td may reschedule p. 1613 * Returns: 0 for permitted, an errno value otherwise 1614 * Locks: Sufficient locks to protect various components of td and p 1615 * must be held. td must be curthread, and a lock must 1616 * be held for p. 1617 * References: td and p must be valid for the lifetime of the call 1618 */ 1619 int 1620 p_cansched(struct thread *td, struct proc *p) 1621 { 1622 int error; 1623 1624 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1625 PROC_LOCK_ASSERT(p, MA_OWNED); 1626 if (td->td_proc == p) 1627 return (0); 1628 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1629 return (error); 1630 #ifdef MAC 1631 if ((error = mac_proc_check_sched(td->td_ucred, p))) 1632 return (error); 1633 #endif 1634 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1635 return (error); 1636 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1637 return (error); 1638 if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid && 1639 td->td_ucred->cr_uid != p->p_ucred->cr_ruid) { 1640 error = priv_check(td, PRIV_SCHED_DIFFCRED); 1641 if (error) 1642 return (error); 1643 } 1644 return (0); 1645 } 1646 1647 /* 1648 * Handle getting or setting the prison's unprivileged_proc_debug 1649 * value. 1650 */ 1651 static int 1652 sysctl_unprivileged_proc_debug(SYSCTL_HANDLER_ARGS) 1653 { 1654 int error, val; 1655 1656 val = prison_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG); 1657 error = sysctl_handle_int(oidp, &val, 0, req); 1658 if (error != 0 || req->newptr == NULL) 1659 return (error); 1660 if (val != 0 && val != 1) 1661 return (EINVAL); 1662 prison_set_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG, val); 1663 return (0); 1664 } 1665 1666 /* 1667 * The 'unprivileged_proc_debug' flag may be used to disable a variety of 1668 * unprivileged inter-process debugging services, including some procfs 1669 * functionality, ptrace(), and ktrace(). In the past, inter-process 1670 * debugging has been involved in a variety of security problems, and sites 1671 * not requiring the service might choose to disable it when hardening 1672 * systems. 1673 */ 1674 SYSCTL_PROC(_security_bsd, OID_AUTO, unprivileged_proc_debug, 1675 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_SECURE | 1676 CTLFLAG_MPSAFE, 0, 0, sysctl_unprivileged_proc_debug, "I", 1677 "Unprivileged processes may use process debugging facilities"); 1678 1679 /*- 1680 * Determine whether td may debug p. 1681 * Returns: 0 for permitted, an errno value otherwise 1682 * Locks: Sufficient locks to protect various components of td and p 1683 * must be held. td must be curthread, and a lock must 1684 * be held for p. 1685 * References: td and p must be valid for the lifetime of the call 1686 */ 1687 int 1688 p_candebug(struct thread *td, struct proc *p) 1689 { 1690 int error, grpsubset, i, uidsubset; 1691 1692 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1693 PROC_LOCK_ASSERT(p, MA_OWNED); 1694 if (td->td_proc == p) 1695 return (0); 1696 if ((error = priv_check(td, PRIV_DEBUG_UNPRIV))) 1697 return (error); 1698 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1699 return (error); 1700 #ifdef MAC 1701 if ((error = mac_proc_check_debug(td->td_ucred, p))) 1702 return (error); 1703 #endif 1704 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1705 return (error); 1706 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1707 return (error); 1708 1709 /* 1710 * Is p's group set a subset of td's effective group set? This 1711 * includes p's egid, group access list, rgid, and svgid. 1712 */ 1713 grpsubset = 1; 1714 for (i = 0; i < p->p_ucred->cr_ngroups; i++) { 1715 if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) { 1716 grpsubset = 0; 1717 break; 1718 } 1719 } 1720 grpsubset = grpsubset && 1721 groupmember(p->p_ucred->cr_rgid, td->td_ucred) && 1722 groupmember(p->p_ucred->cr_svgid, td->td_ucred); 1723 1724 /* 1725 * Are the uids present in p's credential equal to td's 1726 * effective uid? This includes p's euid, svuid, and ruid. 1727 */ 1728 uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid && 1729 td->td_ucred->cr_uid == p->p_ucred->cr_svuid && 1730 td->td_ucred->cr_uid == p->p_ucred->cr_ruid); 1731 1732 /* 1733 * If p's gids aren't a subset, or the uids aren't a subset, 1734 * or the credential has changed, require appropriate privilege 1735 * for td to debug p. 1736 */ 1737 if (!grpsubset || !uidsubset) { 1738 error = priv_check(td, PRIV_DEBUG_DIFFCRED); 1739 if (error) 1740 return (error); 1741 } 1742 1743 /* 1744 * Has the credential of the process changed since the last exec()? 1745 */ 1746 if ((p->p_flag & P_SUGID) != 0) { 1747 error = priv_check(td, PRIV_DEBUG_SUGID); 1748 if (error) 1749 return (error); 1750 } 1751 1752 /* Can't trace init when securelevel > 0. */ 1753 if (p == initproc) { 1754 error = securelevel_gt(td->td_ucred, 0); 1755 if (error) 1756 return (error); 1757 } 1758 1759 /* 1760 * Can't trace a process that's currently exec'ing. 1761 * 1762 * XXX: Note, this is not a security policy decision, it's a 1763 * basic correctness/functionality decision. Therefore, this check 1764 * should be moved to the caller's of p_candebug(). 1765 */ 1766 if ((p->p_flag & P_INEXEC) != 0) 1767 return (EBUSY); 1768 1769 /* Denied explicitly */ 1770 if ((p->p_flag2 & P2_NOTRACE) != 0) { 1771 error = priv_check(td, PRIV_DEBUG_DENIED); 1772 if (error != 0) 1773 return (error); 1774 } 1775 1776 return (0); 1777 } 1778 1779 /*- 1780 * Determine whether the subject represented by cred can "see" a socket. 1781 * Returns: 0 for permitted, ENOENT otherwise. 1782 */ 1783 int 1784 cr_canseesocket(struct ucred *cred, struct socket *so) 1785 { 1786 int error; 1787 1788 error = prison_check(cred, so->so_cred); 1789 if (error) 1790 return (ENOENT); 1791 #ifdef MAC 1792 error = mac_socket_check_visible(cred, so); 1793 if (error) 1794 return (error); 1795 #endif 1796 if (cr_canseeotheruids(cred, so->so_cred)) 1797 return (ENOENT); 1798 if (cr_canseeothergids(cred, so->so_cred)) 1799 return (ENOENT); 1800 1801 return (0); 1802 } 1803 1804 /*- 1805 * Determine whether td can wait for the exit of p. 1806 * Returns: 0 for permitted, an errno value otherwise 1807 * Locks: Sufficient locks to protect various components of td and p 1808 * must be held. td must be curthread, and a lock must 1809 * be held for p. 1810 * References: td and p must be valid for the lifetime of the call 1811 1812 */ 1813 int 1814 p_canwait(struct thread *td, struct proc *p) 1815 { 1816 int error; 1817 1818 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1819 PROC_LOCK_ASSERT(p, MA_OWNED); 1820 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1821 return (error); 1822 #ifdef MAC 1823 if ((error = mac_proc_check_wait(td->td_ucred, p))) 1824 return (error); 1825 #endif 1826 #if 0 1827 /* XXXMAC: This could have odd effects on some shells. */ 1828 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1829 return (error); 1830 #endif 1831 1832 return (0); 1833 } 1834 1835 /* 1836 * Credential management. 1837 * 1838 * struct ucred objects are rarely allocated but gain and lose references all 1839 * the time (e.g., on struct file alloc/dealloc) turning refcount updates into 1840 * a significant source of cache-line ping ponging. Common cases are worked 1841 * around by modifying thread-local counter instead if the cred to operate on 1842 * matches td_realucred. 1843 * 1844 * The counter is split into 2 parts: 1845 * - cr_users -- total count of all struct proc and struct thread objects 1846 * which have given cred in p_ucred and td_ucred respectively 1847 * - cr_ref -- the actual ref count, only valid if cr_users == 0 1848 * 1849 * If users == 0 then cr_ref behaves similarly to refcount(9), in particular if 1850 * the count reaches 0 the object is freeable. 1851 * If users > 0 and curthread->td_realucred == cred, then updates are performed 1852 * against td_ucredref. 1853 * In other cases updates are performed against cr_ref. 1854 * 1855 * Changing td_realucred into something else decrements cr_users and transfers 1856 * accumulated updates. 1857 */ 1858 struct ucred * 1859 crcowget(struct ucred *cr) 1860 { 1861 1862 mtx_lock(&cr->cr_mtx); 1863 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 1864 __func__, cr->cr_users, cr)); 1865 cr->cr_users++; 1866 cr->cr_ref++; 1867 mtx_unlock(&cr->cr_mtx); 1868 return (cr); 1869 } 1870 1871 static struct ucred * 1872 crunuse(struct thread *td) 1873 { 1874 struct ucred *cr, *crold; 1875 1876 MPASS(td->td_realucred == td->td_ucred); 1877 cr = td->td_realucred; 1878 mtx_lock(&cr->cr_mtx); 1879 cr->cr_ref += td->td_ucredref; 1880 td->td_ucredref = 0; 1881 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 1882 __func__, cr->cr_users, cr)); 1883 cr->cr_users--; 1884 if (cr->cr_users == 0) { 1885 KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p", 1886 __func__, cr->cr_ref, cr)); 1887 crold = cr; 1888 } else { 1889 cr->cr_ref--; 1890 crold = NULL; 1891 } 1892 mtx_unlock(&cr->cr_mtx); 1893 td->td_realucred = NULL; 1894 return (crold); 1895 } 1896 1897 static void 1898 crunusebatch(struct ucred *cr, int users, int ref) 1899 { 1900 1901 KASSERT(users > 0, ("%s: passed users %d not > 0 ; cred %p", 1902 __func__, users, cr)); 1903 mtx_lock(&cr->cr_mtx); 1904 KASSERT(cr->cr_users >= users, ("%s: users %d not > %d on cred %p", 1905 __func__, cr->cr_users, users, cr)); 1906 cr->cr_users -= users; 1907 cr->cr_ref += ref; 1908 cr->cr_ref -= users; 1909 if (cr->cr_users > 0) { 1910 mtx_unlock(&cr->cr_mtx); 1911 return; 1912 } 1913 KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p", 1914 __func__, cr->cr_ref, cr)); 1915 if (cr->cr_ref > 0) { 1916 mtx_unlock(&cr->cr_mtx); 1917 return; 1918 } 1919 crfree_final(cr); 1920 } 1921 1922 void 1923 crcowfree(struct thread *td) 1924 { 1925 struct ucred *cr; 1926 1927 cr = crunuse(td); 1928 if (cr != NULL) 1929 crfree(cr); 1930 } 1931 1932 struct ucred * 1933 crcowsync(void) 1934 { 1935 struct thread *td; 1936 struct proc *p; 1937 struct ucred *crnew, *crold; 1938 1939 td = curthread; 1940 p = td->td_proc; 1941 PROC_LOCK_ASSERT(p, MA_OWNED); 1942 1943 MPASS(td->td_realucred == td->td_ucred); 1944 if (td->td_realucred == p->p_ucred) 1945 return (NULL); 1946 1947 crnew = crcowget(p->p_ucred); 1948 crold = crunuse(td); 1949 td->td_realucred = crnew; 1950 td->td_ucred = td->td_realucred; 1951 return (crold); 1952 } 1953 1954 /* 1955 * Batching. 1956 */ 1957 void 1958 credbatch_add(struct credbatch *crb, struct thread *td) 1959 { 1960 struct ucred *cr; 1961 1962 MPASS(td->td_realucred != NULL); 1963 MPASS(td->td_realucred == td->td_ucred); 1964 MPASS(TD_GET_STATE(td) == TDS_INACTIVE); 1965 cr = td->td_realucred; 1966 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 1967 __func__, cr->cr_users, cr)); 1968 if (crb->cred != cr) { 1969 if (crb->users > 0) { 1970 MPASS(crb->cred != NULL); 1971 crunusebatch(crb->cred, crb->users, crb->ref); 1972 crb->users = 0; 1973 crb->ref = 0; 1974 } 1975 } 1976 crb->cred = cr; 1977 crb->users++; 1978 crb->ref += td->td_ucredref; 1979 td->td_ucredref = 0; 1980 td->td_realucred = NULL; 1981 } 1982 1983 void 1984 credbatch_final(struct credbatch *crb) 1985 { 1986 1987 MPASS(crb->cred != NULL); 1988 MPASS(crb->users > 0); 1989 crunusebatch(crb->cred, crb->users, crb->ref); 1990 } 1991 1992 /* 1993 * Allocate a zeroed cred structure. 1994 */ 1995 struct ucred * 1996 crget(void) 1997 { 1998 struct ucred *cr; 1999 2000 cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO); 2001 mtx_init(&cr->cr_mtx, "cred", NULL, MTX_DEF); 2002 cr->cr_ref = 1; 2003 #ifdef AUDIT 2004 audit_cred_init(cr); 2005 #endif 2006 #ifdef MAC 2007 mac_cred_init(cr); 2008 #endif 2009 cr->cr_groups = cr->cr_smallgroups; 2010 cr->cr_agroups = 2011 sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]); 2012 return (cr); 2013 } 2014 2015 /* 2016 * Claim another reference to a ucred structure. 2017 */ 2018 struct ucred * 2019 crhold(struct ucred *cr) 2020 { 2021 struct thread *td; 2022 2023 td = curthread; 2024 if (__predict_true(td->td_realucred == cr)) { 2025 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 2026 __func__, cr->cr_users, cr)); 2027 td->td_ucredref++; 2028 return (cr); 2029 } 2030 mtx_lock(&cr->cr_mtx); 2031 cr->cr_ref++; 2032 mtx_unlock(&cr->cr_mtx); 2033 return (cr); 2034 } 2035 2036 /* 2037 * Free a cred structure. Throws away space when ref count gets to 0. 2038 */ 2039 void 2040 crfree(struct ucred *cr) 2041 { 2042 struct thread *td; 2043 2044 td = curthread; 2045 if (__predict_true(td->td_realucred == cr)) { 2046 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 2047 __func__, cr->cr_users, cr)); 2048 td->td_ucredref--; 2049 return; 2050 } 2051 mtx_lock(&cr->cr_mtx); 2052 KASSERT(cr->cr_users >= 0, ("%s: users %d not >= 0 on cred %p", 2053 __func__, cr->cr_users, cr)); 2054 cr->cr_ref--; 2055 if (cr->cr_users > 0) { 2056 mtx_unlock(&cr->cr_mtx); 2057 return; 2058 } 2059 KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p", 2060 __func__, cr->cr_ref, cr)); 2061 if (cr->cr_ref > 0) { 2062 mtx_unlock(&cr->cr_mtx); 2063 return; 2064 } 2065 crfree_final(cr); 2066 } 2067 2068 static void 2069 crfree_final(struct ucred *cr) 2070 { 2071 2072 KASSERT(cr->cr_users == 0, ("%s: users %d not == 0 on cred %p", 2073 __func__, cr->cr_users, cr)); 2074 KASSERT(cr->cr_ref == 0, ("%s: ref %ld not == 0 on cred %p", 2075 __func__, cr->cr_ref, cr)); 2076 2077 /* 2078 * Some callers of crget(), such as nfs_statfs(), allocate a temporary 2079 * credential, but don't allocate a uidinfo structure. 2080 */ 2081 if (cr->cr_uidinfo != NULL) 2082 uifree(cr->cr_uidinfo); 2083 if (cr->cr_ruidinfo != NULL) 2084 uifree(cr->cr_ruidinfo); 2085 if (cr->cr_prison != NULL) 2086 prison_free(cr->cr_prison); 2087 if (cr->cr_loginclass != NULL) 2088 loginclass_free(cr->cr_loginclass); 2089 #ifdef AUDIT 2090 audit_cred_destroy(cr); 2091 #endif 2092 #ifdef MAC 2093 mac_cred_destroy(cr); 2094 #endif 2095 mtx_destroy(&cr->cr_mtx); 2096 if (cr->cr_groups != cr->cr_smallgroups) 2097 free(cr->cr_groups, M_CRED); 2098 free(cr, M_CRED); 2099 } 2100 2101 /* 2102 * Copy a ucred's contents from a template. Does not block. 2103 */ 2104 void 2105 crcopy(struct ucred *dest, struct ucred *src) 2106 { 2107 2108 KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred")); 2109 bcopy(&src->cr_startcopy, &dest->cr_startcopy, 2110 (unsigned)((caddr_t)&src->cr_endcopy - 2111 (caddr_t)&src->cr_startcopy)); 2112 dest->cr_flags = src->cr_flags; 2113 crsetgroups(dest, src->cr_ngroups, src->cr_groups); 2114 uihold(dest->cr_uidinfo); 2115 uihold(dest->cr_ruidinfo); 2116 prison_hold(dest->cr_prison); 2117 loginclass_hold(dest->cr_loginclass); 2118 #ifdef AUDIT 2119 audit_cred_copy(src, dest); 2120 #endif 2121 #ifdef MAC 2122 mac_cred_copy(src, dest); 2123 #endif 2124 } 2125 2126 /* 2127 * Dup cred struct to a new held one. 2128 */ 2129 struct ucred * 2130 crdup(struct ucred *cr) 2131 { 2132 struct ucred *newcr; 2133 2134 newcr = crget(); 2135 crcopy(newcr, cr); 2136 return (newcr); 2137 } 2138 2139 /* 2140 * Fill in a struct xucred based on a struct ucred. 2141 */ 2142 void 2143 cru2x(struct ucred *cr, struct xucred *xcr) 2144 { 2145 int ngroups; 2146 2147 bzero(xcr, sizeof(*xcr)); 2148 xcr->cr_version = XUCRED_VERSION; 2149 xcr->cr_uid = cr->cr_uid; 2150 2151 ngroups = MIN(cr->cr_ngroups, XU_NGROUPS); 2152 xcr->cr_ngroups = ngroups; 2153 bcopy(cr->cr_groups, xcr->cr_groups, 2154 ngroups * sizeof(*cr->cr_groups)); 2155 } 2156 2157 void 2158 cru2xt(struct thread *td, struct xucred *xcr) 2159 { 2160 2161 cru2x(td->td_ucred, xcr); 2162 xcr->cr_pid = td->td_proc->p_pid; 2163 } 2164 2165 /* 2166 * Set initial process credentials. 2167 * Callers are responsible for providing the reference for provided credentials. 2168 */ 2169 void 2170 proc_set_cred_init(struct proc *p, struct ucred *newcred) 2171 { 2172 2173 p->p_ucred = crcowget(newcred); 2174 } 2175 2176 /* 2177 * Change process credentials. 2178 * Callers are responsible for providing the reference for passed credentials 2179 * and for freeing old ones. 2180 * 2181 * Process has to be locked except when it does not have credentials (as it 2182 * should not be visible just yet) or when newcred is NULL (as this can be 2183 * only used when the process is about to be freed, at which point it should 2184 * not be visible anymore). 2185 */ 2186 void 2187 proc_set_cred(struct proc *p, struct ucred *newcred) 2188 { 2189 struct ucred *cr; 2190 2191 cr = p->p_ucred; 2192 MPASS(cr != NULL); 2193 PROC_LOCK_ASSERT(p, MA_OWNED); 2194 KASSERT(newcred->cr_users == 0, ("%s: users %d not 0 on cred %p", 2195 __func__, newcred->cr_users, newcred)); 2196 mtx_lock(&cr->cr_mtx); 2197 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 2198 __func__, cr->cr_users, cr)); 2199 cr->cr_users--; 2200 mtx_unlock(&cr->cr_mtx); 2201 p->p_ucred = newcred; 2202 newcred->cr_users = 1; 2203 PROC_UPDATE_COW(p); 2204 } 2205 2206 void 2207 proc_unset_cred(struct proc *p) 2208 { 2209 struct ucred *cr; 2210 2211 MPASS(p->p_state == PRS_ZOMBIE || p->p_state == PRS_NEW); 2212 cr = p->p_ucred; 2213 p->p_ucred = NULL; 2214 KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p", 2215 __func__, cr->cr_users, cr)); 2216 mtx_lock(&cr->cr_mtx); 2217 cr->cr_users--; 2218 if (cr->cr_users == 0) 2219 KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p", 2220 __func__, cr->cr_ref, cr)); 2221 mtx_unlock(&cr->cr_mtx); 2222 crfree(cr); 2223 } 2224 2225 struct ucred * 2226 crcopysafe(struct proc *p, struct ucred *cr) 2227 { 2228 struct ucred *oldcred; 2229 int groups; 2230 2231 PROC_LOCK_ASSERT(p, MA_OWNED); 2232 2233 oldcred = p->p_ucred; 2234 while (cr->cr_agroups < oldcred->cr_agroups) { 2235 groups = oldcred->cr_agroups; 2236 PROC_UNLOCK(p); 2237 crextend(cr, groups); 2238 PROC_LOCK(p); 2239 oldcred = p->p_ucred; 2240 } 2241 crcopy(cr, oldcred); 2242 2243 return (oldcred); 2244 } 2245 2246 /* 2247 * Extend the passed in credential to hold n items. 2248 */ 2249 void 2250 crextend(struct ucred *cr, int n) 2251 { 2252 int cnt; 2253 2254 /* Truncate? */ 2255 if (n <= cr->cr_agroups) 2256 return; 2257 2258 /* 2259 * We extend by 2 each time since we're using a power of two 2260 * allocator until we need enough groups to fill a page. 2261 * Once we're allocating multiple pages, only allocate as many 2262 * as we actually need. The case of processes needing a 2263 * non-power of two number of pages seems more likely than 2264 * a real world process that adds thousands of groups one at a 2265 * time. 2266 */ 2267 if ( n < PAGE_SIZE / sizeof(gid_t) ) { 2268 if (cr->cr_agroups == 0) 2269 cnt = MAX(1, MINALLOCSIZE / sizeof(gid_t)); 2270 else 2271 cnt = cr->cr_agroups * 2; 2272 2273 while (cnt < n) 2274 cnt *= 2; 2275 } else 2276 cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t)); 2277 2278 /* Free the old array. */ 2279 if (cr->cr_groups != cr->cr_smallgroups) 2280 free(cr->cr_groups, M_CRED); 2281 2282 cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO); 2283 cr->cr_agroups = cnt; 2284 } 2285 2286 /* 2287 * Copy groups in to a credential, preserving any necessary invariants. 2288 * Currently this includes the sorting of all supplemental gids. 2289 * crextend() must have been called before hand to ensure sufficient 2290 * space is available. 2291 */ 2292 static void 2293 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups) 2294 { 2295 int i; 2296 int j; 2297 gid_t g; 2298 2299 KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small")); 2300 2301 bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t)); 2302 cr->cr_ngroups = ngrp; 2303 2304 /* 2305 * Sort all groups except cr_groups[0] to allow groupmember to 2306 * perform a binary search. 2307 * 2308 * XXX: If large numbers of groups become common this should 2309 * be replaced with shell sort like linux uses or possibly 2310 * heap sort. 2311 */ 2312 for (i = 2; i < ngrp; i++) { 2313 g = cr->cr_groups[i]; 2314 for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--) 2315 cr->cr_groups[j + 1] = cr->cr_groups[j]; 2316 cr->cr_groups[j + 1] = g; 2317 } 2318 } 2319 2320 /* 2321 * Copy groups in to a credential after expanding it if required. 2322 * Truncate the list to (ngroups_max + 1) if it is too large. 2323 */ 2324 void 2325 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups) 2326 { 2327 2328 if (ngrp > ngroups_max + 1) 2329 ngrp = ngroups_max + 1; 2330 2331 crextend(cr, ngrp); 2332 crsetgroups_locked(cr, ngrp, groups); 2333 } 2334 2335 /* 2336 * Get login name, if available. 2337 */ 2338 #ifndef _SYS_SYSPROTO_H_ 2339 struct getlogin_args { 2340 char *namebuf; 2341 u_int namelen; 2342 }; 2343 #endif 2344 /* ARGSUSED */ 2345 int 2346 sys_getlogin(struct thread *td, struct getlogin_args *uap) 2347 { 2348 char login[MAXLOGNAME]; 2349 struct proc *p = td->td_proc; 2350 size_t len; 2351 2352 if (uap->namelen > MAXLOGNAME) 2353 uap->namelen = MAXLOGNAME; 2354 PROC_LOCK(p); 2355 SESS_LOCK(p->p_session); 2356 len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; 2357 SESS_UNLOCK(p->p_session); 2358 PROC_UNLOCK(p); 2359 if (len > uap->namelen) 2360 return (ERANGE); 2361 return (copyout(login, uap->namebuf, len)); 2362 } 2363 2364 /* 2365 * Set login name. 2366 */ 2367 #ifndef _SYS_SYSPROTO_H_ 2368 struct setlogin_args { 2369 char *namebuf; 2370 }; 2371 #endif 2372 /* ARGSUSED */ 2373 int 2374 sys_setlogin(struct thread *td, struct setlogin_args *uap) 2375 { 2376 struct proc *p = td->td_proc; 2377 int error; 2378 char logintmp[MAXLOGNAME]; 2379 2380 CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); 2381 2382 error = priv_check(td, PRIV_PROC_SETLOGIN); 2383 if (error) 2384 return (error); 2385 error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); 2386 if (error != 0) { 2387 if (error == ENAMETOOLONG) 2388 error = EINVAL; 2389 return (error); 2390 } 2391 AUDIT_ARG_LOGIN(logintmp); 2392 PROC_LOCK(p); 2393 SESS_LOCK(p->p_session); 2394 strcpy(p->p_session->s_login, logintmp); 2395 SESS_UNLOCK(p->p_session); 2396 PROC_UNLOCK(p); 2397 return (0); 2398 } 2399 2400 void 2401 setsugid(struct proc *p) 2402 { 2403 2404 PROC_LOCK_ASSERT(p, MA_OWNED); 2405 p->p_flag |= P_SUGID; 2406 } 2407 2408 /*- 2409 * Change a process's effective uid. 2410 * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified. 2411 * References: newcred must be an exclusive credential reference for the 2412 * duration of the call. 2413 */ 2414 void 2415 change_euid(struct ucred *newcred, struct uidinfo *euip) 2416 { 2417 2418 newcred->cr_uid = euip->ui_uid; 2419 uihold(euip); 2420 uifree(newcred->cr_uidinfo); 2421 newcred->cr_uidinfo = euip; 2422 } 2423 2424 /*- 2425 * Change a process's effective gid. 2426 * Side effects: newcred->cr_gid will be modified. 2427 * References: newcred must be an exclusive credential reference for the 2428 * duration of the call. 2429 */ 2430 void 2431 change_egid(struct ucred *newcred, gid_t egid) 2432 { 2433 2434 newcred->cr_groups[0] = egid; 2435 } 2436 2437 /*- 2438 * Change a process's real uid. 2439 * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo 2440 * will be updated, and the old and new cr_ruidinfo proc 2441 * counts will be updated. 2442 * References: newcred must be an exclusive credential reference for the 2443 * duration of the call. 2444 */ 2445 void 2446 change_ruid(struct ucred *newcred, struct uidinfo *ruip) 2447 { 2448 2449 (void)chgproccnt(newcred->cr_ruidinfo, -1, 0); 2450 newcred->cr_ruid = ruip->ui_uid; 2451 uihold(ruip); 2452 uifree(newcred->cr_ruidinfo); 2453 newcred->cr_ruidinfo = ruip; 2454 (void)chgproccnt(newcred->cr_ruidinfo, 1, 0); 2455 } 2456 2457 /*- 2458 * Change a process's real gid. 2459 * Side effects: newcred->cr_rgid will be updated. 2460 * References: newcred must be an exclusive credential reference for the 2461 * duration of the call. 2462 */ 2463 void 2464 change_rgid(struct ucred *newcred, gid_t rgid) 2465 { 2466 2467 newcred->cr_rgid = rgid; 2468 } 2469 2470 /*- 2471 * Change a process's saved uid. 2472 * Side effects: newcred->cr_svuid will be updated. 2473 * References: newcred must be an exclusive credential reference for the 2474 * duration of the call. 2475 */ 2476 void 2477 change_svuid(struct ucred *newcred, uid_t svuid) 2478 { 2479 2480 newcred->cr_svuid = svuid; 2481 } 2482 2483 /*- 2484 * Change a process's saved gid. 2485 * Side effects: newcred->cr_svgid will be updated. 2486 * References: newcred must be an exclusive credential reference for the 2487 * duration of the call. 2488 */ 2489 void 2490 change_svgid(struct ucred *newcred, gid_t svgid) 2491 { 2492 2493 newcred->cr_svgid = svgid; 2494 } 2495 2496 bool allow_ptrace = true; 2497 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace, CTLFLAG_RWTUN, 2498 &allow_ptrace, 0, 2499 "Deny ptrace(2) use by returning ENOSYS"); 2500