1// SPDX-License-Identifier: GPL-2.0-or-later
2/* scm.c - Socket level control messages processing.
3 *
4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
5 * Alignment and value checking mods by Craig Metz
6 */
7
8#include <linux/module.h>
9#include <linux/signal.h>
10#include <linux/capability.h>
11#include <linux/errno.h>
12#include <linux/sched.h>
13#include <linux/sched/user.h>
14#include <linux/mm.h>
15#include <linux/kernel.h>
16#include <linux/stat.h>
17#include <linux/socket.h>
18#include <linux/file.h>
19#include <linux/fcntl.h>
20#include <linux/net.h>
21#include <linux/interrupt.h>
22#include <linux/netdevice.h>
23#include <linux/security.h>
24#include <linux/pid_namespace.h>
25#include <linux/pid.h>
26#include <uapi/linux/pidfd.h>
27#include <linux/pidfs.h>
28#include <linux/nsproxy.h>
29#include <linux/slab.h>
30#include <linux/errqueue.h>
31#include <linux/io_uring.h>
32
33#include <linux/uaccess.h>
34
35#include <net/protocol.h>
36#include <linux/skbuff.h>
37#include <net/sock.h>
38#include <net/compat.h>
39#include <net/scm.h>
40#include <net/cls_cgroup.h>
41#include <net/af_unix.h>
42
43
44/*
45 * Only allow a user to send credentials, that they could set with
46 * setu(g)id.
47 */
48
49static __inline__ int scm_check_creds(struct ucred *creds)
50{
51 const struct cred *cred = current_cred();
52 kuid_t uid = make_kuid(from: cred->user_ns, uid: creds->uid);
53 kgid_t gid = make_kgid(from: cred->user_ns, gid: creds->gid);
54
55 if (!uid_valid(uid) || !gid_valid(gid))
56 return -EINVAL;
57
58 if ((creds->pid == task_tgid_vnr(current) ||
59 ns_capable(ns: task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
60 ((uid_eq(left: uid, right: cred->uid) || uid_eq(left: uid, right: cred->euid) ||
61 uid_eq(left: uid, right: cred->suid)) || ns_capable(ns: cred->user_ns, CAP_SETUID)) &&
62 ((gid_eq(left: gid, right: cred->gid) || gid_eq(left: gid, right: cred->egid) ||
63 gid_eq(left: gid, right: cred->sgid)) || ns_capable(ns: cred->user_ns, CAP_SETGID))) {
64 return 0;
65 }
66 return -EPERM;
67}
68
69static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
70{
71 int *fdp = (int*)CMSG_DATA(cmsg);
72 struct scm_fp_list *fpl = *fplp;
73 struct file **fpp;
74 int i, num;
75
76 num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int);
77
78 if (num <= 0)
79 return 0;
80
81 if (num > SCM_MAX_FD)
82 return -EINVAL;
83
84 if (!fpl)
85 {
86 fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL_ACCOUNT);
87 if (!fpl)
88 return -ENOMEM;
89 *fplp = fpl;
90 fpl->count = 0;
91 fpl->count_unix = 0;
92 fpl->max = SCM_MAX_FD;
93 fpl->user = NULL;
94#if IS_ENABLED(CONFIG_UNIX)
95 fpl->inflight = false;
96 fpl->dead = false;
97 fpl->edges = NULL;
98 INIT_LIST_HEAD(list: &fpl->vertices);
99#endif
100 }
101 fpp = &fpl->fp[fpl->count];
102
103 if (fpl->count + num > fpl->max)
104 return -EINVAL;
105
106 /*
107 * Verify the descriptors and increment the usage count.
108 */
109
110 for (i=0; i< num; i++)
111 {
112 int fd = fdp[i];
113 struct file *file;
114
115 if (fd < 0 || !(file = fget_raw(fd)))
116 return -EBADF;
117 /* don't allow io_uring files */
118 if (io_is_uring_fops(file)) {
119 fput(file);
120 return -EINVAL;
121 }
122 if (unix_get_socket(filp: file))
123 fpl->count_unix++;
124
125 *fpp++ = file;
126 fpl->count++;
127 }
128
129 if (!fpl->user)
130 fpl->user = get_uid(current_user());
131
132 return num;
133}
134
135void __scm_destroy(struct scm_cookie *scm)
136{
137 struct scm_fp_list *fpl = scm->fp;
138 int i;
139
140 if (fpl) {
141 scm->fp = NULL;
142 for (i=fpl->count-1; i>=0; i--)
143 fput(fpl->fp[i]);
144 free_uid(fpl->user);
145 kfree(objp: fpl);
146 }
147}
148EXPORT_SYMBOL(__scm_destroy);
149
150static inline int scm_replace_pid(struct scm_cookie *scm, struct pid *pid)
151{
152 int err;
153
154 /* drop all previous references */
155 scm_destroy_cred(scm);
156
157 err = pidfs_register_pid(pid);
158 if (unlikely(err))
159 return err;
160
161 scm->pid = pid;
162 scm->creds.pid = pid_vnr(pid);
163 return 0;
164}
165
166int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
167{
168 const struct proto_ops *ops = READ_ONCE(sock->ops);
169 struct cmsghdr *cmsg;
170 int err;
171
172 for_each_cmsghdr(cmsg, msg) {
173 err = -EINVAL;
174
175 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
176 /* The first check was omitted in <= 2.2.5. The reasoning was
177 that parser checks cmsg_len in any case, so that
178 additional check would be work duplication.
179 But if cmsg_level is not SOL_SOCKET, we do not check
180 for too short ancillary data object at all! Oops.
181 OK, let's add it...
182 */
183 if (!CMSG_OK(msg, cmsg))
184 goto error;
185
186 if (cmsg->cmsg_level != SOL_SOCKET)
187 continue;
188
189 switch (cmsg->cmsg_type)
190 {
191 case SCM_RIGHTS:
192 if (!ops || ops->family != PF_UNIX)
193 goto error;
194 err=scm_fp_copy(cmsg, fplp: &p->fp);
195 if (err<0)
196 goto error;
197 break;
198 case SCM_CREDENTIALS:
199 {
200 struct ucred creds;
201 kuid_t uid;
202 kgid_t gid;
203 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred)))
204 goto error;
205 memcpy(to: &creds, CMSG_DATA(cmsg), len: sizeof(struct ucred));
206 err = scm_check_creds(creds: &creds);
207 if (err)
208 goto error;
209
210 if (!p->pid || pid_vnr(pid: p->pid) != creds.pid) {
211 struct pid *pid;
212 err = -ESRCH;
213 pid = find_get_pid(nr: creds.pid);
214 if (!pid)
215 goto error;
216
217 /* pass a struct pid reference from
218 * find_get_pid() to scm_replace_pid().
219 */
220 err = scm_replace_pid(scm: p, pid);
221 if (err) {
222 put_pid(pid);
223 goto error;
224 }
225 }
226
227 err = -EINVAL;
228 uid = make_kuid(from: current_user_ns(), uid: creds.uid);
229 gid = make_kgid(from: current_user_ns(), gid: creds.gid);
230 if (!uid_valid(uid) || !gid_valid(gid))
231 goto error;
232
233 p->creds.uid = uid;
234 p->creds.gid = gid;
235 break;
236 }
237 default:
238 goto error;
239 }
240 }
241
242 if (p->fp && !p->fp->count)
243 {
244 kfree(objp: p->fp);
245 p->fp = NULL;
246 }
247 return 0;
248
249error:
250 scm_destroy(scm: p);
251 return err;
252}
253EXPORT_SYMBOL(__scm_send);
254
255int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
256{
257 int cmlen = CMSG_LEN(len);
258
259 if (msg->msg_flags & MSG_CMSG_COMPAT)
260 return put_cmsg_compat(msg, level, type, len, data);
261
262 if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) {
263 msg->msg_flags |= MSG_CTRUNC;
264 return 0; /* XXX: return error? check spec. */
265 }
266 if (msg->msg_controllen < cmlen) {
267 msg->msg_flags |= MSG_CTRUNC;
268 cmlen = msg->msg_controllen;
269 }
270
271 if (msg->msg_control_is_user) {
272 struct cmsghdr __user *cm = msg->msg_control_user;
273
274 check_object_size(ptr: data, n: cmlen - sizeof(*cm), to_user: true);
275
276 if (can_do_masked_user_access())
277 cm = masked_user_access_begin(cm);
278 else if (!user_write_access_begin(cm, cmlen))
279 goto efault;
280
281 unsafe_put_user(cmlen, &cm->cmsg_len, efault_end);
282 unsafe_put_user(level, &cm->cmsg_level, efault_end);
283 unsafe_put_user(type, &cm->cmsg_type, efault_end);
284 unsafe_copy_to_user(CMSG_USER_DATA(cm), data,
285 cmlen - sizeof(*cm), efault_end);
286 user_write_access_end();
287 } else {
288 struct cmsghdr *cm = msg->msg_control;
289
290 cm->cmsg_level = level;
291 cm->cmsg_type = type;
292 cm->cmsg_len = cmlen;
293 memcpy(CMSG_DATA(cm), from: data, len: cmlen - sizeof(*cm));
294 }
295
296 cmlen = min(CMSG_SPACE(len), msg->msg_controllen);
297 if (msg->msg_control_is_user)
298 msg->msg_control_user += cmlen;
299 else
300 msg->msg_control += cmlen;
301 msg->msg_controllen -= cmlen;
302 return 0;
303
304efault_end:
305 user_write_access_end();
306efault:
307 return -EFAULT;
308}
309EXPORT_SYMBOL(put_cmsg);
310
311int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len,
312 void *data)
313{
314 /* Don't produce truncated CMSGs */
315 if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len))
316 return -ETOOSMALL;
317
318 return put_cmsg(msg, level, type, len, data);
319}
320
321void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
322{
323 struct scm_timestamping64 tss;
324 int i;
325
326 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
327 tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
328 tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
329 }
330
331 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss);
332}
333EXPORT_SYMBOL(put_cmsg_scm_timestamping64);
334
335void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
336{
337 struct scm_timestamping tss;
338 int i;
339
340 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) {
341 tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec;
342 tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec;
343 }
344
345 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss);
346}
347EXPORT_SYMBOL(put_cmsg_scm_timestamping);
348
349static int scm_max_fds(struct msghdr *msg)
350{
351 if (msg->msg_controllen <= sizeof(struct cmsghdr))
352 return 0;
353 return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
354}
355
356void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
357{
358 struct cmsghdr __user *cm =
359 (__force struct cmsghdr __user *)msg->msg_control_user;
360 unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
361 int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);
362 int __user *cmsg_data = CMSG_USER_DATA(cm);
363 int err = 0, i;
364
365 /* no use for FD passing from kernel space callers */
366 if (WARN_ON_ONCE(!msg->msg_control_is_user))
367 return;
368
369 if (msg->msg_flags & MSG_CMSG_COMPAT) {
370 scm_detach_fds_compat(msg, scm);
371 return;
372 }
373
374 for (i = 0; i < fdmax; i++) {
375 err = scm_recv_one_fd(f: scm->fp->fp[i], ufd: cmsg_data + i, flags: o_flags);
376 if (err < 0)
377 break;
378 }
379
380 if (i > 0) {
381 int cmlen = CMSG_LEN(i * sizeof(int));
382
383 err = put_user(SOL_SOCKET, &cm->cmsg_level);
384 if (!err)
385 err = put_user(SCM_RIGHTS, &cm->cmsg_type);
386 if (!err)
387 err = put_user(cmlen, &cm->cmsg_len);
388 if (!err) {
389 cmlen = CMSG_SPACE(i * sizeof(int));
390 if (msg->msg_controllen < cmlen)
391 cmlen = msg->msg_controllen;
392 msg->msg_control_user += cmlen;
393 msg->msg_controllen -= cmlen;
394 }
395 }
396
397 if (i < scm->fp->count || (scm->fp->count && fdmax <= 0))
398 msg->msg_flags |= MSG_CTRUNC;
399
400 /*
401 * All of the files that fit in the message have had their usage counts
402 * incremented, so we just free the list.
403 */
404 __scm_destroy(scm);
405}
406EXPORT_SYMBOL(scm_detach_fds);
407
408struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
409{
410 struct scm_fp_list *new_fpl;
411 int i;
412
413 if (!fpl)
414 return NULL;
415
416 new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]),
417 GFP_KERNEL_ACCOUNT);
418 if (new_fpl) {
419 for (i = 0; i < fpl->count; i++)
420 get_file(f: fpl->fp[i]);
421
422 new_fpl->max = new_fpl->count;
423 new_fpl->user = get_uid(u: fpl->user);
424#if IS_ENABLED(CONFIG_UNIX)
425 new_fpl->inflight = false;
426 new_fpl->edges = NULL;
427 INIT_LIST_HEAD(list: &new_fpl->vertices);
428#endif
429 }
430 return new_fpl;
431}
432EXPORT_SYMBOL(scm_fp_dup);
433
434#ifdef CONFIG_SECURITY_NETWORK
435static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm)
436{
437 struct lsm_context ctx;
438 int err;
439
440 if (sk->sk_scm_security) {
441 err = security_secid_to_secctx(secid: scm->secid, cp: &ctx);
442
443 if (err >= 0) {
444 put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, ctx.len,
445 ctx.context);
446
447 security_release_secctx(cp: &ctx);
448 }
449 }
450}
451
452static bool scm_has_secdata(struct sock *sk)
453{
454 return sk->sk_scm_security;
455}
456#else
457static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm)
458{
459}
460
461static bool scm_has_secdata(struct sock *sk)
462{
463 return false;
464}
465#endif
466
467static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm)
468{
469 struct file *pidfd_file = NULL;
470 int len, pidfd;
471
472 /* put_cmsg() doesn't return an error if CMSG is truncated,
473 * that's why we need to opencode these checks here.
474 */
475 if (msg->msg_flags & MSG_CMSG_COMPAT)
476 len = sizeof(struct compat_cmsghdr) + sizeof(int);
477 else
478 len = sizeof(struct cmsghdr) + sizeof(int);
479
480 if (msg->msg_controllen < len) {
481 msg->msg_flags |= MSG_CTRUNC;
482 return;
483 }
484
485 if (!scm->pid)
486 return;
487
488 pidfd = pidfd_prepare(pid: scm->pid, PIDFD_STALE, ret_file: &pidfd_file);
489
490 if (put_cmsg(msg, SOL_SOCKET, SCM_PIDFD, sizeof(int), &pidfd)) {
491 if (pidfd_file) {
492 put_unused_fd(fd: pidfd);
493 fput(pidfd_file);
494 }
495
496 return;
497 }
498
499 if (pidfd_file)
500 fd_install(fd: pidfd, file: pidfd_file);
501}
502
503static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
504 struct scm_cookie *scm, int flags)
505{
506 if (!msg->msg_control) {
507 if (sk->sk_scm_credentials || sk->sk_scm_pidfd ||
508 scm->fp || scm_has_secdata(sk))
509 msg->msg_flags |= MSG_CTRUNC;
510
511 scm_destroy(scm);
512 return false;
513 }
514
515 if (sk->sk_scm_credentials) {
516 struct user_namespace *current_ns = current_user_ns();
517 struct ucred ucreds = {
518 .pid = scm->creds.pid,
519 .uid = from_kuid_munged(to: current_ns, kuid: scm->creds.uid),
520 .gid = from_kgid_munged(to: current_ns, kgid: scm->creds.gid),
521 };
522
523 put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
524 }
525
526 scm_passec(sk, msg, scm);
527
528 if (scm->fp)
529 scm_detach_fds(msg, scm);
530
531 return true;
532}
533
534void scm_recv(struct socket *sock, struct msghdr *msg,
535 struct scm_cookie *scm, int flags)
536{
537 if (!__scm_recv_common(sk: sock->sk, msg, scm, flags))
538 return;
539
540 scm_destroy_cred(scm);
541}
542EXPORT_SYMBOL(scm_recv);
543
544void scm_recv_unix(struct socket *sock, struct msghdr *msg,
545 struct scm_cookie *scm, int flags)
546{
547 if (!__scm_recv_common(sk: sock->sk, msg, scm, flags))
548 return;
549
550 if (sock->sk->sk_scm_pidfd)
551 scm_pidfd_recv(msg, scm);
552
553 scm_destroy_cred(scm);
554}
555