groups.c 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Supplementary group IDs
  4. */
  5. #include <linux/cred.h>
  6. #include <linux/export.h>
  7. #include <linux/slab.h>
  8. #include <linux/security.h>
  9. #include <linux/sort.h>
  10. #include <linux/syscalls.h>
  11. #include <linux/user_namespace.h>
  12. #include <linux/vmalloc.h>
  13. #include <linux/uaccess.h>
  14. struct group_info *groups_alloc(int gidsetsize)
  15. {
  16. struct group_info *gi;
  17. gi = kvmalloc(struct_size(gi, gid, gidsetsize), GFP_KERNEL_ACCOUNT);
  18. if (!gi)
  19. return NULL;
  20. atomic_set(&gi->usage, 1);
  21. gi->ngroups = gidsetsize;
  22. return gi;
  23. }
  24. EXPORT_SYMBOL(groups_alloc);
  25. void groups_free(struct group_info *group_info)
  26. {
  27. kvfree(group_info);
  28. }
  29. EXPORT_SYMBOL(groups_free);
  30. /* export the group_info to a user-space array */
  31. static int groups_to_user(gid_t __user *grouplist,
  32. const struct group_info *group_info)
  33. {
  34. struct user_namespace *user_ns = current_user_ns();
  35. int i;
  36. unsigned int count = group_info->ngroups;
  37. for (i = 0; i < count; i++) {
  38. gid_t gid;
  39. gid = from_kgid_munged(user_ns, group_info->gid[i]);
  40. if (put_user(gid, grouplist+i))
  41. return -EFAULT;
  42. }
  43. return 0;
  44. }
  45. /* fill a group_info from a user-space array - it must be allocated already */
  46. static int groups_from_user(struct group_info *group_info,
  47. gid_t __user *grouplist)
  48. {
  49. struct user_namespace *user_ns = current_user_ns();
  50. int i;
  51. unsigned int count = group_info->ngroups;
  52. for (i = 0; i < count; i++) {
  53. gid_t gid;
  54. kgid_t kgid;
  55. if (get_user(gid, grouplist+i))
  56. return -EFAULT;
  57. kgid = make_kgid(user_ns, gid);
  58. if (!gid_valid(kgid))
  59. return -EINVAL;
  60. group_info->gid[i] = kgid;
  61. }
  62. return 0;
  63. }
  64. static int gid_cmp(const void *_a, const void *_b)
  65. {
  66. kgid_t a = *(kgid_t *)_a;
  67. kgid_t b = *(kgid_t *)_b;
  68. return gid_gt(a, b) - gid_lt(a, b);
  69. }
  70. void groups_sort(struct group_info *group_info)
  71. {
  72. sort(group_info->gid, group_info->ngroups, sizeof(*group_info->gid),
  73. gid_cmp, NULL);
  74. }
  75. EXPORT_SYMBOL(groups_sort);
  76. /* a simple bsearch */
  77. int groups_search(const struct group_info *group_info, kgid_t grp)
  78. {
  79. unsigned int left, right;
  80. if (!group_info)
  81. return 0;
  82. left = 0;
  83. right = group_info->ngroups;
  84. while (left < right) {
  85. unsigned int mid = (left+right)/2;
  86. if (gid_gt(grp, group_info->gid[mid]))
  87. left = mid + 1;
  88. else if (gid_lt(grp, group_info->gid[mid]))
  89. right = mid;
  90. else
  91. return 1;
  92. }
  93. return 0;
  94. }
  95. /**
  96. * set_groups - Change a group subscription in a set of credentials
  97. * @new: The newly prepared set of credentials to alter
  98. * @group_info: The group list to install
  99. */
  100. void set_groups(struct cred *new, struct group_info *group_info)
  101. {
  102. put_group_info(new->group_info);
  103. get_group_info(group_info);
  104. new->group_info = group_info;
  105. }
  106. EXPORT_SYMBOL(set_groups);
  107. /**
  108. * set_current_groups - Change current's group subscription
  109. * @group_info: The group list to impose
  110. *
  111. * Validate a group subscription and, if valid, impose it upon current's task
  112. * security record.
  113. */
  114. int set_current_groups(struct group_info *group_info)
  115. {
  116. struct cred *new;
  117. const struct cred *old;
  118. int retval;
  119. new = prepare_creds();
  120. if (!new)
  121. return -ENOMEM;
  122. old = current_cred();
  123. set_groups(new, group_info);
  124. retval = security_task_fix_setgroups(new, old);
  125. if (retval < 0)
  126. goto error;
  127. return commit_creds(new);
  128. error:
  129. abort_creds(new);
  130. return retval;
  131. }
  132. EXPORT_SYMBOL(set_current_groups);
  133. SYSCALL_DEFINE2(getgroups, int, gidsetsize, gid_t __user *, grouplist)
  134. {
  135. const struct cred *cred = current_cred();
  136. int i;
  137. if (gidsetsize < 0)
  138. return -EINVAL;
  139. /* no need to grab task_lock here; it cannot change */
  140. i = cred->group_info->ngroups;
  141. if (gidsetsize) {
  142. if (i > gidsetsize) {
  143. i = -EINVAL;
  144. goto out;
  145. }
  146. if (groups_to_user(grouplist, cred->group_info)) {
  147. i = -EFAULT;
  148. goto out;
  149. }
  150. }
  151. out:
  152. return i;
  153. }
  154. bool may_setgroups(void)
  155. {
  156. struct user_namespace *user_ns = current_user_ns();
  157. return ns_capable_setid(user_ns, CAP_SETGID) &&
  158. userns_may_setgroups(user_ns);
  159. }
  160. /*
  161. * SMP: Our groups are copy-on-write. We can set them safely
  162. * without another task interfering.
  163. */
  164. SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist)
  165. {
  166. struct group_info *group_info;
  167. int retval;
  168. if (!may_setgroups())
  169. return -EPERM;
  170. if ((unsigned)gidsetsize > NGROUPS_MAX)
  171. return -EINVAL;
  172. group_info = groups_alloc(gidsetsize);
  173. if (!group_info)
  174. return -ENOMEM;
  175. retval = groups_from_user(group_info, grouplist);
  176. if (retval) {
  177. put_group_info(group_info);
  178. return retval;
  179. }
  180. groups_sort(group_info);
  181. retval = set_current_groups(group_info);
  182. put_group_info(group_info);
  183. return retval;
  184. }
  185. /*
  186. * Check whether we're fsgid/egid or in the supplemental group..
  187. */
  188. int in_group_p(kgid_t grp)
  189. {
  190. const struct cred *cred = current_cred();
  191. int retval = 1;
  192. if (!gid_eq(grp, cred->fsgid))
  193. retval = groups_search(cred->group_info, grp);
  194. return retval;
  195. }
  196. EXPORT_SYMBOL(in_group_p);
  197. int in_egroup_p(kgid_t grp)
  198. {
  199. const struct cred *cred = current_cred();
  200. int retval = 1;
  201. if (!gid_eq(grp, cred->egid))
  202. retval = groups_search(cred->group_info, grp);
  203. return retval;
  204. }
  205. EXPORT_SYMBOL(in_egroup_p);