| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 16 Oct 2013 15:01:57 -0700
From: Jim Lieb <jlieb@...asas.com>
To: tytso@....edu, viro@...iv.linux.org
Cc: linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
bfields@...hat.com, jlayton@...hat.com,
Jim Lieb <jlieb@...asas.com>
Subject: [PATCH 1/3] switch_creds: Syscall to switch creds for file server ops
File servers must do some operations with the credentials of
their client. This syscall switches the key credentials similar
to nfsd_setuser() in fs/nfsd/auth.c with the capability of retaining a
handle to the credentials by way of an fd for an open anonymous file.
This makes switching for subsequent operations for that client more efficient.
Signed-off-by: Jim Lieb <jlieb@...asas.com>
---
include/linux/cred.h | 15 ++++
include/linux/syscalls.h | 2 +
kernel/sys.c | 175 +++++++++++++++++++++++++++++++++++++++++++++++
kernel/sys_ni.c | 3 +
4 files changed, 195 insertions(+)
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 04421e8..66a006e 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -138,6 +138,21 @@ struct cred {
struct rcu_head rcu; /* RCU deletion hook */
};
+/* switch_creds() syscall parameters*/
+
+#define SWCREDS_REVERT 0
+#define SWCREDS_FROMFD 1
+#define SWCREDS_FSIDS 2
+
+/* arg for SWCREDS_FSIDS command */
+
+struct user_creds {
+ uid_t uid;
+ gid_t gid;
+ unsigned ngroups;
+ gid_t altgroups[0];
+};
+
extern void __put_cred(struct cred *);
extern void exit_creds(struct task_struct *);
extern int copy_creds(struct task_struct *, unsigned long);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 7fac04e..3550a8f 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -64,6 +64,7 @@ struct old_linux_dirent;
struct perf_event_attr;
struct file_handle;
struct sigaltstack;
+struct user_creds;
#include <linux/types.h>
#include <linux/aio_abi.h>
@@ -231,6 +232,7 @@ asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid);
asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid);
asmlinkage long sys_setfsuid(uid_t uid);
asmlinkage long sys_setfsgid(gid_t gid);
+asmlinkage long sys_switch_creds(int cmd, unsigned long arg);
asmlinkage long sys_setpgid(pid_t pid, pid_t pgid);
asmlinkage long sys_setsid(void);
asmlinkage long sys_setgroups(int gidsetsize, gid_t __user *grouplist);
diff --git a/kernel/sys.c b/kernel/sys.c
index c18ecca..cebc661 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -53,6 +53,7 @@
#include <linux/rcupdate.h>
#include <linux/uidgid.h>
#include <linux/cred.h>
+#include <linux/anon_inodes.h>
#include <linux/kmsg_dump.h>
/* Move somewhere else to avoid recompiling? */
@@ -798,6 +799,180 @@ change_okay:
return old_fsgid;
}
+static int swcreds_release(struct inode *inode, struct file *file)
+{
+ return 0;
+}
+
+#ifdef CONFIG_PROC_FS
+static int swcreds_show_fdinfo(struct seq_file *m, struct file *f)
+{
+ const struct group_info *group_info = f->f_cred->group_info;
+ int ret;
+
+ ret = seq_printf(m, "setcreds: fsuid = %d, fsgid = %d, ngroups = %d\n",
+ from_kuid_munged(current_user_ns(),
+ f->f_cred->fsuid),
+ from_kgid_munged(current_user_ns(),
+ f->f_cred->fsgid),
+ group_info->ngroups);
+ if (!ret) {
+ int i;
+
+ for (i = 0; i < f->f_cred->group_info->ngroups; i++) {
+ ret = seq_printf(m, "altgroup[%d] = %d\n",
+ i,
+ from_kgid_munged(current_user_ns(),
+ GROUP_AT(group_info,
+ i)));
+ if (ret)
+ break;
+ }
+ }
+ return ret;
+}
+#endif
+
+static const struct file_operations swcreds_fops = {
+#ifdef CONFIG_PROC_FS
+ .show_fdinfo = swcreds_show_fdinfo,
+#endif
+ .release = swcreds_release
+};
+
+/* do_switch_creds - set thread creds from struct pointed to by arg
+ *
+ * Does setfsuid, setfsgid, setgroups for thread in one call and one rcu update.
+ * drop special root capabilities as well which are not dropped by setfsuid.
+ * This code is similar to nfsd_setuid in concept.
+ */
+
+static int do_switch_creds(unsigned long arg)
+{
+ const struct user_creds __user *creds;
+ const gid_t __user *alt_groups;
+ const struct cred *old = current_cred();
+ int i, new_fd;
+ struct cred *new;
+ struct user_creds ncred;
+ struct group_info *group_info;
+ int retval;
+
+ creds = (const struct user_creds __user *)arg;
+ /* validate and copyin creds */
+ if (copy_from_user(&ncred, creds, sizeof(struct user_creds)))
+ return -EFAULT;
+
+ if (ncred.ngroups > NGROUPS_MAX)
+ return -EINVAL;
+ new = prepare_creds();
+ if (!new)
+ return -ENOMEM;
+ group_info = groups_alloc(ncred.ngroups);
+ if (!group_info) {
+ abort_creds(new);
+ return -ENOMEM;
+ }
+ new->fsuid = make_kuid(old->user_ns, ncred.uid);
+ new->fsgid = make_kgid(old->user_ns, ncred.gid);
+ alt_groups = &creds->altgroups[0];
+ for (i = 0; i < ncred.ngroups; i++) {
+ kgid_t kgid;
+ gid_t gid;
+
+ if (get_user(gid, alt_groups+i)) {
+ retval = -EFAULT;
+ goto bad_altgrp;
+ }
+ kgid = make_kgid(old->user_ns, gid);
+ if (!gid_valid(kgid)) {
+ retval = -EINVAL;
+ goto bad_altgrp;
+ }
+ GROUP_AT(group_info, i) = kgid;
+ }
+ retval = set_groups(new, group_info);
+ put_group_info(group_info);
+ if (retval < 0) {
+ abort_creds(new);
+ return retval;
+ }
+ /* We need to be the real user in capabilities as well.
+ * don't leak my root caps into the mix */
+ new->cap_effective = cap_drop_nfsd_set(new->cap_effective);
+ old = override_creds(new);
+ /* now open a anon file to preserve these creds
+ * and return the fd
+ */
+ new_fd = anon_inode_getfd("[switch_creds]",
+ &swcreds_fops,
+ NULL,
+ (O_RDONLY|O_CLOEXEC));
+ if (new_fd < 0) {
+ revert_creds(old);
+ abort_creds(new);
+ }
+ return new_fd;
+
+bad_altgrp:
+ put_group_info(group_info);
+ abort_creds(new);
+ return retval;
+}
+
+/**
+ * switch_creds -- Change user (client) file system credentials
+ *
+ * Switch the thread's current file access credentials from the argument.
+ * The end result is the thread has the fsuid, fsgid, altgroups and
+ * non-root capabilities of the user we want to be for subsequent syscalls.
+ *
+ * @cmd SWCREDS_REVERT revert thread's creds to its real creds.
+ * Always returns 0
+ * SWCREDS_FROM_FD override current creds with creds from open file.
+ * Returns 0 or file related error.
+ * SWCREDS_FSIDS set fsuid, fsgid, altgroups from arg
+ * Return fd or error
+ * @arg fd or pointer to creds struct
+ *
+ * The returned fd is a somewhat useless but minimally resource consuming
+ * anon file that can only be used to store the new creds state.
+ *
+ * Return 0, fd, or error.
+ */
+
+SYSCALL_DEFINE2(switch_creds, int, cmd, unsigned long, arg)
+{
+ const struct cred *old;
+
+ old = current_cred();
+ if (!ns_capable(old->user_ns, CAP_SETGID) ||
+ !ns_capable(old->user_ns, CAP_SETUID))
+ return -EPERM;
+
+ if (cmd == SWCREDS_REVERT) {
+ if (current->real_cred != current->cred) {
+ revert_creds(current->real_cred);
+ return 0;
+ }
+ }
+ if (cmd == SWCREDS_FROMFD) {
+ struct fd f;
+ const struct cred *file_cred;
+
+ f = fdget(arg);
+ if (unlikely(!f.file))
+ return -EBADF;
+ file_cred = f.file->f_cred;
+ (void)override_creds(file_cred);
+ fdput(f);
+ return 0;
+ } else if (cmd == SWCREDS_FSIDS) {
+ return do_switch_creds(arg);
+ }
+ return -EINVAL;
+}
+
/**
* sys_getpid - return the thread group id of the current process
*
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 7078052..7573cad 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -209,3 +209,6 @@ cond_syscall(compat_sys_open_by_handle_at);
/* compare kernel pointers */
cond_syscall(sys_kcmp);
+
+/* switch task creds */
+cond_syscall(sys_switch_creds);
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists