kern_prot.c revision 83742
1/* 2 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993 3 * The Regents of the University of California. All rights reserved. 4 * Copyright (c) 2000, 2001 Robert N. M. Watson. All rights reserved. 5 * (c) UNIX System Laboratories, Inc. 6 * All or some portions of this file are derived from material licensed 7 * to the University of California by American Telephone and Telegraph 8 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 9 * the permission of UNIX System Laboratories, Inc. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the University of 22 * California, Berkeley and its contributors. 23 * 4. Neither the name of the University nor the names of its contributors 24 * may be used to endorse or promote products derived from this software 25 * without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94 40 * $FreeBSD: head/sys/kern/kern_prot.c 83742 2001-09-20 21:45:31Z rwatson $ 41 */ 42 43/* 44 * System calls related to processes and protection 45 */ 46 47#include "opt_compat.h" 48#include "opt_global.h" 49 50#include <sys/param.h> 51#include <sys/systm.h> 52#include <sys/acct.h> 53#include <sys/kernel.h> 54#include <sys/lock.h> 55#include <sys/mutex.h> 56#include <sys/proc.h> 57#include <sys/sysproto.h> 58#include <sys/malloc.h> 59#include <sys/pioctl.h> 60#include <sys/resourcevar.h> 61#include <sys/sysctl.h> 62#include <sys/jail.h> 63 64static MALLOC_DEFINE(M_CRED, "cred", "credentials"); 65 66SYSCTL_NODE(_kern, OID_AUTO, security, CTLFLAG_RW, 0, 67 "Kernel security policy"); 68 69#ifndef _SYS_SYSPROTO_H_ 70struct getpid_args { 71 int dummy; 72}; 73#endif 74 75/* 76 * getpid 77 */ 78 79/* 80 * MPSAFE 81 */ 82/* ARGSUSED */ 83int 84getpid(td, uap) 85 struct thread *td; 86 struct getpid_args *uap; 87{ 88 struct proc *p = td->td_proc; 89 90 mtx_lock(&Giant); 91 td->td_retval[0] = p->p_pid; 92#if defined(COMPAT_43) || defined(COMPAT_SUNOS) 93 PROC_LOCK(p); 94 td->td_retval[1] = p->p_pptr->p_pid; 95 PROC_UNLOCK(p); 96#endif 97 mtx_unlock(&Giant); 98 return (0); 99} 100 101/* 102 * getppid 103 */ 104 105#ifndef _SYS_SYSPROTO_H_ 106struct getppid_args { 107 int dummy; 108}; 109#endif 110/* 111 * MPSAFE 112 */ 113/* ARGSUSED */ 114int 115getppid(td, uap) 116 struct thread *td; 117 struct getppid_args *uap; 118{ 119 struct proc *p = td->td_proc; 120 121 mtx_lock(&Giant); 122 PROC_LOCK(p); 123 td->td_retval[0] = p->p_pptr->p_pid; 124 PROC_UNLOCK(p); 125 mtx_unlock(&Giant); 126 return (0); 127} 128 129/* 130 * Get process group ID; note that POSIX getpgrp takes no parameter 131 * 132 * MP SAFE 133 */ 134#ifndef _SYS_SYSPROTO_H_ 135struct getpgrp_args { 136 int dummy; 137}; 138#endif 139/* 140 * MPSAFE 141 */ 142int 143getpgrp(td, uap) 144 struct thread *td; 145 struct getpgrp_args *uap; 146{ 147 struct proc *p = td->td_proc; 148 149 mtx_lock(&Giant); 150 td->td_retval[0] = p->p_pgrp->pg_id; 151 mtx_unlock(&Giant); 152 return (0); 153} 154 155/* Get an arbitary pid's process group id */ 156#ifndef _SYS_SYSPROTO_H_ 157struct getpgid_args { 158 pid_t pid; 159}; 160#endif 161 162/* 163 * MPSAFE 164 */ 165int 166getpgid(td, uap) 167 struct thread *td; 168 struct getpgid_args *uap; 169{ 170 struct proc *p = td->td_proc; 171 struct proc *pt; 172 int error = 0; 173 174 mtx_lock(&Giant); 175 if (uap->pid == 0) 176 td->td_retval[0] = p->p_pgrp->pg_id; 177 else { 178 if ((pt = pfind(uap->pid)) == NULL) { 179 error = ESRCH; 180 goto done2; 181 } 182 if ((error = p_cansee(p, pt))) { 183 PROC_UNLOCK(pt); 184 goto done2; 185 } 186 td->td_retval[0] = pt->p_pgrp->pg_id; 187 PROC_UNLOCK(pt); 188 } 189done2: 190 mtx_unlock(&Giant); 191 return (error); 192} 193 194/* 195 * Get an arbitary pid's session id. 196 */ 197#ifndef _SYS_SYSPROTO_H_ 198struct getsid_args { 199 pid_t pid; 200}; 201#endif 202 203/* 204 * MPSAFE 205 */ 206int 207getsid(td, uap) 208 struct thread *td; 209 struct getsid_args *uap; 210{ 211 struct proc *p = td->td_proc; 212 struct proc *pt; 213 int error = 0; 214 215 mtx_lock(&Giant); 216 if (uap->pid == 0) { 217 td->td_retval[0] = p->p_session->s_sid; 218 } else { 219 if ((pt = pfind(uap->pid)) == NULL) { 220 error = ESRCH; 221 goto done2; 222 } 223 if ((error = p_cansee(p, pt))) { 224 PROC_UNLOCK(pt); 225 goto done2; 226 } 227 td->td_retval[0] = pt->p_session->s_sid; 228 PROC_UNLOCK(pt); 229 } 230done2: 231 mtx_unlock(&Giant); 232 return (error); 233} 234 235 236/* 237 * getuid() - MP SAFE 238 */ 239#ifndef _SYS_SYSPROTO_H_ 240struct getuid_args { 241 int dummy; 242}; 243#endif 244 245/* 246 * MPSAFE 247 */ 248/* ARGSUSED */ 249int 250getuid(td, uap) 251 struct thread *td; 252 struct getuid_args *uap; 253{ 254 struct proc *p = td->td_proc; 255 256 mtx_lock(&Giant); 257 td->td_retval[0] = p->p_ucred->cr_ruid; 258#if defined(COMPAT_43) || defined(COMPAT_SUNOS) 259 td->td_retval[1] = p->p_ucred->cr_uid; 260#endif 261 mtx_unlock(&Giant); 262 return (0); 263} 264 265/* 266 * geteuid() - MP SAFE 267 */ 268#ifndef _SYS_SYSPROTO_H_ 269struct geteuid_args { 270 int dummy; 271}; 272#endif 273 274/* ARGSUSED */ 275int 276geteuid(td, uap) 277 struct thread *td; 278 struct geteuid_args *uap; 279{ 280 mtx_lock(&Giant); 281 td->td_retval[0] = td->td_proc->p_ucred->cr_uid; 282 mtx_unlock(&Giant); 283 return (0); 284} 285 286/* 287 * getgid() - MP SAFE 288 */ 289#ifndef _SYS_SYSPROTO_H_ 290struct getgid_args { 291 int dummy; 292}; 293#endif 294 295/* 296 * MPSAFE 297 */ 298/* ARGSUSED */ 299int 300getgid(td, uap) 301 struct thread *td; 302 struct getgid_args *uap; 303{ 304 struct proc *p = td->td_proc; 305 306 mtx_lock(&Giant); 307 td->td_retval[0] = p->p_ucred->cr_rgid; 308#if defined(COMPAT_43) || defined(COMPAT_SUNOS) 309 td->td_retval[1] = p->p_ucred->cr_groups[0]; 310#endif 311 mtx_unlock(&Giant); 312 return (0); 313} 314 315/* 316 * Get effective group ID. The "egid" is groups[0], and could be obtained 317 * via getgroups. This syscall exists because it is somewhat painful to do 318 * correctly in a library function. 319 */ 320#ifndef _SYS_SYSPROTO_H_ 321struct getegid_args { 322 int dummy; 323}; 324#endif 325 326/* 327 * MPSAFE 328 */ 329/* ARGSUSED */ 330int 331getegid(td, uap) 332 struct thread *td; 333 struct getegid_args *uap; 334{ 335 struct proc *p = td->td_proc; 336 337 mtx_lock(&Giant); 338 td->td_retval[0] = p->p_ucred->cr_groups[0]; 339 mtx_unlock(&Giant); 340 return (0); 341} 342 343#ifndef _SYS_SYSPROTO_H_ 344struct getgroups_args { 345 u_int gidsetsize; 346 gid_t *gidset; 347}; 348#endif 349/* 350 * MPSAFE 351 */ 352int 353getgroups(td, uap) 354 struct thread *td; 355 register struct getgroups_args *uap; 356{ 357 struct ucred *cred; 358 struct proc *p = td->td_proc; 359 u_int ngrp; 360 int error = 0; 361 362 mtx_lock(&Giant); 363 cred = p->p_ucred; 364 if ((ngrp = uap->gidsetsize) == 0) { 365 td->td_retval[0] = cred->cr_ngroups; 366 error = 0; 367 goto done2; 368 } 369 if (ngrp < cred->cr_ngroups) { 370 error = EINVAL; 371 goto done2; 372 } 373 ngrp = cred->cr_ngroups; 374 if ((error = copyout((caddr_t)cred->cr_groups, 375 (caddr_t)uap->gidset, ngrp * sizeof(gid_t)))) { 376 goto done2; 377 } 378 td->td_retval[0] = ngrp; 379done2: 380 mtx_unlock(&Giant); 381 return (error); 382} 383 384#ifndef _SYS_SYSPROTO_H_ 385struct setsid_args { 386 int dummy; 387}; 388#endif 389 390/* 391 * MPSAFE 392 */ 393/* ARGSUSED */ 394int 395setsid(td, uap) 396 register struct thread *td; 397 struct setsid_args *uap; 398{ 399 int error; 400 struct proc *p = td->td_proc; 401 402 mtx_lock(&Giant); 403 if (p->p_pgid == p->p_pid || pgfind(p->p_pid)) { 404 error = EPERM; 405 } else { 406 (void)enterpgrp(p, p->p_pid, 1); 407 td->td_retval[0] = p->p_pid; 408 error = 0; 409 } 410 mtx_unlock(&Giant); 411 return (error); 412} 413 414/* 415 * set process group (setpgid/old setpgrp) 416 * 417 * caller does setpgid(targpid, targpgid) 418 * 419 * pid must be caller or child of caller (ESRCH) 420 * if a child 421 * pid must be in same session (EPERM) 422 * pid can't have done an exec (EACCES) 423 * if pgid != pid 424 * there must exist some pid in same session having pgid (EPERM) 425 * pid must not be session leader (EPERM) 426 */ 427#ifndef _SYS_SYSPROTO_H_ 428struct setpgid_args { 429 int pid; /* target process id */ 430 int pgid; /* target pgrp id */ 431}; 432#endif 433/* 434 * MPSAFE 435 */ 436/* ARGSUSED */ 437int 438setpgid(td, uap) 439 struct thread *td; 440 register struct setpgid_args *uap; 441{ 442 struct proc *curp = td->td_proc; 443 register struct proc *targp; /* target process */ 444 register struct pgrp *pgrp; /* target pgrp */ 445 int error; 446 447 if (uap->pgid < 0) 448 return (EINVAL); 449 450 mtx_lock(&Giant); 451 452 if (uap->pid != 0 && uap->pid != curp->p_pid) { 453 if ((targp = pfind(uap->pid)) == NULL || !inferior(targp)) { 454 if (targp) 455 PROC_UNLOCK(targp); 456 error = ESRCH; 457 goto done2; 458 } 459 if ((error = p_cansee(curproc, targp))) { 460 PROC_UNLOCK(targp); 461 goto done2; 462 } 463 if (targp->p_pgrp == NULL || 464 targp->p_session != curp->p_session) { 465 PROC_UNLOCK(targp); 466 error = EPERM; 467 goto done2; 468 } 469 if (targp->p_flag & P_EXEC) { 470 PROC_UNLOCK(targp); 471 error = EACCES; 472 goto done2; 473 } 474 } else { 475 targp = curp; 476 PROC_LOCK(curp); /* XXX: not needed */ 477 } 478 if (SESS_LEADER(targp)) { 479 PROC_UNLOCK(targp); 480 error = EPERM; 481 goto done2; 482 } 483 if (uap->pgid == 0) { 484 uap->pgid = targp->p_pid; 485 } else if (uap->pgid != targp->p_pid) { 486 if ((pgrp = pgfind(uap->pgid)) == 0 || 487 pgrp->pg_session != curp->p_session) { 488 PROC_UNLOCK(targp); 489 error = EPERM; 490 goto done2; 491 } 492 } 493 /* XXX: We should probably hold the lock across enterpgrp. */ 494 PROC_UNLOCK(targp); 495 error = enterpgrp(targp, uap->pgid, 0); 496done2: 497 mtx_unlock(&Giant); 498 return (error); 499} 500 501/* 502 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD 503 * compatible. It says that setting the uid/gid to euid/egid is a special 504 * case of "appropriate privilege". Once the rules are expanded out, this 505 * basically means that setuid(nnn) sets all three id's, in all permitted 506 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid()) 507 * does not set the saved id - this is dangerous for traditional BSD 508 * programs. For this reason, we *really* do not want to set 509 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2. 510 */ 511#define POSIX_APPENDIX_B_4_2_2 512 513#ifndef _SYS_SYSPROTO_H_ 514struct setuid_args { 515 uid_t uid; 516}; 517#endif 518/* 519 * MPSAFE 520 */ 521/* ARGSUSED */ 522int 523setuid(td, uap) 524 struct thread *td; 525 struct setuid_args *uap; 526{ 527 struct proc *p = td->td_proc; 528 struct ucred *newcred, *oldcred; 529 uid_t uid; 530 int error = 0; 531 532 uid = uap->uid; 533 oldcred = p->p_ucred; 534 mtx_lock(&Giant); 535 536 /* 537 * See if we have "permission" by POSIX 1003.1 rules. 538 * 539 * Note that setuid(geteuid()) is a special case of 540 * "appropriate privileges" in appendix B.4.2.2. We need 541 * to use this clause to be compatible with traditional BSD 542 * semantics. Basically, it means that "setuid(xx)" sets all 543 * three id's (assuming you have privs). 544 * 545 * Notes on the logic. We do things in three steps. 546 * 1: We determine if the euid is going to change, and do EPERM 547 * right away. We unconditionally change the euid later if this 548 * test is satisfied, simplifying that part of the logic. 549 * 2: We determine if the real and/or saved uid's are going to 550 * change. Determined by compile options. 551 * 3: Change euid last. (after tests in #2 for "appropriate privs") 552 */ 553 if (uid != oldcred->cr_ruid && /* allow setuid(getuid()) */ 554#ifdef _POSIX_SAVED_IDS 555 uid != oldcred->cr_svuid && /* allow setuid(saved gid) */ 556#endif 557#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 558 uid != oldcred->cr_uid && /* allow setuid(geteuid()) */ 559#endif 560 (error = suser_xxx(oldcred, NULL, PRISON_ROOT))) 561 goto done2; 562 563 newcred = crdup(oldcred); 564#ifdef _POSIX_SAVED_IDS 565 /* 566 * Do we have "appropriate privileges" (are we root or uid == euid) 567 * If so, we are changing the real uid and/or saved uid. 568 */ 569 if ( 570#ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */ 571 uid == oldcred->cr_uid || 572#endif 573 suser_xxx(oldcred, NULL, PRISON_ROOT) == 0) /* we are using privs */ 574#endif 575 { 576 /* 577 * Set the real uid and transfer proc count to new user. 578 */ 579 if (uid != oldcred->cr_ruid) { 580 change_ruid(newcred, uid); 581 setsugid(p); 582 } 583 /* 584 * Set saved uid 585 * 586 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as 587 * the security of seteuid() depends on it. B.4.2.2 says it 588 * is important that we should do this. 589 */ 590 if (uid != oldcred->cr_svuid) { 591 change_svuid(newcred, uid); 592 setsugid(p); 593 } 594 } 595 596 /* 597 * In all permitted cases, we are changing the euid. 598 * Copy credentials so other references do not see our changes. 599 */ 600 if (uid != oldcred->cr_uid) { 601 change_euid(newcred, uid); 602 setsugid(p); 603 } 604 p->p_ucred = newcred; 605 crfree(oldcred); 606done2: 607 mtx_unlock(&Giant); 608 return (error); 609} 610 611#ifndef _SYS_SYSPROTO_H_ 612struct seteuid_args { 613 uid_t euid; 614}; 615#endif 616/* 617 * MPSAFE 618 */ 619/* ARGSUSED */ 620int 621seteuid(td, uap) 622 struct thread *td; 623 struct seteuid_args *uap; 624{ 625 struct proc *p = td->td_proc; 626 struct ucred *newcred, *oldcred; 627 uid_t euid; 628 int error = 0; 629 630 euid = uap->euid; 631 632 mtx_lock(&Giant); 633 oldcred = p->p_ucred; 634 if (euid != oldcred->cr_ruid && /* allow seteuid(getuid()) */ 635 euid != oldcred->cr_svuid && /* allow seteuid(saved uid) */ 636 (error = suser_xxx(oldcred, NULL, PRISON_ROOT))) { 637 goto done2; 638 } 639 /* 640 * Everything's okay, do it. Copy credentials so other references do 641 * not see our changes. 642 */ 643 newcred = crdup(oldcred); 644 if (oldcred->cr_uid != euid) { 645 change_euid(newcred, euid); 646 setsugid(p); 647 } 648 p->p_ucred = newcred; 649 crfree(oldcred); 650done2: 651 mtx_unlock(&Giant); 652 return (error); 653} 654 655#ifndef _SYS_SYSPROTO_H_ 656struct setgid_args { 657 gid_t gid; 658}; 659#endif 660/* 661 * MPSAFE 662 */ 663/* ARGSUSED */ 664int 665setgid(td, uap) 666 struct thread *td; 667 struct setgid_args *uap; 668{ 669 struct proc *p = td->td_proc; 670 struct ucred *newcred, *oldcred; 671 gid_t gid; 672 int error = 0; 673 674 gid = uap->gid; 675 676 mtx_lock(&Giant); 677 oldcred = p->p_ucred; 678 /* 679 * See if we have "permission" by POSIX 1003.1 rules. 680 * 681 * Note that setgid(getegid()) is a special case of 682 * "appropriate privileges" in appendix B.4.2.2. We need 683 * to use this clause to be compatible with traditional BSD 684 * semantics. Basically, it means that "setgid(xx)" sets all 685 * three id's (assuming you have privs). 686 * 687 * For notes on the logic here, see setuid() above. 688 */ 689 if (gid != oldcred->cr_rgid && /* allow setgid(getgid()) */ 690#ifdef _POSIX_SAVED_IDS 691 gid != oldcred->cr_svgid && /* allow setgid(saved gid) */ 692#endif 693#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 694 gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */ 695#endif 696 (error = suser_xxx(oldcred, NULL, PRISON_ROOT))) { 697 goto done2; 698 } 699 700 newcred = crdup(oldcred); 701#ifdef _POSIX_SAVED_IDS 702 /* 703 * Do we have "appropriate privileges" (are we root or gid == egid) 704 * If so, we are changing the real uid and saved gid. 705 */ 706 if ( 707#ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */ 708 gid == oldcred->cr_groups[0] || 709#endif 710 suser_xxx(oldcred, NULL, PRISON_ROOT) == 0) /* we are using privs */ 711#endif 712 { 713 /* 714 * Set real gid 715 */ 716 if (oldcred->cr_rgid != gid) { 717 change_rgid(newcred, gid); 718 setsugid(p); 719 } 720 /* 721 * Set saved gid 722 * 723 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as 724 * the security of setegid() depends on it. B.4.2.2 says it 725 * is important that we should do this. 726 */ 727 if (oldcred->cr_svgid != gid) { 728 change_svgid(newcred, gid); 729 setsugid(p); 730 } 731 } 732 /* 733 * In all cases permitted cases, we are changing the egid. 734 * Copy credentials so other references do not see our changes. 735 */ 736 if (oldcred->cr_groups[0] != gid) { 737 change_egid(newcred, gid); 738 setsugid(p); 739 } 740 p->p_ucred = newcred; 741 crfree(oldcred); 742done2: 743 mtx_unlock(&Giant); 744 return (error); 745} 746 747#ifndef _SYS_SYSPROTO_H_ 748struct setegid_args { 749 gid_t egid; 750}; 751#endif 752/* 753 * MPSAFE 754 */ 755/* ARGSUSED */ 756int 757setegid(td, uap) 758 struct thread *td; 759 struct setegid_args *uap; 760{ 761 struct proc *p = td->td_proc; 762 struct ucred *newcred, *oldcred; 763 gid_t egid; 764 int error = 0; 765 766 egid = uap->egid; 767 768 mtx_lock(&Giant); 769 oldcred = p->p_ucred; 770 if (egid != oldcred->cr_rgid && /* allow setegid(getgid()) */ 771 egid != oldcred->cr_svgid && /* allow setegid(saved gid) */ 772 (error = suser_xxx(oldcred, NULL, PRISON_ROOT))) { 773 goto done2; 774 } 775 newcred = crdup(oldcred); 776 if (oldcred->cr_groups[0] != egid) { 777 change_egid(newcred, egid); 778 setsugid(p); 779 } 780 p->p_ucred = newcred; 781 crfree(oldcred); 782done2: 783 mtx_unlock(&Giant); 784 return (error); 785} 786 787#ifndef _SYS_SYSPROTO_H_ 788struct setgroups_args { 789 u_int gidsetsize; 790 gid_t *gidset; 791}; 792#endif 793/* 794 * MPSAFE 795 */ 796/* ARGSUSED */ 797int 798setgroups(td, uap) 799 struct thread *td; 800 struct setgroups_args *uap; 801{ 802 struct proc *p = td->td_proc; 803 struct ucred *newcred, *oldcred; 804 u_int ngrp; 805 int error; 806 807 mtx_lock(&Giant); 808 809 ngrp = uap->gidsetsize; 810 oldcred = p->p_ucred; 811 if ((error = suser_xxx(oldcred, NULL, PRISON_ROOT))) 812 goto done2; 813 if (ngrp > NGROUPS) { 814 error = EINVAL; 815 goto done2; 816 } 817 /* 818 * XXX A little bit lazy here. We could test if anything has 819 * changed before crcopy() and setting P_SUGID. 820 */ 821 newcred = crdup(oldcred); 822 if (ngrp < 1) { 823 /* 824 * setgroups(0, NULL) is a legitimate way of clearing the 825 * groups vector on non-BSD systems (which generally do not 826 * have the egid in the groups[0]). We risk security holes 827 * when running non-BSD software if we do not do the same. 828 */ 829 newcred->cr_ngroups = 1; 830 } else { 831 if ((error = copyin((caddr_t)uap->gidset, 832 (caddr_t)newcred->cr_groups, ngrp * sizeof(gid_t)))) { 833 crfree(newcred); 834 goto done2; 835 } 836 newcred->cr_ngroups = ngrp; 837 } 838 setsugid(p); 839 p->p_ucred = newcred; 840 crfree(oldcred); 841done2: 842 mtx_unlock(&Giant); 843 return (error); 844} 845 846#ifndef _SYS_SYSPROTO_H_ 847struct setreuid_args { 848 uid_t ruid; 849 uid_t euid; 850}; 851#endif 852/* 853 * MPSAFE 854 */ 855/* ARGSUSED */ 856int 857setreuid(td, uap) 858 register struct thread *td; 859 struct setreuid_args *uap; 860{ 861 struct proc *p = td->td_proc; 862 struct ucred *newcred, *oldcred; 863 uid_t ruid, euid; 864 int error = 0; 865 866 ruid = uap->ruid; 867 euid = uap->euid; 868 869 mtx_lock(&Giant); 870 871 oldcred = p->p_ucred; 872 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 873 ruid != oldcred->cr_svuid) || 874 (euid != (uid_t)-1 && euid != oldcred->cr_uid && 875 euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) && 876 (error = suser_xxx(oldcred, NULL, PRISON_ROOT)) != 0) { 877 goto done2; 878 } 879 newcred = crdup(oldcred); 880 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 881 change_euid(newcred, euid); 882 setsugid(p); 883 } 884 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 885 change_ruid(newcred, ruid); 886 setsugid(p); 887 } 888 if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) && 889 newcred->cr_svuid != newcred->cr_uid) { 890 change_svuid(newcred, newcred->cr_uid); 891 setsugid(p); 892 } 893 p->p_ucred = newcred; 894 crfree(oldcred); 895done2: 896 mtx_unlock(&Giant); 897 return (error); 898} 899 900#ifndef _SYS_SYSPROTO_H_ 901struct setregid_args { 902 gid_t rgid; 903 gid_t egid; 904}; 905#endif 906/* 907 * MPSAFE 908 */ 909/* ARGSUSED */ 910int 911setregid(td, uap) 912 register struct thread *td; 913 struct setregid_args *uap; 914{ 915 struct proc *p = td->td_proc; 916 struct ucred *newcred, *oldcred; 917 gid_t rgid, egid; 918 int error = 0; 919 920 rgid = uap->rgid; 921 egid = uap->egid; 922 923 mtx_lock(&Giant); 924 925 oldcred = p->p_ucred; 926 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 927 rgid != oldcred->cr_svgid) || 928 (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] && 929 egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) && 930 (error = suser_xxx(oldcred, NULL, PRISON_ROOT)) != 0) { 931 goto done2; 932 } 933 934 newcred = crdup(oldcred); 935 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 936 change_egid(newcred, egid); 937 setsugid(p); 938 } 939 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 940 change_rgid(newcred, rgid); 941 setsugid(p); 942 } 943 if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) && 944 newcred->cr_svgid != newcred->cr_groups[0]) { 945 change_svgid(newcred, newcred->cr_groups[0]); 946 setsugid(p); 947 } 948 p->p_ucred = newcred; 949 crfree(oldcred); 950done2: 951 mtx_unlock(&Giant); 952 return (error); 953} 954 955/* 956 * setresuid(ruid, euid, suid) is like setreuid except control over the 957 * saved uid is explicit. 958 */ 959 960#ifndef _SYS_SYSPROTO_H_ 961struct setresuid_args { 962 uid_t ruid; 963 uid_t euid; 964 uid_t suid; 965}; 966#endif 967/* 968 * MPSAFE 969 */ 970/* ARGSUSED */ 971int 972setresuid(td, uap) 973 register struct thread *td; 974 struct setresuid_args *uap; 975{ 976 struct proc *p = td->td_proc; 977 struct ucred *newcred, *oldcred; 978 uid_t ruid, euid, suid; 979 int error; 980 981 ruid = uap->ruid; 982 euid = uap->euid; 983 suid = uap->suid; 984 985 mtx_lock(&Giant); 986 oldcred = p->p_ucred; 987 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 988 ruid != oldcred->cr_svuid && 989 ruid != oldcred->cr_uid) || 990 (euid != (uid_t)-1 && euid != oldcred->cr_ruid && 991 euid != oldcred->cr_svuid && 992 euid != oldcred->cr_uid) || 993 (suid != (uid_t)-1 && suid != oldcred->cr_ruid && 994 suid != oldcred->cr_svuid && 995 suid != oldcred->cr_uid)) && 996 (error = suser_xxx(oldcred, NULL, PRISON_ROOT)) != 0) { 997 goto done2; 998 } 999 1000 newcred = crdup(oldcred); 1001 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 1002 change_euid(newcred, euid); 1003 setsugid(p); 1004 } 1005 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 1006 change_ruid(newcred, ruid); 1007 setsugid(p); 1008 } 1009 if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) { 1010 change_svuid(newcred, suid); 1011 setsugid(p); 1012 } 1013 p->p_ucred = newcred; 1014 crfree(oldcred); 1015 error = 0; 1016done2: 1017 mtx_unlock(&Giant); 1018 return (error); 1019} 1020 1021/* 1022 * setresgid(rgid, egid, sgid) is like setregid except control over the 1023 * saved gid is explicit. 1024 */ 1025 1026#ifndef _SYS_SYSPROTO_H_ 1027struct setresgid_args { 1028 gid_t rgid; 1029 gid_t egid; 1030 gid_t sgid; 1031}; 1032#endif 1033/* 1034 * MPSAFE 1035 */ 1036/* ARGSUSED */ 1037int 1038setresgid(td, uap) 1039 register struct thread *td; 1040 struct setresgid_args *uap; 1041{ 1042 struct proc *p = td->td_proc; 1043 struct ucred *newcred, *oldcred; 1044 gid_t rgid, egid, sgid; 1045 int error; 1046 1047 rgid = uap->rgid; 1048 egid = uap->egid; 1049 sgid = uap->sgid; 1050 1051 mtx_lock(&Giant); 1052 oldcred = p->p_ucred; 1053 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 1054 rgid != oldcred->cr_svgid && 1055 rgid != oldcred->cr_groups[0]) || 1056 (egid != (gid_t)-1 && egid != oldcred->cr_rgid && 1057 egid != oldcred->cr_svgid && 1058 egid != oldcred->cr_groups[0]) || 1059 (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid && 1060 sgid != oldcred->cr_svgid && 1061 sgid != oldcred->cr_groups[0])) && 1062 (error = suser_xxx(oldcred, NULL, PRISON_ROOT)) != 0) { 1063 goto done2; 1064 } 1065 newcred = crdup(oldcred); 1066 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 1067 change_egid(newcred, egid); 1068 setsugid(p); 1069 } 1070 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 1071 change_rgid(newcred, rgid); 1072 setsugid(p); 1073 } 1074 if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) { 1075 change_svgid(newcred, sgid); 1076 setsugid(p); 1077 } 1078 p->p_ucred = newcred; 1079 crfree(oldcred); 1080 error = 0; 1081done2: 1082 mtx_unlock(&Giant); 1083 return (error); 1084} 1085 1086#ifndef _SYS_SYSPROTO_H_ 1087struct getresuid_args { 1088 uid_t *ruid; 1089 uid_t *euid; 1090 uid_t *suid; 1091}; 1092#endif 1093/* 1094 * MPSAFE 1095 */ 1096/* ARGSUSED */ 1097int 1098getresuid(td, uap) 1099 register struct thread *td; 1100 struct getresuid_args *uap; 1101{ 1102 struct ucred *cred; 1103 struct proc *p = td->td_proc; 1104 int error1 = 0, error2 = 0, error3 = 0; 1105 1106 mtx_lock(&Giant); 1107 cred = p->p_ucred; 1108 1109 if (uap->ruid) 1110 error1 = copyout((caddr_t)&cred->cr_ruid, 1111 (caddr_t)uap->ruid, sizeof(cred->cr_ruid)); 1112 if (uap->euid) 1113 error2 = copyout((caddr_t)&cred->cr_uid, 1114 (caddr_t)uap->euid, sizeof(cred->cr_uid)); 1115 if (uap->suid) 1116 error3 = copyout((caddr_t)&cred->cr_svuid, 1117 (caddr_t)uap->suid, sizeof(cred->cr_svuid)); 1118 mtx_unlock(&Giant); 1119 return error1 ? error1 : (error2 ? error2 : error3); 1120} 1121 1122#ifndef _SYS_SYSPROTO_H_ 1123struct getresgid_args { 1124 gid_t *rgid; 1125 gid_t *egid; 1126 gid_t *sgid; 1127}; 1128#endif 1129/* 1130 * MPSAFE 1131 */ 1132/* ARGSUSED */ 1133int 1134getresgid(td, uap) 1135 register struct thread *td; 1136 struct getresgid_args *uap; 1137{ 1138 struct ucred *cred; 1139 struct proc *p = td->td_proc; 1140 int error1 = 0, error2 = 0, error3 = 0; 1141 1142 mtx_lock(&Giant); 1143 cred = p->p_ucred; 1144 1145 if (uap->rgid) 1146 error1 = copyout((caddr_t)&cred->cr_rgid, 1147 (caddr_t)uap->rgid, sizeof(cred->cr_rgid)); 1148 if (uap->egid) 1149 error2 = copyout((caddr_t)&cred->cr_groups[0], 1150 (caddr_t)uap->egid, sizeof(cred->cr_groups[0])); 1151 if (uap->sgid) 1152 error3 = copyout((caddr_t)&cred->cr_svgid, 1153 (caddr_t)uap->sgid, sizeof(cred->cr_svgid)); 1154 mtx_unlock(&Giant); 1155 return error1 ? error1 : (error2 ? error2 : error3); 1156} 1157 1158 1159#ifndef _SYS_SYSPROTO_H_ 1160struct issetugid_args { 1161 int dummy; 1162}; 1163#endif 1164/* ARGSUSED */ 1165int 1166issetugid(td, uap) 1167 register struct thread *td; 1168 struct issetugid_args *uap; 1169{ 1170 struct proc *p = td->td_proc; 1171 1172 /* 1173 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time, 1174 * we use P_SUGID because we consider changing the owners as 1175 * "tainting" as well. 1176 * This is significant for procs that start as root and "become" 1177 * a user without an exec - programs cannot know *everything* 1178 * that libc *might* have put in their data segment. 1179 */ 1180 td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0; 1181 return (0); 1182} 1183 1184/* 1185 * MPSAFE 1186 */ 1187int 1188__setugid(td, uap) 1189 struct thread *td; 1190 struct __setugid_args *uap; 1191{ 1192#ifdef REGRESSION 1193 int error = 0; 1194 1195 mtx_lock(&Giant); 1196 switch (uap->flag) { 1197 case 0: 1198 td->td_proc->p_flag &= ~P_SUGID; 1199 break; 1200 case 1: 1201 td->td_proc->p_flag |= P_SUGID; 1202 break; 1203 default: 1204 error = EINVAL; 1205 break; 1206 } 1207 mtx_unlock(&Giant); 1208 return (error); 1209#else /* !REGRESSION */ 1210 return (ENOSYS); 1211#endif /* !REGRESSION */ 1212} 1213 1214/* 1215 * Check if gid is a member of the group set. 1216 */ 1217int 1218groupmember(gid, cred) 1219 gid_t gid; 1220 struct ucred *cred; 1221{ 1222 register gid_t *gp; 1223 gid_t *egp; 1224 1225 egp = &(cred->cr_groups[cred->cr_ngroups]); 1226 for (gp = cred->cr_groups; gp < egp; gp++) 1227 if (*gp == gid) 1228 return (1); 1229 return (0); 1230} 1231 1232/* 1233 * `suser_enabled' (which can be set by the kern.security.suser_enabled 1234 * sysctl) determines whether the system 'super-user' policy is in effect. 1235 * If it is nonzero, an effective uid of 0 connotes special privilege, 1236 * overriding many mandatory and discretionary protections. If it is zero, 1237 * uid 0 is offered no special privilege in the kernel security policy. 1238 * Setting it to zero may seriously impact the functionality of many 1239 * existing userland programs, and should not be done without careful 1240 * consideration of the consequences. 1241 */ 1242int suser_enabled = 1; 1243SYSCTL_INT(_kern_security, OID_AUTO, suser_enabled, CTLFLAG_RW, 1244 &suser_enabled, 0, "processes with uid 0 have privilege"); 1245 1246/* 1247 * Test whether the specified credentials imply "super-user" privilege. 1248 * Return 0 or EPERM. 1249 */ 1250int 1251suser(p) 1252 struct proc *p; 1253{ 1254 return suser_xxx(0, p, 0); 1255} 1256 1257/* 1258 * version for when the thread pointer is available and not the proc. 1259 * (saves having to include proc.h into every file that needs to do the change.) 1260 */ 1261int 1262suser_td(td) 1263 1264 struct thread *td; 1265{ 1266 return suser_xxx(0, td->td_proc, 0); 1267} 1268 1269/* 1270 * wrapper to use if you have the thread on hand but not the proc. 1271 */ 1272int 1273suser_xxx_td(cred, td, flag) 1274 struct ucred *cred; 1275 struct thread *td; 1276 int flag; 1277{ 1278 return(suser_xxx(cred, td->td_proc, flag)); 1279} 1280 1281int 1282suser_xxx(cred, proc, flag) 1283 struct ucred *cred; 1284 struct proc *proc; 1285 int flag; 1286{ 1287 if (!suser_enabled) 1288 return (EPERM); 1289 if (!cred && !proc) { 1290 printf("suser_xxx(): THINK!\n"); 1291 return (EPERM); 1292 } 1293 if (!cred) 1294 cred = proc->p_ucred; 1295 if (cred->cr_uid != 0) 1296 return (EPERM); 1297 if (jailed(cred) && !(flag & PRISON_ROOT)) 1298 return (EPERM); 1299 return (0); 1300} 1301 1302 1303/* 1304 * Test securelevel values against passed required securelevel. 1305 * _gt implements (securelevel > level), and _ge implements 1306 * (securelevel >= level). Returns 0 oer EPERM. 1307 * 1308 * cr is permitted to be NULL for the time being, as there were some 1309 * existing securelevel checks that occurred without a process/credential 1310 * context. In the future this will be disallowed, so a kernel 1311 * message is displayed. 1312 * 1313 * XXX: The redundant construction below is to facilitate the merging 1314 * of support for per-jail securelevels, which maintain a local 1315 * jail securelevel in the process credential. 1316 */ 1317int 1318securelevel_gt(struct ucred *cr, int level) 1319{ 1320 1321 if (cr == NULL) { 1322 printf("securelevel_gt: cr is NULL\n"); 1323 if (securelevel > level) 1324 return (0); 1325 else 1326 return (EPERM); 1327 } else { 1328 if (securelevel > level) 1329 return (0); 1330 else 1331 return (EPERM); 1332 } 1333} 1334 1335int 1336securelevel_ge(struct ucred *cr, int level) 1337{ 1338 1339 if (cr == NULL) { 1340 printf("securelevel_ge: cr is NULL\n"); 1341 if (securelevel >= level) 1342 return (0); 1343 else 1344 return (EPERM); 1345 } else { 1346 if (securelevel >= level) 1347 return (0); 1348 else 1349 return (EPERM); 1350 } 1351} 1352 1353/*- 1354 * Determine if u1 "can see" the subject specified by u2. 1355 * Returns: 0 for permitted, an errno value otherwise 1356 * Locks: none 1357 * References: u1 and u2 must be immutable credentials 1358 * u1 and u2 must be valid for the lifetime of the call 1359 * u1 may equal u2, in which case only one reference is required 1360 */ 1361int 1362cr_cansee(struct ucred *u1, struct ucred *u2) 1363{ 1364 int error; 1365 1366 if ((error = prison_check(u1, u2))) 1367 return (error); 1368 if (!ps_showallprocs && u1->cr_ruid != u2->cr_ruid) { 1369 if (suser_xxx(u1, NULL, PRISON_ROOT) != 0) 1370 return (ESRCH); 1371 } 1372 return (0); 1373} 1374 1375/*- 1376 * Determine if p1 "can see" the subject specified by p2. 1377 * Returns: 0 for permitted, an errno value otherwise 1378 * Locks: Sufficient locks to protect p1->p_ucred and p2->p_ucred must 1379 * be held. Normally, p1 will be curproc, and a lock must be held 1380 * for p2. 1381 * References: p1 and p2 must be valid for the lifetime of the call 1382 */ 1383int 1384p_cansee(struct proc *p1, struct proc *p2) 1385{ 1386 1387 /* Wrap cr_cansee() for all functionality. */ 1388 return (cr_cansee(p1->p_ucred, p2->p_ucred)); 1389} 1390 1391/*- 1392 * Determine whether p1 may deliver the specified signal to p2. 1393 * Returns: 0 for permitted, an errno value otherwise 1394 * Locks: Sufficient locks to protect various components of p1 and p2 1395 * must be held. Normally, p1 will be curproc, and a lock must 1396 * be held for p2. 1397 * References: p1 and p2 must be valid for the lifetime of the call 1398 */ 1399int 1400p_cansignal(struct proc *p1, struct proc *p2, int signum) 1401{ 1402 int error; 1403 1404 if (p1 == p2) 1405 return (0); 1406 1407 /* 1408 * Jail semantics limit the scope of signalling to p2 in the same 1409 * jail as p1, if p1 is in jail. 1410 */ 1411 if ((error = prison_check(p1->p_ucred, p2->p_ucred))) 1412 return (error); 1413 1414 /* 1415 * UNIX signalling semantics require that processes in the same 1416 * session always be able to deliver SIGCONT to one another, 1417 * overriding the remaining protections. 1418 */ 1419 if (signum == SIGCONT && p1->p_session == p2->p_session) 1420 return (0); 1421 1422 /* 1423 * UNIX signal semantics depend on the status of the P_SUGID 1424 * bit on the target process. If the bit is set, then additional 1425 * restrictions are placed on the set of available signals. 1426 */ 1427 if (p2->p_flag & P_SUGID) { 1428 switch (signum) { 1429 case 0: 1430 case SIGKILL: 1431 case SIGINT: 1432 case SIGTERM: 1433 case SIGSTOP: 1434 case SIGTTIN: 1435 case SIGTTOU: 1436 case SIGTSTP: 1437 case SIGHUP: 1438 case SIGUSR1: 1439 case SIGUSR2: 1440 /* 1441 * Generally, permit job and terminal control 1442 * signals. 1443 */ 1444 break; 1445 default: 1446 /* Not permitted, privilege is required. */ 1447 error = suser_xxx(NULL, p1, PRISON_ROOT); 1448 if (error) 1449 return (error); 1450 } 1451 } 1452 1453 /* 1454 * Generally, the target credential's ruid or svuid must match the 1455 * subject credential's ruid or euid. 1456 */ 1457 if (p1->p_ucred->cr_ruid != p2->p_ucred->cr_ruid && 1458 p1->p_ucred->cr_ruid != p2->p_ucred->cr_svuid && 1459 p1->p_ucred->cr_uid != p2->p_ucred->cr_ruid && 1460 p1->p_ucred->cr_uid != p2->p_ucred->cr_svuid) { 1461 /* Not permitted, try privilege. */ 1462 error = suser_xxx(NULL, p1, PRISON_ROOT); 1463 if (error) 1464 return (error); 1465 } 1466 1467 return (0); 1468} 1469 1470/*- 1471 * Determine whether p1 may reschedule p2 1472 * Returns: 0 for permitted, an errno value otherwise 1473 * Locks: Sufficient locks to protect various components of p1 and p2 1474 * must be held. Normally, p1 will be curproc, and a lock must 1475 * be held for p2. 1476 * References: p1 and p2 must be valid for the lifetime of the call 1477 */ 1478int 1479p_cansched(struct proc *p1, struct proc *p2) 1480{ 1481 int error; 1482 1483 if (p1 == p2) 1484 return (0); 1485 if ((error = prison_check(p1->p_ucred, p2->p_ucred))) 1486 return (error); 1487 if (p1->p_ucred->cr_ruid == p2->p_ucred->cr_ruid) 1488 return (0); 1489 if (p1->p_ucred->cr_uid == p2->p_ucred->cr_ruid) 1490 return (0); 1491 if (suser_xxx(0, p1, PRISON_ROOT) == 0) 1492 return (0); 1493 1494#ifdef CAPABILITIES 1495 if (!cap_check_xxx(0, p1, CAP_SYS_NICE, PRISON_ROOT)) 1496 return (0); 1497#endif 1498 1499 return (EPERM); 1500} 1501 1502/* 1503 * The kern_unprivileged_procdebug_permitted flag may be used to disable 1504 * a variety of unprivileged inter-process debugging services, including 1505 * some procfs functionality, ptrace(), and ktrace(). In the past, 1506 * inter-process debugging has been involved in a variety of security 1507 * problems, and sites not requiring the service might choose to disable it 1508 * when hardening systems. 1509 * 1510 * XXX: Should modifying and reading this variable require locking? 1511 */ 1512static int kern_unprivileged_procdebug_permitted = 1; 1513SYSCTL_INT(_kern_security, OID_AUTO, unprivileged_procdebug_permitted, 1514 CTLFLAG_RW, &kern_unprivileged_procdebug_permitted, 0, 1515 "Unprivileged processes may use process debugging facilities"); 1516 1517/*- 1518 * Determine whether p1 may debug p2. 1519 * Returns: 0 for permitted, an errno value otherwise 1520 * Locks: Sufficient locks to protect various components of p1 and p2 1521 * must be held. Normally, p1 will be curproc, and a lock must 1522 * be held for p2. 1523 * References: p1 and p2 must be valid for the lifetime of the call 1524 */ 1525int 1526p_candebug(struct proc *p1, struct proc *p2) 1527{ 1528 int error; 1529 1530 if ((error = prison_check(p1->p_ucred, p2->p_ucred))) 1531 return (error); 1532 1533 /* 1534 * Not owned by you, has done setuid (unless you're root). 1535 * XXX add a CAP_SYS_PTRACE here? 1536 */ 1537 if (p1->p_ucred->cr_uid != p2->p_ucred->cr_uid || 1538 p1->p_ucred->cr_uid != p2->p_ucred->cr_svuid || 1539 p1->p_ucred->cr_uid != p2->p_ucred->cr_ruid || 1540 p2->p_flag & P_SUGID || !kern_unprivileged_procdebug_permitted) { 1541 if ((error = suser_xxx(0, p1, PRISON_ROOT)) != 0) 1542 return (error); 1543 } 1544 1545 /* can't trace init when securelevel > 0 */ 1546 if (p2->p_pid == 1) { 1547 error = securelevel_gt(p1->p_ucred, 0); 1548 if (error) 1549 return (error); 1550 } 1551 1552 return (0); 1553} 1554 1555/* 1556 * Allocate a zeroed cred structure. 1557 */ 1558struct ucred * 1559crget() 1560{ 1561 register struct ucred *cr; 1562 1563 MALLOC(cr, struct ucred *, sizeof(*cr), M_CRED, M_WAITOK|M_ZERO); 1564 cr->cr_ref = 1; 1565 mtx_init(&cr->cr_mtx, "ucred", MTX_DEF); 1566 return (cr); 1567} 1568 1569/* 1570 * Claim another reference to a ucred structure. 1571 */ 1572void 1573crhold(cr) 1574 struct ucred *cr; 1575{ 1576 1577 mtx_lock(&cr->cr_mtx); 1578 cr->cr_ref++; 1579 mtx_unlock(&(cr)->cr_mtx); 1580} 1581 1582 1583/* 1584 * Free a cred structure. 1585 * Throws away space when ref count gets to 0. 1586 */ 1587void 1588crfree(cr) 1589 struct ucred *cr; 1590{ 1591 1592 mtx_lock(&cr->cr_mtx); 1593 KASSERT(cr->cr_ref > 0, ("bad ucred refcount: %d", cr->cr_ref)); 1594 if (--cr->cr_ref == 0) { 1595 mtx_destroy(&cr->cr_mtx); 1596 /* 1597 * Some callers of crget(), such as nfs_statfs(), 1598 * allocate a temporary credential, but don't 1599 * allocate a uidinfo structure. 1600 */ 1601 if (cr->cr_uidinfo != NULL) 1602 uifree(cr->cr_uidinfo); 1603 if (cr->cr_ruidinfo != NULL) 1604 uifree(cr->cr_ruidinfo); 1605 /* 1606 * Free a prison, if any. 1607 */ 1608 if (jailed(cr)) 1609 prison_free(cr->cr_prison); 1610 FREE((caddr_t)cr, M_CRED); 1611 } else { 1612 mtx_unlock(&cr->cr_mtx); 1613 } 1614} 1615 1616/* 1617 * Copy cred structure to a new one and free the old one. 1618 */ 1619struct ucred * 1620crcopy(cr) 1621 struct ucred *cr; 1622{ 1623 struct ucred *newcr; 1624 1625 mtx_lock(&cr->cr_mtx); 1626 if (cr->cr_ref == 1) { 1627 mtx_unlock(&cr->cr_mtx); 1628 return (cr); 1629 } 1630 mtx_unlock(&cr->cr_mtx); 1631 newcr = crdup(cr); 1632 crfree(cr); 1633 return (newcr); 1634} 1635 1636/* 1637 * Dup cred struct to a new held one. 1638 */ 1639struct ucred * 1640crdup(cr) 1641 struct ucred *cr; 1642{ 1643 struct ucred *newcr; 1644 1645 MALLOC(newcr, struct ucred *, sizeof(*cr), M_CRED, M_WAITOK); 1646 *newcr = *cr; 1647 mtx_init(&newcr->cr_mtx, "ucred", MTX_DEF); 1648 uihold(newcr->cr_uidinfo); 1649 uihold(newcr->cr_ruidinfo); 1650 if (jailed(newcr)) 1651 prison_hold(newcr->cr_prison); 1652 newcr->cr_ref = 1; 1653 return (newcr); 1654} 1655 1656/* 1657 * Get login name, if available. 1658 */ 1659#ifndef _SYS_SYSPROTO_H_ 1660struct getlogin_args { 1661 char *namebuf; 1662 u_int namelen; 1663}; 1664#endif 1665/* 1666 * MPSAFE 1667 */ 1668/* ARGSUSED */ 1669int 1670getlogin(td, uap) 1671 struct thread *td; 1672 struct getlogin_args *uap; 1673{ 1674 int error; 1675 struct proc *p = td->td_proc; 1676 1677 mtx_lock(&Giant); 1678 if (uap->namelen > MAXLOGNAME) 1679 uap->namelen = MAXLOGNAME; 1680 error = copyout((caddr_t) p->p_pgrp->pg_session->s_login, 1681 (caddr_t) uap->namebuf, uap->namelen); 1682 mtx_unlock(&Giant); 1683 return(error); 1684} 1685 1686/* 1687 * Set login name. 1688 */ 1689#ifndef _SYS_SYSPROTO_H_ 1690struct setlogin_args { 1691 char *namebuf; 1692}; 1693#endif 1694/* 1695 * MPSAFE 1696 */ 1697/* ARGSUSED */ 1698int 1699setlogin(td, uap) 1700 struct thread *td; 1701 struct setlogin_args *uap; 1702{ 1703 struct proc *p = td->td_proc; 1704 int error; 1705 char logintmp[MAXLOGNAME]; 1706 1707 mtx_lock(&Giant); 1708 if ((error = suser_xxx(0, p, PRISON_ROOT))) 1709 goto done2; 1710 error = copyinstr((caddr_t) uap->namebuf, (caddr_t) logintmp, 1711 sizeof(logintmp), (size_t *)0); 1712 if (error == ENAMETOOLONG) { 1713 error = EINVAL; 1714 } else if (!error) { 1715 (void) memcpy(p->p_pgrp->pg_session->s_login, logintmp, 1716 sizeof(logintmp)); 1717 } 1718done2: 1719 mtx_unlock(&Giant); 1720 return (error); 1721} 1722 1723void 1724setsugid(p) 1725 struct proc *p; 1726{ 1727 p->p_flag |= P_SUGID; 1728 if (!(p->p_pfsflags & PF_ISUGID)) 1729 p->p_stops = 0; 1730} 1731 1732/*- 1733 * Change a process's effective uid. 1734 * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified. 1735 * References: newcred must be an exclusive credential reference for the 1736 * duration of the call. 1737 */ 1738void 1739change_euid(newcred, euid) 1740 struct ucred *newcred; 1741 uid_t euid; 1742{ 1743 1744 newcred->cr_uid = euid; 1745 uifree(newcred->cr_uidinfo); 1746 newcred->cr_uidinfo = uifind(euid); 1747} 1748 1749/*- 1750 * Change a process's effective gid. 1751 * Side effects: newcred->cr_gid will be modified. 1752 * References: newcred must be an exclusive credential reference for the 1753 * duration of the call. 1754 */ 1755void 1756change_egid(newcred, egid) 1757 struct ucred *newcred; 1758 gid_t egid; 1759{ 1760 1761 newcred->cr_groups[0] = egid; 1762} 1763 1764/*- 1765 * Change a process's real uid. 1766 * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo 1767 * will be updated, and the old and new cr_ruidinfo proc 1768 * counts will be updated. 1769 * References: newcred must be an exclusive credential reference for the 1770 * duration of the call. 1771 */ 1772void 1773change_ruid(newcred, ruid) 1774 struct ucred *newcred; 1775 uid_t ruid; 1776{ 1777 1778 (void)chgproccnt(newcred->cr_ruidinfo, -1, 0); 1779 newcred->cr_ruid = ruid; 1780 uifree(newcred->cr_ruidinfo); 1781 newcred->cr_ruidinfo = uifind(ruid); 1782 (void)chgproccnt(newcred->cr_ruidinfo, 1, 0); 1783} 1784 1785/*- 1786 * Change a process's real gid. 1787 * Side effects: newcred->cr_rgid will be updated. 1788 * References: newcred must be an exclusive credential reference for the 1789 * duration of the call. 1790 */ 1791void 1792change_rgid(newcred, rgid) 1793 struct ucred *newcred; 1794 gid_t rgid; 1795{ 1796 1797 newcred->cr_rgid = rgid; 1798} 1799 1800/*- 1801 * Change a process's saved uid. 1802 * Side effects: newcred->cr_svuid will be updated. 1803 * References: newcred must be an exclusive credential reference for the 1804 * duration of the call. 1805 */ 1806void 1807change_svuid(newcred, svuid) 1808 struct ucred *newcred; 1809 uid_t svuid; 1810{ 1811 1812 newcred->cr_svuid = svuid; 1813} 1814 1815/*- 1816 * Change a process's saved gid. 1817 * Side effects: newcred->cr_svgid will be updated. 1818 * References: newcred must be an exclusive credential reference for the 1819 * duration of the call. 1820 */ 1821void 1822change_svgid(newcred, svgid) 1823 struct ucred *newcred; 1824 gid_t svgid; 1825{ 1826 1827 newcred->cr_svgid = svgid; 1828} 1829