FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
linux/kernel/groups.c at master · fabgithub/linux · GitHub
fabgithub
linux
Repository navigation
Code
Pull requests
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
linux
/
kernel
/
groups.c
Copy path
More file actions
More file actions
Latest commit
History
History
History
281 lines (238 loc) · 5.98 KB
Breadcrumbs
linux
/
kernel
/
groups.c
Copy path
File metadata and controls
281 lines (238 loc) · 5.98 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
/*
* Supplementary group IDs
*/
#include
<linux/cred.h>
#include
<linux/export.h>
#include
<linux/slab.h>
#include
<linux/security.h>
#include
<linux/syscalls.h>
#include
<asm/uaccess.h>
/* init to 2 - one for init_task, one to ensure it is never freed */
struct
group_info
init_groups
=
{ .
usage
=
ATOMIC_INIT
(
2
) };
struct
group_info
*
groups_alloc
(
int
gidsetsize
)
{
struct
group_info
*
group_info
;
int
nblocks
;
int
i
;
nblocks
=
(
gidsetsize
+
NGROUPS_PER_BLOCK
-
1
) /
NGROUPS_PER_BLOCK
;
/* Make sure we always allocate at least one indirect block pointer */
nblocks
=
nblocks
? :
1
;
group_info
=
kmalloc
(
sizeof
(
*
group_info
)
+
nblocks
*
sizeof
(
gid_t
*
),
GFP_USER
);
if
(!
group_info
)
return
NULL
;
group_info
->
ngroups
=
gidsetsize
;
group_info
->
nblocks
=
nblocks
;
atomic_set
(
&
group_info
->
usage
,
1
);
if
(
gidsetsize
<=
NGROUPS_SMALL
)
group_info
->
blocks
[
0
]
=
group_info
->
small_block
;
else
{
for
(
i
=
0
;
i
<
nblocks
;
i
++
) {
kgid_t
*
b
;
b
=
(
void
*
)
__get_free_page
(
GFP_USER
);
if
(!
b
)
goto
out_undo_partial_alloc
;
group_info
->
blocks
[
i
]
=
b
;
}
}
return
group_info
;
out_undo_partial_alloc
:
while
(
--
i
>=
0
) {
free_page
((
unsigned long
)
group_info
->
blocks
[
i
]);
}
kfree
(
group_info
);
return
NULL
;
}
EXPORT_SYMBOL
(
groups_alloc
);
void
groups_free
(
struct
group_info
*
group_info
)
{
if
(
group_info
->
blocks
[
0
]
!=
group_info
->
small_block
) {
int
i
;
for
(
i
=
0
;
i
<
group_info
->
nblocks
;
i
++
)
free_page
((
unsigned long
)
group_info
->
blocks
[
i
]);
}
kfree
(
group_info
);
}
EXPORT_SYMBOL
(
groups_free
);
/* export the group_info to a user-space array */
static
int
groups_to_user
(
gid_t
__user
*
grouplist
,
const
struct
group_info
*
group_info
)
{
struct
user_namespace
*
user_ns
=
current_user_ns
();
int
i
;
unsigned
int
count
=
group_info
->
ngroups
;
for
(
i
=
0
;
i
<
count
;
i
++
) {
gid_t
gid
;
gid
=
from_kgid_munged
(
user_ns
,
GROUP_AT
(
group_info
,
i
));
if
(
put_user
(
gid
,
grouplist
+
i
))
return
-
EFAULT
;
}
return
0
;
}
/* fill a group_info from a user-space array - it must be allocated already */
static
int
groups_from_user
(
struct
group_info
*
group_info
,
gid_t
__user
*
grouplist
)
{
struct
user_namespace
*
user_ns
=
current_user_ns
();
int
i
;
unsigned
int
count
=
group_info
->
ngroups
;
for
(
i
=
0
;
i
<
count
;
i
++
) {
gid_t
gid
;
kgid_t
kgid
;
if
(
get_user
(
gid
,
grouplist
+
i
))
return
-
EFAULT
;
kgid
=
make_kgid
(
user_ns
,
gid
);
if
(!
gid_valid
(
kgid
))
return
-
EINVAL
;
GROUP_AT
(
group_info
,
i
)
=
kgid
;
}
return
0
;
}
/* a simple Shell sort */
static
void
groups_sort
(
struct
group_info
*
group_info
)
{
int
base
,
max
,
stride
;
int
gidsetsize
=
group_info
->
ngroups
;
for
(
stride
=
1
;
stride
<
gidsetsize
;
stride
=
3
*
stride
+
1
)
;
/* nothing */
stride
/=
3
;
while
(
stride
) {
max
=
gidsetsize
-
stride
;
for
(
base
=
0
;
base
<
max
;
base
++
) {
int
left
=
base
;
int
right
=
left
+
stride
;
kgid_t
tmp
=
GROUP_AT
(
group_info
,
right
);
while
(
left
>=
0
&&
gid_gt
(
GROUP_AT
(
group_info
,
left
),
tmp
)) {
GROUP_AT
(
group_info
,
right
)
=
GROUP_AT
(
group_info
,
left
);
right
=
left
;
left
-=
stride
;
}
GROUP_AT
(
group_info
,
right
)
=
tmp
;
}
stride
/=
3
;
}
}
/* a simple bsearch */
int
groups_search
(
const
struct
group_info
*
group_info
,
kgid_t
grp
)
{
unsigned
int
left
,
right
;
if
(!
group_info
)
return
0
;
left
=
0
;
right
=
group_info
->
ngroups
;
while
(
left
<
right
) {
unsigned
int
mid
=
(
left
+
right
)/
2
;
if
(
gid_gt
(
grp
,
GROUP_AT
(
group_info
,
mid
)))
left
=
mid
+
1
;
else
if
(
gid_lt
(
grp
,
GROUP_AT
(
group_info
,
mid
)))
right
=
mid
;
else
return
1
;
}
return
0
;
}
/**
* set_groups - Change a group subscription in a set of credentials
* @new: The newly prepared set of credentials to alter
* @group_info: The group list to install
*
* Validate a group subscription and, if valid, insert it into a set
* of credentials.
*/
int
set_groups
(
struct
cred
*
new
,
struct
group_info
*
group_info
)
{
put_group_info
(
new
->
group_info
);
groups_sort
(
group_info
);
get_group_info
(
group_info
);
new
->
group_info
=
group_info
;
return
0
;
}
EXPORT_SYMBOL
(
set_groups
);
/**
* set_current_groups - Change current's group subscription
* @group_info: The group list to impose
*
* Validate a group subscription and, if valid, impose it upon current's task
* security record.
*/
int
set_current_groups
(
struct
group_info
*
group_info
)
{
struct
cred
*
new
;
int
ret
;
new
=
prepare_creds
();
if
(!
new
)
return
-
ENOMEM
;
ret
=
set_groups
(
new
,
group_info
);
if
(
ret
<
0
) {
abort_creds
(
new
);
return
ret
;
}
return
commit_creds
(
new
);
}
EXPORT_SYMBOL
(
set_current_groups
);
SYSCALL_DEFINE2
(
getgroups
,
int
,
gidsetsize
,
gid_t
__user
*
,
grouplist
)
{
const
struct
cred
*
cred
=
current_cred
();
int
i
;
if
(
gidsetsize
<
0
)
return
-
EINVAL
;
/* no need to grab task_lock here; it cannot change */
i
=
cred
->
group_info
->
ngroups
;
if
(
gidsetsize
) {
if
(
i
>
gidsetsize
) {
i
=
-
EINVAL
;
goto
out
;
}
if
(
groups_to_user
(
grouplist
,
cred
->
group_info
)) {
i
=
-
EFAULT
;
goto
out
;
}
}
out
:
return
i
;
}
/*
* SMP: Our groups are copy-on-write. We can set them safely
* without another task interfering.
*/
SYSCALL_DEFINE2
(
setgroups
,
int
,
gidsetsize
,
gid_t
__user
*
,
grouplist
)
{
struct
group_info
*
group_info
;
int
retval
;
if
(!
nsown_capable
(
CAP_SETGID
))
return
-
EPERM
;
if
((
unsigned
)
gidsetsize
>
NGROUPS_MAX
)
return
-
EINVAL
;
group_info
=
groups_alloc
(
gidsetsize
);
if
(!
group_info
)
return
-
ENOMEM
;
retval
=
groups_from_user
(
group_info
,
grouplist
);
if
(
retval
) {
put_group_info
(
group_info
);
return
retval
;
}
retval
=
set_current_groups
(
group_info
);
put_group_info
(
group_info
);
return
retval
;
}
/*
* Check whether we're fsgid/egid or in the supplemental group..
*/
int
in_group_p
(
kgid_t
grp
)
{
const
struct
cred
*
cred
=
current_cred
();
int
retval
=
1
;
if
(!
gid_eq
(
grp
,
cred
->
fsgid
))
retval
=
groups_search
(
cred
->
group_info
,
grp
);
return
retval
;
}
EXPORT_SYMBOL
(
in_group_p
);
int
in_egroup_p
(
kgid_t
grp
)
{
const
struct
cred
*
cred
=
current_cred
();
int
retval
=
1
;
if
(!
gid_eq
(
grp
,
cred
->
egid
))
retval
=
groups_search
(
cred
->
group_info
,
grp
);
return
retval
;
}
EXPORT_SYMBOL
(
in_egroup_p
);
Back
|
FazBrowse Home
|
New Git URL