scm.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2#ifndef __LINUX_NET_SCM_H
  3#define __LINUX_NET_SCM_H
  4
  5#include <linux/limits.h>
  6#include <linux/net.h>
  7#include <linux/cred.h>
  8#include <linux/file.h>
  9#include <linux/security.h>
 10#include <linux/pid.h>
 11#include <linux/nsproxy.h>
 12#include <linux/sched/signal.h>
 13#include <net/compat.h>
 14
 15/* Well, we should have at least one descriptor open
 16 * to accept passed FDs 8)
 17 */
 18#define SCM_MAX_FD	253
 19
 20struct scm_creds {
 21	u32	pid;
 22	kuid_t	uid;
 23	kgid_t	gid;
 24};
 25
 26#ifdef CONFIG_UNIX
 27struct unix_edge;
 28#endif
 29
 30struct scm_fp_list {
 31	short			count;
 32	short			count_unix;
 33	short			max;
 34#ifdef CONFIG_UNIX
 35	bool			inflight;
 36	bool			dead;
 37	struct list_head	vertices;
 38	struct unix_edge	*edges;
 39#endif
 40	struct user_struct	*user;
 41	struct file		*fp[SCM_MAX_FD];
 42};
 43
 44struct scm_cookie {
 45	struct pid		*pid;		/* Skb credentials */
 46	struct scm_fp_list	*fp;		/* Passed files		*/
 47	struct scm_creds	creds;		/* Skb credentials	*/
 48#ifdef CONFIG_SECURITY_NETWORK
 49	u32			secid;		/* Passed security ID 	*/
 50#endif
 51};
 52
 53void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm);
 54void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm);
 55int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm);
 56void __scm_destroy(struct scm_cookie *scm);
 57struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl);
 58
 59#ifdef CONFIG_SECURITY_NETWORK
 60static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
 61{
 62	security_socket_getpeersec_dgram(sock, NULL, &scm->secid);
 63}
 64#else
 65static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
 66{ }
 67#endif /* CONFIG_SECURITY_NETWORK */
 68
 69static __inline__ void scm_set_cred(struct scm_cookie *scm,
 70				    struct pid *pid, kuid_t uid, kgid_t gid)
 71{
 72	scm->pid = get_pid(pid);
 73	scm->creds.pid = pid_vnr(pid);
 74	scm->creds.uid = uid;
 75	scm->creds.gid = gid;
 76}
 77
 78static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 79{
 80	put_pid(scm->pid);
 81	scm->pid = NULL;
 82}
 83
 84static __inline__ void scm_destroy(struct scm_cookie *scm)
 85{
 86	scm_destroy_cred(scm);
 87	if (scm->fp)
 88		__scm_destroy(scm);
 89}
 90
 91static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
 92			       struct scm_cookie *scm, bool forcecreds)
 93{
 94	memset(scm, 0, sizeof(*scm));
 95	scm->creds.uid = INVALID_UID;
 96	scm->creds.gid = INVALID_GID;
 97	if (forcecreds)
 98		scm_set_cred(scm, task_tgid(current), current_uid(), current_gid());
 99	unix_get_peersec_dgram(sock, scm);
100	if (msg->msg_controllen <= 0)
101		return 0;
102	return __scm_send(sock, msg, scm);
103}
104
105void scm_recv(struct socket *sock, struct msghdr *msg,
106	      struct scm_cookie *scm, int flags);
107void scm_recv_unix(struct socket *sock, struct msghdr *msg,
108		   struct scm_cookie *scm, int flags);
109
110static inline int scm_recv_one_fd(struct file *f, int __user *ufd,
111				  unsigned int flags)
112{
113	if (!ufd)
114		return -EFAULT;
115	return receive_fd(f, ufd, flags);
116}
117
118#endif /* __LINUX_NET_SCM_H */
119