priv: Narrow down privileges
[dragonfly.git] / sys / kern / kern_prot.c
CommitLineData
984263bc
MD
1/*
2 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by the University of
21 * California, Berkeley and its contributors.
22 * 4. Neither the name of the University nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94
39 * $FreeBSD: src/sys/kern/kern_prot.c,v 1.53.2.9 2002/03/09 05:20:26 dd Exp $
420eedf5 40 * $DragonFly: src/sys/kern/kern_prot.c,v 1.29 2008/02/16 15:53:39 matthias Exp $
984263bc
MD
41 */
42
43/*
44 * System calls related to processes and protection
45 */
46
47#include "opt_compat.h"
48
49#include <sys/param.h>
50#include <sys/acct.h>
51#include <sys/systm.h>
52#include <sys/sysproto.h>
53#include <sys/kernel.h>
3b564f1f 54#include <sys/lock.h>
984263bc 55#include <sys/proc.h>
28eeae89 56#include <sys/priv.h>
984263bc
MD
57#include <sys/malloc.h>
58#include <sys/pioctl.h>
59#include <sys/resourcevar.h>
41c20dac 60#include <sys/jail.h>
508ceb09 61#include <sys/lockf.h>
d9b2033e
MD
62#include <sys/spinlock.h>
63
64#include <sys/thread2.h>
65#include <sys/spinlock2.h>
984263bc
MD
66
67static MALLOC_DEFINE(M_CRED, "cred", "credentials");
68
984263bc
MD
69/*
70 * NOT MP SAFE due to p_pptr access
71 */
72/* ARGSUSED */
73int
753fd850 74sys_getpid(struct getpid_args *uap)
984263bc 75{
41c20dac 76 struct proc *p = curproc;
984263bc 77
c7114eea 78 uap->sysmsg_fds[0] = p->p_pid;
984263bc 79#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 80 uap->sysmsg_fds[1] = p->p_pptr->p_pid;
984263bc
MD
81#endif
82 return (0);
83}
84
984263bc
MD
85/* ARGSUSED */
86int
753fd850 87sys_getppid(struct getppid_args *uap)
984263bc 88{
41c20dac 89 struct proc *p = curproc;
984263bc 90
c7114eea 91 uap->sysmsg_result = p->p_pptr->p_pid;
984263bc 92 return (0);
f9366a82
SS
93}
94
95/* ARGSUSED */
96int
97sys_lwp_gettid(struct lwp_gettid_args *uap)
98{
99 struct lwp *lp = curthread->td_lwp;
100
101 uap->sysmsg_result = lp->lwp_tid;
102 return (0);
984263bc
MD
103}
104
105/*
106 * Get process group ID; note that POSIX getpgrp takes no parameter
107 *
108 * MP SAFE
109 */
984263bc 110int
753fd850 111sys_getpgrp(struct getpgrp_args *uap)
984263bc 112{
41c20dac 113 struct proc *p = curproc;
984263bc 114
c7114eea 115 uap->sysmsg_result = p->p_pgrp->pg_id;
984263bc
MD
116 return (0);
117}
118
a64ba182 119/*
420eedf5 120 * Get an arbitrary pid's process group id
a64ba182 121 */
984263bc 122int
753fd850 123sys_getpgid(struct getpgid_args *uap)
984263bc 124{
41c20dac 125 struct proc *p = curproc;
984263bc
MD
126 struct proc *pt;
127
128 pt = p;
129 if (uap->pid == 0)
130 goto found;
131
132 if ((pt = pfind(uap->pid)) == 0)
133 return ESRCH;
134found:
c7114eea 135 uap->sysmsg_result = pt->p_pgrp->pg_id;
984263bc
MD
136 return 0;
137}
138
139/*
420eedf5 140 * Get an arbitrary pid's session id.
984263bc 141 */
984263bc 142int
753fd850 143sys_getsid(struct getsid_args *uap)
984263bc 144{
41c20dac 145 struct proc *p = curproc;
984263bc
MD
146 struct proc *pt;
147
148 pt = p;
149 if (uap->pid == 0)
150 goto found;
151
152 if ((pt = pfind(uap->pid)) == 0)
153 return ESRCH;
154found:
c7114eea 155 uap->sysmsg_result = pt->p_session->s_sid;
984263bc
MD
156 return 0;
157}
158
159
160/*
161 * getuid() - MP SAFE
162 */
984263bc
MD
163/* ARGSUSED */
164int
753fd850 165sys_getuid(struct getuid_args *uap)
984263bc 166{
41c20dac 167 struct proc *p = curproc;
984263bc 168
c7114eea 169 uap->sysmsg_fds[0] = p->p_ucred->cr_ruid;
984263bc 170#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 171 uap->sysmsg_fds[1] = p->p_ucred->cr_uid;
984263bc
MD
172#endif
173 return (0);
174}
175
176/*
177 * geteuid() - MP SAFE
178 */
984263bc
MD
179/* ARGSUSED */
180int
753fd850 181sys_geteuid(struct geteuid_args *uap)
984263bc 182{
41c20dac 183 struct proc *p = curproc;
984263bc 184
c7114eea 185 uap->sysmsg_result = p->p_ucred->cr_uid;
984263bc
MD
186 return (0);
187}
188
189/*
190 * getgid() - MP SAFE
191 */
984263bc
MD
192/* ARGSUSED */
193int
753fd850 194sys_getgid(struct getgid_args *uap)
984263bc 195{
41c20dac 196 struct proc *p = curproc;
984263bc 197
c7114eea 198 uap->sysmsg_fds[0] = p->p_ucred->cr_rgid;
984263bc 199#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 200 uap->sysmsg_fds[1] = p->p_ucred->cr_groups[0];
984263bc
MD
201#endif
202 return (0);
203}
204
205/*
206 * Get effective group ID. The "egid" is groups[0], and could be obtained
207 * via getgroups. This syscall exists because it is somewhat painful to do
208 * correctly in a library function.
6ad3ed15
DR
209 *
210 * MP SAFE
984263bc 211 */
984263bc
MD
212/* ARGSUSED */
213int
753fd850 214sys_getegid(struct getegid_args *uap)
984263bc 215{
41c20dac 216 struct proc *p = curproc;
984263bc 217
c7114eea 218 uap->sysmsg_result = p->p_ucred->cr_groups[0];
984263bc
MD
219 return (0);
220}
221
984263bc 222int
753fd850 223sys_getgroups(struct getgroups_args *uap)
984263bc 224{
41c20dac
MD
225 struct proc *p = curproc;
226 struct ucred *cr;
227 u_int ngrp;
984263bc
MD
228 int error;
229
41c20dac
MD
230 if (p == NULL) /* API enforcement */
231 return(EPERM);
232 cr = p->p_ucred;
233
984263bc 234 if ((ngrp = uap->gidsetsize) == 0) {
c7114eea 235 uap->sysmsg_result = cr->cr_ngroups;
984263bc
MD
236 return (0);
237 }
41c20dac 238 if (ngrp < cr->cr_ngroups)
984263bc 239 return (EINVAL);
41c20dac
MD
240 ngrp = cr->cr_ngroups;
241 if ((error = copyout((caddr_t)cr->cr_groups,
984263bc
MD
242 (caddr_t)uap->gidset, ngrp * sizeof(gid_t))))
243 return (error);
c7114eea 244 uap->sysmsg_result = ngrp;
984263bc
MD
245 return (0);
246}
247
984263bc
MD
248/* ARGSUSED */
249int
753fd850 250sys_setsid(struct setsid_args *uap)
984263bc 251{
41c20dac 252 struct proc *p = curproc;
984263bc
MD
253
254 if (p->p_pgid == p->p_pid || pgfind(p->p_pid)) {
255 return (EPERM);
256 } else {
257 (void)enterpgrp(p, p->p_pid, 1);
c7114eea 258 uap->sysmsg_result = p->p_pid;
984263bc
MD
259 return (0);
260 }
261}
262
263/*
264 * set process group (setpgid/old setpgrp)
265 *
266 * caller does setpgid(targpid, targpgid)
267 *
268 * pid must be caller or child of caller (ESRCH)
269 * if a child
270 * pid must be in same session (EPERM)
271 * pid can't have done an exec (EACCES)
272 * if pgid != pid
273 * there must exist some pid in same session having pgid (EPERM)
274 * pid must not be session leader (EPERM)
275 */
984263bc
MD
276/* ARGSUSED */
277int
753fd850 278sys_setpgid(struct setpgid_args *uap)
984263bc 279{
41c20dac
MD
280 struct proc *curp = curproc;
281 struct proc *targp; /* target process */
282 struct pgrp *pgrp; /* target pgrp */
984263bc
MD
283
284 if (uap->pgid < 0)
285 return (EINVAL);
286 if (uap->pid != 0 && uap->pid != curp->p_pid) {
287 if ((targp = pfind(uap->pid)) == 0 || !inferior(targp))
288 return (ESRCH);
289 if (targp->p_pgrp == NULL || targp->p_session != curp->p_session)
290 return (EPERM);
291 if (targp->p_flag & P_EXEC)
292 return (EACCES);
293 } else
294 targp = curp;
295 if (SESS_LEADER(targp))
296 return (EPERM);
297 if (uap->pgid == 0)
298 uap->pgid = targp->p_pid;
299 else if (uap->pgid != targp->p_pid)
300 if ((pgrp = pgfind(uap->pgid)) == 0 ||
301 pgrp->pg_session != curp->p_session)
302 return (EPERM);
303 return (enterpgrp(targp, uap->pgid, 0));
304}
305
306/*
307 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
9a7c6212 308 * compatible. It says that setting the uid/gid to euid/egid is a special
984263bc
MD
309 * case of "appropriate privilege". Once the rules are expanded out, this
310 * basically means that setuid(nnn) sets all three id's, in all permitted
311 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid())
312 * does not set the saved id - this is dangerous for traditional BSD
313 * programs. For this reason, we *really* do not want to set
314 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
315 */
316#define POSIX_APPENDIX_B_4_2_2
317
984263bc
MD
318/* ARGSUSED */
319int
753fd850 320sys_setuid(struct setuid_args *uap)
984263bc 321{
41c20dac
MD
322 struct proc *p = curproc;
323 struct ucred *cr;
324 uid_t uid;
984263bc
MD
325 int error;
326
41c20dac
MD
327 if (p == NULL) /* API enforcement */
328 return(EPERM);
329 cr = p->p_ucred;
330
984263bc
MD
331 /*
332 * See if we have "permission" by POSIX 1003.1 rules.
333 *
334 * Note that setuid(geteuid()) is a special case of
335 * "appropriate privileges" in appendix B.4.2.2. We need
9a7c6212 336 * to use this clause to be compatible with traditional BSD
984263bc
MD
337 * semantics. Basically, it means that "setuid(xx)" sets all
338 * three id's (assuming you have privs).
339 *
340 * Notes on the logic. We do things in three steps.
341 * 1: We determine if the euid is going to change, and do EPERM
342 * right away. We unconditionally change the euid later if this
343 * test is satisfied, simplifying that part of the logic.
344 * 2: We determine if the real and/or saved uid's are going to
345 * change. Determined by compile options.
346 * 3: Change euid last. (after tests in #2 for "appropriate privs")
347 */
348 uid = uap->uid;
41c20dac 349 if (uid != cr->cr_ruid && /* allow setuid(getuid()) */
984263bc 350#ifdef _POSIX_SAVED_IDS
41c20dac 351 uid != crc->cr_svuid && /* allow setuid(saved gid) */
984263bc
MD
352#endif
353#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
41c20dac 354 uid != cr->cr_uid && /* allow setuid(geteuid()) */
984263bc 355#endif
1dad22bb 356 (error = priv_check_cred(cr, PRIV_CRED_SETUID, PRISON_ROOT)))
984263bc
MD
357 return (error);
358
359#ifdef _POSIX_SAVED_IDS
360 /*
361 * Do we have "appropriate privileges" (are we root or uid == euid)
362 * If so, we are changing the real uid and/or saved uid.
363 */
364 if (
365#ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */
41c20dac 366 uid == cr->cr_uid ||
984263bc 367#endif
1dad22bb 368 priv_check_cred(cr, PRIV_CRED_SETUID, PRISON_ROOT) == 0) /* we are using privs */
984263bc
MD
369#endif
370 {
371 /*
372 * Set the real uid and transfer proc count to new user.
373 */
41c20dac 374 if (uid != cr->cr_ruid) {
be170d6b 375 cr = change_ruid(uid);
41c20dac 376 setsugid();
984263bc
MD
377 }
378 /*
379 * Set saved uid
380 *
381 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as
382 * the security of seteuid() depends on it. B.4.2.2 says it
383 * is important that we should do this.
384 */
41c20dac 385 if (cr->cr_svuid != uid) {
115ccd83 386 cr = cratom(&p->p_ucred);
41c20dac
MD
387 cr->cr_svuid = uid;
388 setsugid();
984263bc
MD
389 }
390 }
391
392 /*
393 * In all permitted cases, we are changing the euid.
394 * Copy credentials so other references do not see our changes.
395 */
41c20dac
MD
396 if (cr->cr_uid != uid) {
397 change_euid(uid);
398 setsugid();
984263bc
MD
399 }
400 return (0);
401}
402
984263bc
MD
403/* ARGSUSED */
404int
753fd850 405sys_seteuid(struct seteuid_args *uap)
984263bc 406{
41c20dac
MD
407 struct proc *p = curproc;
408 struct ucred *cr;
409 uid_t euid;
984263bc
MD
410 int error;
411
41c20dac
MD
412 if (p == NULL) /* API enforcement */
413 return(EPERM);
414
415 cr = p->p_ucred;
984263bc 416 euid = uap->euid;
41c20dac
MD
417 if (euid != cr->cr_ruid && /* allow seteuid(getuid()) */
418 euid != cr->cr_svuid && /* allow seteuid(saved uid) */
1dad22bb 419 (error = priv_check_cred(cr, PRIV_CRED_SETEUID, PRISON_ROOT)))
984263bc
MD
420 return (error);
421 /*
422 * Everything's okay, do it. Copy credentials so other references do
423 * not see our changes.
424 */
41c20dac
MD
425 if (cr->cr_uid != euid) {
426 change_euid(euid);
427 setsugid();
984263bc
MD
428 }
429 return (0);
430}
431
984263bc
MD
432/* ARGSUSED */
433int
753fd850 434sys_setgid(struct setgid_args *uap)
984263bc 435{
41c20dac
MD
436 struct proc *p = curproc;
437 struct ucred *cr;
438 gid_t gid;
984263bc
MD
439 int error;
440
41c20dac
MD
441 if (p == NULL) /* API enforcement */
442 return(EPERM);
443 cr = p->p_ucred;
444
984263bc
MD
445 /*
446 * See if we have "permission" by POSIX 1003.1 rules.
447 *
448 * Note that setgid(getegid()) is a special case of
449 * "appropriate privileges" in appendix B.4.2.2. We need
9a7c6212 450 * to use this clause to be compatible with traditional BSD
984263bc
MD
451 * semantics. Basically, it means that "setgid(xx)" sets all
452 * three id's (assuming you have privs).
453 *
454 * For notes on the logic here, see setuid() above.
455 */
456 gid = uap->gid;
41c20dac 457 if (gid != cr->cr_rgid && /* allow setgid(getgid()) */
984263bc 458#ifdef _POSIX_SAVED_IDS
41c20dac 459 gid != cr->cr_svgid && /* allow setgid(saved gid) */
984263bc
MD
460#endif
461#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
41c20dac 462 gid != cr->cr_groups[0] && /* allow setgid(getegid()) */
984263bc 463#endif
1dad22bb 464 (error = priv_check_cred(cr, PRIV_CRED_SETGID, PRISON_ROOT)))
984263bc
MD
465 return (error);
466
467#ifdef _POSIX_SAVED_IDS
468 /*
469 * Do we have "appropriate privileges" (are we root or gid == egid)
470 * If so, we are changing the real uid and saved gid.
471 */
472 if (
473#ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */
41c20dac 474 gid == cr->cr_groups[0] ||
984263bc 475#endif
1dad22bb 476 priv_check_cred(cr, PRIV_CRED_SETGID, PRISON_ROOT) == 0) /* we are using privs */
984263bc
MD
477#endif
478 {
479 /*
480 * Set real gid
481 */
41c20dac 482 if (cr->cr_rgid != gid) {
115ccd83 483 cr = cratom(&p->p_ucred);
41c20dac
MD
484 cr->cr_rgid = gid;
485 setsugid();
984263bc
MD
486 }
487 /*
488 * Set saved gid
489 *
490 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as
491 * the security of setegid() depends on it. B.4.2.2 says it
492 * is important that we should do this.
493 */
41c20dac 494 if (cr->cr_svgid != gid) {
115ccd83 495 cr = cratom(&p->p_ucred);
41c20dac
MD
496 cr->cr_svgid = gid;
497 setsugid();
984263bc
MD
498 }
499 }
500 /*
501 * In all cases permitted cases, we are changing the egid.
502 * Copy credentials so other references do not see our changes.
503 */
41c20dac 504 if (cr->cr_groups[0] != gid) {
e9a372eb 505 cr = cratom(&p->p_ucred);
41c20dac
MD
506 cr->cr_groups[0] = gid;
507 setsugid();
984263bc
MD
508 }
509 return (0);
510}
511
984263bc
MD
512/* ARGSUSED */
513int
753fd850 514sys_setegid(struct setegid_args *uap)
984263bc 515{
41c20dac
MD
516 struct proc *p = curproc;
517 struct ucred *cr;
518 gid_t egid;
984263bc
MD
519 int error;
520
41c20dac
MD
521 if (p == NULL) /* API enforcement */
522 return(EPERM);
523 cr = p->p_ucred;
524
984263bc 525 egid = uap->egid;
41c20dac
MD
526 if (egid != cr->cr_rgid && /* allow setegid(getgid()) */
527 egid != cr->cr_svgid && /* allow setegid(saved gid) */
1dad22bb 528 (error = priv_check_cred(cr, PRIV_CRED_SETEGID, PRISON_ROOT)))
984263bc 529 return (error);
41c20dac 530 if (cr->cr_groups[0] != egid) {
e9a372eb 531 cr = cratom(&p->p_ucred);
41c20dac
MD
532 cr->cr_groups[0] = egid;
533 setsugid();
984263bc
MD
534 }
535 return (0);
536}
537
984263bc
MD
538/* ARGSUSED */
539int
753fd850 540sys_setgroups(struct setgroups_args *uap)
984263bc 541{
41c20dac
MD
542 struct proc *p = curproc;
543 struct ucred *cr;
544 u_int ngrp;
984263bc
MD
545 int error;
546
41c20dac
MD
547 if (p == NULL) /* API enforcement */
548 return(EPERM);
549 cr = p->p_ucred;
550
1dad22bb 551 if ((error = priv_check_cred(cr, PRIV_CRED_SETGROUPS, PRISON_ROOT)))
984263bc
MD
552 return (error);
553 ngrp = uap->gidsetsize;
554 if (ngrp > NGROUPS)
555 return (EINVAL);
556 /*
557 * XXX A little bit lazy here. We could test if anything has
e9a372eb 558 * changed before cratom() and setting P_SUGID.
984263bc 559 */
e9a372eb 560 cr = cratom(&p->p_ucred);
984263bc
MD
561 if (ngrp < 1) {
562 /*
563 * setgroups(0, NULL) is a legitimate way of clearing the
564 * groups vector on non-BSD systems (which generally do not
565 * have the egid in the groups[0]). We risk security holes
566 * when running non-BSD software if we do not do the same.
567 */
41c20dac 568 cr->cr_ngroups = 1;
984263bc
MD
569 } else {
570 if ((error = copyin((caddr_t)uap->gidset,
41c20dac 571 (caddr_t)cr->cr_groups, ngrp * sizeof(gid_t))))
984263bc 572 return (error);
41c20dac 573 cr->cr_ngroups = ngrp;
984263bc 574 }
41c20dac 575 setsugid();
984263bc
MD
576 return (0);
577}
578
984263bc
MD
579/* ARGSUSED */
580int
753fd850 581sys_setreuid(struct setreuid_args *uap)
984263bc 582{
41c20dac
MD
583 struct proc *p = curproc;
584 struct ucred *cr;
585 uid_t ruid, euid;
984263bc
MD
586 int error;
587
41c20dac
MD
588 if (p == NULL) /* API enforcement */
589 return(EPERM);
590 cr = p->p_ucred;
591
984263bc
MD
592 ruid = uap->ruid;
593 euid = uap->euid;
41c20dac
MD
594 if (((ruid != (uid_t)-1 && ruid != cr->cr_ruid && ruid != cr->cr_svuid) ||
595 (euid != (uid_t)-1 && euid != cr->cr_uid &&
596 euid != cr->cr_ruid && euid != cr->cr_svuid)) &&
1dad22bb 597 (error = priv_check_cred(cr, PRIV_SETREUID, PRISON_ROOT)) != 0)
984263bc
MD
598 return (error);
599
41c20dac 600 if (euid != (uid_t)-1 && cr->cr_uid != euid) {
be170d6b 601 cr = change_euid(euid);
41c20dac 602 setsugid();
984263bc 603 }
41c20dac 604 if (ruid != (uid_t)-1 && cr->cr_ruid != ruid) {
be170d6b 605 cr = change_ruid(ruid);
41c20dac 606 setsugid();
984263bc 607 }
41c20dac
MD
608 if ((ruid != (uid_t)-1 || cr->cr_uid != cr->cr_ruid) &&
609 cr->cr_svuid != cr->cr_uid) {
e9a372eb 610 cr = cratom(&p->p_ucred);
41c20dac
MD
611 cr->cr_svuid = cr->cr_uid;
612 setsugid();
984263bc
MD
613 }
614 return (0);
615}
616
984263bc
MD
617/* ARGSUSED */
618int
753fd850 619sys_setregid(struct setregid_args *uap)
984263bc 620{
41c20dac
MD
621 struct proc *p = curproc;
622 struct ucred *cr;
623 gid_t rgid, egid;
984263bc
MD
624 int error;
625
41c20dac
MD
626 if (p == NULL) /* API enforcement */
627 return(EPERM);
628 cr = p->p_ucred;
629
984263bc
MD
630 rgid = uap->rgid;
631 egid = uap->egid;
41c20dac
MD
632 if (((rgid != (gid_t)-1 && rgid != cr->cr_rgid && rgid != cr->cr_svgid) ||
633 (egid != (gid_t)-1 && egid != cr->cr_groups[0] &&
634 egid != cr->cr_rgid && egid != cr->cr_svgid)) &&
1dad22bb 635 (error = priv_check_cred(cr, PRIV_CRED_SETREGID, PRISON_ROOT)) != 0)
984263bc
MD
636 return (error);
637
41c20dac 638 if (egid != (gid_t)-1 && cr->cr_groups[0] != egid) {
e9a372eb 639 cr = cratom(&p->p_ucred);
41c20dac
MD
640 cr->cr_groups[0] = egid;
641 setsugid();
984263bc 642 }
41c20dac 643 if (rgid != (gid_t)-1 && cr->cr_rgid != rgid) {
e9a372eb 644 cr = cratom(&p->p_ucred);
41c20dac
MD
645 cr->cr_rgid = rgid;
646 setsugid();
984263bc 647 }
41c20dac
MD
648 if ((rgid != (gid_t)-1 || cr->cr_groups[0] != cr->cr_rgid) &&
649 cr->cr_svgid != cr->cr_groups[0]) {
e9a372eb 650 cr = cratom(&p->p_ucred);
41c20dac
MD
651 cr->cr_svgid = cr->cr_groups[0];
652 setsugid();
984263bc
MD
653 }
654 return (0);
655}
656
657/*
658 * setresuid(ruid, euid, suid) is like setreuid except control over the
659 * saved uid is explicit.
660 */
661
984263bc
MD
662/* ARGSUSED */
663int
753fd850 664sys_setresuid(struct setresuid_args *uap)
984263bc 665{
41c20dac
MD
666 struct proc *p = curproc;
667 struct ucred *cr;
668 uid_t ruid, euid, suid;
984263bc
MD
669 int error;
670
41c20dac 671 cr = p->p_ucred;
984263bc
MD
672 ruid = uap->ruid;
673 euid = uap->euid;
674 suid = uap->suid;
41c20dac
MD
675 if (((ruid != (uid_t)-1 && ruid != cr->cr_ruid && ruid != cr->cr_svuid &&
676 ruid != cr->cr_uid) ||
677 (euid != (uid_t)-1 && euid != cr->cr_ruid && euid != cr->cr_svuid &&
678 euid != cr->cr_uid) ||
679 (suid != (uid_t)-1 && suid != cr->cr_ruid && suid != cr->cr_svuid &&
680 suid != cr->cr_uid)) &&
1dad22bb 681 (error = priv_check_cred(cr, PRIV_CRED_SETRESUID, PRISON_ROOT)) != 0)
984263bc 682 return (error);
41c20dac 683 if (euid != (uid_t)-1 && cr->cr_uid != euid) {
be170d6b 684 cr = change_euid(euid);
41c20dac 685 setsugid();
984263bc 686 }
41c20dac 687 if (ruid != (uid_t)-1 && cr->cr_ruid != ruid) {
be170d6b 688 cr = change_ruid(ruid);
41c20dac 689 setsugid();
984263bc 690 }
41c20dac 691 if (suid != (uid_t)-1 && cr->cr_svuid != suid) {
e9a372eb 692 cr = cratom(&p->p_ucred);
41c20dac
MD
693 cr->cr_svuid = suid;
694 setsugid();
984263bc
MD
695 }
696 return (0);
697}
698
699/*
700 * setresgid(rgid, egid, sgid) is like setregid except control over the
701 * saved gid is explicit.
702 */
703
984263bc
MD
704/* ARGSUSED */
705int
753fd850 706sys_setresgid(struct setresgid_args *uap)
984263bc 707{
41c20dac
MD
708 struct proc *p = curproc;
709 struct ucred *cr;
710 gid_t rgid, egid, sgid;
984263bc
MD
711 int error;
712
41c20dac 713 cr = p->p_ucred;
984263bc
MD
714 rgid = uap->rgid;
715 egid = uap->egid;
716 sgid = uap->sgid;
41c20dac
MD
717 if (((rgid != (gid_t)-1 && rgid != cr->cr_rgid && rgid != cr->cr_svgid &&
718 rgid != cr->cr_groups[0]) ||
719 (egid != (gid_t)-1 && egid != cr->cr_rgid && egid != cr->cr_svgid &&
720 egid != cr->cr_groups[0]) ||
721 (sgid != (gid_t)-1 && sgid != cr->cr_rgid && sgid != cr->cr_svgid &&
722 sgid != cr->cr_groups[0])) &&
1dad22bb 723 (error = priv_check_cred(cr, PRIV_CRED_SETRESGID, PRISON_ROOT)) != 0)
984263bc
MD
724 return (error);
725
41c20dac 726 if (egid != (gid_t)-1 && cr->cr_groups[0] != egid) {
e9a372eb 727 cr = cratom(&p->p_ucred);
41c20dac
MD
728 cr->cr_groups[0] = egid;
729 setsugid();
984263bc 730 }
41c20dac 731 if (rgid != (gid_t)-1 && cr->cr_rgid != rgid) {
e9a372eb 732 cr = cratom(&p->p_ucred);
41c20dac
MD
733 cr->cr_rgid = rgid;
734 setsugid();
984263bc 735 }
41c20dac 736 if (sgid != (gid_t)-1 && cr->cr_svgid != sgid) {
e9a372eb 737 cr = cratom(&p->p_ucred);
41c20dac
MD
738 cr->cr_svgid = sgid;
739 setsugid();
984263bc
MD
740 }
741 return (0);
742}
743
984263bc
MD
744/* ARGSUSED */
745int
753fd850 746sys_getresuid(struct getresuid_args *uap)
984263bc 747{
41c20dac
MD
748 struct proc *p = curproc;
749 struct ucred *cr = p->p_ucred;
984263bc
MD
750 int error1 = 0, error2 = 0, error3 = 0;
751
752 if (uap->ruid)
41c20dac
MD
753 error1 = copyout((caddr_t)&cr->cr_ruid,
754 (caddr_t)uap->ruid, sizeof(cr->cr_ruid));
984263bc 755 if (uap->euid)
41c20dac
MD
756 error2 = copyout((caddr_t)&cr->cr_uid,
757 (caddr_t)uap->euid, sizeof(cr->cr_uid));
984263bc 758 if (uap->suid)
41c20dac
MD
759 error3 = copyout((caddr_t)&cr->cr_svuid,
760 (caddr_t)uap->suid, sizeof(cr->cr_svuid));
984263bc
MD
761 return error1 ? error1 : (error2 ? error2 : error3);
762}
763
984263bc
MD
764/* ARGSUSED */
765int
753fd850 766sys_getresgid(struct getresgid_args *uap)
984263bc 767{
41c20dac
MD
768 struct proc *p = curproc;
769 struct ucred *cr = p->p_ucred;
984263bc
MD
770 int error1 = 0, error2 = 0, error3 = 0;
771
772 if (uap->rgid)
41c20dac
MD
773 error1 = copyout((caddr_t)&cr->cr_rgid,
774 (caddr_t)uap->rgid, sizeof(cr->cr_rgid));
984263bc 775 if (uap->egid)
41c20dac
MD
776 error2 = copyout((caddr_t)&cr->cr_groups[0],
777 (caddr_t)uap->egid, sizeof(cr->cr_groups[0]));
984263bc 778 if (uap->sgid)
41c20dac
MD
779 error3 = copyout((caddr_t)&cr->cr_svgid,
780 (caddr_t)uap->sgid, sizeof(cr->cr_svgid));
984263bc
MD
781 return error1 ? error1 : (error2 ? error2 : error3);
782}
783
784
984263bc
MD
785/* ARGSUSED */
786int
753fd850 787sys_issetugid(struct issetugid_args *uap)
984263bc 788{
41c20dac 789 struct proc *p = curproc;
984263bc
MD
790 /*
791 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
792 * we use P_SUGID because we consider changing the owners as
793 * "tainting" as well.
794 * This is significant for procs that start as root and "become"
795 * a user without an exec - programs cannot know *everything*
796 * that libc *might* have put in their data segment.
797 */
c7114eea 798 uap->sysmsg_result = (p->p_flag & P_SUGID) ? 1 : 0;
984263bc
MD
799 return (0);
800}
801
802/*
803 * Check if gid is a member of the group set.
804 */
805int
41c20dac 806groupmember(gid_t gid, struct ucred *cred)
984263bc 807{
41c20dac 808 gid_t *gp;
984263bc
MD
809 gid_t *egp;
810
811 egp = &(cred->cr_groups[cred->cr_ngroups]);
4f645dbb 812 for (gp = cred->cr_groups; gp < egp; gp++) {
984263bc
MD
813 if (*gp == gid)
814 return (1);
4f645dbb 815 }
984263bc
MD
816 return (0);
817}
818
819/*
820 * Test whether the specified credentials imply "super-user"
d46b588e
MN
821 * privilege.
822 *
823 * Depreciated! Use priv_check() instead.
824 */
825int
826suser(struct thread *td)
827{
828 return priv_check(td, PRIV_ROOT);
829}
830
831/*
832 * Depreciated! Use priv_check_cred() instead.
833 */
834int
835suser_cred(struct ucred *cred, int flag)
836{
837 return priv_check_cred(cred, PRIV_ROOT, flag);
838}
839
840/*
841 * Test whether the specified credentials have the privilege
842 * in question.
843 *
844 * A kernel thread without a process context is assumed to have
845 * the privilege in question. In situations where the caller always
846 * expect a cred to exist, the cred should be passed separately and
847 * priv_check_cred() should be used instead of priv_check().
dadab5e9 848 *
984263bc
MD
849 * Returns 0 or error.
850 */
851int
d46b588e 852priv_check(struct thread *td, int priv)
984263bc 853{
dadab5e9 854 struct proc *p = td->td_proc;
41c20dac
MD
855
856 if (p != NULL) {
d46b588e 857 return priv_check_cred(p->p_ucred, priv, 0);
41c20dac 858 } else {
dadab5e9 859 return (0);
41c20dac 860 }
984263bc
MD
861}
862
e4700d00 863/*
d46b588e
MN
864 * Check a credential for privilege.
865 *
e4700d00
JH
866 * A non-null credential is expected unless NULL_CRED_OKAY is set.
867 */
984263bc 868int
d46b588e 869priv_check_cred(struct ucred *cred, int priv, int flags)
984263bc 870{
d46b588e
MN
871 KASSERT(PRIV_VALID(priv), ("priv_check_cred: invalid privilege"));
872
873 KASSERT(cred != NULL || flags & NULL_CRED_OKAY,
874 ("priv_check_cred: NULL cred!"));
41c20dac 875
e4700d00 876 if (cred == NULL) {
d46b588e 877 if (flags & NULL_CRED_OKAY)
e4700d00
JH
878 return (0);
879 else
880 return (EPERM);
881 }
984263bc
MD
882 if (cred->cr_uid != 0)
883 return (EPERM);
d46b588e 884 if (cred->cr_prison && !(flags & PRISON_ROOT))
984263bc 885 return (EPERM);
dadab5e9 886 /* NOTE: accounting for suser access (p_acflag/ASU) removed */
984263bc
MD
887 return (0);
888}
889
890/*
891 * Return zero if p1 can fondle p2, return errno (EPERM/ESRCH) otherwise.
892 */
984263bc 893int
41c20dac 894p_trespass(struct ucred *cr1, struct ucred *cr2)
984263bc 895{
41c20dac 896 if (cr1 == cr2)
984263bc 897 return (0);
41c20dac 898 if (!PRISON_CHECK(cr1, cr2))
984263bc 899 return (ESRCH);
41c20dac 900 if (cr1->cr_ruid == cr2->cr_ruid)
984263bc 901 return (0);
41c20dac 902 if (cr1->cr_uid == cr2->cr_ruid)
984263bc 903 return (0);
41c20dac 904 if (cr1->cr_ruid == cr2->cr_uid)
984263bc 905 return (0);
41c20dac 906 if (cr1->cr_uid == cr2->cr_uid)
984263bc 907 return (0);
895c1f85 908 if (priv_check_cred(cr1, PRIV_ROOT, PRISON_ROOT) == 0)
984263bc
MD
909 return (0);
910 return (EPERM);
911}
912
913/*
d9b2033e
MD
914 * MPSAFE
915 */
916static __inline void
917_crinit(struct ucred *cr)
918{
919 bzero(cr, sizeof(*cr));
920 cr->cr_ref = 1;
921 spin_init(&cr->cr_spin);
922}
923
924/*
925 * MPSAFE
926 */
927void
928crinit(struct ucred *cr)
929{
930 _crinit(cr);
931}
932
933/*
984263bc 934 * Allocate a zeroed cred structure.
d9b2033e
MD
935 *
936 * MPSAFE
984263bc
MD
937 */
938struct ucred *
77153250 939crget(void)
984263bc 940{
1fd87d54 941 struct ucred *cr;
984263bc
MD
942
943 MALLOC(cr, struct ucred *, sizeof(*cr), M_CRED, M_WAITOK);
d9b2033e 944 _crinit(cr);
984263bc
MD
945 return (cr);
946}
947
948/*
e9a372eb
MD
949 * Claim another reference to a ucred structure. Can be used with special
950 * creds.
d9b2033e
MD
951 *
952 * It must be possible to call this routine with spinlocks held, meaning
953 * that this routine itself cannot obtain a spinlock.
954 *
955 * MPSAFE
984263bc 956 */
dadab5e9 957struct ucred *
41c20dac 958crhold(struct ucred *cr)
984263bc 959{
e9a372eb 960 if (cr != NOCRED && cr != FSCRED)
d9b2033e 961 atomic_add_int(&cr->cr_ref, 1);
dadab5e9 962 return(cr);
984263bc
MD
963}
964
965/*
d9b2033e
MD
966 * Drop a reference from the cred structure, free it if the reference count
967 * reaches 0.
968 *
969 * NOTE: because we used atomic_add_int() above, without a spinlock, we
970 * must also use atomic_subtract_int() below. A spinlock is required
971 * in crfree() to handle multiple callers racing the refcount to 0.
972 *
973 * MPALMOSTSAFE - acquires mplock on 1->0 transition of ref count
984263bc
MD
974 */
975void
41c20dac 976crfree(struct ucred *cr)
984263bc 977{
d9b2033e 978 if (cr->cr_ref <= 0)
984263bc 979 panic("Freeing already free credential! %p", cr);
d9b2033e
MD
980 spin_lock_wr(&cr->cr_spin);
981 atomic_subtract_int(&cr->cr_ref, 1);
982 if (cr->cr_ref == 0) {
983 spin_unlock_wr(&cr->cr_spin);
984263bc
MD
984 /*
985 * Some callers of crget(), such as nfs_statfs(),
986 * allocate a temporary credential, but don't
987 * allocate a uidinfo structure.
988 */
d9b2033e 989 get_mplock();
792033e7
MD
990 if (cr->cr_uidinfo != NULL) {
991 uidrop(cr->cr_uidinfo);
992 cr->cr_uidinfo = NULL;
993 }
994 if (cr->cr_ruidinfo != NULL) {
995 uidrop(cr->cr_ruidinfo);
996 cr->cr_ruidinfo = NULL;
997 }
41c20dac
MD
998
999 /*
1000 * Destroy empty prisons
1001 */
b40e316c
JS
1002 if (jailed(cr))
1003 prison_free(cr->cr_prison);
41c20dac
MD
1004 cr->cr_prison = NULL; /* safety */
1005
984263bc 1006 FREE((caddr_t)cr, M_CRED);
d9b2033e
MD
1007 rel_mplock();
1008 } else {
1009 spin_unlock_wr(&cr->cr_spin);
984263bc
MD
1010 }
1011}
1012
1013/*
e9a372eb
MD
1014 * Atomize a cred structure so it can be modified without polluting
1015 * other references to it.
1016 */
1017struct ucred *
1018cratom(struct ucred **pcr)
1019{
1020 struct ucred *oldcr;
1021 struct ucred *newcr;
1022
1023 oldcr = *pcr;
1024 if (oldcr->cr_ref == 1)
1025 return (oldcr);
1026 newcr = crget();
1027 *newcr = *oldcr;
1028 if (newcr->cr_uidinfo)
1029 uihold(newcr->cr_uidinfo);
1030 if (newcr->cr_ruidinfo)
1031 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1032 if (jailed(newcr))
1033 prison_hold(newcr->cr_prison);
e9a372eb
MD
1034 newcr->cr_ref = 1;
1035 crfree(oldcr);
1036 *pcr = newcr;
1037 return (newcr);
1038}
1039
1040#if 0 /* no longer used but keep around for a little while */
1041/*
984263bc
MD
1042 * Copy cred structure to a new one and free the old one.
1043 */
1044struct ucred *
41c20dac 1045crcopy(struct ucred *cr)
984263bc
MD
1046{
1047 struct ucred *newcr;
1048
1049 if (cr->cr_ref == 1)
1050 return (cr);
1051 newcr = crget();
1052 *newcr = *cr;
41c20dac
MD
1053 if (newcr->cr_uidinfo)
1054 uihold(newcr->cr_uidinfo);
1055 if (newcr->cr_ruidinfo)
1056 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1057 if (jailed(newcr))
1058 prison_hold(newcr->cr_prison);
984263bc 1059 newcr->cr_ref = 1;
41c20dac 1060 crfree(cr);
984263bc
MD
1061 return (newcr);
1062}
e9a372eb 1063#endif
984263bc
MD
1064
1065/*
1066 * Dup cred struct to a new held one.
1067 */
1068struct ucred *
77153250 1069crdup(struct ucred *cr)
984263bc
MD
1070{
1071 struct ucred *newcr;
1072
1073 newcr = crget();
1074 *newcr = *cr;
41c20dac
MD
1075 if (newcr->cr_uidinfo)
1076 uihold(newcr->cr_uidinfo);
1077 if (newcr->cr_ruidinfo)
1078 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1079 if (jailed(newcr))
1080 prison_hold(newcr->cr_prison);
984263bc
MD
1081 newcr->cr_ref = 1;
1082 return (newcr);
1083}
1084
1085/*
1086 * Fill in a struct xucred based on a struct ucred.
1087 */
1088void
77153250 1089cru2x(struct ucred *cr, struct xucred *xcr)
984263bc
MD
1090{
1091
1092 bzero(xcr, sizeof(*xcr));
1093 xcr->cr_version = XUCRED_VERSION;
1094 xcr->cr_uid = cr->cr_uid;
1095 xcr->cr_ngroups = cr->cr_ngroups;
1096 bcopy(cr->cr_groups, xcr->cr_groups, sizeof(cr->cr_groups));
1097}
1098
1099/*
1100 * Get login name, if available.
1101 */
984263bc
MD
1102/* ARGSUSED */
1103int
753fd850 1104sys_getlogin(struct getlogin_args *uap)
984263bc 1105{
41c20dac 1106 struct proc *p = curproc;
984263bc
MD
1107
1108 if (uap->namelen > MAXLOGNAME)
1109 uap->namelen = MAXLOGNAME;
1110 return (copyout((caddr_t) p->p_pgrp->pg_session->s_login,
1111 (caddr_t) uap->namebuf, uap->namelen));
1112}
1113
1114/*
1115 * Set login name.
1116 */
984263bc
MD
1117/* ARGSUSED */
1118int
753fd850 1119sys_setlogin(struct setlogin_args *uap)
984263bc 1120{
41c20dac 1121 struct proc *p = curproc;
984263bc
MD
1122 int error;
1123 char logintmp[MAXLOGNAME];
1124
41c20dac 1125 KKASSERT(p != NULL);
1dad22bb 1126 if ((error = priv_check_cred(p->p_ucred, PRIV_PROC_SETLOGIN, PRISON_ROOT)))
984263bc
MD
1127 return (error);
1128 error = copyinstr((caddr_t) uap->namebuf, (caddr_t) logintmp,
60233e58 1129 sizeof(logintmp), NULL);
984263bc
MD
1130 if (error == ENAMETOOLONG)
1131 error = EINVAL;
1132 else if (!error)
1133 (void) memcpy(p->p_pgrp->pg_session->s_login, logintmp,
1134 sizeof(logintmp));
1135 return (error);
1136}
1137
1138void
77153250 1139setsugid(void)
984263bc 1140{
41c20dac
MD
1141 struct proc *p = curproc;
1142
1143 KKASSERT(p != NULL);
984263bc
MD
1144 p->p_flag |= P_SUGID;
1145 if (!(p->p_pfsflags & PF_ISUGID))
1146 p->p_stops = 0;
1147}
1148
1149/*
1150 * Helper function to change the effective uid of a process
1151 */
be170d6b 1152struct ucred *
41c20dac 1153change_euid(uid_t euid)
984263bc 1154{
41c20dac
MD
1155 struct proc *p = curproc;
1156 struct ucred *cr;
984263bc 1157
41c20dac 1158 KKASSERT(p != NULL);
94507578 1159 lf_count_adjust(p, 0);
e9a372eb 1160 cr = cratom(&p->p_ucred);
41c20dac 1161 cr->cr_uid = euid;
792033e7 1162 uireplace(&cr->cr_uidinfo, uifind(euid));
94507578 1163 lf_count_adjust(p, 1);
be170d6b 1164 return (cr);
984263bc
MD
1165}
1166
1167/*
1168 * Helper function to change the real uid of a process
1169 *
1170 * The per-uid process count for this process is transfered from
1171 * the old uid to the new uid.
1172 */
be170d6b 1173struct ucred *
41c20dac 1174change_ruid(uid_t ruid)
984263bc 1175{
41c20dac
MD
1176 struct proc *p = curproc;
1177 struct ucred *cr;
984263bc 1178
41c20dac
MD
1179 KKASSERT(p != NULL);
1180
e9a372eb 1181 cr = cratom(&p->p_ucred);
be170d6b 1182 chgproccnt(cr->cr_ruidinfo, -1, 0);
41c20dac 1183 cr->cr_ruid = ruid;
792033e7 1184 uireplace(&cr->cr_ruidinfo, uifind(ruid));
be170d6b
SS
1185 chgproccnt(cr->cr_ruidinfo, 1, 0);
1186 return (cr);
984263bc 1187}