Fix two typos
[dragonfly.git] / sys / kern / kern_prot.c
CommitLineData
984263bc
MD
1/*
2 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
3 * The Regents of the University of California. All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 * must display the following acknowledgement:
20 * This product includes software developed by the University of
21 * California, Berkeley and its contributors.
22 * 4. Neither the name of the University nor the names of its contributors
23 * may be used to endorse or promote products derived from this software
24 * without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94
39 * $FreeBSD: src/sys/kern/kern_prot.c,v 1.53.2.9 2002/03/09 05:20:26 dd Exp $
420eedf5 40 * $DragonFly: src/sys/kern/kern_prot.c,v 1.29 2008/02/16 15:53:39 matthias Exp $
984263bc
MD
41 */
42
43/*
44 * System calls related to processes and protection
45 */
46
47#include "opt_compat.h"
48
49#include <sys/param.h>
50#include <sys/acct.h>
51#include <sys/systm.h>
52#include <sys/sysproto.h>
53#include <sys/kernel.h>
3b564f1f 54#include <sys/lock.h>
984263bc
MD
55#include <sys/proc.h>
56#include <sys/malloc.h>
57#include <sys/pioctl.h>
58#include <sys/resourcevar.h>
41c20dac 59#include <sys/jail.h>
508ceb09 60#include <sys/lockf.h>
d9b2033e
MD
61#include <sys/spinlock.h>
62
63#include <sys/thread2.h>
64#include <sys/spinlock2.h>
984263bc
MD
65
66static MALLOC_DEFINE(M_CRED, "cred", "credentials");
67
984263bc
MD
68/*
69 * NOT MP SAFE due to p_pptr access
70 */
71/* ARGSUSED */
72int
753fd850 73sys_getpid(struct getpid_args *uap)
984263bc 74{
41c20dac 75 struct proc *p = curproc;
984263bc 76
c7114eea 77 uap->sysmsg_fds[0] = p->p_pid;
984263bc 78#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 79 uap->sysmsg_fds[1] = p->p_pptr->p_pid;
984263bc
MD
80#endif
81 return (0);
82}
83
984263bc
MD
84/* ARGSUSED */
85int
753fd850 86sys_getppid(struct getppid_args *uap)
984263bc 87{
41c20dac 88 struct proc *p = curproc;
984263bc 89
c7114eea 90 uap->sysmsg_result = p->p_pptr->p_pid;
984263bc 91 return (0);
f9366a82
SS
92}
93
94/* ARGSUSED */
95int
96sys_lwp_gettid(struct lwp_gettid_args *uap)
97{
98 struct lwp *lp = curthread->td_lwp;
99
100 uap->sysmsg_result = lp->lwp_tid;
101 return (0);
984263bc
MD
102}
103
104/*
105 * Get process group ID; note that POSIX getpgrp takes no parameter
106 *
107 * MP SAFE
108 */
984263bc 109int
753fd850 110sys_getpgrp(struct getpgrp_args *uap)
984263bc 111{
41c20dac 112 struct proc *p = curproc;
984263bc 113
c7114eea 114 uap->sysmsg_result = p->p_pgrp->pg_id;
984263bc
MD
115 return (0);
116}
117
a64ba182 118/*
420eedf5 119 * Get an arbitrary pid's process group id
a64ba182 120 */
984263bc 121int
753fd850 122sys_getpgid(struct getpgid_args *uap)
984263bc 123{
41c20dac 124 struct proc *p = curproc;
984263bc
MD
125 struct proc *pt;
126
127 pt = p;
128 if (uap->pid == 0)
129 goto found;
130
131 if ((pt = pfind(uap->pid)) == 0)
132 return ESRCH;
133found:
c7114eea 134 uap->sysmsg_result = pt->p_pgrp->pg_id;
984263bc
MD
135 return 0;
136}
137
138/*
420eedf5 139 * Get an arbitrary pid's session id.
984263bc 140 */
984263bc 141int
753fd850 142sys_getsid(struct getsid_args *uap)
984263bc 143{
41c20dac 144 struct proc *p = curproc;
984263bc
MD
145 struct proc *pt;
146
147 pt = p;
148 if (uap->pid == 0)
149 goto found;
150
151 if ((pt = pfind(uap->pid)) == 0)
152 return ESRCH;
153found:
c7114eea 154 uap->sysmsg_result = pt->p_session->s_sid;
984263bc
MD
155 return 0;
156}
157
158
159/*
160 * getuid() - MP SAFE
161 */
984263bc
MD
162/* ARGSUSED */
163int
753fd850 164sys_getuid(struct getuid_args *uap)
984263bc 165{
41c20dac 166 struct proc *p = curproc;
984263bc 167
c7114eea 168 uap->sysmsg_fds[0] = p->p_ucred->cr_ruid;
984263bc 169#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 170 uap->sysmsg_fds[1] = p->p_ucred->cr_uid;
984263bc
MD
171#endif
172 return (0);
173}
174
175/*
176 * geteuid() - MP SAFE
177 */
984263bc
MD
178/* ARGSUSED */
179int
753fd850 180sys_geteuid(struct geteuid_args *uap)
984263bc 181{
41c20dac 182 struct proc *p = curproc;
984263bc 183
c7114eea 184 uap->sysmsg_result = p->p_ucred->cr_uid;
984263bc
MD
185 return (0);
186}
187
188/*
189 * getgid() - MP SAFE
190 */
984263bc
MD
191/* ARGSUSED */
192int
753fd850 193sys_getgid(struct getgid_args *uap)
984263bc 194{
41c20dac 195 struct proc *p = curproc;
984263bc 196
c7114eea 197 uap->sysmsg_fds[0] = p->p_ucred->cr_rgid;
984263bc 198#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
c7114eea 199 uap->sysmsg_fds[1] = p->p_ucred->cr_groups[0];
984263bc
MD
200#endif
201 return (0);
202}
203
204/*
205 * Get effective group ID. The "egid" is groups[0], and could be obtained
206 * via getgroups. This syscall exists because it is somewhat painful to do
207 * correctly in a library function.
6ad3ed15
DR
208 *
209 * MP SAFE
984263bc 210 */
984263bc
MD
211/* ARGSUSED */
212int
753fd850 213sys_getegid(struct getegid_args *uap)
984263bc 214{
41c20dac 215 struct proc *p = curproc;
984263bc 216
c7114eea 217 uap->sysmsg_result = p->p_ucred->cr_groups[0];
984263bc
MD
218 return (0);
219}
220
984263bc 221int
753fd850 222sys_getgroups(struct getgroups_args *uap)
984263bc 223{
41c20dac
MD
224 struct proc *p = curproc;
225 struct ucred *cr;
226 u_int ngrp;
984263bc
MD
227 int error;
228
41c20dac
MD
229 if (p == NULL) /* API enforcement */
230 return(EPERM);
231 cr = p->p_ucred;
232
984263bc 233 if ((ngrp = uap->gidsetsize) == 0) {
c7114eea 234 uap->sysmsg_result = cr->cr_ngroups;
984263bc
MD
235 return (0);
236 }
41c20dac 237 if (ngrp < cr->cr_ngroups)
984263bc 238 return (EINVAL);
41c20dac
MD
239 ngrp = cr->cr_ngroups;
240 if ((error = copyout((caddr_t)cr->cr_groups,
984263bc
MD
241 (caddr_t)uap->gidset, ngrp * sizeof(gid_t))))
242 return (error);
c7114eea 243 uap->sysmsg_result = ngrp;
984263bc
MD
244 return (0);
245}
246
984263bc
MD
247/* ARGSUSED */
248int
753fd850 249sys_setsid(struct setsid_args *uap)
984263bc 250{
41c20dac 251 struct proc *p = curproc;
984263bc
MD
252
253 if (p->p_pgid == p->p_pid || pgfind(p->p_pid)) {
254 return (EPERM);
255 } else {
256 (void)enterpgrp(p, p->p_pid, 1);
c7114eea 257 uap->sysmsg_result = p->p_pid;
984263bc
MD
258 return (0);
259 }
260}
261
262/*
263 * set process group (setpgid/old setpgrp)
264 *
265 * caller does setpgid(targpid, targpgid)
266 *
267 * pid must be caller or child of caller (ESRCH)
268 * if a child
269 * pid must be in same session (EPERM)
270 * pid can't have done an exec (EACCES)
271 * if pgid != pid
272 * there must exist some pid in same session having pgid (EPERM)
273 * pid must not be session leader (EPERM)
274 */
984263bc
MD
275/* ARGSUSED */
276int
753fd850 277sys_setpgid(struct setpgid_args *uap)
984263bc 278{
41c20dac
MD
279 struct proc *curp = curproc;
280 struct proc *targp; /* target process */
281 struct pgrp *pgrp; /* target pgrp */
984263bc
MD
282
283 if (uap->pgid < 0)
284 return (EINVAL);
285 if (uap->pid != 0 && uap->pid != curp->p_pid) {
286 if ((targp = pfind(uap->pid)) == 0 || !inferior(targp))
287 return (ESRCH);
288 if (targp->p_pgrp == NULL || targp->p_session != curp->p_session)
289 return (EPERM);
290 if (targp->p_flag & P_EXEC)
291 return (EACCES);
292 } else
293 targp = curp;
294 if (SESS_LEADER(targp))
295 return (EPERM);
296 if (uap->pgid == 0)
297 uap->pgid = targp->p_pid;
298 else if (uap->pgid != targp->p_pid)
299 if ((pgrp = pgfind(uap->pgid)) == 0 ||
300 pgrp->pg_session != curp->p_session)
301 return (EPERM);
302 return (enterpgrp(targp, uap->pgid, 0));
303}
304
305/*
306 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
9a7c6212 307 * compatible. It says that setting the uid/gid to euid/egid is a special
984263bc
MD
308 * case of "appropriate privilege". Once the rules are expanded out, this
309 * basically means that setuid(nnn) sets all three id's, in all permitted
310 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid())
311 * does not set the saved id - this is dangerous for traditional BSD
312 * programs. For this reason, we *really* do not want to set
313 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
314 */
315#define POSIX_APPENDIX_B_4_2_2
316
984263bc
MD
317/* ARGSUSED */
318int
753fd850 319sys_setuid(struct setuid_args *uap)
984263bc 320{
41c20dac
MD
321 struct proc *p = curproc;
322 struct ucred *cr;
323 uid_t uid;
984263bc
MD
324 int error;
325
41c20dac
MD
326 if (p == NULL) /* API enforcement */
327 return(EPERM);
328 cr = p->p_ucred;
329
984263bc
MD
330 /*
331 * See if we have "permission" by POSIX 1003.1 rules.
332 *
333 * Note that setuid(geteuid()) is a special case of
334 * "appropriate privileges" in appendix B.4.2.2. We need
9a7c6212 335 * to use this clause to be compatible with traditional BSD
984263bc
MD
336 * semantics. Basically, it means that "setuid(xx)" sets all
337 * three id's (assuming you have privs).
338 *
339 * Notes on the logic. We do things in three steps.
340 * 1: We determine if the euid is going to change, and do EPERM
341 * right away. We unconditionally change the euid later if this
342 * test is satisfied, simplifying that part of the logic.
343 * 2: We determine if the real and/or saved uid's are going to
344 * change. Determined by compile options.
345 * 3: Change euid last. (after tests in #2 for "appropriate privs")
346 */
347 uid = uap->uid;
41c20dac 348 if (uid != cr->cr_ruid && /* allow setuid(getuid()) */
984263bc 349#ifdef _POSIX_SAVED_IDS
41c20dac 350 uid != crc->cr_svuid && /* allow setuid(saved gid) */
984263bc
MD
351#endif
352#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
41c20dac 353 uid != cr->cr_uid && /* allow setuid(geteuid()) */
984263bc 354#endif
dadab5e9 355 (error = suser_cred(cr, PRISON_ROOT)))
984263bc
MD
356 return (error);
357
358#ifdef _POSIX_SAVED_IDS
359 /*
360 * Do we have "appropriate privileges" (are we root or uid == euid)
361 * If so, we are changing the real uid and/or saved uid.
362 */
363 if (
364#ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */
41c20dac 365 uid == cr->cr_uid ||
984263bc 366#endif
dadab5e9 367 suser_cred(cr, PRISON_ROOT) == 0) /* we are using privs */
984263bc
MD
368#endif
369 {
370 /*
371 * Set the real uid and transfer proc count to new user.
372 */
41c20dac 373 if (uid != cr->cr_ruid) {
be170d6b 374 cr = change_ruid(uid);
41c20dac 375 setsugid();
984263bc
MD
376 }
377 /*
378 * Set saved uid
379 *
380 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as
381 * the security of seteuid() depends on it. B.4.2.2 says it
382 * is important that we should do this.
383 */
41c20dac 384 if (cr->cr_svuid != uid) {
115ccd83 385 cr = cratom(&p->p_ucred);
41c20dac
MD
386 cr->cr_svuid = uid;
387 setsugid();
984263bc
MD
388 }
389 }
390
391 /*
392 * In all permitted cases, we are changing the euid.
393 * Copy credentials so other references do not see our changes.
394 */
41c20dac
MD
395 if (cr->cr_uid != uid) {
396 change_euid(uid);
397 setsugid();
984263bc
MD
398 }
399 return (0);
400}
401
984263bc
MD
402/* ARGSUSED */
403int
753fd850 404sys_seteuid(struct seteuid_args *uap)
984263bc 405{
41c20dac
MD
406 struct proc *p = curproc;
407 struct ucred *cr;
408 uid_t euid;
984263bc
MD
409 int error;
410
41c20dac
MD
411 if (p == NULL) /* API enforcement */
412 return(EPERM);
413
414 cr = p->p_ucred;
984263bc 415 euid = uap->euid;
41c20dac
MD
416 if (euid != cr->cr_ruid && /* allow seteuid(getuid()) */
417 euid != cr->cr_svuid && /* allow seteuid(saved uid) */
dadab5e9 418 (error = suser_cred(cr, PRISON_ROOT)))
984263bc
MD
419 return (error);
420 /*
421 * Everything's okay, do it. Copy credentials so other references do
422 * not see our changes.
423 */
41c20dac
MD
424 if (cr->cr_uid != euid) {
425 change_euid(euid);
426 setsugid();
984263bc
MD
427 }
428 return (0);
429}
430
984263bc
MD
431/* ARGSUSED */
432int
753fd850 433sys_setgid(struct setgid_args *uap)
984263bc 434{
41c20dac
MD
435 struct proc *p = curproc;
436 struct ucred *cr;
437 gid_t gid;
984263bc
MD
438 int error;
439
41c20dac
MD
440 if (p == NULL) /* API enforcement */
441 return(EPERM);
442 cr = p->p_ucred;
443
984263bc
MD
444 /*
445 * See if we have "permission" by POSIX 1003.1 rules.
446 *
447 * Note that setgid(getegid()) is a special case of
448 * "appropriate privileges" in appendix B.4.2.2. We need
9a7c6212 449 * to use this clause to be compatible with traditional BSD
984263bc
MD
450 * semantics. Basically, it means that "setgid(xx)" sets all
451 * three id's (assuming you have privs).
452 *
453 * For notes on the logic here, see setuid() above.
454 */
455 gid = uap->gid;
41c20dac 456 if (gid != cr->cr_rgid && /* allow setgid(getgid()) */
984263bc 457#ifdef _POSIX_SAVED_IDS
41c20dac 458 gid != cr->cr_svgid && /* allow setgid(saved gid) */
984263bc
MD
459#endif
460#ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */
41c20dac 461 gid != cr->cr_groups[0] && /* allow setgid(getegid()) */
984263bc 462#endif
dadab5e9 463 (error = suser_cred(cr, PRISON_ROOT)))
984263bc
MD
464 return (error);
465
466#ifdef _POSIX_SAVED_IDS
467 /*
468 * Do we have "appropriate privileges" (are we root or gid == egid)
469 * If so, we are changing the real uid and saved gid.
470 */
471 if (
472#ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */
41c20dac 473 gid == cr->cr_groups[0] ||
984263bc 474#endif
dadab5e9 475 suser_cred(cr, PRISON_ROOT) == 0) /* we are using privs */
984263bc
MD
476#endif
477 {
478 /*
479 * Set real gid
480 */
41c20dac 481 if (cr->cr_rgid != gid) {
115ccd83 482 cr = cratom(&p->p_ucred);
41c20dac
MD
483 cr->cr_rgid = gid;
484 setsugid();
984263bc
MD
485 }
486 /*
487 * Set saved gid
488 *
489 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as
490 * the security of setegid() depends on it. B.4.2.2 says it
491 * is important that we should do this.
492 */
41c20dac 493 if (cr->cr_svgid != gid) {
115ccd83 494 cr = cratom(&p->p_ucred);
41c20dac
MD
495 cr->cr_svgid = gid;
496 setsugid();
984263bc
MD
497 }
498 }
499 /*
500 * In all cases permitted cases, we are changing the egid.
501 * Copy credentials so other references do not see our changes.
502 */
41c20dac 503 if (cr->cr_groups[0] != gid) {
e9a372eb 504 cr = cratom(&p->p_ucred);
41c20dac
MD
505 cr->cr_groups[0] = gid;
506 setsugid();
984263bc
MD
507 }
508 return (0);
509}
510
984263bc
MD
511/* ARGSUSED */
512int
753fd850 513sys_setegid(struct setegid_args *uap)
984263bc 514{
41c20dac
MD
515 struct proc *p = curproc;
516 struct ucred *cr;
517 gid_t egid;
984263bc
MD
518 int error;
519
41c20dac
MD
520 if (p == NULL) /* API enforcement */
521 return(EPERM);
522 cr = p->p_ucred;
523
984263bc 524 egid = uap->egid;
41c20dac
MD
525 if (egid != cr->cr_rgid && /* allow setegid(getgid()) */
526 egid != cr->cr_svgid && /* allow setegid(saved gid) */
dadab5e9 527 (error = suser_cred(cr, PRISON_ROOT)))
984263bc 528 return (error);
41c20dac 529 if (cr->cr_groups[0] != egid) {
e9a372eb 530 cr = cratom(&p->p_ucred);
41c20dac
MD
531 cr->cr_groups[0] = egid;
532 setsugid();
984263bc
MD
533 }
534 return (0);
535}
536
984263bc
MD
537/* ARGSUSED */
538int
753fd850 539sys_setgroups(struct setgroups_args *uap)
984263bc 540{
41c20dac
MD
541 struct proc *p = curproc;
542 struct ucred *cr;
543 u_int ngrp;
984263bc
MD
544 int error;
545
41c20dac
MD
546 if (p == NULL) /* API enforcement */
547 return(EPERM);
548 cr = p->p_ucred;
549
dadab5e9 550 if ((error = suser_cred(cr, PRISON_ROOT)))
984263bc
MD
551 return (error);
552 ngrp = uap->gidsetsize;
553 if (ngrp > NGROUPS)
554 return (EINVAL);
555 /*
556 * XXX A little bit lazy here. We could test if anything has
e9a372eb 557 * changed before cratom() and setting P_SUGID.
984263bc 558 */
e9a372eb 559 cr = cratom(&p->p_ucred);
984263bc
MD
560 if (ngrp < 1) {
561 /*
562 * setgroups(0, NULL) is a legitimate way of clearing the
563 * groups vector on non-BSD systems (which generally do not
564 * have the egid in the groups[0]). We risk security holes
565 * when running non-BSD software if we do not do the same.
566 */
41c20dac 567 cr->cr_ngroups = 1;
984263bc
MD
568 } else {
569 if ((error = copyin((caddr_t)uap->gidset,
41c20dac 570 (caddr_t)cr->cr_groups, ngrp * sizeof(gid_t))))
984263bc 571 return (error);
41c20dac 572 cr->cr_ngroups = ngrp;
984263bc 573 }
41c20dac 574 setsugid();
984263bc
MD
575 return (0);
576}
577
984263bc
MD
578/* ARGSUSED */
579int
753fd850 580sys_setreuid(struct setreuid_args *uap)
984263bc 581{
41c20dac
MD
582 struct proc *p = curproc;
583 struct ucred *cr;
584 uid_t ruid, euid;
984263bc
MD
585 int error;
586
41c20dac
MD
587 if (p == NULL) /* API enforcement */
588 return(EPERM);
589 cr = p->p_ucred;
590
984263bc
MD
591 ruid = uap->ruid;
592 euid = uap->euid;
41c20dac
MD
593 if (((ruid != (uid_t)-1 && ruid != cr->cr_ruid && ruid != cr->cr_svuid) ||
594 (euid != (uid_t)-1 && euid != cr->cr_uid &&
595 euid != cr->cr_ruid && euid != cr->cr_svuid)) &&
dadab5e9 596 (error = suser_cred(cr, PRISON_ROOT)) != 0)
984263bc
MD
597 return (error);
598
41c20dac 599 if (euid != (uid_t)-1 && cr->cr_uid != euid) {
be170d6b 600 cr = change_euid(euid);
41c20dac 601 setsugid();
984263bc 602 }
41c20dac 603 if (ruid != (uid_t)-1 && cr->cr_ruid != ruid) {
be170d6b 604 cr = change_ruid(ruid);
41c20dac 605 setsugid();
984263bc 606 }
41c20dac
MD
607 if ((ruid != (uid_t)-1 || cr->cr_uid != cr->cr_ruid) &&
608 cr->cr_svuid != cr->cr_uid) {
e9a372eb 609 cr = cratom(&p->p_ucred);
41c20dac
MD
610 cr->cr_svuid = cr->cr_uid;
611 setsugid();
984263bc
MD
612 }
613 return (0);
614}
615
984263bc
MD
616/* ARGSUSED */
617int
753fd850 618sys_setregid(struct setregid_args *uap)
984263bc 619{
41c20dac
MD
620 struct proc *p = curproc;
621 struct ucred *cr;
622 gid_t rgid, egid;
984263bc
MD
623 int error;
624
41c20dac
MD
625 if (p == NULL) /* API enforcement */
626 return(EPERM);
627 cr = p->p_ucred;
628
984263bc
MD
629 rgid = uap->rgid;
630 egid = uap->egid;
41c20dac
MD
631 if (((rgid != (gid_t)-1 && rgid != cr->cr_rgid && rgid != cr->cr_svgid) ||
632 (egid != (gid_t)-1 && egid != cr->cr_groups[0] &&
633 egid != cr->cr_rgid && egid != cr->cr_svgid)) &&
dadab5e9 634 (error = suser_cred(cr, PRISON_ROOT)) != 0)
984263bc
MD
635 return (error);
636
41c20dac 637 if (egid != (gid_t)-1 && cr->cr_groups[0] != egid) {
e9a372eb 638 cr = cratom(&p->p_ucred);
41c20dac
MD
639 cr->cr_groups[0] = egid;
640 setsugid();
984263bc 641 }
41c20dac 642 if (rgid != (gid_t)-1 && cr->cr_rgid != rgid) {
e9a372eb 643 cr = cratom(&p->p_ucred);
41c20dac
MD
644 cr->cr_rgid = rgid;
645 setsugid();
984263bc 646 }
41c20dac
MD
647 if ((rgid != (gid_t)-1 || cr->cr_groups[0] != cr->cr_rgid) &&
648 cr->cr_svgid != cr->cr_groups[0]) {
e9a372eb 649 cr = cratom(&p->p_ucred);
41c20dac
MD
650 cr->cr_svgid = cr->cr_groups[0];
651 setsugid();
984263bc
MD
652 }
653 return (0);
654}
655
656/*
657 * setresuid(ruid, euid, suid) is like setreuid except control over the
658 * saved uid is explicit.
659 */
660
984263bc
MD
661/* ARGSUSED */
662int
753fd850 663sys_setresuid(struct setresuid_args *uap)
984263bc 664{
41c20dac
MD
665 struct proc *p = curproc;
666 struct ucred *cr;
667 uid_t ruid, euid, suid;
984263bc
MD
668 int error;
669
41c20dac 670 cr = p->p_ucred;
984263bc
MD
671 ruid = uap->ruid;
672 euid = uap->euid;
673 suid = uap->suid;
41c20dac
MD
674 if (((ruid != (uid_t)-1 && ruid != cr->cr_ruid && ruid != cr->cr_svuid &&
675 ruid != cr->cr_uid) ||
676 (euid != (uid_t)-1 && euid != cr->cr_ruid && euid != cr->cr_svuid &&
677 euid != cr->cr_uid) ||
678 (suid != (uid_t)-1 && suid != cr->cr_ruid && suid != cr->cr_svuid &&
679 suid != cr->cr_uid)) &&
dadab5e9 680 (error = suser_cred(cr, PRISON_ROOT)) != 0)
984263bc 681 return (error);
41c20dac 682 if (euid != (uid_t)-1 && cr->cr_uid != euid) {
be170d6b 683 cr = change_euid(euid);
41c20dac 684 setsugid();
984263bc 685 }
41c20dac 686 if (ruid != (uid_t)-1 && cr->cr_ruid != ruid) {
be170d6b 687 cr = change_ruid(ruid);
41c20dac 688 setsugid();
984263bc 689 }
41c20dac 690 if (suid != (uid_t)-1 && cr->cr_svuid != suid) {
e9a372eb 691 cr = cratom(&p->p_ucred);
41c20dac
MD
692 cr->cr_svuid = suid;
693 setsugid();
984263bc
MD
694 }
695 return (0);
696}
697
698/*
699 * setresgid(rgid, egid, sgid) is like setregid except control over the
700 * saved gid is explicit.
701 */
702
984263bc
MD
703/* ARGSUSED */
704int
753fd850 705sys_setresgid(struct setresgid_args *uap)
984263bc 706{
41c20dac
MD
707 struct proc *p = curproc;
708 struct ucred *cr;
709 gid_t rgid, egid, sgid;
984263bc
MD
710 int error;
711
41c20dac 712 cr = p->p_ucred;
984263bc
MD
713 rgid = uap->rgid;
714 egid = uap->egid;
715 sgid = uap->sgid;
41c20dac
MD
716 if (((rgid != (gid_t)-1 && rgid != cr->cr_rgid && rgid != cr->cr_svgid &&
717 rgid != cr->cr_groups[0]) ||
718 (egid != (gid_t)-1 && egid != cr->cr_rgid && egid != cr->cr_svgid &&
719 egid != cr->cr_groups[0]) ||
720 (sgid != (gid_t)-1 && sgid != cr->cr_rgid && sgid != cr->cr_svgid &&
721 sgid != cr->cr_groups[0])) &&
dadab5e9 722 (error = suser_cred(cr, PRISON_ROOT)) != 0)
984263bc
MD
723 return (error);
724
41c20dac 725 if (egid != (gid_t)-1 && cr->cr_groups[0] != egid) {
e9a372eb 726 cr = cratom(&p->p_ucred);
41c20dac
MD
727 cr->cr_groups[0] = egid;
728 setsugid();
984263bc 729 }
41c20dac 730 if (rgid != (gid_t)-1 && cr->cr_rgid != rgid) {
e9a372eb 731 cr = cratom(&p->p_ucred);
41c20dac
MD
732 cr->cr_rgid = rgid;
733 setsugid();
984263bc 734 }
41c20dac 735 if (sgid != (gid_t)-1 && cr->cr_svgid != sgid) {
e9a372eb 736 cr = cratom(&p->p_ucred);
41c20dac
MD
737 cr->cr_svgid = sgid;
738 setsugid();
984263bc
MD
739 }
740 return (0);
741}
742
984263bc
MD
743/* ARGSUSED */
744int
753fd850 745sys_getresuid(struct getresuid_args *uap)
984263bc 746{
41c20dac
MD
747 struct proc *p = curproc;
748 struct ucred *cr = p->p_ucred;
984263bc
MD
749 int error1 = 0, error2 = 0, error3 = 0;
750
751 if (uap->ruid)
41c20dac
MD
752 error1 = copyout((caddr_t)&cr->cr_ruid,
753 (caddr_t)uap->ruid, sizeof(cr->cr_ruid));
984263bc 754 if (uap->euid)
41c20dac
MD
755 error2 = copyout((caddr_t)&cr->cr_uid,
756 (caddr_t)uap->euid, sizeof(cr->cr_uid));
984263bc 757 if (uap->suid)
41c20dac
MD
758 error3 = copyout((caddr_t)&cr->cr_svuid,
759 (caddr_t)uap->suid, sizeof(cr->cr_svuid));
984263bc
MD
760 return error1 ? error1 : (error2 ? error2 : error3);
761}
762
984263bc
MD
763/* ARGSUSED */
764int
753fd850 765sys_getresgid(struct getresgid_args *uap)
984263bc 766{
41c20dac
MD
767 struct proc *p = curproc;
768 struct ucred *cr = p->p_ucred;
984263bc
MD
769 int error1 = 0, error2 = 0, error3 = 0;
770
771 if (uap->rgid)
41c20dac
MD
772 error1 = copyout((caddr_t)&cr->cr_rgid,
773 (caddr_t)uap->rgid, sizeof(cr->cr_rgid));
984263bc 774 if (uap->egid)
41c20dac
MD
775 error2 = copyout((caddr_t)&cr->cr_groups[0],
776 (caddr_t)uap->egid, sizeof(cr->cr_groups[0]));
984263bc 777 if (uap->sgid)
41c20dac
MD
778 error3 = copyout((caddr_t)&cr->cr_svgid,
779 (caddr_t)uap->sgid, sizeof(cr->cr_svgid));
984263bc
MD
780 return error1 ? error1 : (error2 ? error2 : error3);
781}
782
783
984263bc
MD
784/* ARGSUSED */
785int
753fd850 786sys_issetugid(struct issetugid_args *uap)
984263bc 787{
41c20dac 788 struct proc *p = curproc;
984263bc
MD
789 /*
790 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
791 * we use P_SUGID because we consider changing the owners as
792 * "tainting" as well.
793 * This is significant for procs that start as root and "become"
794 * a user without an exec - programs cannot know *everything*
795 * that libc *might* have put in their data segment.
796 */
c7114eea 797 uap->sysmsg_result = (p->p_flag & P_SUGID) ? 1 : 0;
984263bc
MD
798 return (0);
799}
800
801/*
802 * Check if gid is a member of the group set.
803 */
804int
41c20dac 805groupmember(gid_t gid, struct ucred *cred)
984263bc 806{
41c20dac 807 gid_t *gp;
984263bc
MD
808 gid_t *egp;
809
810 egp = &(cred->cr_groups[cred->cr_ngroups]);
4f645dbb 811 for (gp = cred->cr_groups; gp < egp; gp++) {
984263bc
MD
812 if (*gp == gid)
813 return (1);
4f645dbb 814 }
984263bc
MD
815 return (0);
816}
817
818/*
819 * Test whether the specified credentials imply "super-user"
820 * privilege; if so, and we have accounting info, set the flag
dadab5e9
MD
821 * indicating use of super-powers. A kernel thread without a process
822 * context is assumed to have super user capabilities. In situations
823 * where the caller always expect a cred to exist, the cred should be
824 * passed separately and suser_cred()should be used instead of suser().
825 *
984263bc
MD
826 * Returns 0 or error.
827 */
828int
dadab5e9 829suser(struct thread *td)
984263bc 830{
dadab5e9 831 struct proc *p = td->td_proc;
41c20dac
MD
832
833 if (p != NULL) {
dadab5e9 834 return suser_cred(p->p_ucred, 0);
41c20dac 835 } else {
dadab5e9 836 return (0);
41c20dac 837 }
984263bc
MD
838}
839
e4700d00
JH
840/*
841 * A non-null credential is expected unless NULL_CRED_OKAY is set.
842 */
984263bc 843int
dadab5e9 844suser_cred(struct ucred *cred, int flag)
984263bc 845{
e4700d00
JH
846 KASSERT(cred != NULL || flag & NULL_CRED_OKAY,
847 ("suser_cred: NULL cred!"));
41c20dac 848
e4700d00
JH
849 if (cred == NULL) {
850 if (flag & NULL_CRED_OKAY)
851 return (0);
852 else
853 return (EPERM);
854 }
984263bc
MD
855 if (cred->cr_uid != 0)
856 return (EPERM);
41c20dac 857 if (cred->cr_prison && !(flag & PRISON_ROOT))
984263bc 858 return (EPERM);
dadab5e9 859 /* NOTE: accounting for suser access (p_acflag/ASU) removed */
984263bc
MD
860 return (0);
861}
862
863/*
864 * Return zero if p1 can fondle p2, return errno (EPERM/ESRCH) otherwise.
865 */
984263bc 866int
41c20dac 867p_trespass(struct ucred *cr1, struct ucred *cr2)
984263bc 868{
41c20dac 869 if (cr1 == cr2)
984263bc 870 return (0);
41c20dac 871 if (!PRISON_CHECK(cr1, cr2))
984263bc 872 return (ESRCH);
41c20dac 873 if (cr1->cr_ruid == cr2->cr_ruid)
984263bc 874 return (0);
41c20dac 875 if (cr1->cr_uid == cr2->cr_ruid)
984263bc 876 return (0);
41c20dac 877 if (cr1->cr_ruid == cr2->cr_uid)
984263bc 878 return (0);
41c20dac 879 if (cr1->cr_uid == cr2->cr_uid)
984263bc 880 return (0);
dadab5e9 881 if (suser_cred(cr1, PRISON_ROOT) == 0)
984263bc
MD
882 return (0);
883 return (EPERM);
884}
885
d9b2033e
MD
886/*
887 * MPSAFE
888 */
889static __inline void
890_crinit(struct ucred *cr)
891{
892 bzero(cr, sizeof(*cr));
893 cr->cr_ref = 1;
894 spin_init(&cr->cr_spin);
895}
896
897/*
898 * MPSAFE
899 */
900void
901crinit(struct ucred *cr)
902{
903 _crinit(cr);
904}
905
984263bc
MD
906/*
907 * Allocate a zeroed cred structure.
d9b2033e
MD
908 *
909 * MPSAFE
984263bc
MD
910 */
911struct ucred *
77153250 912crget(void)
984263bc 913{
1fd87d54 914 struct ucred *cr;
984263bc
MD
915
916 MALLOC(cr, struct ucred *, sizeof(*cr), M_CRED, M_WAITOK);
d9b2033e 917 _crinit(cr);
984263bc
MD
918 return (cr);
919}
920
921/*
e9a372eb
MD
922 * Claim another reference to a ucred structure. Can be used with special
923 * creds.
d9b2033e
MD
924 *
925 * It must be possible to call this routine with spinlocks held, meaning
926 * that this routine itself cannot obtain a spinlock.
927 *
928 * MPSAFE
984263bc 929 */
dadab5e9 930struct ucred *
41c20dac 931crhold(struct ucred *cr)
984263bc 932{
e9a372eb 933 if (cr != NOCRED && cr != FSCRED)
d9b2033e 934 atomic_add_int(&cr->cr_ref, 1);
dadab5e9 935 return(cr);
984263bc
MD
936}
937
938/*
d9b2033e
MD
939 * Drop a reference from the cred structure, free it if the reference count
940 * reaches 0.
941 *
942 * NOTE: because we used atomic_add_int() above, without a spinlock, we
943 * must also use atomic_subtract_int() below. A spinlock is required
944 * in crfree() to handle multiple callers racing the refcount to 0.
945 *
946 * MPALMOSTSAFE - acquires mplock on 1->0 transition of ref count
984263bc
MD
947 */
948void
41c20dac 949crfree(struct ucred *cr)
984263bc 950{
d9b2033e 951 if (cr->cr_ref <= 0)
984263bc 952 panic("Freeing already free credential! %p", cr);
d9b2033e
MD
953 spin_lock_wr(&cr->cr_spin);
954 atomic_subtract_int(&cr->cr_ref, 1);
955 if (cr->cr_ref == 0) {
956 spin_unlock_wr(&cr->cr_spin);
984263bc
MD
957 /*
958 * Some callers of crget(), such as nfs_statfs(),
959 * allocate a temporary credential, but don't
960 * allocate a uidinfo structure.
961 */
d9b2033e 962 get_mplock();
792033e7
MD
963 if (cr->cr_uidinfo != NULL) {
964 uidrop(cr->cr_uidinfo);
965 cr->cr_uidinfo = NULL;
966 }
967 if (cr->cr_ruidinfo != NULL) {
968 uidrop(cr->cr_ruidinfo);
969 cr->cr_ruidinfo = NULL;
970 }
41c20dac
MD
971
972 /*
973 * Destroy empty prisons
974 */
b40e316c
JS
975 if (jailed(cr))
976 prison_free(cr->cr_prison);
41c20dac
MD
977 cr->cr_prison = NULL; /* safety */
978
984263bc 979 FREE((caddr_t)cr, M_CRED);
d9b2033e
MD
980 rel_mplock();
981 } else {
982 spin_unlock_wr(&cr->cr_spin);
984263bc
MD
983 }
984}
985
e9a372eb
MD
986/*
987 * Atomize a cred structure so it can be modified without polluting
988 * other references to it.
989 */
990struct ucred *
991cratom(struct ucred **pcr)
992{
993 struct ucred *oldcr;
994 struct ucred *newcr;
995
996 oldcr = *pcr;
997 if (oldcr->cr_ref == 1)
998 return (oldcr);
999 newcr = crget();
1000 *newcr = *oldcr;
1001 if (newcr->cr_uidinfo)
1002 uihold(newcr->cr_uidinfo);
1003 if (newcr->cr_ruidinfo)
1004 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1005 if (jailed(newcr))
1006 prison_hold(newcr->cr_prison);
e9a372eb
MD
1007 newcr->cr_ref = 1;
1008 crfree(oldcr);
1009 *pcr = newcr;
1010 return (newcr);
1011}
1012
1013#if 0 /* no longer used but keep around for a little while */
984263bc
MD
1014/*
1015 * Copy cred structure to a new one and free the old one.
1016 */
1017struct ucred *
41c20dac 1018crcopy(struct ucred *cr)
984263bc
MD
1019{
1020 struct ucred *newcr;
1021
1022 if (cr->cr_ref == 1)
1023 return (cr);
1024 newcr = crget();
1025 *newcr = *cr;
41c20dac
MD
1026 if (newcr->cr_uidinfo)
1027 uihold(newcr->cr_uidinfo);
1028 if (newcr->cr_ruidinfo)
1029 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1030 if (jailed(newcr))
1031 prison_hold(newcr->cr_prison);
984263bc 1032 newcr->cr_ref = 1;
41c20dac 1033 crfree(cr);
984263bc
MD
1034 return (newcr);
1035}
e9a372eb 1036#endif
984263bc
MD
1037
1038/*
1039 * Dup cred struct to a new held one.
1040 */
1041struct ucred *
77153250 1042crdup(struct ucred *cr)
984263bc
MD
1043{
1044 struct ucred *newcr;
1045
1046 newcr = crget();
1047 *newcr = *cr;
41c20dac
MD
1048 if (newcr->cr_uidinfo)
1049 uihold(newcr->cr_uidinfo);
1050 if (newcr->cr_ruidinfo)
1051 uihold(newcr->cr_ruidinfo);
b40e316c
JS
1052 if (jailed(newcr))
1053 prison_hold(newcr->cr_prison);
984263bc
MD
1054 newcr->cr_ref = 1;
1055 return (newcr);
1056}
1057
1058/*
1059 * Fill in a struct xucred based on a struct ucred.
1060 */
1061void
77153250 1062cru2x(struct ucred *cr, struct xucred *xcr)
984263bc
MD
1063{
1064
1065 bzero(xcr, sizeof(*xcr));
1066 xcr->cr_version = XUCRED_VERSION;
1067 xcr->cr_uid = cr->cr_uid;
1068 xcr->cr_ngroups = cr->cr_ngroups;
1069 bcopy(cr->cr_groups, xcr->cr_groups, sizeof(cr->cr_groups));
1070}
1071
1072/*
1073 * Get login name, if available.
1074 */
984263bc
MD
1075/* ARGSUSED */
1076int
753fd850 1077sys_getlogin(struct getlogin_args *uap)
984263bc 1078{
41c20dac 1079 struct proc *p = curproc;
984263bc
MD
1080
1081 if (uap->namelen > MAXLOGNAME)
1082 uap->namelen = MAXLOGNAME;
1083 return (copyout((caddr_t) p->p_pgrp->pg_session->s_login,
1084 (caddr_t) uap->namebuf, uap->namelen));
1085}
1086
1087/*
1088 * Set login name.
1089 */
984263bc
MD
1090/* ARGSUSED */
1091int
753fd850 1092sys_setlogin(struct setlogin_args *uap)
984263bc 1093{
41c20dac 1094 struct proc *p = curproc;
984263bc
MD
1095 int error;
1096 char logintmp[MAXLOGNAME];
1097
41c20dac 1098 KKASSERT(p != NULL);
dadab5e9 1099 if ((error = suser_cred(p->p_ucred, PRISON_ROOT)))
984263bc
MD
1100 return (error);
1101 error = copyinstr((caddr_t) uap->namebuf, (caddr_t) logintmp,
1102 sizeof(logintmp), (size_t *)0);
1103 if (error == ENAMETOOLONG)
1104 error = EINVAL;
1105 else if (!error)
1106 (void) memcpy(p->p_pgrp->pg_session->s_login, logintmp,
1107 sizeof(logintmp));
1108 return (error);
1109}
1110
1111void
77153250 1112setsugid(void)
984263bc 1113{
41c20dac
MD
1114 struct proc *p = curproc;
1115
1116 KKASSERT(p != NULL);
984263bc
MD
1117 p->p_flag |= P_SUGID;
1118 if (!(p->p_pfsflags & PF_ISUGID))
1119 p->p_stops = 0;
1120}
1121
1122/*
1123 * Helper function to change the effective uid of a process
1124 */
be170d6b 1125struct ucred *
41c20dac 1126change_euid(uid_t euid)
984263bc 1127{
41c20dac
MD
1128 struct proc *p = curproc;
1129 struct ucred *cr;
984263bc 1130
41c20dac 1131 KKASSERT(p != NULL);
94507578 1132 lf_count_adjust(p, 0);
e9a372eb 1133 cr = cratom(&p->p_ucred);
41c20dac 1134 cr->cr_uid = euid;
792033e7 1135 uireplace(&cr->cr_uidinfo, uifind(euid));
94507578 1136 lf_count_adjust(p, 1);
be170d6b 1137 return (cr);
984263bc
MD
1138}
1139
1140/*
1141 * Helper function to change the real uid of a process
1142 *
1143 * The per-uid process count for this process is transfered from
1144 * the old uid to the new uid.
1145 */
be170d6b 1146struct ucred *
41c20dac 1147change_ruid(uid_t ruid)
984263bc 1148{
41c20dac
MD
1149 struct proc *p = curproc;
1150 struct ucred *cr;
984263bc 1151
41c20dac
MD
1152 KKASSERT(p != NULL);
1153
e9a372eb 1154 cr = cratom(&p->p_ucred);
be170d6b 1155 chgproccnt(cr->cr_ruidinfo, -1, 0);
41c20dac 1156 cr->cr_ruid = ruid;
792033e7 1157 uireplace(&cr->cr_ruidinfo, uifind(ruid));
be170d6b
SS
1158 chgproccnt(cr->cr_ruidinfo, 1, 0);
1159 return (cr);
984263bc 1160}