17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
5f48205bcasper * Common Development and Distribution License (the "License").
6f48205bcasper * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
217c478bdstevel@tonic-gate/*
22bda8958jp * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
237c478bdstevel@tonic-gate * Use is subject to license terms.
247c478bdstevel@tonic-gate */
257c478bdstevel@tonic-gate
267c478bdstevel@tonic-gate/*
277c478bdstevel@tonic-gate *	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T
287c478bdstevel@tonic-gate */
297c478bdstevel@tonic-gate
307c478bdstevel@tonic-gate#pragma ident	"%Z%%M%	%I%	%E% SMI"
317c478bdstevel@tonic-gate
327c478bdstevel@tonic-gate#include <sys/param.h>
337c478bdstevel@tonic-gate#include <sys/types.h>
347c478bdstevel@tonic-gate#include <sys/sysmacros.h>
357c478bdstevel@tonic-gate#include <sys/systm.h>
367c478bdstevel@tonic-gate#include <sys/cred_impl.h>
377c478bdstevel@tonic-gate#include <sys/errno.h>
387c478bdstevel@tonic-gate#include <sys/proc.h>
397c478bdstevel@tonic-gate#include <sys/debug.h>
407c478bdstevel@tonic-gate#include <sys/policy.h>
417c478bdstevel@tonic-gate
427c478bdstevel@tonic-gate
437c478bdstevel@tonic-gateint
447c478bdstevel@tonic-gatesetgid(gid_t gid)
457c478bdstevel@tonic-gate{
46f48205bcasper	proc_t *p;
477c478bdstevel@tonic-gate	int error;
487c478bdstevel@tonic-gate	int do_nocd = 0;
497c478bdstevel@tonic-gate	cred_t	*cr, *newcr;
50f48205bcasper	ksid_t ksid, *ksp;
51bda8958jp	zone_t	*zone = crgetzone(CRED());
527c478bdstevel@tonic-gate
53bda8958jp
54bda8958jp	if (!VALID_GID(gid, zone))
557c478bdstevel@tonic-gate		return (set_errno(EINVAL));
567c478bdstevel@tonic-gate
57f48205bcasper	if (gid > MAXUID) {
58bda8958jp		if (ksid_lookupbygid(zone, gid, &ksid) != 0)
59f48205bcasper			return (set_errno(EINVAL));
60f48205bcasper		ksp = &ksid;
61f48205bcasper	} else {
62f48205bcasper		ksp = NULL;
63f48205bcasper	}
64f48205bcasper
657c478bdstevel@tonic-gate	/*
667c478bdstevel@tonic-gate	 * Need to pre-allocate the new cred structure before grabbing
67ddf7fe9casper	 * the p_crlock mutex.  We cannot hold the mutex across the
68ddf7fe9casper	 * secpolicy functions.
697c478bdstevel@tonic-gate	 */
70f48205bcasper	newcr = cralloc_ksid();
717c478bdstevel@tonic-gate	p = ttoproc(curthread);
727c478bdstevel@tonic-gate	mutex_enter(&p->p_crlock);
73ddf7fe9casperretry:
747c478bdstevel@tonic-gate	cr = p->p_cred;
75ddf7fe9casper	crhold(cr);
76ddf7fe9casper	mutex_exit(&p->p_crlock);
77ddf7fe9casper
787c478bdstevel@tonic-gate
797c478bdstevel@tonic-gate	if ((gid == cr->cr_rgid || gid == cr->cr_sgid) &&
807c478bdstevel@tonic-gate	    secpolicy_allow_setid(cr, -1, B_TRUE) != 0) {
81ddf7fe9casper		mutex_enter(&p->p_crlock);
82ddf7fe9casper		crfree(cr);
83ddf7fe9casper		if (cr != p->p_cred)
84ddf7fe9casper			goto retry;
857c478bdstevel@tonic-gate		error = 0;
867c478bdstevel@tonic-gate		crcopy_to(cr, newcr);
877c478bdstevel@tonic-gate		p->p_cred = newcr;
887c478bdstevel@tonic-gate		newcr->cr_gid = gid;
89f48205bcasper		crsetsid(newcr, ksp, KSID_GROUP);
90ddf7fe9casper		mutex_exit(&p->p_crlock);
917c478bdstevel@tonic-gate	} else if ((error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) {
92ddf7fe9casper		mutex_enter(&p->p_crlock);
93ddf7fe9casper		crfree(cr);
94ddf7fe9casper		if (cr != p->p_cred)
95ddf7fe9casper			goto retry;
967c478bdstevel@tonic-gate		/*
977c478bdstevel@tonic-gate		 * A privileged process that makes itself look like a
987c478bdstevel@tonic-gate		 * set-gid process must be marked to produce no core dump.
997c478bdstevel@tonic-gate		 */
1007c478bdstevel@tonic-gate		if (cr->cr_gid != gid ||
1017c478bdstevel@tonic-gate		    cr->cr_rgid != gid ||
1027c478bdstevel@tonic-gate		    cr->cr_sgid != gid)
1037c478bdstevel@tonic-gate			do_nocd = 1;
1047c478bdstevel@tonic-gate		crcopy_to(cr, newcr);
1057c478bdstevel@tonic-gate		p->p_cred = newcr;
1067c478bdstevel@tonic-gate		newcr->cr_gid = gid;
1077c478bdstevel@tonic-gate		newcr->cr_rgid = gid;
1087c478bdstevel@tonic-gate		newcr->cr_sgid = gid;
109f48205bcasper		crsetsid(newcr, ksp, KSID_GROUP);
110ddf7fe9casper		mutex_exit(&p->p_crlock);
111f48205bcasper	} else {
1127c478bdstevel@tonic-gate		crfree(newcr);
113ddf7fe9casper		crfree(cr);
114f48205bcasper		if (ksp != NULL)
115f48205bcasper			ksid_rele(ksp);
116f48205bcasper
117f48205bcasper	}
1187c478bdstevel@tonic-gate
1197c478bdstevel@tonic-gate	if (error == 0) {
1207c478bdstevel@tonic-gate		if (do_nocd) {
1217c478bdstevel@tonic-gate			mutex_enter(&p->p_lock);
1227c478bdstevel@tonic-gate			p->p_flag |= SNOCD;
1237c478bdstevel@tonic-gate			mutex_exit(&p->p_lock);
1247c478bdstevel@tonic-gate		}
1257c478bdstevel@tonic-gate		crset(p, newcr);	/* broadcast to process threads */
1267c478bdstevel@tonic-gate		return (0);
1277c478bdstevel@tonic-gate	}
1287c478bdstevel@tonic-gate	return (set_errno(error));
1297c478bdstevel@tonic-gate}
1307c478bdstevel@tonic-gate
1317c478bdstevel@tonic-gateint64_t
1327c478bdstevel@tonic-gategetgid(void)
1337c478bdstevel@tonic-gate{
1347c478bdstevel@tonic-gate	rval_t	r;
1357c478bdstevel@tonic-gate	cred_t	*cr;
1367c478bdstevel@tonic-gate
1377c478bdstevel@tonic-gate	cr = curthread->t_cred;
1387c478bdstevel@tonic-gate	r.r_val1 = cr->cr_rgid;
1397c478bdstevel@tonic-gate	r.r_val2 = cr->cr_gid;
1407c478bdstevel@tonic-gate	return (r.r_vals);
1417c478bdstevel@tonic-gate}
1427c478bdstevel@tonic-gate
1437c478bdstevel@tonic-gateint
1447c478bdstevel@tonic-gatesetegid(gid_t gid)
1457c478bdstevel@tonic-gate{
146f48205bcasper	proc_t *p;
147f48205bcasper	cred_t	*cr, *newcr;
1487c478bdstevel@tonic-gate	int error = EPERM;
1497c478bdstevel@tonic-gate	int do_nocd = 0;
150f48205bcasper	ksid_t ksid, *ksp;
151bda8958jp	zone_t	*zone = crgetzone(CRED());
1527c478bdstevel@tonic-gate
153bda8958jp	if (!VALID_GID(gid, zone))
1547c478bdstevel@tonic-gate		return (set_errno(EINVAL));
1557c478bdstevel@tonic-gate
156f48205bcasper	if (gid > MAXUID) {
157bda8958jp		if (ksid_lookupbygid(zone, gid, &ksid) != 0)
158f48205bcasper			return (set_errno(EINVAL));
159f48205bcasper		ksp = &ksid;
160f48205bcasper	} else {
161f48205bcasper		ksp = NULL;
162f48205bcasper	}
1637c478bdstevel@tonic-gate	/*
1647c478bdstevel@tonic-gate	 * Need to pre-allocate the new cred structure before grabbing
1657c478bdstevel@tonic-gate	 * the p_crlock mutex.
1667c478bdstevel@tonic-gate	 */
167f48205bcasper	newcr = cralloc_ksid();
1687c478bdstevel@tonic-gate	p = ttoproc(curthread);
1697c478bdstevel@tonic-gate	mutex_enter(&p->p_crlock);
170ddf7fe9casperretry:
171ddf7fe9casper	crhold(cr = p->p_cred);
172ddf7fe9casper	mutex_exit(&p->p_crlock);
173ddf7fe9casper
1747c478bdstevel@tonic-gate	if (gid == cr->cr_rgid || gid == cr->cr_gid || gid == cr->cr_sgid ||
1757c478bdstevel@tonic-gate	    (error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) {
176ddf7fe9casper		mutex_enter(&p->p_crlock);
177ddf7fe9casper		crfree(cr);
178ddf7fe9casper		if (cr != p->p_cred)
179ddf7fe9casper			goto retry;
1807c478bdstevel@tonic-gate		/*
1817c478bdstevel@tonic-gate		 * A privileged process that makes itself look like a
1827c478bdstevel@tonic-gate		 * set-gid process must be marked to produce no core dump.
1837c478bdstevel@tonic-gate		 */
1847c478bdstevel@tonic-gate		if (cr->cr_gid != gid && error == 0)
1857c478bdstevel@tonic-gate			do_nocd = 1;
1867c478bdstevel@tonic-gate		error = 0;
1877c478bdstevel@tonic-gate		crcopy_to(cr, newcr);
1887c478bdstevel@tonic-gate		p->p_cred = newcr;
1897c478bdstevel@tonic-gate		newcr->cr_gid = gid;
190f48205bcasper		crsetsid(newcr, ksp, KSID_GROUP);
191ddf7fe9casper		mutex_exit(&p->p_crlock);
192f48205bcasper	} else {
1937c478bdstevel@tonic-gate		crfree(newcr);
194ddf7fe9casper		crfree(cr);
195f48205bcasper		if (ksp != NULL)
196f48205bcasper			ksid_rele(ksp);
197f48205bcasper	}
1987c478bdstevel@tonic-gate
1997c478bdstevel@tonic-gate	if (error == 0) {
2007c478bdstevel@tonic-gate		if (do_nocd) {
2017c478bdstevel@tonic-gate			mutex_enter(&p->p_lock);
2027c478bdstevel@tonic-gate			p->p_flag |= SNOCD;
2037c478bdstevel@tonic-gate			mutex_exit(&p->p_lock);
2047c478bdstevel@tonic-gate		}
2057c478bdstevel@tonic-gate		crset(p, newcr);	/* broadcast to process threads */
2067c478bdstevel@tonic-gate		return (0);
2077c478bdstevel@tonic-gate	}
2087c478bdstevel@tonic-gate	return (set_errno(error));
2097c478bdstevel@tonic-gate}
2107c478bdstevel@tonic-gate
2117c478bdstevel@tonic-gate/*
2127c478bdstevel@tonic-gate * Buy-back from SunOS 4.x
2137c478bdstevel@tonic-gate *
2147c478bdstevel@tonic-gate * Like setgid() and setegid() combined -except- that non-root users
2157c478bdstevel@tonic-gate * can change cr_rgid to cr_gid, and the semantics of cr_sgid are
2167c478bdstevel@tonic-gate * subtly different.
2177c478bdstevel@tonic-gate */
2187c478bdstevel@tonic-gateint
2197c478bdstevel@tonic-gatesetregid(gid_t rgid, gid_t egid)
2207c478bdstevel@tonic-gate{
2217c478bdstevel@tonic-gate	proc_t *p;
2227c478bdstevel@tonic-gate	int error = EPERM;
2237c478bdstevel@tonic-gate	int do_nocd = 0;
2247c478bdstevel@tonic-gate	cred_t *cr, *newcr;
225f48205bcasper	ksid_t ksid, *ksp;
226bda8958jp	zone_t	*zone = crgetzone(CRED());
2277c478bdstevel@tonic-gate
228bda8958jp	if ((rgid != -1 && !VALID_GID(rgid, zone)) ||
229bda8958jp	    (egid != -1 && !VALID_GID(egid, zone)))
2307c478bdstevel@tonic-gate		return (set_errno(EINVAL));
2317c478bdstevel@tonic-gate
232f48205bcasper	if (egid != -1 && egid > MAXUID) {
233bda8958jp		if (ksid_lookupbygid(zone, egid, &ksid) != 0)
234f48205bcasper			return (set_errno(EINVAL));
235f48205bcasper		ksp = &ksid;
236f48205bcasper	} else {
237f48205bcasper		ksp = NULL;
238f48205bcasper	}
2397c478bdstevel@tonic-gate	/*
2407c478bdstevel@tonic-gate	 * Need to pre-allocate the new cred structure before grabbing
2417c478bdstevel@tonic-gate	 * the p_crlock mutex.
2427c478bdstevel@tonic-gate	 */
243f48205bcasper	newcr = cralloc_ksid();
2447c478bdstevel@tonic-gate
2457c478bdstevel@tonic-gate	p = ttoproc(curthread);
2467c478bdstevel@tonic-gate	mutex_enter(&p->p_crlock);
2477c478bdstevel@tonic-gate	cr = p->p_cred;
2487c478bdstevel@tonic-gate
2497c478bdstevel@tonic-gate	if ((rgid == -1 ||
2507c478bdstevel@tonic-gate	    rgid == cr->cr_rgid || rgid == cr->cr_gid || rgid == cr->cr_sgid) &&
2517c478bdstevel@tonic-gate	    (egid == -1 || egid == cr->cr_rgid || egid == cr->cr_gid ||
2527c478bdstevel@tonic-gate	    egid == cr->cr_sgid) ||
2537c478bdstevel@tonic-gate	    (error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) {
2547c478bdstevel@tonic-gate		crhold(cr);
2557c478bdstevel@tonic-gate		crcopy_to(cr, newcr);
2567c478bdstevel@tonic-gate		p->p_cred = newcr;
2577c478bdstevel@tonic-gate
258f48205bcasper		if (egid != -1) {
2597c478bdstevel@tonic-gate			newcr->cr_gid = egid;
260f48205bcasper			crsetsid(newcr, ksp, KSID_GROUP);
261f48205bcasper		}
2627c478bdstevel@tonic-gate		if (rgid != -1)
2637c478bdstevel@tonic-gate			newcr->cr_rgid = rgid;
2647c478bdstevel@tonic-gate		/*
2657c478bdstevel@tonic-gate		 * "If the real gid is being changed, or the effective gid is
2667c478bdstevel@tonic-gate		 * being changed to a value not equal to the real gid, the
2677c478bdstevel@tonic-gate		 * saved gid is set to the new effective gid."
2687c478bdstevel@tonic-gate		 */
2697c478bdstevel@tonic-gate		if (rgid != -1 ||
2707c478bdstevel@tonic-gate		    (egid != -1 && newcr->cr_gid != newcr->cr_rgid))
2717c478bdstevel@tonic-gate			newcr->cr_sgid = newcr->cr_gid;
2727c478bdstevel@tonic-gate		/*
2737c478bdstevel@tonic-gate		 * A privileged process that makes itself look like a
2747c478bdstevel@tonic-gate		 * set-gid process must be marked to produce no core dump.
2757c478bdstevel@tonic-gate		 */
2767c478bdstevel@tonic-gate		if ((cr->cr_gid != newcr->cr_gid ||
2777c478bdstevel@tonic-gate		    cr->cr_rgid != newcr->cr_rgid ||
2787c478bdstevel@tonic-gate		    cr->cr_sgid != newcr->cr_sgid) && error == 0)
2797c478bdstevel@tonic-gate			do_nocd = 1;
2807c478bdstevel@tonic-gate		error = 0;
2817c478bdstevel@tonic-gate		crfree(cr);
2827c478bdstevel@tonic-gate	}
2837c478bdstevel@tonic-gate	mutex_exit(&p->p_crlock);
2847c478bdstevel@tonic-gate
2857c478bdstevel@tonic-gate	if (error == 0) {
2867c478bdstevel@tonic-gate		if (do_nocd) {
2877c478bdstevel@tonic-gate			mutex_enter(&p->p_lock);
2887c478bdstevel@tonic-gate			p->p_flag |= SNOCD;
2897c478bdstevel@tonic-gate			mutex_exit(&p->p_lock);
2907c478bdstevel@tonic-gate		}
2917c478bdstevel@tonic-gate		crset(p, newcr);	/* broadcast to process threads */
2927c478bdstevel@tonic-gate		return (0);
2937c478bdstevel@tonic-gate	}
2947c478bdstevel@tonic-gate	crfree(newcr);
295f48205bcasper	if (ksp != NULL)
296f48205bcasper		ksid_rele(ksp);
2977c478bdstevel@tonic-gate	return (set_errno(error));
2987c478bdstevel@tonic-gate}
299