17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5f48205beScasper * Common Development and Distribution License (the "License"). 6f48205beScasper * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22bda89588Sjp * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T 287c478bd9Sstevel@tonic-gate */ 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 317c478bd9Sstevel@tonic-gate 327c478bd9Sstevel@tonic-gate #include <sys/param.h> 337c478bd9Sstevel@tonic-gate #include <sys/types.h> 347c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 357c478bd9Sstevel@tonic-gate #include <sys/systm.h> 367c478bd9Sstevel@tonic-gate #include <sys/cred_impl.h> 377c478bd9Sstevel@tonic-gate #include <sys/errno.h> 387c478bd9Sstevel@tonic-gate #include <sys/proc.h> 397c478bd9Sstevel@tonic-gate #include <sys/debug.h> 407c478bd9Sstevel@tonic-gate #include <sys/policy.h> 417c478bd9Sstevel@tonic-gate 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate int 447c478bd9Sstevel@tonic-gate setgid(gid_t gid) 457c478bd9Sstevel@tonic-gate { 46f48205beScasper proc_t *p; 477c478bd9Sstevel@tonic-gate int error; 487c478bd9Sstevel@tonic-gate int do_nocd = 0; 497c478bd9Sstevel@tonic-gate cred_t *cr, *newcr; 50f48205beScasper ksid_t ksid, *ksp; 51bda89588Sjp zone_t *zone = crgetzone(CRED()); 527c478bd9Sstevel@tonic-gate 53bda89588Sjp 54bda89588Sjp if (!VALID_GID(gid, zone)) 557c478bd9Sstevel@tonic-gate return (set_errno(EINVAL)); 567c478bd9Sstevel@tonic-gate 57f48205beScasper if (gid > MAXUID) { 58bda89588Sjp if (ksid_lookupbygid(zone, gid, &ksid) != 0) 59f48205beScasper return (set_errno(EINVAL)); 60f48205beScasper ksp = &ksid; 61f48205beScasper } else { 62f48205beScasper ksp = NULL; 63f48205beScasper } 64f48205beScasper 657c478bd9Sstevel@tonic-gate /* 667c478bd9Sstevel@tonic-gate * Need to pre-allocate the new cred structure before grabbing 67*ddf7fe95Scasper * the p_crlock mutex. We cannot hold the mutex across the 68*ddf7fe95Scasper * secpolicy functions. 697c478bd9Sstevel@tonic-gate */ 70f48205beScasper newcr = cralloc_ksid(); 717c478bd9Sstevel@tonic-gate p = ttoproc(curthread); 727c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock); 73*ddf7fe95Scasper retry: 747c478bd9Sstevel@tonic-gate cr = p->p_cred; 75*ddf7fe95Scasper crhold(cr); 76*ddf7fe95Scasper mutex_exit(&p->p_crlock); 77*ddf7fe95Scasper 787c478bd9Sstevel@tonic-gate 797c478bd9Sstevel@tonic-gate if ((gid == cr->cr_rgid || gid == cr->cr_sgid) && 807c478bd9Sstevel@tonic-gate secpolicy_allow_setid(cr, -1, B_TRUE) != 0) { 81*ddf7fe95Scasper mutex_enter(&p->p_crlock); 82*ddf7fe95Scasper crfree(cr); 83*ddf7fe95Scasper if (cr != p->p_cred) 84*ddf7fe95Scasper goto retry; 857c478bd9Sstevel@tonic-gate error = 0; 867c478bd9Sstevel@tonic-gate crcopy_to(cr, newcr); 877c478bd9Sstevel@tonic-gate p->p_cred = newcr; 887c478bd9Sstevel@tonic-gate newcr->cr_gid = gid; 89f48205beScasper crsetsid(newcr, ksp, KSID_GROUP); 90*ddf7fe95Scasper mutex_exit(&p->p_crlock); 917c478bd9Sstevel@tonic-gate } else if ((error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) { 92*ddf7fe95Scasper mutex_enter(&p->p_crlock); 93*ddf7fe95Scasper crfree(cr); 94*ddf7fe95Scasper if (cr != p->p_cred) 95*ddf7fe95Scasper goto retry; 967c478bd9Sstevel@tonic-gate /* 977c478bd9Sstevel@tonic-gate * A privileged process that makes itself look like a 987c478bd9Sstevel@tonic-gate * set-gid process must be marked to produce no core dump. 997c478bd9Sstevel@tonic-gate */ 1007c478bd9Sstevel@tonic-gate if (cr->cr_gid != gid || 1017c478bd9Sstevel@tonic-gate cr->cr_rgid != gid || 1027c478bd9Sstevel@tonic-gate cr->cr_sgid != gid) 1037c478bd9Sstevel@tonic-gate do_nocd = 1; 1047c478bd9Sstevel@tonic-gate crcopy_to(cr, newcr); 1057c478bd9Sstevel@tonic-gate p->p_cred = newcr; 1067c478bd9Sstevel@tonic-gate newcr->cr_gid = gid; 1077c478bd9Sstevel@tonic-gate newcr->cr_rgid = gid; 1087c478bd9Sstevel@tonic-gate newcr->cr_sgid = gid; 109f48205beScasper crsetsid(newcr, ksp, KSID_GROUP); 110*ddf7fe95Scasper mutex_exit(&p->p_crlock); 111f48205beScasper } else { 1127c478bd9Sstevel@tonic-gate crfree(newcr); 113*ddf7fe95Scasper crfree(cr); 114f48205beScasper if (ksp != NULL) 115f48205beScasper ksid_rele(ksp); 116f48205beScasper 117f48205beScasper } 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate if (error == 0) { 1207c478bd9Sstevel@tonic-gate if (do_nocd) { 1217c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); 1227c478bd9Sstevel@tonic-gate p->p_flag |= SNOCD; 1237c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock); 1247c478bd9Sstevel@tonic-gate } 1257c478bd9Sstevel@tonic-gate crset(p, newcr); /* broadcast to process threads */ 1267c478bd9Sstevel@tonic-gate return (0); 1277c478bd9Sstevel@tonic-gate } 1287c478bd9Sstevel@tonic-gate return (set_errno(error)); 1297c478bd9Sstevel@tonic-gate } 1307c478bd9Sstevel@tonic-gate 1317c478bd9Sstevel@tonic-gate int64_t 1327c478bd9Sstevel@tonic-gate getgid(void) 1337c478bd9Sstevel@tonic-gate { 1347c478bd9Sstevel@tonic-gate rval_t r; 1357c478bd9Sstevel@tonic-gate cred_t *cr; 1367c478bd9Sstevel@tonic-gate 1377c478bd9Sstevel@tonic-gate cr = curthread->t_cred; 1387c478bd9Sstevel@tonic-gate r.r_val1 = cr->cr_rgid; 1397c478bd9Sstevel@tonic-gate r.r_val2 = cr->cr_gid; 1407c478bd9Sstevel@tonic-gate return (r.r_vals); 1417c478bd9Sstevel@tonic-gate } 1427c478bd9Sstevel@tonic-gate 1437c478bd9Sstevel@tonic-gate int 1447c478bd9Sstevel@tonic-gate setegid(gid_t gid) 1457c478bd9Sstevel@tonic-gate { 146f48205beScasper proc_t *p; 147f48205beScasper cred_t *cr, *newcr; 1487c478bd9Sstevel@tonic-gate int error = EPERM; 1497c478bd9Sstevel@tonic-gate int do_nocd = 0; 150f48205beScasper ksid_t ksid, *ksp; 151bda89588Sjp zone_t *zone = crgetzone(CRED()); 1527c478bd9Sstevel@tonic-gate 153bda89588Sjp if (!VALID_GID(gid, zone)) 1547c478bd9Sstevel@tonic-gate return (set_errno(EINVAL)); 1557c478bd9Sstevel@tonic-gate 156f48205beScasper if (gid > MAXUID) { 157bda89588Sjp if (ksid_lookupbygid(zone, gid, &ksid) != 0) 158f48205beScasper return (set_errno(EINVAL)); 159f48205beScasper ksp = &ksid; 160f48205beScasper } else { 161f48205beScasper ksp = NULL; 162f48205beScasper } 1637c478bd9Sstevel@tonic-gate /* 1647c478bd9Sstevel@tonic-gate * Need to pre-allocate the new cred structure before grabbing 1657c478bd9Sstevel@tonic-gate * the p_crlock mutex. 1667c478bd9Sstevel@tonic-gate */ 167f48205beScasper newcr = cralloc_ksid(); 1687c478bd9Sstevel@tonic-gate p = ttoproc(curthread); 1697c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock); 170*ddf7fe95Scasper retry: 171*ddf7fe95Scasper crhold(cr = p->p_cred); 172*ddf7fe95Scasper mutex_exit(&p->p_crlock); 173*ddf7fe95Scasper 1747c478bd9Sstevel@tonic-gate if (gid == cr->cr_rgid || gid == cr->cr_gid || gid == cr->cr_sgid || 1757c478bd9Sstevel@tonic-gate (error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) { 176*ddf7fe95Scasper mutex_enter(&p->p_crlock); 177*ddf7fe95Scasper crfree(cr); 178*ddf7fe95Scasper if (cr != p->p_cred) 179*ddf7fe95Scasper goto retry; 1807c478bd9Sstevel@tonic-gate /* 1817c478bd9Sstevel@tonic-gate * A privileged process that makes itself look like a 1827c478bd9Sstevel@tonic-gate * set-gid process must be marked to produce no core dump. 1837c478bd9Sstevel@tonic-gate */ 1847c478bd9Sstevel@tonic-gate if (cr->cr_gid != gid && error == 0) 1857c478bd9Sstevel@tonic-gate do_nocd = 1; 1867c478bd9Sstevel@tonic-gate error = 0; 1877c478bd9Sstevel@tonic-gate crcopy_to(cr, newcr); 1887c478bd9Sstevel@tonic-gate p->p_cred = newcr; 1897c478bd9Sstevel@tonic-gate newcr->cr_gid = gid; 190f48205beScasper crsetsid(newcr, ksp, KSID_GROUP); 191*ddf7fe95Scasper mutex_exit(&p->p_crlock); 192f48205beScasper } else { 1937c478bd9Sstevel@tonic-gate crfree(newcr); 194*ddf7fe95Scasper crfree(cr); 195f48205beScasper if (ksp != NULL) 196f48205beScasper ksid_rele(ksp); 197f48205beScasper } 1987c478bd9Sstevel@tonic-gate 1997c478bd9Sstevel@tonic-gate if (error == 0) { 2007c478bd9Sstevel@tonic-gate if (do_nocd) { 2017c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); 2027c478bd9Sstevel@tonic-gate p->p_flag |= SNOCD; 2037c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock); 2047c478bd9Sstevel@tonic-gate } 2057c478bd9Sstevel@tonic-gate crset(p, newcr); /* broadcast to process threads */ 2067c478bd9Sstevel@tonic-gate return (0); 2077c478bd9Sstevel@tonic-gate } 2087c478bd9Sstevel@tonic-gate return (set_errno(error)); 2097c478bd9Sstevel@tonic-gate } 2107c478bd9Sstevel@tonic-gate 2117c478bd9Sstevel@tonic-gate /* 2127c478bd9Sstevel@tonic-gate * Buy-back from SunOS 4.x 2137c478bd9Sstevel@tonic-gate * 2147c478bd9Sstevel@tonic-gate * Like setgid() and setegid() combined -except- that non-root users 2157c478bd9Sstevel@tonic-gate * can change cr_rgid to cr_gid, and the semantics of cr_sgid are 2167c478bd9Sstevel@tonic-gate * subtly different. 2177c478bd9Sstevel@tonic-gate */ 2187c478bd9Sstevel@tonic-gate int 2197c478bd9Sstevel@tonic-gate setregid(gid_t rgid, gid_t egid) 2207c478bd9Sstevel@tonic-gate { 2217c478bd9Sstevel@tonic-gate proc_t *p; 2227c478bd9Sstevel@tonic-gate int error = EPERM; 2237c478bd9Sstevel@tonic-gate int do_nocd = 0; 2247c478bd9Sstevel@tonic-gate cred_t *cr, *newcr; 225f48205beScasper ksid_t ksid, *ksp; 226bda89588Sjp zone_t *zone = crgetzone(CRED()); 2277c478bd9Sstevel@tonic-gate 228bda89588Sjp if ((rgid != -1 && !VALID_GID(rgid, zone)) || 229bda89588Sjp (egid != -1 && !VALID_GID(egid, zone))) 2307c478bd9Sstevel@tonic-gate return (set_errno(EINVAL)); 2317c478bd9Sstevel@tonic-gate 232f48205beScasper if (egid != -1 && egid > MAXUID) { 233bda89588Sjp if (ksid_lookupbygid(zone, egid, &ksid) != 0) 234f48205beScasper return (set_errno(EINVAL)); 235f48205beScasper ksp = &ksid; 236f48205beScasper } else { 237f48205beScasper ksp = NULL; 238f48205beScasper } 2397c478bd9Sstevel@tonic-gate /* 2407c478bd9Sstevel@tonic-gate * Need to pre-allocate the new cred structure before grabbing 2417c478bd9Sstevel@tonic-gate * the p_crlock mutex. 2427c478bd9Sstevel@tonic-gate */ 243f48205beScasper newcr = cralloc_ksid(); 2447c478bd9Sstevel@tonic-gate 2457c478bd9Sstevel@tonic-gate p = ttoproc(curthread); 2467c478bd9Sstevel@tonic-gate mutex_enter(&p->p_crlock); 2477c478bd9Sstevel@tonic-gate cr = p->p_cred; 2487c478bd9Sstevel@tonic-gate 2497c478bd9Sstevel@tonic-gate if ((rgid == -1 || 2507c478bd9Sstevel@tonic-gate rgid == cr->cr_rgid || rgid == cr->cr_gid || rgid == cr->cr_sgid) && 2517c478bd9Sstevel@tonic-gate (egid == -1 || egid == cr->cr_rgid || egid == cr->cr_gid || 2527c478bd9Sstevel@tonic-gate egid == cr->cr_sgid) || 2537c478bd9Sstevel@tonic-gate (error = secpolicy_allow_setid(cr, -1, B_FALSE)) == 0) { 2547c478bd9Sstevel@tonic-gate crhold(cr); 2557c478bd9Sstevel@tonic-gate crcopy_to(cr, newcr); 2567c478bd9Sstevel@tonic-gate p->p_cred = newcr; 2577c478bd9Sstevel@tonic-gate 258f48205beScasper if (egid != -1) { 2597c478bd9Sstevel@tonic-gate newcr->cr_gid = egid; 260f48205beScasper crsetsid(newcr, ksp, KSID_GROUP); 261f48205beScasper } 2627c478bd9Sstevel@tonic-gate if (rgid != -1) 2637c478bd9Sstevel@tonic-gate newcr->cr_rgid = rgid; 2647c478bd9Sstevel@tonic-gate /* 2657c478bd9Sstevel@tonic-gate * "If the real gid is being changed, or the effective gid is 2667c478bd9Sstevel@tonic-gate * being changed to a value not equal to the real gid, the 2677c478bd9Sstevel@tonic-gate * saved gid is set to the new effective gid." 2687c478bd9Sstevel@tonic-gate */ 2697c478bd9Sstevel@tonic-gate if (rgid != -1 || 2707c478bd9Sstevel@tonic-gate (egid != -1 && newcr->cr_gid != newcr->cr_rgid)) 2717c478bd9Sstevel@tonic-gate newcr->cr_sgid = newcr->cr_gid; 2727c478bd9Sstevel@tonic-gate /* 2737c478bd9Sstevel@tonic-gate * A privileged process that makes itself look like a 2747c478bd9Sstevel@tonic-gate * set-gid process must be marked to produce no core dump. 2757c478bd9Sstevel@tonic-gate */ 2767c478bd9Sstevel@tonic-gate if ((cr->cr_gid != newcr->cr_gid || 2777c478bd9Sstevel@tonic-gate cr->cr_rgid != newcr->cr_rgid || 2787c478bd9Sstevel@tonic-gate cr->cr_sgid != newcr->cr_sgid) && error == 0) 2797c478bd9Sstevel@tonic-gate do_nocd = 1; 2807c478bd9Sstevel@tonic-gate error = 0; 2817c478bd9Sstevel@tonic-gate crfree(cr); 2827c478bd9Sstevel@tonic-gate } 2837c478bd9Sstevel@tonic-gate mutex_exit(&p->p_crlock); 2847c478bd9Sstevel@tonic-gate 2857c478bd9Sstevel@tonic-gate if (error == 0) { 2867c478bd9Sstevel@tonic-gate if (do_nocd) { 2877c478bd9Sstevel@tonic-gate mutex_enter(&p->p_lock); 2887c478bd9Sstevel@tonic-gate p->p_flag |= SNOCD; 2897c478bd9Sstevel@tonic-gate mutex_exit(&p->p_lock); 2907c478bd9Sstevel@tonic-gate } 2917c478bd9Sstevel@tonic-gate crset(p, newcr); /* broadcast to process threads */ 2927c478bd9Sstevel@tonic-gate return (0); 2937c478bd9Sstevel@tonic-gate } 2947c478bd9Sstevel@tonic-gate crfree(newcr); 295f48205beScasper if (ksp != NULL) 296f48205beScasper ksid_rele(ksp); 2977c478bd9Sstevel@tonic-gate return (set_errno(error)); 2987c478bd9Sstevel@tonic-gate } 299