Commit 28b5ba2a authored by David Herrmann's avatar David Herrmann Committed by David S. Miller
Browse files

net: introduce SO_PEERGROUPS getsockopt



This adds the new getsockopt(2) option SO_PEERGROUPS on SOL_SOCKET to
retrieve the auxiliary groups of the remote peer. It is designed to
naturally extend SO_PEERCRED. That is, the underlying data is from the
same credentials. Regarding its syntax, it is based on SO_PEERSEC. That
is, if the provided buffer is too small, ERANGE is returned and @optlen
is updated. Otherwise, the information is copied, @optlen is set to the
actual size, and 0 is returned.

While SO_PEERCRED (and thus `struct ucred') already returns the primary
group, it lacks the auxiliary group vector. However, nearly all access
controls (including kernel side VFS and SYSVIPC, but also user-space
polkit, DBus, ...) consider the entire set of groups, rather than just
the primary group. But this is currently not possible with pure
SO_PEERCRED. Instead, user-space has to work around this and query the
system database for the auxiliary groups of a UID retrieved via
SO_PEERCRED.

Unfortunately, there is no race-free way to query the auxiliary groups
of the PID/UID retrieved via SO_PEERCRED. Hence, the current user-space
solution is to use getgrouplist(3p), which itself falls back to NSS and
whatever is configured in nsswitch.conf(3). This effectively checks
which groups we *would* assign to the user if it logged in *now*. On
normal systems it is as easy as reading /etc/group, but with NSS it can
resort to quering network databases (eg., LDAP), using IPC or network
communication.

Long story short: Whenever we want to use auxiliary groups for access
checks on IPC, we need further IPC to talk to the user/group databases,
rather than just relying on SO_PEERCRED and the incoming socket. This
is unfortunate, and might even result in dead-locks if the database
query uses the same IPC as the original request.

So far, those recursions / dead-locks have been avoided by using
primitive IPC for all crucial NSS modules. However, we want to avoid
re-inventing the wheel for each NSS module that might be involved in
user/group queries. Hence, we would preferably make DBus (and other IPC
that supports access-management based on groups) work without resorting
to the user/group database. This new SO_PEERGROUPS ioctl would allow us
to make dbus-daemon work without ever calling into NSS.

Cc: Michal Sekletar <msekleta@redhat.com>
Cc: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: default avatarTom Gundersen <teg@jklm.no>
Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dd99e425
......@@ -107,4 +107,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _UAPI_ASM_SOCKET_H */
......@@ -100,5 +100,7 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _ASM_SOCKET_H */
......@@ -109,4 +109,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _ASM_IA64_SOCKET_H */
......@@ -100,4 +100,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _ASM_M32R_SOCKET_H */
......@@ -118,4 +118,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _UAPI_ASM_SOCKET_H */
......@@ -100,4 +100,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _ASM_SOCKET_H */
......@@ -99,4 +99,6 @@
#define SCM_TIMESTAMPING_PKTINFO 0x4033
#define SO_PEERGROUPS 0x4034
#endif /* _UAPI_ASM_SOCKET_H */
......@@ -106,4 +106,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _ASM_SOCKET_H */
......@@ -96,6 +96,8 @@
#define SCM_TIMESTAMPING_PKTINFO 0x003c
#define SO_PEERGROUPS 0x003d
/* Security levels - as per NRL IPv6 - don't actually do anything */
#define SO_SECURITY_AUTHENTICATION 0x5001
#define SO_SECURITY_ENCRYPTION_TRANSPORT 0x5002
......
......@@ -111,4 +111,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* _XTENSA_SOCKET_H */
......@@ -102,4 +102,6 @@
#define SCM_TIMESTAMPING_PKTINFO 58
#define SO_PEERGROUPS 59
#endif /* __ASM_GENERIC_SOCKET_H */
......@@ -1078,6 +1078,18 @@ static void cred_to_ucred(struct pid *pid, const struct cred *cred,
}
}
static int groups_to_user(gid_t __user *dst, const struct group_info *src)
{
struct user_namespace *user_ns = current_user_ns();
int i;
for (i = 0; i < src->ngroups; i++)
if (put_user(from_kgid_munged(user_ns, src->gid[i]), dst + i))
return -EFAULT;
return 0;
}
int sock_getsockopt(struct socket *sock, int level, int optname,
char __user *optval, int __user *optlen)
{
......@@ -1231,6 +1243,27 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
goto lenout;
}
case SO_PEERGROUPS:
{
int ret, n;
if (!sk->sk_peer_cred)
return -ENODATA;
n = sk->sk_peer_cred->group_info->ngroups;
if (len < n * sizeof(gid_t)) {
len = n * sizeof(gid_t);
return put_user(len, optlen) ? -EFAULT : -ERANGE;
}
len = n * sizeof(gid_t);
ret = groups_to_user((gid_t __user *)optval,
sk->sk_peer_cred->group_info);
if (ret)
return ret;
goto lenout;
}
case SO_PEERNAME:
{
char address[128];
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment