beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-23 08:00:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6
ladybird/Kernel/Syscalls/setuid.cpp

353 lines
11 KiB
C++
Raw Normal View History

Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
/*
* Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
*
Everything: Move to SPDX license identifiers in all files. SPDX License Identifiers are a more compact / standardized way of representing file license information. See: https://spdx.dev/resources/use/#identifiers This was done with the `ambr` search and replace tool. ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
2021-04-22 08:24:48 +00:00
* SPDX-License-Identifier: BSD-2-Clause
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
*/
Kernel+LibC: Enforce a limit on the number of supplementary group IDs This patch adds the NGROUPS_MAX constant and enforces it in sys$setgroups() to ensure that no process has more than 32 supplementary group IDs. The number doesn't mean anything in particular, just had to pick a number. Perhaps one day we'll have a reason to change it.
2022-08-20 20:22:58 +00:00
#include <Kernel/API/POSIX/sys/limits.h>
Kernel: Move all tasks-related code to the Tasks subdirectory
2023-02-24 17:45:37 +00:00
#include <Kernel/Tasks/Process.h>
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
namespace Kernel {
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$seteuid(UserID new_euid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Return EINVAL when specifying -1 for setuid and similar syscalls For setreuid and setresuid syscalls, -1 means to set the current uid/euid/gid/egid value, to be more convenient for programming. However, for other syscalls where we pass only one argument, there's no justification to specify -1. This behavior is identical to how Linux handles the value -1, and is influenced by the fact that the manual pages for the group of one argument syscalls that handle ID operations is ambiguous about this topic.
2021-12-19 13:10:45 +00:00
if (new_euid == (uid_t)-1)
return EINVAL;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_euid != credentials->uid() && new_euid != credentials->suid() && !credentials->is_superuser())
return EPERM;
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
credentials->gid(),
new_euid,
credentials->egid(),
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Don't keep protected Process data in a separate allocation The previous architecture had a huge flaw: the pointer to the protected data was itself unprotected, allowing you to overwrite it at any time. This patch reorganizes the protected data so it's part of the Process class itself. (Actually, it's a new ProcessBase helper class.) We use the first 4 KB of Process objects themselves as the new storage location for protected data. Then we make Process objects page-aligned using MAKE_ALIGNED_ALLOCATED. This allows us to easily turn on/off write-protection for everything in the ProcessBase portion of Process. :^) Thanks to @bugaevc for pointing out the flaw! This is still not perfect but it's an improvement.
2021-03-11 12:13:05 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->euid() != new_euid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setegid(GroupID new_egid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Return EINVAL when specifying -1 for setuid and similar syscalls For setreuid and setresuid syscalls, -1 means to set the current uid/euid/gid/egid value, to be more convenient for programming. However, for other syscalls where we pass only one argument, there's no justification to specify -1. This behavior is identical to how Linux handles the value -1, and is influenced by the fact that the manual pages for the group of one argument syscalls that handle ID operations is ambiguous about this topic.
2021-12-19 13:10:45 +00:00
if (new_egid == (uid_t)-1)
return EINVAL;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_egid != credentials->gid() && new_egid != credentials->sgid() && !credentials->is_superuser())
return EPERM;
Kernel+LibC: Introduce a "dumpable" flag for processes This new flag controls two things: - Whether the kernel will generate core dumps for the process - Whether the EUID:EGID should own the process's files in /proc Processes are automatically made non-dumpable when their EUID or EGID is changed, either via syscalls that specifically modify those ID's, or via sys$execve(), when a set-uid or set-gid program is executed. A process can change its own dumpable flag at any time by calling the new sys$prctl(PR_SET_DUMPABLE) syscall. Fixes #4504.
2020-12-25 17:27:42 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
credentials->gid(),
credentials->euid(),
new_egid,
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->egid() != new_egid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setuid(UserID new_uid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Return EINVAL when specifying -1 for setuid and similar syscalls For setreuid and setresuid syscalls, -1 means to set the current uid/euid/gid/egid value, to be more convenient for programming. However, for other syscalls where we pass only one argument, there's no justification to specify -1. This behavior is identical to how Linux handles the value -1, and is influenced by the fact that the manual pages for the group of one argument syscalls that handle ID operations is ambiguous about this topic.
2021-12-19 13:10:45 +00:00
if (new_uid == (uid_t)-1)
return EINVAL;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_uid != credentials->uid() && new_uid != credentials->euid() && !credentials->is_superuser())
return EPERM;
Kernel+LibC: Introduce a "dumpable" flag for processes This new flag controls two things: - Whether the kernel will generate core dumps for the process - Whether the EUID:EGID should own the process's files in /proc Processes are automatically made non-dumpable when their EUID or EGID is changed, either via syscalls that specifically modify those ID's, or via sys$execve(), when a set-uid or set-gid program is executed. A process can change its own dumpable flag at any time by calling the new sys$prctl(PR_SET_DUMPABLE) syscall. Fixes #4504.
2020-12-25 17:27:42 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
new_uid,
credentials->gid(),
new_uid,
credentials->egid(),
new_uid,
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->euid() != new_uid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setgid(GroupID new_gid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Return EINVAL when specifying -1 for setuid and similar syscalls For setreuid and setresuid syscalls, -1 means to set the current uid/euid/gid/egid value, to be more convenient for programming. However, for other syscalls where we pass only one argument, there's no justification to specify -1. This behavior is identical to how Linux handles the value -1, and is influenced by the fact that the manual pages for the group of one argument syscalls that handle ID operations is ambiguous about this topic.
2021-12-19 13:10:45 +00:00
if (new_gid == (uid_t)-1)
return EINVAL;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_gid != credentials->gid() && new_gid != credentials->egid() && !credentials->is_superuser())
return EPERM;
Kernel+LibC: Introduce a "dumpable" flag for processes This new flag controls two things: - Whether the kernel will generate core dumps for the process - Whether the EUID:EGID should own the process's files in /proc Processes are automatically made non-dumpable when their EUID or EGID is changed, either via syscalls that specifically modify those ID's, or via sys$execve(), when a set-uid or set-gid program is executed. A process can change its own dumpable flag at any time by calling the new sys$prctl(PR_SET_DUMPABLE) syscall. Fixes #4504.
2020-12-25 17:27:42 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
new_gid,
credentials->euid(),
new_gid,
credentials->suid(),
new_gid,
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->egid() != new_gid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setreuid(UserID new_ruid, UserID new_euid)
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_ruid == (uid_t)-1)
new_ruid = credentials->uid();
if (new_euid == (uid_t)-1)
new_euid = credentials->euid();
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto ok = [&credentials](UserID id) { return id == credentials->uid() || id == credentials->euid() || id == credentials->suid(); };
if (!ok(new_ruid) || !ok(new_euid))
return EPERM;
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_ruid < (uid_t)-1 || new_euid < (uid_t)-1)
return EINVAL;
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
new_ruid,
credentials->gid(),
new_euid,
credentials->egid(),
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->euid() != new_euid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel/LibC: Implement `setreuid`
2021-04-09 11:13:15 +00:00
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setresuid(UserID new_ruid, UserID new_euid, UserID new_suid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_ruid == (uid_t)-1)
new_ruid = credentials->uid();
if (new_euid == (uid_t)-1)
new_euid = credentials->euid();
if (new_suid == (uid_t)-1)
new_suid = credentials->suid();
auto ok = [&credentials](UserID id) { return id == credentials->uid() || id == credentials->euid() || id == credentials->suid(); };
if ((!ok(new_ruid) || !ok(new_euid) || !ok(new_suid)) && !credentials->is_superuser())
return EPERM;
auto new_credentials = TRY(Credentials::create(
new_ruid,
credentials->gid(),
new_euid,
credentials->egid(),
new_suid,
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->euid() != new_euid)
protected_data.dumpable = false;
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel+LibC: Implement `setregid(2)` This copies and adapts the setresgid syscall, following in the footsteps of setreuid and setresuid.
2022-10-01 12:47:38 +00:00
ErrorOr<FlatPtr> Process::sys$setregid(GroupID new_rgid, GroupID new_egid)
{
VERIFY_NO_PROCESS_BIG_LOCK(this);
TRY(require_promise(Pledge::id));
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
if (new_rgid == (gid_t)-1)
new_rgid = credentials->gid();
if (new_egid == (gid_t)-1)
new_egid = credentials->egid();
auto ok = [&credentials](GroupID id) { return id == credentials->gid() || id == credentials->egid() || id == credentials->sgid(); };
if (!ok(new_rgid) || !ok(new_egid))
return EPERM;
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
new_rgid,
credentials->euid(),
new_egid,
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel+LibC: Implement `setregid(2)` This copies and adapts the setresgid syscall, following in the footsteps of setreuid and setresuid.
2022-10-01 12:47:38 +00:00
if (credentials->egid() != new_egid)
protected_data.dumpable = false;
protected_data.credentials = move(new_credentials);
return 0;
});
}
Kernel: Replace KResult and KResultOr<T> with Error and ErrorOr<T> We now use AK::Error and AK::ErrorOr<T> in both kernel and userspace! This was a slightly tedious refactoring that took a long time, so it's not unlikely that some bugs crept in. Nevertheless, it does pass basic functionality testing, and it's just real nice to finally see the same pattern in all contexts. :^)
2021-11-07 23:51:39 +00:00
ErrorOr<FlatPtr> Process::sys$setresgid(GroupID new_rgid, GroupID new_egid, GroupID new_sgid)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (new_rgid == (gid_t)-1)
new_rgid = credentials->gid();
if (new_egid == (gid_t)-1)
new_egid = credentials->egid();
if (new_sgid == (gid_t)-1)
new_sgid = credentials->sgid();
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto ok = [&credentials](GroupID id) { return id == credentials->gid() || id == credentials->egid() || id == credentials->sgid(); };
if ((!ok(new_rgid) || !ok(new_egid) || !ok(new_sgid)) && !credentials->is_superuser())
return EPERM;
Kernel+LibC: Introduce a "dumpable" flag for processes This new flag controls two things: - Whether the kernel will generate core dumps for the process - Whether the EUID:EGID should own the process's files in /proc Processes are automatically made non-dumpable when their EUID or EGID is changed, either via syscalls that specifically modify those ID's, or via sys$execve(), when a set-uid or set-gid program is executed. A process can change its own dumpable flag at any time by calling the new sys$prctl(PR_SET_DUMPABLE) syscall. Fixes #4504.
2020-12-25 17:27:42 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
auto new_credentials = TRY(Credentials::create(
credentials->uid(),
new_rgid,
credentials->euid(),
new_egid,
credentials->suid(),
new_sgid,
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
credentials->extra_gids(),
credentials->sid(),
credentials->pgid()));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
if (credentials->egid() != new_egid)
protected_data.dumpable = false;
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
protected_data.credentials = move(new_credentials);
return 0;
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
ErrorOr<FlatPtr> Process::sys$setgroups(size_t count, Userspace<GroupID const*> user_gids)
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
{
Kernel: Mark syscalls that get/set user/group ID as not needing big lock Now that these operate on the neatly atomic and immutable Credentials object, they should no longer require the process big lock for synchronization. :^)
2022-08-20 16:36:47 +00:00
VERIFY_NO_PROCESS_BIG_LOCK(this);
Kernel: Handle promise violations in the syscall handler Previously we would crash the process immediately when a promise violation was found during a syscall. This is error prone, as we don't unwind the stack. This means that in certain cases we can leak resources, like an OwnPtr / RefPtr tracked on the stack. Or even leak a lock acquired in a ScopeLockLocker. To remedy this situation we move the promise violation handling to the syscall handler, right before we return to user space. This allows the code to follow the normal unwind path, and grantees there is no longer any cleanup that needs to occur. The Process::require_promise() and Process::require_no_promises() functions were modified to return ErrorOr<void> so we enforce that the errors are always propagated by the caller.
2021-12-29 09:11:45 +00:00
TRY(require_promise(Pledge::id));
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
Kernel+LibC: Enforce a limit on the number of supplementary group IDs This patch adds the NGROUPS_MAX constant and enforces it in sys$setgroups() to ensure that no process has more than 32 supplementary group IDs. The number doesn't mean anything in particular, just had to pick a number. Perhaps one day we'll have a reason to change it.
2022-08-20 20:22:58 +00:00
if (count > NGROUPS_MAX)
return EINVAL;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return with_mutable_protected_data([&](auto& protected_data) -> ErrorOr<FlatPtr> {
auto credentials = this->credentials();
if (!credentials->is_superuser())
return EPERM;
if (!count) {
protected_data.credentials = TRY(Credentials::create(
credentials->uid(),
credentials->gid(),
credentials->euid(),
credentials->egid(),
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
{},
credentials->sid(),
credentials->pgid()));
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
return 0;
}
Vector<GroupID> new_extra_gids;
TRY(new_extra_gids.try_resize(count));
TRY(copy_n_from_user(new_extra_gids.data(), user_gids, count));
HashTable<GroupID> unique_extra_gids;
for (auto& extra_gid : new_extra_gids) {
if (extra_gid != credentials->gid())
TRY(unique_extra_gids.try_set(extra_gid));
}
new_extra_gids.clear_with_capacity();
for (auto extra_gid : unique_extra_gids) {
TRY(new_extra_gids.try_append(extra_gid));
}
protected_data.credentials = TRY(Credentials::create(
Kernel: Add Credentials to hold a set of user and group IDs This patch adds a new object to hold a Process's user credentials: - UID, EUID, SUID - GID, EGID, SGID, extra GIDs Credentials are immutable and child processes initially inherit the Credentials object from their parent. Whenever a process changes one or more of its user/group IDs, a new Credentials object is constructed. Any code that wants to inspect and act on a set of credentials can now do so without worrying about data races.
2022-08-20 16:25:54 +00:00
credentials->uid(),
credentials->gid(),
credentials->euid(),
credentials->egid(),
credentials->suid(),
credentials->sgid(),
Kernel: Add `sid` and `pgid` to `Credentials` There are places in the kernel that would like to have access to `pgid` credentials in certain circumstances. I haven't found any use cases for `sid` yet, but `sid` and `pgid` are both changed with `sys$setpgid`, so it seemed sensical to add it. In Linux, `man 7 credentials` also mentions both the session id and process group id, so this isn't unprecedented.
2022-12-19 20:21:51 +00:00
new_extra_gids.span(),
credentials->sid(),
credentials->pgid()));
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
return 0;
Kernel: Guard Process "protected data" with a spinlock This ensures that both mutable and immutable access to the protected data of a process is serialized. Note that there may still be multiple TOCTOU issues around this, as we have a bunch of convenience accessors that make it easy to introduce them. We'll need to audit those as well.
2022-08-21 10:18:26 +00:00
});
Kernel: Move syscall implementations out of Process.cpp This is something I've been meaning to do for a long time, and here we finally go. This patch moves all sys$foo functions out of Process.cpp and into files in Kernel/Syscalls/. It's not exactly one syscall per file (although it could be, but I got a bit tired of the repetitive work here..) This makes hacking on individual syscalls a lot less painful since you don't have to rebuild nearly as much code every time. I'm also hopeful that this makes it easier to understand individual syscalls. :^)
2020-07-30 21:38:15 +00:00
}
}
Reference in a new issue Copy permalink