net: introduce SO_PEERGROUPS getsockopt

This adds the new getsockopt(2) option SO_PEERGROUPS on SOL_SOCKET to
retrieve the auxiliary groups of the remote peer. It is designed to
naturally extend SO_PEERCRED. That is, the underlying data is from the
same credentials. Regarding its syntax, it is based on SO_PEERSEC. That
is, if the provided buffer is too small, ERANGE is returned and @optlen
is updated. Otherwise, the information is copied, @optlen is set to the
actual size, and 0 is returned.

While SO_PEERCRED (and thus `struct ucred') already returns the primary
group, it lacks the auxiliary group vector. However, nearly all access
controls (including kernel side VFS and SYSVIPC, but also user-space
polkit, DBus, ...) consider the entire set of groups, rather than just
the primary group. But this is currently not possible with pure
SO_PEERCRED. Instead, user-space has to work around this and query the
system database for the auxiliary groups of a UID retrieved via
SO_PEERCRED.

Unfortunately, there is no race-free way to query the auxiliary groups
of the PID/UID retrieved via SO_PEERCRED. Hence, the current user-space
solution is to use getgrouplist(3p), which itself falls back to NSS and
whatever is configured in nsswitch.conf(3). This effectively checks
which groups we *would* assign to the user if it logged in *now*. On
normal systems it is as easy as reading /etc/group, but with NSS it can
resort to quering network databases (eg., LDAP), using IPC or network
communication.

Long story short: Whenever we want to use auxiliary groups for access
checks on IPC, we need further IPC to talk to the user/group databases,
rather than just relying on SO_PEERCRED and the incoming socket. This
is unfortunate, and might even result in dead-locks if the database
query uses the same IPC as the original request.

So far, those recursions / dead-locks have been avoided by using
primitive IPC for all crucial NSS modules. However, we want to avoid
re-inventing the wheel for each NSS module that might be involved in
user/group queries. Hence, we would preferably make DBus (and other IPC
that supports access-management based on groups) work without resorting
to the user/group database. This new SO_PEERGROUPS ioctl would allow us
to make dbus-daemon work without ever calling into NSS.

Cc: Michal Sekletar <msekleta@redhat.com>
Cc: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: Tom Gundersen <teg@jklm.no>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/arch/alpha/include/uapi/asm/socket.h b/arch/alpha/include/uapi/asm/socket.h
index 0926de63a62b3a9cd8a90ae685e1a5ded5fce6eb..7b285dd4fe05b3647b87879eea0785c6ebbe1947 100644 (file)
--- a/arch/alpha/include/uapi/asm/socket.h
+++ b/arch/alpha/include/uapi/asm/socket.h
@@ -107,4 +107,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _UAPI_ASM_SOCKET_H */

diff --git a/arch/frv/include/uapi/asm/socket.h b/arch/frv/include/uapi/asm/socket.h
index e491ff08b9a947ee8af9cd20e3960740cafdc105..f1e3b20dce9fd98c869ee125c281b7123ab74b5c 100644 (file)
--- a/arch/frv/include/uapi/asm/socket.h
+++ b/arch/frv/include/uapi/asm/socket.h
@@ -100,5 +100,7 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _ASM_SOCKET_H */
 

diff --git a/arch/ia64/include/uapi/asm/socket.h b/arch/ia64/include/uapi/asm/socket.h
index 869372413333f59dd698767898f2b2ecbf417176..5dd5c5d0d64224098a85491b80cf4e4fed3070e7 100644 (file)
--- a/arch/ia64/include/uapi/asm/socket.h
+++ b/arch/ia64/include/uapi/asm/socket.h
@@ -109,4 +109,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _ASM_IA64_SOCKET_H */

diff --git a/arch/m32r/include/uapi/asm/socket.h b/arch/m32r/include/uapi/asm/socket.h
index 5d97890a8704d97868ba6ddf56f7a1ddf0535fa3..f8f7b47e247f2d88314f72e7a2f8aead2e247ffb 100644 (file)
--- a/arch/m32r/include/uapi/asm/socket.h
+++ b/arch/m32r/include/uapi/asm/socket.h
@@ -100,4 +100,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _ASM_M32R_SOCKET_H */

diff --git a/arch/mips/include/uapi/asm/socket.h b/arch/mips/include/uapi/asm/socket.h
index 365ff51f033a9572616adab72b4f113520c09a3f..882823bec153a69e91522757058d5edaeb4bc64a 100644 (file)
--- a/arch/mips/include/uapi/asm/socket.h
+++ b/arch/mips/include/uapi/asm/socket.h
@@ -118,4 +118,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _UAPI_ASM_SOCKET_H */

diff --git a/arch/mn10300/include/uapi/asm/socket.h b/arch/mn10300/include/uapi/asm/socket.h
index d013c0da0256f0df6e540e3f3a636662c0354a73..c710db354ff222d9aab0d2ee2a5fdd3b9f971284 100644 (file)
--- a/arch/mn10300/include/uapi/asm/socket.h
+++ b/arch/mn10300/include/uapi/asm/socket.h
@@ -100,4 +100,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _ASM_SOCKET_H */

diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index b893ca14fade2247c1f592dabccfd7b349c86b59..a0d4dc9f4eb2ff412e37f811087a768b921ac5b9 100644 (file)
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -99,4 +99,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       0x4033
 
+#define SO_PEERGROUPS          0x4034
+
 #endif /* _UAPI_ASM_SOCKET_H */

diff --git a/arch/s390/include/uapi/asm/socket.h b/arch/s390/include/uapi/asm/socket.h
index fb9769d7e74e2611c8dbfc1f8d58b79b81ea7cea..52a63f4175cb8de14d9da9fb1c086f23e02e5aaf 100644 (file)
--- a/arch/s390/include/uapi/asm/socket.h
+++ b/arch/s390/include/uapi/asm/socket.h
@@ -106,4 +106,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _ASM_SOCKET_H */

diff --git a/arch/sparc/include/uapi/asm/socket.h b/arch/sparc/include/uapi/asm/socket.h
index 5d673302fd4113704eb2903c2250670206572ace..186fd8199f5487f7f2947c5649176d343064a611 100644 (file)
--- a/arch/sparc/include/uapi/asm/socket.h
+++ b/arch/sparc/include/uapi/asm/socket.h
@@ -96,6 +96,8 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       0x003c
 
+#define SO_PEERGROUPS          0x003d
+
 /* Security levels - as per NRL IPv6 - don't actually do anything */
 #define SO_SECURITY_AUTHENTICATION             0x5001
 #define SO_SECURITY_ENCRYPTION_TRANSPORT       0x5002

diff --git a/arch/xtensa/include/uapi/asm/socket.h b/arch/xtensa/include/uapi/asm/socket.h
index 982c2533f912bb0abd95234badd54c31d028fa90..3eed2761c149845ad333e6d4e110b8ecd1b3458e 100644 (file)
--- a/arch/xtensa/include/uapi/asm/socket.h
+++ b/arch/xtensa/include/uapi/asm/socket.h
@@ -111,4 +111,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* _XTENSA_SOCKET_H */

diff --git a/include/uapi/asm-generic/socket.h b/include/uapi/asm-generic/socket.h
index a5f6e819fafd9c9cbd92f18cd13383fb04d9f2fa..9861be8da65e09e7a66ee9d5a543067b677af59e 100644 (file)
--- a/include/uapi/asm-generic/socket.h
+++ b/include/uapi/asm-generic/socket.h
@@ -102,4 +102,6 @@
 
 #define SCM_TIMESTAMPING_PKTINFO       58
 
+#define SO_PEERGROUPS          59
+
 #endif /* __ASM_GENERIC_SOCKET_H */

diff --git a/net/core/sock.c b/net/core/sock.c
index ad8a4bc841267a442a1da3c56ef1cf074f9825b9..6f4b090241c1d1b4f792874491e23aa1506dd8f1 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1078,6 +1078,18 @@ static void cred_to_ucred(struct pid *pid, const struct cred *cred,
        }
 }
 
+static int groups_to_user(gid_t __user *dst, const struct group_info *src)
+{
+       struct user_namespace *user_ns = current_user_ns();
+       int i;
+
+       for (i = 0; i < src->ngroups; i++)
+               if (put_user(from_kgid_munged(user_ns, src->gid[i]), dst + i))
+                       return -EFAULT;
+
+       return 0;
+}
+
 int sock_getsockopt(struct socket *sock, int level, int optname,
                    char __user *optval, int __user *optlen)
 {
@@ -1231,6 +1243,27 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                goto lenout;
        }
 
+       case SO_PEERGROUPS:
+       {
+               int ret, n;
+
+               if (!sk->sk_peer_cred)
+                       return -ENODATA;
+
+               n = sk->sk_peer_cred->group_info->ngroups;
+               if (len < n * sizeof(gid_t)) {
+                       len = n * sizeof(gid_t);
+                       return put_user(len, optlen) ? -EFAULT : -ERANGE;
+               }
+               len = n * sizeof(gid_t);
+
+               ret = groups_to_user((gid_t __user *)optval,
+                                    sk->sk_peer_cred->group_info);
+               if (ret)
+                       return ret;
+               goto lenout;
+       }
+
        case SO_PEERNAME:
        {
                char address[128];