CRED: Separate task security context from task_struct

Separate the task security context from task_struct.  At this point, the
security data is temporarily embedded in the task_struct with two pointers
pointing to it.

Note that the Alpha arch is altered as it refers to (E)UID and (E)GID in
entry.S via asm-offsets.

With comment fixes Signed-off-by: Marc Dionne <marc.c.dionne@gmail.com>

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

4 files changed, 155 insertions, 78 deletions

diff --git a/include/linux/cred.h b/include/linux/cred.h
index b69222cc1fd2..3e65587a72e5 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -12,39 +12,150 @@
 #ifndef _LINUX_CRED_H
 #define _LINUX_CRED_H
 
-#define get_current_user()      (get_uid(current->user))
-
-#define task_uid(task)          ((task)->uid)
-#define task_gid(task)          ((task)->gid)
-#define task_euid(task)         ((task)->euid)
-#define task_egid(task)         ((task)->egid)
-
-#define current_uid()           (current->uid)
-#define current_gid()           (current->gid)
-#define current_euid()          (current->euid)
-#define current_egid()          (current->egid)
-#define current_suid()          (current->suid)
-#define current_sgid()          (current->sgid)
-#define current_fsuid()         (current->fsuid)
-#define current_fsgid()         (current->fsgid)
-#define current_cap()           (current->cap_effective)
+#include <linux/capability.h>
+#include <linux/key.h>
+#include <asm/atomic.h>
+
+struct user_struct;
+struct cred;
+
+/*
+ * COW Supplementary groups list
+ */
+#define NGROUPS_SMALL           32
+#define NGROUPS_PER_BLOCK       ((unsigned int)(PAGE_SIZE / sizeof(gid_t)))
+
+struct group_info {
+        atomic_t        usage;
+        int             ngroups;
+        int             nblocks;
+        gid_t           small_block[NGROUPS_SMALL];
+        gid_t           *blocks[0];
+};
+
+/**
+ * get_group_info - Get a reference to a group info structure
+ * @group_info: The group info to reference
+ *
+ * This must be called with the owning task locked (via task_lock()) when task
+ * != current.  The reason being that the vast majority of callers are looking
+ * at current->group_info, which can not be changed except by the current task.
+ * Changing current->group_info requires the task lock, too.
+ */
+#define get_group_info(group_info)              \
+do {                                            \
+        atomic_inc(&(group_info)->usage);       \
+} while (0)
+
+/**
+ * put_group_info - Release a reference to a group info structure
+ * @group_info: The group info to release
+ */
+#define put_group_info(group_info)                      \
+do {                                                    \
+        if (atomic_dec_and_test(&(group_info)->usage))  \
+                groups_free(group_info);                \
+} while (0)
+
+extern struct group_info *groups_alloc(int);
+extern void groups_free(struct group_info *);
+extern int set_current_groups(struct group_info *);
+extern int set_groups(struct cred *, struct group_info *);
+extern int groups_search(struct group_info *, gid_t);
+
+/* access the groups "array" with this macro */
+#define GROUP_AT(gi, i) \
+        ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
+
+extern int in_group_p(gid_t);
+extern int in_egroup_p(gid_t);
+
+/*
+ * The security context of a task
+ *
+ * The parts of the context break down into two categories:
+ *
+ *  (1) The objective context of a task.  These parts are used when some other
+ *      task is attempting to affect this one.
+ *
+ *  (2) The subjective context.  These details are used when the task is acting
+ *      upon another object, be that a file, a task, a key or whatever.
+ *
+ * Note that some members of this structure belong to both categories - the
+ * LSM security pointer for instance.
+ *
+ * A task has two security pointers.  task->real_cred points to the objective
+ * context that defines that task's actual details.  The objective part of this
+ * context is used whenever that task is acted upon.
+ *
+ * task->cred points to the subjective context that defines the details of how
+ * that task is going to act upon another object.  This may be overridden
+ * temporarily to point to another security context, but normally points to the
+ * same context as task->real_cred.
+ */
+struct cred {
+        atomic_t        usage;
+        uid_t           uid;            /* real UID of the task */
+        gid_t           gid;            /* real GID of the task */
+        uid_t           suid;           /* saved UID of the task */
+        gid_t           sgid;           /* saved GID of the task */
+        uid_t           euid;           /* effective UID of the task */
+        gid_t           egid;           /* effective GID of the task */
+        uid_t           fsuid;          /* UID for VFS ops */
+        gid_t           fsgid;          /* GID for VFS ops */
+        unsigned        securebits;     /* SUID-less security management */
+        kernel_cap_t    cap_inheritable; /* caps our children can inherit */
+        kernel_cap_t    cap_permitted;  /* caps we're permitted */
+        kernel_cap_t    cap_effective;  /* caps we can actually use */
+        kernel_cap_t    cap_bset;       /* capability bounding set */
+#ifdef CONFIG_KEYS
+        unsigned char   jit_keyring;    /* default keyring to attach requested
+                                         * keys to */
+        struct key      *thread_keyring; /* keyring private to this thread */
+        struct key      *request_key_auth; /* assumed request_key authority */
+#endif
+#ifdef CONFIG_SECURITY
+        void            *security;      /* subjective LSM security */
+#endif
+        struct user_struct *user;       /* real user ID subscription */
+        struct group_info *group_info;  /* supplementary groups for euid/fsgid */
+        struct rcu_head rcu;            /* RCU deletion hook */
+        spinlock_t      lock;           /* lock for pointer changes */
+};
+
+#define get_current_user()      (get_uid(current->cred->user))
+
+#define task_uid(task)          ((task)->cred->uid)
+#define task_gid(task)          ((task)->cred->gid)
+#define task_euid(task)         ((task)->cred->euid)
+#define task_egid(task)         ((task)->cred->egid)
+
+#define current_uid()           (current->cred->uid)
+#define current_gid()           (current->cred->gid)
+#define current_euid()          (current->cred->euid)
+#define current_egid()          (current->cred->egid)
+#define current_suid()          (current->cred->suid)
+#define current_sgid()          (current->cred->sgid)
+#define current_fsuid()         (current->cred->fsuid)
+#define current_fsgid()         (current->cred->fsgid)
+#define current_cap()           (current->cred->cap_effective)
 
 #define current_uid_gid(_uid, _gid)             \
 do {                                            \
-        *(_uid) = current->uid;                 \
-        *(_gid) = current->gid;                 \
+        *(_uid) = current->cred->uid;           \
+        *(_gid) = current->cred->gid;           \
 } while(0)
 
 #define current_euid_egid(_uid, _gid)           \
 do {                                            \
-        *(_uid) = current->euid;                \
-        *(_gid) = current->egid;                \
+        *(_uid) = current->cred->euid;          \
+        *(_gid) = current->cred->egid;          \
 } while(0)
 
 #define current_fsuid_fsgid(_uid, _gid)         \
 do {                                            \
-        *(_uid) = current->fsuid;               \
-        *(_gid) = current->fsgid;               \
+        *(_uid) = current->cred->fsuid;         \
+        *(_gid) = current->cred->fsgid;         \
 } while(0)
 
 #endif /* _LINUX_CRED_H */
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index 23fd8909b9e5..9de41ccd67b5 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -113,6 +113,21 @@ extern struct group_info init_groups;
 # define CAP_INIT_BSET  CAP_INIT_EFF_SET
 #endif
 
+extern struct cred init_cred;
+
+#define INIT_CRED(p)                                            \
+{                                                               \
+        .usage                  = ATOMIC_INIT(3),               \
+        .securebits             = SECUREBITS_DEFAULT,           \
+        .cap_inheritable        = CAP_INIT_INH_SET,             \
+        .cap_permitted          = CAP_FULL_SET,                 \
+        .cap_effective          = CAP_INIT_EFF_SET,             \
+        .cap_bset               = CAP_INIT_BSET,                \
+        .user                   = INIT_USER,                    \
+        .group_info             = &init_groups,                 \
+        .lock                   = __SPIN_LOCK_UNLOCKED(p.lock), \
+}
+
 /*
  *  INIT_TASK is used to set up the first task table, touch at
  * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -147,13 +162,8 @@ extern struct group_info init_groups;
         .children       = LIST_HEAD_INIT(tsk.children),                 \
         .sibling        = LIST_HEAD_INIT(tsk.sibling),                  \
         .group_leader   = &tsk,                                         \
-        .group_info     = &init_groups,                                 \
-        .cap_effective  = CAP_INIT_EFF_SET,                             \
-        .cap_inheritable = CAP_INIT_INH_SET,                            \
-        .cap_permitted  = CAP_FULL_SET,                                 \
-        .cap_bset       = CAP_INIT_BSET,                                \
-        .securebits     = SECUREBITS_DEFAULT,                           \
-        .user           = INIT_USER,                                    \
+        .__temp_cred    = INIT_CRED(tsk.__temp_cred),                   \
+        .cred           = &tsk.__temp_cred,                             \
         .comm           = "swapper",                                    \
         .thread         = INIT_THREAD,                                  \
         .fs             = &init_fs,                                     \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index b483f39a7112..c8b92502354d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -660,6 +660,7 @@ extern struct user_struct *find_user(uid_t);
 extern struct user_struct root_user;
 #define INIT_USER (&root_user)
 
+
 struct backing_dev_info;
 struct reclaim_state;
 
@@ -883,38 +884,7 @@ partition_sched_domains(int ndoms_new, cpumask_t *doms_new,
 #endif  /* !CONFIG_SMP */
 
 struct io_context;                      /* See blkdev.h */
-#define NGROUPS_SMALL           32
-#define NGROUPS_PER_BLOCK       ((unsigned int)(PAGE_SIZE / sizeof(gid_t)))
-struct group_info {
-        int ngroups;
-        atomic_t usage;
-        gid_t small_block[NGROUPS_SMALL];
-        int nblocks;
-        gid_t *blocks[0];
-};
-
-/*
- * get_group_info() must be called with the owning task locked (via task_lock())
- * when task != current.  The reason being that the vast majority of callers are
- * looking at current->group_info, which can not be changed except by the
- * current task.  Changing current->group_info requires the task lock, too.
- */
-#define get_group_info(group_info) do { \
-        atomic_inc(&(group_info)->usage); \
-} while (0)
 
-#define put_group_info(group_info) do { \
-        if (atomic_dec_and_test(&(group_info)->usage)) \
-                groups_free(group_info); \
-} while (0)
-
-extern struct group_info *groups_alloc(int gidsetsize);
-extern void groups_free(struct group_info *group_info);
-extern int set_current_groups(struct group_info *group_info);
-extern int groups_search(struct group_info *group_info, gid_t grp);
-/* access the groups "array" with this macro */
-#define GROUP_AT(gi, i) \
-    ((gi)->blocks[(i)/NGROUPS_PER_BLOCK][(i)%NGROUPS_PER_BLOCK])
 
 #ifdef ARCH_HAS_PREFETCH_SWITCH_STACK
 extern void prefetch_stack(struct task_struct *t);
@@ -1181,17 +1151,9 @@ struct task_struct {
         struct list_head cpu_timers[3];
 
 /* process credentials */
-        uid_t uid,euid,suid,fsuid;
-        gid_t gid,egid,sgid,fsgid;
-        struct group_info *group_info;
-        kernel_cap_t   cap_effective, cap_inheritable, cap_permitted, cap_bset;
-        struct user_struct *user;
-        unsigned securebits;
-#ifdef CONFIG_KEYS
-        unsigned char jit_keyring;      /* default keyring to attach requested keys to */
-        struct key *request_key_auth;   /* assumed request_key authority */
-        struct key *thread_keyring;     /* keyring private to this thread */
-#endif
+        struct cred __temp_cred __deprecated; /* temporary credentials to be removed */
+        struct cred *cred;      /* actual/objective task credentials */
+
         char comm[TASK_COMM_LEN]; /* executable name excluding path
                                      - access with [gs]et_task_comm (which lock
                                        it with task_lock())
@@ -1228,9 +1190,6 @@ struct task_struct {
         int (*notifier)(void *priv);
         void *notifier_data;
         sigset_t *notifier_mask;
-#ifdef CONFIG_SECURITY
-        void *security;
-#endif
         struct audit_context *audit_context;
 #ifdef CONFIG_AUDITSYSCALL
         uid_t loginuid;
@@ -1787,9 +1746,6 @@ extern void wake_up_new_task(struct task_struct *tsk,
 extern void sched_fork(struct task_struct *p, int clone_flags);
 extern void sched_dead(struct task_struct *p);
 
-extern int in_group_p(gid_t);
-extern int in_egroup_p(gid_t);
-
 extern void proc_caches_init(void);
 extern void flush_signals(struct task_struct *);
 extern void ignore_signals(struct task_struct *);
diff --git a/include/linux/securebits.h b/include/linux/securebits.h
index 92f09bdf1175..6d389491bfa2 100644
--- a/include/linux/securebits.h
+++ b/include/linux/securebits.h
@@ -32,7 +32,7 @@
    setting is locked or not. A setting which is locked cannot be
    changed from user-level. */
 #define issecure_mask(X)        (1 << (X))
-#define issecure(X)             (issecure_mask(X) & current->securebits)
+#define issecure(X)             (issecure_mask(X) & current->cred->securebits)
 
 #define SECURE_ALL_BITS         (issecure_mask(SECURE_NOROOT) | \
                                  issecure_mask(SECURE_NO_SETUID_FIXUP) | \