CRED: Wrap task credential accesses in the networking subsystem

Wrap access to task credentials so that they can be separated more easily from
the task_struct during the introduction of COW creds.

Change most current->(|e|s|fs)[ug]id to current_(|e|s|fs)[ug]id().

Change some task->e?[ug]id to task_e?[ug]id().  In some places it makes more
sense to use RCU directly rather than a convenient wrapper; these will be
addressed by later patches.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Cc: netdev@vger.kernel.org
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/include/net/scm.h b/include/net/scm.h
index 06df126103cab8224d6cf7ae64c7f00e75f06e12..f160116db54a94c5cf671fd51c46222287d7c635 100644 (file)
--- a/include/net/scm.h
+++ b/include/net/scm.h
@@ -54,8 +54,8 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
                               struct scm_cookie *scm)
 {
        struct task_struct *p = current;
-       scm->creds.uid = p->uid;
-       scm->creds.gid = p->gid;
+       scm->creds.uid = current_uid();
+       scm->creds.gid = current_gid();
        scm->creds.pid = task_tgid_vnr(p);
        scm->fp = NULL;
        scm->seq = 0;

diff --git a/net/core/dev.c b/net/core/dev.c
index d9038e328cc153b2257330934bacd78b12e0f3f1..262df226b3c9a85852d41af69cc269cb930008fb 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2958,6 +2958,8 @@ static void dev_change_rx_flags(struct net_device *dev, int flags)
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
 {
        unsigned short old_flags = dev->flags;
+       uid_t uid;
+       gid_t gid;
 
        ASSERT_RTNL();
 
@@ -2982,15 +2984,17 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
                printk(KERN_INFO "device %s %s promiscuous mode\n",
                       dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
                                                               "left");
-               if (audit_enabled)
+               if (audit_enabled) {
+                       current_uid_gid(&uid, &gid);
                        audit_log(current->audit_context, GFP_ATOMIC,
                                AUDIT_ANOM_PROMISCUOUS,
                                "dev=%s prom=%d old_prom=%d auid=%u uid=%u gid=%u ses=%u",
                                dev->name, (dev->flags & IFF_PROMISC),
                                (old_flags & IFF_PROMISC),
                                audit_get_loginuid(current),
-                               current->uid, current->gid,
+                               uid, gid,
                                audit_get_sessionid(current));
+               }
 
                dev_change_rx_flags(dev, IFF_PROMISC);
        }

diff --git a/net/core/scm.c b/net/core/scm.c
index 10f5c65f6a470cc914de500b43d63990e89db1b6..4681d8f9b45b3f756cb511362df7ed09ae74abc5 100644 (file)
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -45,10 +45,10 @@
 static __inline__ int scm_check_creds(struct ucred *creds)
 {
        if ((creds->pid == task_tgid_vnr(current) || capable(CAP_SYS_ADMIN)) &&
-           ((creds->uid == current->uid || creds->uid == current->euid ||
-             creds->uid == current->suid) || capable(CAP_SETUID)) &&
-           ((creds->gid == current->gid || creds->gid == current->egid ||
-             creds->gid == current->sgid) || capable(CAP_SETGID))) {
+           ((creds->uid == current_uid()   || creds->uid == current_euid() ||
+             creds->uid == current_suid()) || capable(CAP_SETUID)) &&
+           ((creds->gid == current_gid()   || creds->gid == current_egid() ||
+             creds->gid == current_sgid()) || capable(CAP_SETGID))) {
               return 0;
        }
        return -EPERM;

diff --git a/net/socket.c b/net/socket.c
index 57550c3bcabec28ab7ee82030e6d1d4cb36192a0..62c7729527ff916447623a40d4966f7ba24663f1 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -491,8 +491,8 @@ static struct socket *sock_alloc(void)
        sock = SOCKET_I(inode);
 
        inode->i_mode = S_IFSOCK | S_IRWXUGO;
-       inode->i_uid = current->fsuid;
-       inode->i_gid = current->fsgid;
+       inode->i_uid = current_fsuid();
+       inode->i_gid = current_fsgid();
 
        get_cpu_var(sockets_in_use)++;
        put_cpu_var(sockets_in_use);