2 * linux/net/sunrpc/auth_unix.c
4 * UNIX-style authentication; no AUTH_SHORT support
6 * Copyright (C) 1996, Olaf Kirch <okir@monad.swb.de>
9 #include <linux/types.h>
10 #include <linux/sched.h>
11 #include <linux/module.h>
12 #include <linux/socket.h>
14 #include <linux/sunrpc/clnt.h>
15 #include <linux/sunrpc/auth.h>
16 #include <linux/vserver/xid.h>
18 #define NFS_NGROUPS 16
21 struct rpc_cred uc_base;
23 uid_t uc_puid; /* process uid */
24 gid_t uc_pgid; /* process gid */
25 gid_t uc_gids[NFS_NGROUPS];
27 #define uc_uid uc_base.cr_uid
28 #define uc_count uc_base.cr_count
29 #define uc_flags uc_base.cr_flags
30 #define uc_expire uc_base.cr_expire
32 #define UNX_CRED_EXPIRE (60 * HZ)
34 #define UNX_WRITESLACK (21 + (UNX_MAXNODENAME >> 2))
37 # define RPCDBG_FACILITY RPCDBG_AUTH
40 static struct rpc_credops unix_credops;
42 static struct rpc_auth *
43 unx_create(struct rpc_clnt *clnt, rpc_authflavor_t flavor)
45 struct rpc_auth *auth;
47 dprintk("RPC: creating UNIX authenticator for client %p\n", clnt);
48 if (!(auth = (struct rpc_auth *) kmalloc(sizeof(*auth), GFP_KERNEL)))
50 auth->au_cslack = UNX_WRITESLACK;
51 auth->au_rslack = 2; /* assume AUTH_NULL verf */
52 auth->au_expire = UNX_CRED_EXPIRE;
53 auth->au_ops = &authunix_ops;
55 rpcauth_init_credcache(auth);
61 unx_destroy(struct rpc_auth *auth)
63 dprintk("RPC: destroying UNIX authenticator %p\n", auth);
64 rpcauth_free_credcache(auth);
67 static struct rpc_cred *
68 unx_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
70 struct unx_cred *cred;
73 dprintk("RPC: allocating UNIX cred for uid %d gid %d\n",
74 acred->uid, acred->gid);
76 if (!(cred = (struct unx_cred *) kmalloc(sizeof(*cred), GFP_KERNEL)))
79 atomic_set(&cred->uc_count, 0);
80 cred->uc_flags = RPCAUTH_CRED_UPTODATE;
81 if (flags & RPC_TASK_ROOTCREDS) {
82 cred->uc_uid = cred->uc_puid = 0;
83 cred->uc_gid = cred->uc_pgid = 0;
84 cred->uc_gids[0] = NOGROUP;
86 int groups = acred->group_info->ngroups;
87 if (groups > NFS_NGROUPS)
90 cred->uc_uid = acred->uid;
91 cred->uc_gid = acred->gid;
92 // cred->uc_puid = XIDINO_UID(current->uid, current->xid);
93 // cred->uc_pgid = XIDINO_GID(current->gid, current->xid);
94 cred->uc_puid = current->uid;
95 cred->uc_pgid = current->gid;
96 for (i = 0; i < groups; i++)
97 cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
99 cred->uc_gids[i] = NOGROUP;
101 cred->uc_base.cr_ops = &unix_credops;
103 return (struct rpc_cred *) cred;
107 unx_destroy_cred(struct rpc_cred *cred)
113 * Match credentials against current process creds.
114 * The root_override argument takes care of cases where the caller may
115 * request root creds (e.g. for NFS swapping).
118 unx_match(struct auth_cred *acred, struct rpc_cred *rcred, int taskflags)
120 struct unx_cred *cred = (struct unx_cred *) rcred;
123 if (!(taskflags & RPC_TASK_ROOTCREDS)) {
126 if (cred->uc_uid != acred->uid
127 || cred->uc_gid != acred->gid
128 || cred->uc_puid != XIDINO_UID(current->uid, current->xid)
129 || cred->uc_pgid != XIDINO_GID(current->gid, current->xid))
132 groups = acred->group_info->ngroups;
133 if (groups > NFS_NGROUPS)
134 groups = NFS_NGROUPS;
135 for (i = 0; i < groups ; i++)
136 if (cred->uc_gids[i] != GROUP_AT(acred->group_info, i))
140 return (cred->uc_uid == 0 && cred->uc_puid == 0
141 && cred->uc_gid == 0 && cred->uc_pgid == 0
142 && cred->uc_gids[0] == (gid_t) NOGROUP);
146 * Marshal credentials.
147 * Maybe we should keep a cached credential for performance reasons.
150 unx_marshal(struct rpc_task *task, u32 *p, int ruid)
152 struct rpc_clnt *clnt = task->tk_client;
153 struct unx_cred *cred = (struct unx_cred *) task->tk_msg.rpc_cred;
157 *p++ = htonl(RPC_AUTH_UNIX);
159 *p++ = htonl(jiffies/HZ);
162 * Copy the UTS nodename captured when the client was created.
164 p = xdr_encode_array(p, clnt->cl_nodename, clnt->cl_nodelen);
166 /* Note: we don't use real uid if it involves raising privilege */
167 if (ruid && cred->uc_puid != 0 && cred->uc_pgid != 0) {
168 *p++ = htonl((u32) cred->uc_puid);
169 *p++ = htonl((u32) cred->uc_pgid);
171 *p++ = htonl((u32) cred->uc_uid);
172 *p++ = htonl((u32) cred->uc_gid);
175 for (i = 0; i < 16 && cred->uc_gids[i] != (gid_t) NOGROUP; i++)
176 *p++ = htonl((u32) cred->uc_gids[i]);
177 *hold = htonl(p - hold - 1); /* gid array length */
178 *base = htonl((p - base - 1) << 2); /* cred length */
180 *p++ = htonl(RPC_AUTH_NULL);
187 * Refresh credentials. This is a no-op for AUTH_UNIX
190 unx_refresh(struct rpc_task *task)
192 task->tk_msg.rpc_cred->cr_flags |= RPCAUTH_CRED_UPTODATE;
193 return task->tk_status = -EACCES;
197 unx_validate(struct rpc_task *task, u32 *p)
199 rpc_authflavor_t flavor;
202 flavor = ntohl(*p++);
203 if (flavor != RPC_AUTH_NULL &&
204 flavor != RPC_AUTH_UNIX &&
205 flavor != RPC_AUTH_SHORT) {
206 printk("RPC: bad verf flavor: %u\n", flavor);
211 if (size > RPC_MAX_AUTH_SIZE) {
212 printk("RPC: giant verf size: %u\n", size);
215 task->tk_auth->au_rslack = (size >> 2) + 2;
221 struct rpc_authops authunix_ops = {
222 .owner = THIS_MODULE,
223 .au_flavor = RPC_AUTH_UNIX,
227 .create = unx_create,
228 .destroy = unx_destroy,
229 .crcreate = unx_create_cred,
233 struct rpc_credops unix_credops = {
234 .crdestroy = unx_destroy_cred,
235 .crmatch = unx_match,
236 .crmarshal = unx_marshal,
237 .crrefresh = unx_refresh,
238 .crvalidate = unx_validate,