148 	struct cred *new;  in cred_alloc_blank()  local
150 	new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);  in cred_alloc_blank()
151 	if (!new)  in cred_alloc_blank()
154 	atomic_long_set(&new->usage, 1);  in cred_alloc_blank()
155 	if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)  in cred_alloc_blank()
158 	return new;  in cred_alloc_blank()
161 	abort_creds(new);  in cred_alloc_blank()
166  * prepare_creds - Prepare a new set of credentials for modification
168  * Prepare a new set of task credentials for modification.  A task's creds
170  * prepare a new copy, which the caller then modifies and then commits by
175  * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
183 	struct cred *new;  in prepare_creds()  local
185 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);  in prepare_creds()
186 	if (!new)  in prepare_creds()
189 	kdebug("prepare_creds() alloc %p", new);  in prepare_creds()
192 	memcpy(new, old, sizeof(struct cred));  in prepare_creds()
194 	new->non_rcu = 0;  in prepare_creds()
195 	atomic_long_set(&new->usage, 1);  in prepare_creds()
196 	get_group_info(new->group_info);  in prepare_creds()
197 	get_uid(new->user);  in prepare_creds()
198 	get_user_ns(new->user_ns);  in prepare_creds()
201 	key_get(new->session_keyring);  in prepare_creds()
202 	key_get(new->process_keyring);  in prepare_creds()
203 	key_get(new->thread_keyring);  in prepare_creds()
204 	key_get(new->request_key_auth);  in prepare_creds()
208 	new->security = NULL;  in prepare_creds()
211 	new->ucounts = get_ucounts(new->ucounts);  in prepare_creds()
212 	if (!new->ucounts)  in prepare_creds()
215 	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)  in prepare_creds()
218 	return new;  in prepare_creds()
221 	abort_creds(new);  in prepare_creds()
232 	struct cred *new;  in prepare_exec_creds()  local
234 	new = prepare_creds();  in prepare_exec_creds()
235 	if (!new)  in prepare_exec_creds()
236 		return new;  in prepare_exec_creds()
240 	key_put(new->thread_keyring);  in prepare_exec_creds()
241 	new->thread_keyring = NULL;  in prepare_exec_creds()
243 	/* inherit the session keyring; new process keyring */  in prepare_exec_creds()
244 	key_put(new->process_keyring);  in prepare_exec_creds()
245 	new->process_keyring = NULL;  in prepare_exec_creds()
248 	new->suid = new->fsuid = new->euid;  in prepare_exec_creds()
249 	new->sgid = new->fsgid = new->egid;  in prepare_exec_creds()
251 	return new;  in prepare_exec_creds()
255  * Copy credentials for the new process created by fork()
257  * We share if we can, but under some circumstances we have to generate a new
260  * The new process gets the current process's subjective credentials as its
265 	struct cred *new;  in copy_creds()  local
286 	new = prepare_creds();  in copy_creds()
287 	if (!new)  in copy_creds()
291 		ret = create_user_ns(new);  in copy_creds()
294 		ret = set_cred_ucounts(new);  in copy_creds()
300 	/* new threads get their own thread keyrings if their parent already  in copy_creds()
302 	if (new->thread_keyring) {  in copy_creds()
303 		key_put(new->thread_keyring);  in copy_creds()
304 		new->thread_keyring = NULL;  in copy_creds()
306 			install_thread_keyring_to_cred(new);  in copy_creds()
313 		key_put(new->process_keyring);  in copy_creds()
314 		new->process_keyring = NULL;  in copy_creds()
318 	p->cred = p->real_cred = get_cred(new);  in copy_creds()
325 	put_cred(new);  in copy_creds()
355  * commit_creds - Install new credentials upon the current task
356  * @new: The credentials to be assigned
358  * Install a new set of credentials to the current task, using RCU to replace
363  * This function eats the caller's reference to the new credentials.
368 int commit_creds(struct cred *new)  in commit_creds()  argument
373 	kdebug("commit_creds(%p{%ld})", new,  in commit_creds()
374 	       atomic_long_read(&new->usage));  in commit_creds()
377 	BUG_ON(atomic_long_read(&new->usage) < 1);  in commit_creds()
379 	get_cred(new); /* we will require a ref for the subj creds too */  in commit_creds()
382 	if (!uid_eq(old->euid, new->euid) ||  in commit_creds()
383 	    !gid_eq(old->egid, new->egid) ||  in commit_creds()
384 	    !uid_eq(old->fsuid, new->fsuid) ||  in commit_creds()
385 	    !gid_eq(old->fsgid, new->fsgid) ||  in commit_creds()
386 	    !cred_cap_issubset(old, new)) {  in commit_creds()
403 	if (!uid_eq(new->fsuid, old->fsuid))  in commit_creds()
404 		key_fsuid_changed(new);  in commit_creds()
405 	if (!gid_eq(new->fsgid, old->fsgid))  in commit_creds()
406 		key_fsgid_changed(new);  in commit_creds()
412 	if (new->user != old->user || new->user_ns != old->user_ns)  in commit_creds()
413 		inc_rlimit_ucounts(new->ucounts, UCOUNT_RLIMIT_NPROC, 1);  in commit_creds()
415 	rcu_assign_pointer(task->real_cred, new);  in commit_creds()
416 	rcu_assign_pointer(task->cred, new);  in commit_creds()
417 	if (new->user != old->user || new->user_ns != old->user_ns)  in commit_creds()
419 	if (new->user_ns != old->user_ns)  in commit_creds()
420 		switch_cred_namespaces(old, new);  in commit_creds()
423 	if (!uid_eq(new->uid,   old->uid)  ||  in commit_creds()
424 	    !uid_eq(new->euid,  old->euid) ||  in commit_creds()
425 	    !uid_eq(new->suid,  old->suid) ||  in commit_creds()
426 	    !uid_eq(new->fsuid, old->fsuid))  in commit_creds()
429 	if (!gid_eq(new->gid,   old->gid)  ||  in commit_creds()
430 	    !gid_eq(new->egid,  old->egid) ||  in commit_creds()
431 	    !gid_eq(new->sgid,  old->sgid) ||  in commit_creds()
432 	    !gid_eq(new->fsgid, old->fsgid))  in commit_creds()
443  * @new: The credentials that were going to be applied
448 void abort_creds(struct cred *new)  in abort_creds()  argument
450 	kdebug("abort_creds(%p{%ld})", new,  in abort_creds()
451 	       atomic_long_read(&new->usage));  in abort_creds()
453 	BUG_ON(atomic_long_read(&new->usage) < 1);  in abort_creds()
454 	put_cred(new);  in abort_creds()
512 int set_cred_ucounts(struct cred *new)  in set_cred_ucounts()  argument
514 	struct ucounts *new_ucounts, *old_ucounts = new->ucounts;  in set_cred_ucounts()
520 	if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid))  in set_cred_ucounts()
523 	if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid)))  in set_cred_ucounts()
526 	new->ucounts = new_ucounts;  in set_cred_ucounts()
556  * Returns the new credentials or NULL if out of memory.
561 	struct cred *new;  in prepare_kernel_cred()  local
566 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);  in prepare_kernel_cred()
567 	if (!new)  in prepare_kernel_cred()
570 	kdebug("prepare_kernel_cred() alloc %p", new);  in prepare_kernel_cred()
574 	*new = *old;  in prepare_kernel_cred()
575 	new->non_rcu = 0;  in prepare_kernel_cred()
576 	atomic_long_set(&new->usage, 1);  in prepare_kernel_cred()
577 	get_uid(new->user);  in prepare_kernel_cred()
578 	get_user_ns(new->user_ns);  in prepare_kernel_cred()
579 	get_group_info(new->group_info);  in prepare_kernel_cred()
582 	new->session_keyring = NULL;  in prepare_kernel_cred()
583 	new->process_keyring = NULL;  in prepare_kernel_cred()
584 	new->thread_keyring = NULL;  in prepare_kernel_cred()
585 	new->request_key_auth = NULL;  in prepare_kernel_cred()
586 	new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;  in prepare_kernel_cred()
590 	new->security = NULL;  in prepare_kernel_cred()
592 	new->ucounts = get_ucounts(new->ucounts);  in prepare_kernel_cred()
593 	if (!new->ucounts)  in prepare_kernel_cred()
596 	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)  in prepare_kernel_cred()
600 	return new;  in prepare_kernel_cred()
603 	put_cred(new);  in prepare_kernel_cred()
611  * @new: The credentials to alter
617 int set_security_override(struct cred *new, u32 secid)  in set_security_override()  argument
619 	return security_kernel_act_as(new, secid);  in set_security_override()
625  * @new: The credentials to alter
629  * as the object context of the specified inode, so that the new inodes have
632 int set_create_files_as(struct cred *new, struct inode *inode)  in set_create_files_as()  argument
636 	new->fsuid = inode->i_uid;  in set_create_files_as()
637 	new->fsgid = inode->i_gid;  in set_create_files_as()
638 	return security_kernel_create_files_as(new, inode);  in set_create_files_as()