215 	struct cred *new;  in cred_alloc_blank()  local
217 	new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);  in cred_alloc_blank()
218 	if (!new)  in cred_alloc_blank()
221 	atomic_set(&new->usage, 1);  in cred_alloc_blank()
223 	new->magic = CRED_MAGIC;  in cred_alloc_blank()
226 	if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)  in cred_alloc_blank()
229 	return new;  in cred_alloc_blank()
232 	abort_creds(new);  in cred_alloc_blank()
237  * prepare_creds - Prepare a new set of credentials for modification
239  * Prepare a new set of task credentials for modification.  A task's creds
241  * prepare a new copy, which the caller then modifies and then commits by
246  * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
254 	struct cred *new;  in prepare_creds()  local
258 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);  in prepare_creds()
259 	if (!new)  in prepare_creds()
262 	kdebug("prepare_creds() alloc %p", new);  in prepare_creds()
265 	memcpy(new, old, sizeof(struct cred));  in prepare_creds()
267 	new->non_rcu = 0;  in prepare_creds()
268 	atomic_set(&new->usage, 1);  in prepare_creds()
269 	set_cred_subscribers(new, 0);  in prepare_creds()
270 	get_group_info(new->group_info);  in prepare_creds()
271 	get_uid(new->user);  in prepare_creds()
272 	get_user_ns(new->user_ns);  in prepare_creds()
275 	key_get(new->session_keyring);  in prepare_creds()
276 	key_get(new->process_keyring);  in prepare_creds()
277 	key_get(new->thread_keyring);  in prepare_creds()
278 	key_get(new->request_key_auth);  in prepare_creds()
282 	new->security = NULL;  in prepare_creds()
285 	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)  in prepare_creds()
287 	validate_creds(new);  in prepare_creds()
288 	return new;  in prepare_creds()
291 	abort_creds(new);  in prepare_creds()
302 	struct cred *new;  in prepare_exec_creds()  local
304 	new = prepare_creds();  in prepare_exec_creds()
305 	if (!new)  in prepare_exec_creds()
306 		return new;  in prepare_exec_creds()
310 	key_put(new->thread_keyring);  in prepare_exec_creds()
311 	new->thread_keyring = NULL;  in prepare_exec_creds()
313 	/* inherit the session keyring; new process keyring */  in prepare_exec_creds()
314 	key_put(new->process_keyring);  in prepare_exec_creds()
315 	new->process_keyring = NULL;  in prepare_exec_creds()
318 	new->suid = new->fsuid = new->euid;  in prepare_exec_creds()
319 	new->sgid = new->fsgid = new->egid;  in prepare_exec_creds()
321 	return new;  in prepare_exec_creds()
325  * Copy credentials for the new process created by fork()
327  * We share if we can, but under some circumstances we have to generate a new
330  * The new process gets the current process's subjective credentials as its
335 	struct cred *new;  in copy_creds()  local
358 	new = prepare_creds();  in copy_creds()
359 	if (!new)  in copy_creds()
363 		ret = create_user_ns(new);  in copy_creds()
369 	/* new threads get their own thread keyrings if their parent already  in copy_creds()
371 	if (new->thread_keyring) {  in copy_creds()
372 		key_put(new->thread_keyring);  in copy_creds()
373 		new->thread_keyring = NULL;  in copy_creds()
375 			install_thread_keyring_to_cred(new);  in copy_creds()
382 		key_put(new->process_keyring);  in copy_creds()
383 		new->process_keyring = NULL;  in copy_creds()
387 	atomic_inc(&new->user->processes);  in copy_creds()
388 	p->cred = p->real_cred = get_cred(new);  in copy_creds()
389 	alter_cred_subscribers(new, 2);  in copy_creds()
390 	validate_creds(new);  in copy_creds()
394 	put_cred(new);  in copy_creds()
424  * commit_creds - Install new credentials upon the current task
425  * @new: The credentials to be assigned
427  * Install a new set of credentials to the current task, using RCU to replace
432  * This function eats the caller's reference to the new credentials.
437 int commit_creds(struct cred *new)  in commit_creds()  argument
442 	kdebug("commit_creds(%p{%d,%d})", new,  in commit_creds()
443 	       atomic_read(&new->usage),  in commit_creds()
444 	       read_cred_subscribers(new));  in commit_creds()
450 	validate_creds(new);  in commit_creds()
452 	BUG_ON(atomic_read(&new->usage) < 1);  in commit_creds()
454 	get_cred(new); /* we will require a ref for the subj creds too */  in commit_creds()
457 	if (!uid_eq(old->euid, new->euid) ||  in commit_creds()
458 	    !gid_eq(old->egid, new->egid) ||  in commit_creds()
459 	    !uid_eq(old->fsuid, new->fsuid) ||  in commit_creds()
460 	    !gid_eq(old->fsgid, new->fsgid) ||  in commit_creds()
461 	    !cred_cap_issubset(old, new)) {  in commit_creds()
478 	if (!uid_eq(new->fsuid, old->fsuid))  in commit_creds()
479 		key_fsuid_changed(new);  in commit_creds()
480 	if (!gid_eq(new->fsgid, old->fsgid))  in commit_creds()
481 		key_fsgid_changed(new);  in commit_creds()
487 	alter_cred_subscribers(new, 2);  in commit_creds()
488 	if (new->user != old->user)  in commit_creds()
489 		atomic_inc(&new->user->processes);  in commit_creds()
490 	rcu_assign_pointer(task->real_cred, new);  in commit_creds()
491 	rcu_assign_pointer(task->cred, new);  in commit_creds()
492 	if (new->user != old->user)  in commit_creds()
497 	if (!uid_eq(new->uid,   old->uid)  ||  in commit_creds()
498 	    !uid_eq(new->euid,  old->euid) ||  in commit_creds()
499 	    !uid_eq(new->suid,  old->suid) ||  in commit_creds()
500 	    !uid_eq(new->fsuid, old->fsuid))  in commit_creds()
503 	if (!gid_eq(new->gid,   old->gid)  ||  in commit_creds()
504 	    !gid_eq(new->egid,  old->egid) ||  in commit_creds()
505 	    !gid_eq(new->sgid,  old->sgid) ||  in commit_creds()
506 	    !gid_eq(new->fsgid, old->fsgid))  in commit_creds()
518  * @new: The credentials that were going to be applied
523 void abort_creds(struct cred *new)  in abort_creds()  argument
525 	kdebug("abort_creds(%p{%d,%d})", new,  in abort_creds()
526 	       atomic_read(&new->usage),  in abort_creds()
527 	       read_cred_subscribers(new));  in abort_creds()
530 	BUG_ON(read_cred_subscribers(new) != 0);  in abort_creds()
532 	BUG_ON(atomic_read(&new->usage) < 1);  in abort_creds()
533 	put_cred(new);  in abort_creds()
539  * @new: The credentials to be assigned
544 const struct cred *override_creds(const struct cred *new)  in override_creds()  argument
548 	kdebug("override_creds(%p{%d,%d})", new,  in override_creds()
549 	       atomic_read(&new->usage),  in override_creds()
550 	       read_cred_subscribers(new));  in override_creds()
553 	validate_creds(new);  in override_creds()
566 	get_new_cred((struct cred *)new);  in override_creds()
567 	alter_cred_subscribers(new, 1);  in override_creds()
568 	rcu_assign_pointer(current->cred, new);  in override_creds()
680  * Returns the new credentials or NULL if out of memory.
685 	struct cred *new;  in prepare_kernel_cred()  local
687 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);  in prepare_kernel_cred()
688 	if (!new)  in prepare_kernel_cred()
691 	kdebug("prepare_kernel_cred() alloc %p", new);  in prepare_kernel_cred()
700 	*new = *old;  in prepare_kernel_cred()
701 	new->non_rcu = 0;  in prepare_kernel_cred()
702 	atomic_set(&new->usage, 1);  in prepare_kernel_cred()
703 	set_cred_subscribers(new, 0);  in prepare_kernel_cred()
704 	get_uid(new->user);  in prepare_kernel_cred()
705 	get_user_ns(new->user_ns);  in prepare_kernel_cred()
706 	get_group_info(new->group_info);  in prepare_kernel_cred()
709 	new->session_keyring = NULL;  in prepare_kernel_cred()
710 	new->process_keyring = NULL;  in prepare_kernel_cred()
711 	new->thread_keyring = NULL;  in prepare_kernel_cred()
712 	new->request_key_auth = NULL;  in prepare_kernel_cred()
713 	new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;  in prepare_kernel_cred()
717 	new->security = NULL;  in prepare_kernel_cred()
719 	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)  in prepare_kernel_cred()
723 	validate_creds(new);  in prepare_kernel_cred()
724 	return new;  in prepare_kernel_cred()
727 	put_cred(new);  in prepare_kernel_cred()
735  * @new: The credentials to alter
741 int set_security_override(struct cred *new, u32 secid)  in set_security_override()  argument
743 	return security_kernel_act_as(new, secid);  in set_security_override()
749  * @new: The credentials to alter
757 int set_security_override_from_ctx(struct cred *new, const char *secctx)  in set_security_override_from_ctx()  argument
766 	return set_security_override(new, secid);  in set_security_override_from_ctx()
772  * @new: The credentials to alter
776  * as the object context of the specified inode, so that the new inodes have
779 int set_create_files_as(struct cred *new, struct inode *inode)  in set_create_files_as()  argument
783 	new->fsuid = inode->i_uid;  in set_create_files_as()
784 	new->fsgid = inode->i_gid;  in set_create_files_as()
785 	return security_kernel_create_files_as(new, inode);  in set_create_files_as()