28b5ba2aa0
This adds the new getsockopt(2) option SO_PEERGROUPS on SOL_SOCKET to retrieve the auxiliary groups of the remote peer. It is designed to naturally extend SO_PEERCRED. That is, the underlying data is from the same credentials. Regarding its syntax, it is based on SO_PEERSEC. That is, if the provided buffer is too small, ERANGE is returned and @optlen is updated. Otherwise, the information is copied, @optlen is set to the actual size, and 0 is returned. While SO_PEERCRED (and thus `struct ucred') already returns the primary group, it lacks the auxiliary group vector. However, nearly all access controls (including kernel side VFS and SYSVIPC, but also user-space polkit, DBus, ...) consider the entire set of groups, rather than just the primary group. But this is currently not possible with pure SO_PEERCRED. Instead, user-space has to work around this and query the system database for the auxiliary groups of a UID retrieved via SO_PEERCRED. Unfortunately, there is no race-free way to query the auxiliary groups of the PID/UID retrieved via SO_PEERCRED. Hence, the current user-space solution is to use getgrouplist(3p), which itself falls back to NSS and whatever is configured in nsswitch.conf(3). This effectively checks which groups we *would* assign to the user if it logged in *now*. On normal systems it is as easy as reading /etc/group, but with NSS it can resort to quering network databases (eg., LDAP), using IPC or network communication. Long story short: Whenever we want to use auxiliary groups for access checks on IPC, we need further IPC to talk to the user/group databases, rather than just relying on SO_PEERCRED and the incoming socket. This is unfortunate, and might even result in dead-locks if the database query uses the same IPC as the original request. So far, those recursions / dead-locks have been avoided by using primitive IPC for all crucial NSS modules. However, we want to avoid re-inventing the wheel for each NSS module that might be involved in user/group queries. Hence, we would preferably make DBus (and other IPC that supports access-management based on groups) work without resorting to the user/group database. This new SO_PEERGROUPS ioctl would allow us to make dbus-daemon work without ever calling into NSS. Cc: Michal Sekletar <msekleta@redhat.com> Cc: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Tom Gundersen <teg@jklm.no> Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
124 lines
3.2 KiB
C
124 lines
3.2 KiB
C
/*
|
|
* This file is subject to the terms and conditions of the GNU General Public
|
|
* License. See the file "COPYING" in the main directory of this archive
|
|
* for more details.
|
|
*
|
|
* Copyright (C) 1997, 1999, 2000, 2001 Ralf Baechle
|
|
* Copyright (C) 2000, 2001 Silicon Graphics, Inc.
|
|
*/
|
|
#ifndef _UAPI_ASM_SOCKET_H
|
|
#define _UAPI_ASM_SOCKET_H
|
|
|
|
#include <asm/sockios.h>
|
|
|
|
/*
|
|
* For setsockopt(2)
|
|
*
|
|
* This defines are ABI conformant as far as Linux supports these ...
|
|
*/
|
|
#define SOL_SOCKET 0xffff
|
|
|
|
#define SO_DEBUG 0x0001 /* Record debugging information. */
|
|
#define SO_REUSEADDR 0x0004 /* Allow reuse of local addresses. */
|
|
#define SO_KEEPALIVE 0x0008 /* Keep connections alive and send
|
|
SIGPIPE when they die. */
|
|
#define SO_DONTROUTE 0x0010 /* Don't do local routing. */
|
|
#define SO_BROADCAST 0x0020 /* Allow transmission of
|
|
broadcast messages. */
|
|
#define SO_LINGER 0x0080 /* Block on close of a reliable
|
|
socket to transmit pending data. */
|
|
#define SO_OOBINLINE 0x0100 /* Receive out-of-band data in-band. */
|
|
#define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */
|
|
|
|
#define SO_TYPE 0x1008 /* Compatible name for SO_STYLE. */
|
|
#define SO_STYLE SO_TYPE /* Synonym */
|
|
#define SO_ERROR 0x1007 /* get error status and clear */
|
|
#define SO_SNDBUF 0x1001 /* Send buffer size. */
|
|
#define SO_RCVBUF 0x1002 /* Receive buffer. */
|
|
#define SO_SNDLOWAT 0x1003 /* send low-water mark */
|
|
#define SO_RCVLOWAT 0x1004 /* receive low-water mark */
|
|
#define SO_SNDTIMEO 0x1005 /* send timeout */
|
|
#define SO_RCVTIMEO 0x1006 /* receive timeout */
|
|
#define SO_ACCEPTCONN 0x1009
|
|
#define SO_PROTOCOL 0x1028 /* protocol type */
|
|
#define SO_DOMAIN 0x1029 /* domain/socket family */
|
|
|
|
/* linux-specific, might as well be the same as on i386 */
|
|
#define SO_NO_CHECK 11
|
|
#define SO_PRIORITY 12
|
|
#define SO_BSDCOMPAT 14
|
|
|
|
#define SO_PASSCRED 17
|
|
#define SO_PEERCRED 18
|
|
|
|
/* Security levels - as per NRL IPv6 - don't actually do anything */
|
|
#define SO_SECURITY_AUTHENTICATION 22
|
|
#define SO_SECURITY_ENCRYPTION_TRANSPORT 23
|
|
#define SO_SECURITY_ENCRYPTION_NETWORK 24
|
|
|
|
#define SO_BINDTODEVICE 25
|
|
|
|
/* Socket filtering */
|
|
#define SO_ATTACH_FILTER 26
|
|
#define SO_DETACH_FILTER 27
|
|
#define SO_GET_FILTER SO_ATTACH_FILTER
|
|
|
|
#define SO_PEERNAME 28
|
|
#define SO_TIMESTAMP 29
|
|
#define SCM_TIMESTAMP SO_TIMESTAMP
|
|
|
|
#define SO_PEERSEC 30
|
|
#define SO_SNDBUFFORCE 31
|
|
#define SO_RCVBUFFORCE 33
|
|
#define SO_PASSSEC 34
|
|
#define SO_TIMESTAMPNS 35
|
|
#define SCM_TIMESTAMPNS SO_TIMESTAMPNS
|
|
|
|
#define SO_MARK 36
|
|
|
|
#define SO_TIMESTAMPING 37
|
|
#define SCM_TIMESTAMPING SO_TIMESTAMPING
|
|
|
|
#define SO_RXQ_OVFL 40
|
|
|
|
#define SO_WIFI_STATUS 41
|
|
#define SCM_WIFI_STATUS SO_WIFI_STATUS
|
|
#define SO_PEEK_OFF 42
|
|
|
|
/* Instruct lower device to use last 4-bytes of skb data as FCS */
|
|
#define SO_NOFCS 43
|
|
|
|
#define SO_LOCK_FILTER 44
|
|
|
|
#define SO_SELECT_ERR_QUEUE 45
|
|
|
|
#define SO_BUSY_POLL 46
|
|
|
|
#define SO_MAX_PACING_RATE 47
|
|
|
|
#define SO_BPF_EXTENSIONS 48
|
|
|
|
#define SO_INCOMING_CPU 49
|
|
|
|
#define SO_ATTACH_BPF 50
|
|
#define SO_DETACH_BPF SO_DETACH_FILTER
|
|
|
|
#define SO_ATTACH_REUSEPORT_CBPF 51
|
|
#define SO_ATTACH_REUSEPORT_EBPF 52
|
|
|
|
#define SO_CNX_ADVICE 53
|
|
|
|
#define SCM_TIMESTAMPING_OPT_STATS 54
|
|
|
|
#define SO_MEMINFO 55
|
|
|
|
#define SO_INCOMING_NAPI_ID 56
|
|
|
|
#define SO_COOKIE 57
|
|
|
|
#define SCM_TIMESTAMPING_PKTINFO 58
|
|
|
|
#define SO_PEERGROUPS 59
|
|
|
|
#endif /* _UAPI_ASM_SOCKET_H */
|