1 /* Management of a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/slab.h>
16 #include <linux/keyctl.h>
18 #include <linux/err.h>
19 #include <linux/mutex.h>
20 #include <asm/uaccess.h>
23 /* session keyring create vs join semaphore */
24 static DEFINE_MUTEX(key_session_mutex);
26 /* user keyring creation semaphore */
27 static DEFINE_MUTEX(key_user_keyring_mutex);
29 /* the root user's tracking struct */
30 struct key_user root_key_user = {
31 .usage = ATOMIC_INIT(3),
32 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
33 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
34 .nkeys = ATOMIC_INIT(2),
35 .nikeys = ATOMIC_INIT(2),
39 /*****************************************************************************/
41 * install user and user session keyrings for a particular UID
43 int install_user_keyrings(void)
45 struct user_struct *user;
46 const struct cred *cred;
47 struct key *uid_keyring, *session_keyring;
51 cred = current_cred();
54 kenter("%p{%u}", user, user->uid);
56 if (user->uid_keyring) {
57 kleave(" = 0 [exist]");
61 mutex_lock(&key_user_keyring_mutex);
64 if (!user->uid_keyring) {
65 /* get the UID-specific keyring
66 * - there may be one in existence already as it may have been
67 * pinned by a session, but the user_struct pointing to it
68 * may have been destroyed by setuid */
69 sprintf(buf, "_uid.%u", user->uid);
71 uid_keyring = find_keyring_by_name(buf, true);
72 if (IS_ERR(uid_keyring)) {
73 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
74 cred, KEY_ALLOC_IN_QUOTA,
76 if (IS_ERR(uid_keyring)) {
77 ret = PTR_ERR(uid_keyring);
82 /* get a default session keyring (which might also exist
84 sprintf(buf, "_uid_ses.%u", user->uid);
86 session_keyring = find_keyring_by_name(buf, true);
87 if (IS_ERR(session_keyring)) {
89 keyring_alloc(buf, user->uid, (gid_t) -1,
90 cred, KEY_ALLOC_IN_QUOTA, NULL);
91 if (IS_ERR(session_keyring)) {
92 ret = PTR_ERR(session_keyring);
96 /* we install a link from the user session keyring to
98 ret = key_link(session_keyring, uid_keyring);
100 goto error_release_both;
103 /* install the keyrings */
104 user->uid_keyring = uid_keyring;
105 user->session_keyring = session_keyring;
108 mutex_unlock(&key_user_keyring_mutex);
113 key_put(session_keyring);
115 key_put(uid_keyring);
117 mutex_unlock(&key_user_keyring_mutex);
118 kleave(" = %d", ret);
123 * install a fresh thread keyring directly to new credentials
125 int install_thread_keyring_to_cred(struct cred *new)
129 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
130 KEY_ALLOC_QUOTA_OVERRUN, NULL);
132 return PTR_ERR(keyring);
134 new->thread_keyring = keyring;
139 * install a fresh thread keyring, discarding the old one
141 static int install_thread_keyring(void)
146 new = prepare_creds();
150 BUG_ON(new->thread_keyring);
152 ret = install_thread_keyring_to_cred(new);
158 return commit_creds(new);
162 * install a process keyring directly to a credentials struct
163 * - returns -EEXIST if there was already a process keyring, 0 if one installed,
164 * and other -ve on any other error
166 int install_process_keyring_to_cred(struct cred *new)
171 if (new->tgcred->process_keyring)
174 keyring = keyring_alloc("_pid", new->uid, new->gid,
175 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
177 return PTR_ERR(keyring);
179 spin_lock_irq(&new->tgcred->lock);
180 if (!new->tgcred->process_keyring) {
181 new->tgcred->process_keyring = keyring;
187 spin_unlock_irq(&new->tgcred->lock);
193 * make sure a process keyring is installed
196 static int install_process_keyring(void)
201 new = prepare_creds();
205 ret = install_process_keyring_to_cred(new);
208 return ret != -EEXIST ?: 0;
211 return commit_creds(new);
215 * install a session keyring directly to a credentials struct
217 static int install_session_keyring_to_cred(struct cred *cred,
225 /* create an empty session keyring */
227 flags = KEY_ALLOC_QUOTA_OVERRUN;
228 if (cred->tgcred->session_keyring)
229 flags = KEY_ALLOC_IN_QUOTA;
231 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
234 return PTR_ERR(keyring);
236 atomic_inc(&keyring->usage);
239 /* install the keyring */
240 spin_lock_irq(&cred->tgcred->lock);
241 old = cred->tgcred->session_keyring;
242 rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
243 spin_unlock_irq(&cred->tgcred->lock);
245 /* we're using RCU on the pointer, but there's no point synchronising
246 * on it if it didn't previously point to anything */
256 * install a session keyring, discarding the old one
257 * - if a keyring is not supplied, an empty one is invented
259 static int install_session_keyring(struct key *keyring)
264 new = prepare_creds();
268 ret = install_session_keyring_to_cred(new, NULL);
274 return commit_creds(new);
277 /*****************************************************************************/
281 int exec_keys(struct task_struct *tsk)
283 struct thread_group_cred *tgcred = NULL;
287 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
292 new = prepare_creds();
296 /* newly exec'd tasks don't get a thread keyring */
297 key_put(new->thread_keyring);
298 new->thread_keyring = NULL;
300 /* create a new per-thread-group creds for all this set of threads to
302 memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred));
304 atomic_set(&tgcred->usage, 1);
305 spin_lock_init(&tgcred->lock);
307 /* inherit the session keyring; new process keyring */
308 key_get(tgcred->session_keyring);
309 tgcred->process_keyring = NULL;
312 new->tgcred = tgcred;
317 } /* end exec_keys() */
319 /*****************************************************************************/
321 * the filesystem user ID changed
323 void key_fsuid_changed(struct task_struct *tsk)
325 /* update the ownership of the thread keyring */
327 if (tsk->cred->thread_keyring) {
328 down_write(&tsk->cred->thread_keyring->sem);
329 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
330 up_write(&tsk->cred->thread_keyring->sem);
333 } /* end key_fsuid_changed() */
335 /*****************************************************************************/
337 * the filesystem group ID changed
339 void key_fsgid_changed(struct task_struct *tsk)
341 /* update the ownership of the thread keyring */
343 if (tsk->cred->thread_keyring) {
344 down_write(&tsk->cred->thread_keyring->sem);
345 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
346 up_write(&tsk->cred->thread_keyring->sem);
349 } /* end key_fsgid_changed() */
351 /*****************************************************************************/
353 * search the process keyrings for the first matching key
354 * - we use the supplied match function to see if the description (or other
355 * feature of interest) matches
356 * - we return -EAGAIN if we didn't find any matching key
357 * - we return -ENOKEY if we found only negative matching keys
359 key_ref_t search_process_keyrings(struct key_type *type,
360 const void *description,
361 key_match_func_t match,
362 const struct cred *cred)
364 struct request_key_auth *rka;
365 key_ref_t key_ref, ret, err;
369 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
370 * searchable, but we failed to find a key or we found a negative key;
371 * otherwise we want to return a sample error (probably -EACCES) if
372 * none of the keyrings were searchable
374 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
378 err = ERR_PTR(-EAGAIN);
380 /* search the thread keyring first */
381 if (cred->thread_keyring) {
382 key_ref = keyring_search_aux(
383 make_key_ref(cred->thread_keyring, 1),
384 cred, type, description, match);
385 if (!IS_ERR(key_ref))
388 switch (PTR_ERR(key_ref)) {
389 case -EAGAIN: /* no key */
392 case -ENOKEY: /* negative key */
401 /* search the process keyring second */
402 if (cred->tgcred->process_keyring) {
403 key_ref = keyring_search_aux(
404 make_key_ref(cred->tgcred->process_keyring, 1),
405 cred, type, description, match);
406 if (!IS_ERR(key_ref))
409 switch (PTR_ERR(key_ref)) {
410 case -EAGAIN: /* no key */
413 case -ENOKEY: /* negative key */
422 /* search the session keyring */
423 if (cred->tgcred->session_keyring) {
425 key_ref = keyring_search_aux(
426 make_key_ref(rcu_dereference(
427 cred->tgcred->session_keyring),
429 cred, type, description, match);
432 if (!IS_ERR(key_ref))
435 switch (PTR_ERR(key_ref)) {
436 case -EAGAIN: /* no key */
439 case -ENOKEY: /* negative key */
447 /* or search the user-session keyring */
448 else if (cred->user->session_keyring) {
449 key_ref = keyring_search_aux(
450 make_key_ref(cred->user->session_keyring, 1),
451 cred, type, description, match);
452 if (!IS_ERR(key_ref))
455 switch (PTR_ERR(key_ref)) {
456 case -EAGAIN: /* no key */
459 case -ENOKEY: /* negative key */
468 /* if this process has an instantiation authorisation key, then we also
469 * search the keyrings of the process mentioned there
470 * - we don't permit access to request_key auth keys via this method
472 if (cred->request_key_auth &&
473 cred == current_cred() &&
474 type != &key_type_request_key_auth
476 /* defend against the auth key being revoked */
477 down_read(&cred->request_key_auth->sem);
479 if (key_validate(cred->request_key_auth) == 0) {
480 rka = cred->request_key_auth->payload.data;
482 key_ref = search_process_keyrings(type, description,
485 up_read(&cred->request_key_auth->sem);
487 if (!IS_ERR(key_ref))
490 switch (PTR_ERR(key_ref)) {
491 case -EAGAIN: /* no key */
494 case -ENOKEY: /* negative key */
502 up_read(&cred->request_key_auth->sem);
506 /* no key - decide on the error we're going to go for */
507 key_ref = ret ? ret : err;
512 } /* end search_process_keyrings() */
514 /*****************************************************************************/
516 * see if the key we're looking at is the target key
518 static int lookup_user_key_possessed(const struct key *key, const void *target)
520 return key == target;
522 } /* end lookup_user_key_possessed() */
524 /*****************************************************************************/
526 * lookup a key given a key ID from userspace with a given permissions mask
527 * - don't create special keyrings unless so requested
528 * - partially constructed keys aren't found unless requested
530 key_ref_t lookup_user_key(key_serial_t id, int create, int partial,
533 struct request_key_auth *rka;
534 const struct cred *cred;
536 key_ref_t key_ref, skey_ref;
540 cred = get_current_cred();
541 key_ref = ERR_PTR(-ENOKEY);
544 case KEY_SPEC_THREAD_KEYRING:
545 if (!cred->thread_keyring) {
549 ret = install_thread_keyring();
557 key = cred->thread_keyring;
558 atomic_inc(&key->usage);
559 key_ref = make_key_ref(key, 1);
562 case KEY_SPEC_PROCESS_KEYRING:
563 if (!cred->tgcred->process_keyring) {
567 ret = install_process_keyring();
575 key = cred->tgcred->process_keyring;
576 atomic_inc(&key->usage);
577 key_ref = make_key_ref(key, 1);
580 case KEY_SPEC_SESSION_KEYRING:
581 if (!cred->tgcred->session_keyring) {
582 /* always install a session keyring upon access if one
583 * doesn't exist yet */
584 ret = install_user_keyrings();
587 ret = install_session_keyring(
588 cred->user->session_keyring);
596 key = rcu_dereference(cred->tgcred->session_keyring);
597 atomic_inc(&key->usage);
599 key_ref = make_key_ref(key, 1);
602 case KEY_SPEC_USER_KEYRING:
603 if (!cred->user->uid_keyring) {
604 ret = install_user_keyrings();
609 key = cred->user->uid_keyring;
610 atomic_inc(&key->usage);
611 key_ref = make_key_ref(key, 1);
614 case KEY_SPEC_USER_SESSION_KEYRING:
615 if (!cred->user->session_keyring) {
616 ret = install_user_keyrings();
621 key = cred->user->session_keyring;
622 atomic_inc(&key->usage);
623 key_ref = make_key_ref(key, 1);
626 case KEY_SPEC_GROUP_KEYRING:
627 /* group keyrings are not yet supported */
628 key = ERR_PTR(-EINVAL);
631 case KEY_SPEC_REQKEY_AUTH_KEY:
632 key = cred->request_key_auth;
636 atomic_inc(&key->usage);
637 key_ref = make_key_ref(key, 1);
640 case KEY_SPEC_REQUESTOR_KEYRING:
641 if (!cred->request_key_auth)
644 down_read(&cred->request_key_auth->sem);
645 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
646 key_ref = ERR_PTR(-EKEYREVOKED);
649 rka = cred->request_key_auth->payload.data;
650 key = rka->dest_keyring;
651 atomic_inc(&key->usage);
653 up_read(&cred->request_key_auth->sem);
656 key_ref = make_key_ref(key, 1);
660 key_ref = ERR_PTR(-EINVAL);
664 key = key_lookup(id);
666 key_ref = ERR_CAST(key);
670 key_ref = make_key_ref(key, 0);
672 /* check to see if we possess the key */
673 skey_ref = search_process_keyrings(key->type, key,
674 lookup_user_key_possessed,
677 if (!IS_ERR(skey_ref)) {
686 ret = wait_for_key_construction(key, true);
697 ret = key_validate(key);
703 if (!partial && !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
706 /* check the permissions */
707 ret = key_task_permission(key_ref, cred, perm);
716 key_ref_put(key_ref);
717 key_ref = ERR_PTR(ret);
720 /* if we attempted to install a keyring, then it may have caused new
721 * creds to be installed */
726 } /* end lookup_user_key() */
728 /*****************************************************************************/
730 * join the named keyring as the session keyring if possible, or attempt to
731 * create a new one of that name if not
732 * - if the name is NULL, an empty anonymous keyring is installed instead
733 * - named session keyring joining is done with a semaphore held
735 long join_session_keyring(const char *name)
737 const struct cred *old;
742 /* only permit this if there's a single thread in the thread group -
743 * this avoids us having to adjust the creds on all threads and risking
745 if (!is_single_threaded(current))
748 new = prepare_creds();
751 old = current_cred();
753 /* if no name is provided, install an anonymous keyring */
755 ret = install_session_keyring_to_cred(new, NULL);
759 serial = new->tgcred->session_keyring->serial;
760 ret = commit_creds(new);
766 /* allow the user to join or create a named keyring */
767 mutex_lock(&key_session_mutex);
769 /* look for an existing keyring of this name */
770 keyring = find_keyring_by_name(name, false);
771 if (PTR_ERR(keyring) == -ENOKEY) {
772 /* not found - try and create a new one */
773 keyring = keyring_alloc(name, old->uid, old->gid, old,
774 KEY_ALLOC_IN_QUOTA, NULL);
775 if (IS_ERR(keyring)) {
776 ret = PTR_ERR(keyring);
779 } else if (IS_ERR(keyring)) {
780 ret = PTR_ERR(keyring);
784 /* we've got a keyring - now to install it */
785 ret = install_session_keyring_to_cred(new, keyring);
790 mutex_unlock(&key_session_mutex);
792 ret = keyring->serial;
798 mutex_unlock(&key_session_mutex);