1 /* Request a key from userspace
3 * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * See Documentation/keys-request-key.txt
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/kmod.h>
17 #include <linux/err.h>
18 #include <linux/keyctl.h>
19 #include <linux/slab.h>
22 #define key_negative_timeout 60 /* default timeout on a negative key's existence */
25 * wait_on_bit() sleep function for uninterruptible waiting
27 static int key_wait_bit(void *flags
)
34 * wait_on_bit() sleep function for interruptible waiting
36 static int key_wait_bit_intr(void *flags
)
39 return signal_pending(current
) ? -ERESTARTSYS
: 0;
43 * call to complete the construction of a key
45 void complete_request_key(struct key_construction
*cons
, int error
)
47 kenter("{%d,%d},%d", cons
->key
->serial
, cons
->authkey
->serial
, error
);
50 key_negate_and_link(cons
->key
, key_negative_timeout
, NULL
,
53 key_revoke(cons
->authkey
);
56 key_put(cons
->authkey
);
59 EXPORT_SYMBOL(complete_request_key
);
62 * request userspace finish the construction of a key
63 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
65 static int call_sbin_request_key(struct key_construction
*cons
,
69 struct task_struct
*tsk
= current
;
70 key_serial_t prkey
, sskey
;
71 struct key
*key
= cons
->key
, *authkey
= cons
->authkey
, *keyring
;
72 char *argv
[9], *envp
[3], uid_str
[12], gid_str
[12];
73 char key_str
[12], keyring_str
[3][12];
77 kenter("{%d},{%d},%s", key
->serial
, authkey
->serial
, op
);
79 ret
= install_user_keyrings();
83 /* allocate a new session keyring */
84 sprintf(desc
, "_req.%u", key
->serial
);
86 keyring
= keyring_alloc(desc
, current_fsuid(), current_fsgid(), current
,
87 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
88 if (IS_ERR(keyring
)) {
89 ret
= PTR_ERR(keyring
);
93 /* attach the auth key to the session keyring */
94 ret
= __key_link(keyring
, authkey
);
98 /* record the UID and GID */
99 sprintf(uid_str
, "%d", current_fsuid());
100 sprintf(gid_str
, "%d", current_fsgid());
102 /* we say which key is under construction */
103 sprintf(key_str
, "%d", key
->serial
);
105 /* we specify the process's default keyrings */
106 sprintf(keyring_str
[0], "%d",
107 tsk
->thread_keyring
? tsk
->thread_keyring
->serial
: 0);
110 if (tsk
->signal
->process_keyring
)
111 prkey
= tsk
->signal
->process_keyring
->serial
;
113 sprintf(keyring_str
[1], "%d", prkey
);
115 if (tsk
->signal
->session_keyring
) {
117 sskey
= rcu_dereference(tsk
->signal
->session_keyring
)->serial
;
120 sskey
= tsk
->user
->session_keyring
->serial
;
123 sprintf(keyring_str
[2], "%d", sskey
);
125 /* set up a minimal environment */
127 envp
[i
++] = "HOME=/";
128 envp
[i
++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
131 /* set up the argument list */
133 argv
[i
++] = "/sbin/request-key";
134 argv
[i
++] = (char *) op
;
138 argv
[i
++] = keyring_str
[0];
139 argv
[i
++] = keyring_str
[1];
140 argv
[i
++] = keyring_str
[2];
144 ret
= call_usermodehelper_keys(argv
[0], argv
, envp
, keyring
,
146 kdebug("usermode -> 0x%x", ret
);
148 /* ret is the exit/wait code */
149 if (test_bit(KEY_FLAG_USER_CONSTRUCT
, &key
->flags
) ||
150 key_validate(key
) < 0)
153 /* ignore any errors from userspace if the key was
162 kleave(" = %d", ret
);
163 complete_request_key(cons
, ret
);
168 * call out to userspace for key construction
169 * - we ignore program failure and go on key status instead
171 static int construct_key(struct key
*key
, const void *callout_info
,
172 size_t callout_len
, void *aux
,
173 struct key
*dest_keyring
)
175 struct key_construction
*cons
;
176 request_key_actor_t actor
;
180 kenter("%d,%p,%zu,%p", key
->serial
, callout_info
, callout_len
, aux
);
182 cons
= kmalloc(sizeof(*cons
), GFP_KERNEL
);
186 /* allocate an authorisation key */
187 authkey
= request_key_auth_new(key
, callout_info
, callout_len
,
189 if (IS_ERR(authkey
)) {
191 ret
= PTR_ERR(authkey
);
194 cons
->authkey
= key_get(authkey
);
195 cons
->key
= key_get(key
);
198 actor
= call_sbin_request_key
;
199 if (key
->type
->request_key
)
200 actor
= key
->type
->request_key
;
202 ret
= actor(cons
, "create", aux
);
204 /* check that the actor called complete_request_key() prior to
205 * returning an error */
207 !test_bit(KEY_FLAG_REVOKED
, &authkey
->flags
));
211 kleave(" = %d", ret
);
216 * get the appropriate destination keyring for the request
217 * - we return whatever keyring we select with an extra reference upon it which
218 * the caller must release
220 static void construct_get_dest_keyring(struct key
**_dest_keyring
)
222 struct request_key_auth
*rka
;
223 struct task_struct
*tsk
= current
;
224 struct key
*dest_keyring
= *_dest_keyring
, *authkey
;
226 kenter("%p", dest_keyring
);
228 /* find the appropriate keyring */
230 /* the caller supplied one */
231 key_get(dest_keyring
);
233 /* use a default keyring; falling through the cases until we
234 * find one that we actually have */
235 switch (tsk
->jit_keyring
) {
236 case KEY_REQKEY_DEFL_DEFAULT
:
237 case KEY_REQKEY_DEFL_REQUESTOR_KEYRING
:
238 if (tsk
->request_key_auth
) {
239 authkey
= tsk
->request_key_auth
;
240 down_read(&authkey
->sem
);
241 rka
= authkey
->payload
.data
;
242 if (!test_bit(KEY_FLAG_REVOKED
,
245 key_get(rka
->dest_keyring
);
246 up_read(&authkey
->sem
);
251 case KEY_REQKEY_DEFL_THREAD_KEYRING
:
252 dest_keyring
= key_get(tsk
->thread_keyring
);
256 case KEY_REQKEY_DEFL_PROCESS_KEYRING
:
257 dest_keyring
= key_get(tsk
->signal
->process_keyring
);
261 case KEY_REQKEY_DEFL_SESSION_KEYRING
:
263 dest_keyring
= key_get(
264 rcu_dereference(tsk
->signal
->session_keyring
));
270 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING
:
271 dest_keyring
= key_get(tsk
->user
->session_keyring
);
274 case KEY_REQKEY_DEFL_USER_KEYRING
:
275 dest_keyring
= key_get(tsk
->user
->uid_keyring
);
278 case KEY_REQKEY_DEFL_GROUP_KEYRING
:
284 *_dest_keyring
= dest_keyring
;
285 kleave(" [dk %d]", key_serial(dest_keyring
));
290 * allocate a new key in under-construction state and attempt to link it in to
291 * the requested place
292 * - may return a key that's already under construction instead
294 static int construct_alloc_key(struct key_type
*type
,
295 const char *description
,
296 struct key
*dest_keyring
,
298 struct key_user
*user
,
304 kenter("%s,%s,,,", type
->name
, description
);
306 mutex_lock(&user
->cons_lock
);
308 key
= key_alloc(type
, description
,
309 current_fsuid(), current_fsgid(), current
, KEY_POS_ALL
,
314 set_bit(KEY_FLAG_USER_CONSTRUCT
, &key
->flags
);
316 down_write(&dest_keyring
->sem
);
318 /* attach the key to the destination keyring under lock, but we do need
319 * to do another check just in case someone beat us to it whilst we
320 * waited for locks */
321 mutex_lock(&key_construction_mutex
);
323 key_ref
= search_process_keyrings(type
, description
, type
->match
,
325 if (!IS_ERR(key_ref
))
326 goto key_already_present
;
328 __key_link(dest_keyring
, key
);
330 mutex_unlock(&key_construction_mutex
);
331 up_write(&dest_keyring
->sem
);
332 mutex_unlock(&user
->cons_lock
);
334 kleave(" = 0 [%d]", key_serial(key
));
338 mutex_unlock(&key_construction_mutex
);
340 up_write(&dest_keyring
->sem
);
341 mutex_unlock(&user
->cons_lock
);
343 *_key
= key
= key_ref_to_ptr(key_ref
);
344 kleave(" = -EINPROGRESS [%d]", key_serial(key
));
348 mutex_unlock(&user
->cons_lock
);
350 kleave(" = %ld", PTR_ERR(key
));
355 * commence key construction
357 static struct key
*construct_key_and_link(struct key_type
*type
,
358 const char *description
,
359 const char *callout_info
,
362 struct key
*dest_keyring
,
365 struct key_user
*user
;
369 user
= key_user_lookup(current_fsuid());
371 return ERR_PTR(-ENOMEM
);
373 construct_get_dest_keyring(&dest_keyring
);
375 ret
= construct_alloc_key(type
, description
, dest_keyring
, flags
, user
,
380 ret
= construct_key(key
, callout_info
, callout_len
, aux
,
383 goto construction_failed
;
386 key_put(dest_keyring
);
390 key_negate_and_link(key
, key_negative_timeout
, NULL
, NULL
);
392 key_put(dest_keyring
);
398 * - search the process's keyrings
399 * - check the list of keys being created or updated
400 * - call out to userspace for a key if supplementary info was provided
401 * - cache the key in an appropriate keyring
403 struct key
*request_key_and_link(struct key_type
*type
,
404 const char *description
,
405 const void *callout_info
,
408 struct key
*dest_keyring
,
414 kenter("%s,%s,%p,%zu,%p,%p,%lx",
415 type
->name
, description
, callout_info
, callout_len
, aux
,
416 dest_keyring
, flags
);
418 /* search all the process keyrings for a key */
419 key_ref
= search_process_keyrings(type
, description
, type
->match
,
422 if (!IS_ERR(key_ref
)) {
423 key
= key_ref_to_ptr(key_ref
);
424 } else if (PTR_ERR(key_ref
) != -EAGAIN
) {
425 key
= ERR_CAST(key_ref
);
427 /* the search failed, but the keyrings were searchable, so we
428 * should consult userspace if we can */
429 key
= ERR_PTR(-ENOKEY
);
433 key
= construct_key_and_link(type
, description
, callout_info
,
434 callout_len
, aux
, dest_keyring
,
439 kleave(" = %p", key
);
444 * wait for construction of a key to complete
446 int wait_for_key_construction(struct key
*key
, bool intr
)
450 ret
= wait_on_bit(&key
->flags
, KEY_FLAG_USER_CONSTRUCT
,
451 intr
? key_wait_bit_intr
: key_wait_bit
,
452 intr
? TASK_INTERRUPTIBLE
: TASK_UNINTERRUPTIBLE
);
455 return key_validate(key
);
457 EXPORT_SYMBOL(wait_for_key_construction
);
461 * - search the process's keyrings
462 * - check the list of keys being created or updated
463 * - call out to userspace for a key if supplementary info was provided
464 * - waits uninterruptible for creation to complete
466 struct key
*request_key(struct key_type
*type
,
467 const char *description
,
468 const char *callout_info
)
471 size_t callout_len
= 0;
475 callout_len
= strlen(callout_info
);
476 key
= request_key_and_link(type
, description
, callout_info
, callout_len
,
477 NULL
, NULL
, KEY_ALLOC_IN_QUOTA
);
479 ret
= wait_for_key_construction(key
, false);
487 EXPORT_SYMBOL(request_key
);
490 * request a key with auxiliary data for the upcaller
491 * - search the process's keyrings
492 * - check the list of keys being created or updated
493 * - call out to userspace for a key if supplementary info was provided
494 * - waits uninterruptible for creation to complete
496 struct key
*request_key_with_auxdata(struct key_type
*type
,
497 const char *description
,
498 const void *callout_info
,
505 key
= request_key_and_link(type
, description
, callout_info
, callout_len
,
506 aux
, NULL
, KEY_ALLOC_IN_QUOTA
);
508 ret
= wait_for_key_construction(key
, false);
516 EXPORT_SYMBOL(request_key_with_auxdata
);
519 * request a key (allow async construction)
520 * - search the process's keyrings
521 * - check the list of keys being created or updated
522 * - call out to userspace for a key if supplementary info was provided
524 struct key
*request_key_async(struct key_type
*type
,
525 const char *description
,
526 const void *callout_info
,
529 return request_key_and_link(type
, description
, callout_info
,
530 callout_len
, NULL
, NULL
,
533 EXPORT_SYMBOL(request_key_async
);
536 * request a key with auxiliary data for the upcaller (allow async construction)
537 * - search the process's keyrings
538 * - check the list of keys being created or updated
539 * - call out to userspace for a key if supplementary info was provided
541 struct key
*request_key_async_with_auxdata(struct key_type
*type
,
542 const char *description
,
543 const void *callout_info
,
547 return request_key_and_link(type
, description
, callout_info
,
548 callout_len
, aux
, NULL
, KEY_ALLOC_IN_QUOTA
);
550 EXPORT_SYMBOL(request_key_async_with_auxdata
);