1 /* Request a key from userspace
3 * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * See Documentation/keys-request-key.txt
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/kmod.h>
17 #include <linux/err.h>
18 #include <linux/keyctl.h>
19 #include <linux/slab.h>
22 #define key_negative_timeout 60 /* default timeout on a negative key's existence */
25 * wait_on_bit() sleep function for uninterruptible waiting
27 static int key_wait_bit(void *flags
)
34 * wait_on_bit() sleep function for interruptible waiting
36 static int key_wait_bit_intr(void *flags
)
39 return signal_pending(current
) ? -ERESTARTSYS
: 0;
43 * call to complete the construction of a key
45 void complete_request_key(struct key_construction
*cons
, int error
)
47 kenter("{%d,%d},%d", cons
->key
->serial
, cons
->authkey
->serial
, error
);
50 key_negate_and_link(cons
->key
, key_negative_timeout
, NULL
,
53 key_revoke(cons
->authkey
);
56 key_put(cons
->authkey
);
59 EXPORT_SYMBOL(complete_request_key
);
62 * request userspace finish the construction of a key
63 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
65 static int call_sbin_request_key(struct key_construction
*cons
,
69 const struct cred
*cred
= current_cred();
70 key_serial_t prkey
, sskey
;
71 struct key
*key
= cons
->key
, *authkey
= cons
->authkey
, *keyring
,
73 char *argv
[9], *envp
[3], uid_str
[12], gid_str
[12];
74 char key_str
[12], keyring_str
[3][12];
78 kenter("{%d},{%d},%s", key
->serial
, authkey
->serial
, op
);
80 ret
= install_user_keyrings();
84 /* allocate a new session keyring */
85 sprintf(desc
, "_req.%u", key
->serial
);
87 cred
= get_current_cred();
88 keyring
= keyring_alloc(desc
, cred
->fsuid
, cred
->fsgid
, cred
,
89 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
91 if (IS_ERR(keyring
)) {
92 ret
= PTR_ERR(keyring
);
96 /* attach the auth key to the session keyring */
97 ret
= __key_link(keyring
, authkey
);
101 /* record the UID and GID */
102 sprintf(uid_str
, "%d", cred
->fsuid
);
103 sprintf(gid_str
, "%d", cred
->fsgid
);
105 /* we say which key is under construction */
106 sprintf(key_str
, "%d", key
->serial
);
108 /* we specify the process's default keyrings */
109 sprintf(keyring_str
[0], "%d",
110 cred
->thread_keyring
? cred
->thread_keyring
->serial
: 0);
113 if (cred
->tgcred
->process_keyring
)
114 prkey
= cred
->tgcred
->process_keyring
->serial
;
117 session
= rcu_dereference(cred
->tgcred
->session_keyring
);
119 session
= cred
->user
->session_keyring
;
120 sskey
= session
->serial
;
123 sprintf(keyring_str
[2], "%d", sskey
);
125 /* set up a minimal environment */
127 envp
[i
++] = "HOME=/";
128 envp
[i
++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
131 /* set up the argument list */
133 argv
[i
++] = "/sbin/request-key";
134 argv
[i
++] = (char *) op
;
138 argv
[i
++] = keyring_str
[0];
139 argv
[i
++] = keyring_str
[1];
140 argv
[i
++] = keyring_str
[2];
144 ret
= call_usermodehelper_keys(argv
[0], argv
, envp
, keyring
,
146 kdebug("usermode -> 0x%x", ret
);
148 /* ret is the exit/wait code */
149 if (test_bit(KEY_FLAG_USER_CONSTRUCT
, &key
->flags
) ||
150 key_validate(key
) < 0)
153 /* ignore any errors from userspace if the key was
162 complete_request_key(cons
, ret
);
163 kleave(" = %d", ret
);
168 * call out to userspace for key construction
169 * - we ignore program failure and go on key status instead
171 static int construct_key(struct key
*key
, const void *callout_info
,
172 size_t callout_len
, void *aux
,
173 struct key
*dest_keyring
)
175 struct key_construction
*cons
;
176 request_key_actor_t actor
;
180 kenter("%d,%p,%zu,%p", key
->serial
, callout_info
, callout_len
, aux
);
182 cons
= kmalloc(sizeof(*cons
), GFP_KERNEL
);
186 /* allocate an authorisation key */
187 authkey
= request_key_auth_new(key
, callout_info
, callout_len
,
189 if (IS_ERR(authkey
)) {
191 ret
= PTR_ERR(authkey
);
194 cons
->authkey
= key_get(authkey
);
195 cons
->key
= key_get(key
);
198 actor
= call_sbin_request_key
;
199 if (key
->type
->request_key
)
200 actor
= key
->type
->request_key
;
202 ret
= actor(cons
, "create", aux
);
204 /* check that the actor called complete_request_key() prior to
205 * returning an error */
207 !test_bit(KEY_FLAG_REVOKED
, &authkey
->flags
));
211 kleave(" = %d", ret
);
216 * get the appropriate destination keyring for the request
217 * - we return whatever keyring we select with an extra reference upon it which
218 * the caller must release
220 static void construct_get_dest_keyring(struct key
**_dest_keyring
)
222 struct request_key_auth
*rka
;
223 const struct cred
*cred
= current_cred();
224 struct key
*dest_keyring
= *_dest_keyring
, *authkey
;
226 kenter("%p", dest_keyring
);
228 /* find the appropriate keyring */
230 /* the caller supplied one */
231 key_get(dest_keyring
);
233 /* use a default keyring; falling through the cases until we
234 * find one that we actually have */
235 switch (cred
->jit_keyring
) {
236 case KEY_REQKEY_DEFL_DEFAULT
:
237 case KEY_REQKEY_DEFL_REQUESTOR_KEYRING
:
238 if (cred
->request_key_auth
) {
239 authkey
= cred
->request_key_auth
;
240 down_read(&authkey
->sem
);
241 rka
= authkey
->payload
.data
;
242 if (!test_bit(KEY_FLAG_REVOKED
,
245 key_get(rka
->dest_keyring
);
246 up_read(&authkey
->sem
);
251 case KEY_REQKEY_DEFL_THREAD_KEYRING
:
252 dest_keyring
= key_get(cred
->thread_keyring
);
256 case KEY_REQKEY_DEFL_PROCESS_KEYRING
:
257 dest_keyring
= key_get(cred
->tgcred
->process_keyring
);
261 case KEY_REQKEY_DEFL_SESSION_KEYRING
:
263 dest_keyring
= key_get(
264 rcu_dereference(cred
->tgcred
->session_keyring
));
270 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING
:
272 key_get(cred
->user
->session_keyring
);
275 case KEY_REQKEY_DEFL_USER_KEYRING
:
276 dest_keyring
= key_get(cred
->user
->uid_keyring
);
279 case KEY_REQKEY_DEFL_GROUP_KEYRING
:
285 *_dest_keyring
= dest_keyring
;
286 kleave(" [dk %d]", key_serial(dest_keyring
));
291 * allocate a new key in under-construction state and attempt to link it in to
292 * the requested place
293 * - may return a key that's already under construction instead
295 static int construct_alloc_key(struct key_type
*type
,
296 const char *description
,
297 struct key
*dest_keyring
,
299 struct key_user
*user
,
302 const struct cred
*cred
= current_cred();
306 kenter("%s,%s,,,", type
->name
, description
);
308 mutex_lock(&user
->cons_lock
);
310 key
= key_alloc(type
, description
, cred
->fsuid
, cred
->fsgid
, cred
,
315 set_bit(KEY_FLAG_USER_CONSTRUCT
, &key
->flags
);
318 down_write(&dest_keyring
->sem
);
320 /* attach the key to the destination keyring under lock, but we do need
321 * to do another check just in case someone beat us to it whilst we
322 * waited for locks */
323 mutex_lock(&key_construction_mutex
);
325 key_ref
= search_process_keyrings(type
, description
, type
->match
, cred
);
326 if (!IS_ERR(key_ref
))
327 goto key_already_present
;
330 __key_link(dest_keyring
, key
);
332 mutex_unlock(&key_construction_mutex
);
334 up_write(&dest_keyring
->sem
);
335 mutex_unlock(&user
->cons_lock
);
337 kleave(" = 0 [%d]", key_serial(key
));
341 mutex_unlock(&key_construction_mutex
);
343 __key_link(dest_keyring
, key_ref_to_ptr(key_ref
));
344 up_write(&dest_keyring
->sem
);
346 mutex_unlock(&user
->cons_lock
);
348 *_key
= key
= key_ref_to_ptr(key_ref
);
349 kleave(" = -EINPROGRESS [%d]", key_serial(key
));
353 mutex_unlock(&user
->cons_lock
);
355 kleave(" = %ld", PTR_ERR(key
));
360 * commence key construction
362 static struct key
*construct_key_and_link(struct key_type
*type
,
363 const char *description
,
364 const char *callout_info
,
367 struct key
*dest_keyring
,
370 struct key_user
*user
;
376 user
= key_user_lookup(current_fsuid(), current_user_ns());
378 return ERR_PTR(-ENOMEM
);
380 construct_get_dest_keyring(&dest_keyring
);
382 ret
= construct_alloc_key(type
, description
, dest_keyring
, flags
, user
,
387 ret
= construct_key(key
, callout_info
, callout_len
, aux
,
390 kdebug("cons failed");
391 goto construction_failed
;
395 key_put(dest_keyring
);
396 kleave(" = key %d", key_serial(key
));
400 key_negate_and_link(key
, key_negative_timeout
, NULL
, NULL
);
402 key_put(dest_keyring
);
403 kleave(" = %d", ret
);
409 * - search the process's keyrings
410 * - check the list of keys being created or updated
411 * - call out to userspace for a key if supplementary info was provided
412 * - cache the key in an appropriate keyring
414 struct key
*request_key_and_link(struct key_type
*type
,
415 const char *description
,
416 const void *callout_info
,
419 struct key
*dest_keyring
,
422 const struct cred
*cred
= current_cred();
426 kenter("%s,%s,%p,%zu,%p,%p,%lx",
427 type
->name
, description
, callout_info
, callout_len
, aux
,
428 dest_keyring
, flags
);
430 /* search all the process keyrings for a key */
431 key_ref
= search_process_keyrings(type
, description
, type
->match
,
434 if (!IS_ERR(key_ref
)) {
435 key
= key_ref_to_ptr(key_ref
);
437 construct_get_dest_keyring(&dest_keyring
);
438 key_link(dest_keyring
, key
);
439 key_put(dest_keyring
);
441 } else if (PTR_ERR(key_ref
) != -EAGAIN
) {
442 key
= ERR_CAST(key_ref
);
444 /* the search failed, but the keyrings were searchable, so we
445 * should consult userspace if we can */
446 key
= ERR_PTR(-ENOKEY
);
450 key
= construct_key_and_link(type
, description
, callout_info
,
451 callout_len
, aux
, dest_keyring
,
456 kleave(" = %p", key
);
461 * wait for construction of a key to complete
463 int wait_for_key_construction(struct key
*key
, bool intr
)
467 ret
= wait_on_bit(&key
->flags
, KEY_FLAG_USER_CONSTRUCT
,
468 intr
? key_wait_bit_intr
: key_wait_bit
,
469 intr
? TASK_INTERRUPTIBLE
: TASK_UNINTERRUPTIBLE
);
472 return key_validate(key
);
474 EXPORT_SYMBOL(wait_for_key_construction
);
478 * - search the process's keyrings
479 * - check the list of keys being created or updated
480 * - call out to userspace for a key if supplementary info was provided
481 * - waits uninterruptible for creation to complete
483 struct key
*request_key(struct key_type
*type
,
484 const char *description
,
485 const char *callout_info
)
488 size_t callout_len
= 0;
492 callout_len
= strlen(callout_info
);
493 key
= request_key_and_link(type
, description
, callout_info
, callout_len
,
494 NULL
, NULL
, KEY_ALLOC_IN_QUOTA
);
496 ret
= wait_for_key_construction(key
, false);
504 EXPORT_SYMBOL(request_key
);
507 * request a key with auxiliary data for the upcaller
508 * - search the process's keyrings
509 * - check the list of keys being created or updated
510 * - call out to userspace for a key if supplementary info was provided
511 * - waits uninterruptible for creation to complete
513 struct key
*request_key_with_auxdata(struct key_type
*type
,
514 const char *description
,
515 const void *callout_info
,
522 key
= request_key_and_link(type
, description
, callout_info
, callout_len
,
523 aux
, NULL
, KEY_ALLOC_IN_QUOTA
);
525 ret
= wait_for_key_construction(key
, false);
533 EXPORT_SYMBOL(request_key_with_auxdata
);
536 * request a key (allow async construction)
537 * - search the process's keyrings
538 * - check the list of keys being created or updated
539 * - call out to userspace for a key if supplementary info was provided
541 struct key
*request_key_async(struct key_type
*type
,
542 const char *description
,
543 const void *callout_info
,
546 return request_key_and_link(type
, description
, callout_info
,
547 callout_len
, NULL
, NULL
,
550 EXPORT_SYMBOL(request_key_async
);
553 * request a key with auxiliary data for the upcaller (allow async construction)
554 * - search the process's keyrings
555 * - check the list of keys being created or updated
556 * - call out to userspace for a key if supplementary info was provided
558 struct key
*request_key_async_with_auxdata(struct key_type
*type
,
559 const char *description
,
560 const void *callout_info
,
564 return request_key_and_link(type
, description
, callout_info
,
565 callout_len
, aux
, NULL
, KEY_ALLOC_IN_QUOTA
);
567 EXPORT_SYMBOL(request_key_async_with_auxdata
);