1 /* Management of a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/slab.h>
16 #include <linux/keyctl.h>
18 #include <linux/err.h>
19 #include <linux/mutex.h>
20 #include <asm/uaccess.h>
23 /* session keyring create vs join semaphore */
24 static DEFINE_MUTEX(key_session_mutex
);
26 /* user keyring creation semaphore */
27 static DEFINE_MUTEX(key_user_keyring_mutex
);
29 /* the root user's tracking struct */
30 struct key_user root_key_user
= {
31 .usage
= ATOMIC_INIT(3),
32 .cons_lock
= __MUTEX_INITIALIZER(root_key_user
.cons_lock
),
33 .lock
= __SPIN_LOCK_UNLOCKED(root_key_user
.lock
),
34 .nkeys
= ATOMIC_INIT(2),
35 .nikeys
= ATOMIC_INIT(2),
39 /*****************************************************************************/
41 * install user and user session keyrings for a particular UID
43 int install_user_keyrings(void)
45 struct user_struct
*user
;
46 const struct cred
*cred
;
47 struct key
*uid_keyring
, *session_keyring
;
51 cred
= current_cred();
54 kenter("%p{%u}", user
, user
->uid
);
56 if (user
->uid_keyring
) {
57 kleave(" = 0 [exist]");
61 mutex_lock(&key_user_keyring_mutex
);
64 if (!user
->uid_keyring
) {
65 /* get the UID-specific keyring
66 * - there may be one in existence already as it may have been
67 * pinned by a session, but the user_struct pointing to it
68 * may have been destroyed by setuid */
69 sprintf(buf
, "_uid.%u", user
->uid
);
71 uid_keyring
= find_keyring_by_name(buf
, true);
72 if (IS_ERR(uid_keyring
)) {
73 uid_keyring
= keyring_alloc(buf
, user
->uid
, (gid_t
) -1,
74 cred
, KEY_ALLOC_IN_QUOTA
,
76 if (IS_ERR(uid_keyring
)) {
77 ret
= PTR_ERR(uid_keyring
);
82 /* get a default session keyring (which might also exist
84 sprintf(buf
, "_uid_ses.%u", user
->uid
);
86 session_keyring
= find_keyring_by_name(buf
, true);
87 if (IS_ERR(session_keyring
)) {
89 keyring_alloc(buf
, user
->uid
, (gid_t
) -1,
90 cred
, KEY_ALLOC_IN_QUOTA
, NULL
);
91 if (IS_ERR(session_keyring
)) {
92 ret
= PTR_ERR(session_keyring
);
96 /* we install a link from the user session keyring to
98 ret
= key_link(session_keyring
, uid_keyring
);
100 goto error_release_both
;
103 /* install the keyrings */
104 user
->uid_keyring
= uid_keyring
;
105 user
->session_keyring
= session_keyring
;
108 mutex_unlock(&key_user_keyring_mutex
);
113 key_put(session_keyring
);
115 key_put(uid_keyring
);
117 mutex_unlock(&key_user_keyring_mutex
);
118 kleave(" = %d", ret
);
123 * install a fresh thread keyring directly to new credentials
125 int install_thread_keyring_to_cred(struct cred
*new)
129 keyring
= keyring_alloc("_tid", new->uid
, new->gid
, new,
130 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
132 return PTR_ERR(keyring
);
134 new->thread_keyring
= keyring
;
139 * install a fresh thread keyring, discarding the old one
141 static int install_thread_keyring(void)
146 new = prepare_creds();
150 BUG_ON(new->thread_keyring
);
152 ret
= install_thread_keyring_to_cred(new);
158 return commit_creds(new);
162 * install a process keyring directly to a credentials struct
163 * - returns -EEXIST if there was already a process keyring, 0 if one installed,
164 * and other -ve on any other error
166 int install_process_keyring_to_cred(struct cred
*new)
171 if (new->tgcred
->process_keyring
)
174 keyring
= keyring_alloc("_pid", new->uid
, new->gid
,
175 new, KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
177 return PTR_ERR(keyring
);
179 spin_lock_irq(&new->tgcred
->lock
);
180 if (!new->tgcred
->process_keyring
) {
181 new->tgcred
->process_keyring
= keyring
;
187 spin_unlock_irq(&new->tgcred
->lock
);
193 * make sure a process keyring is installed
196 static int install_process_keyring(void)
201 new = prepare_creds();
205 ret
= install_process_keyring_to_cred(new);
208 return ret
!= -EEXIST
?: 0;
211 return commit_creds(new);
215 * install a session keyring directly to a credentials struct
217 static int install_session_keyring_to_cred(struct cred
*cred
,
225 /* create an empty session keyring */
227 flags
= KEY_ALLOC_QUOTA_OVERRUN
;
228 if (cred
->tgcred
->session_keyring
)
229 flags
= KEY_ALLOC_IN_QUOTA
;
231 keyring
= keyring_alloc("_ses", cred
->uid
, cred
->gid
,
234 return PTR_ERR(keyring
);
236 atomic_inc(&keyring
->usage
);
239 /* install the keyring */
240 spin_lock_irq(&cred
->tgcred
->lock
);
241 old
= cred
->tgcred
->session_keyring
;
242 rcu_assign_pointer(cred
->tgcred
->session_keyring
, keyring
);
243 spin_unlock_irq(&cred
->tgcred
->lock
);
245 /* we're using RCU on the pointer, but there's no point synchronising
246 * on it if it didn't previously point to anything */
256 * install a session keyring, discarding the old one
257 * - if a keyring is not supplied, an empty one is invented
259 static int install_session_keyring(struct key
*keyring
)
264 new = prepare_creds();
268 ret
= install_session_keyring_to_cred(new, NULL
);
274 return commit_creds(new);
277 /*****************************************************************************/
279 * the filesystem user ID changed
281 void key_fsuid_changed(struct task_struct
*tsk
)
283 /* update the ownership of the thread keyring */
285 if (tsk
->cred
->thread_keyring
) {
286 down_write(&tsk
->cred
->thread_keyring
->sem
);
287 tsk
->cred
->thread_keyring
->uid
= tsk
->cred
->fsuid
;
288 up_write(&tsk
->cred
->thread_keyring
->sem
);
291 } /* end key_fsuid_changed() */
293 /*****************************************************************************/
295 * the filesystem group ID changed
297 void key_fsgid_changed(struct task_struct
*tsk
)
299 /* update the ownership of the thread keyring */
301 if (tsk
->cred
->thread_keyring
) {
302 down_write(&tsk
->cred
->thread_keyring
->sem
);
303 tsk
->cred
->thread_keyring
->gid
= tsk
->cred
->fsgid
;
304 up_write(&tsk
->cred
->thread_keyring
->sem
);
307 } /* end key_fsgid_changed() */
309 /*****************************************************************************/
311 * search the process keyrings for the first matching key
312 * - we use the supplied match function to see if the description (or other
313 * feature of interest) matches
314 * - we return -EAGAIN if we didn't find any matching key
315 * - we return -ENOKEY if we found only negative matching keys
317 key_ref_t
search_process_keyrings(struct key_type
*type
,
318 const void *description
,
319 key_match_func_t match
,
320 const struct cred
*cred
)
322 struct request_key_auth
*rka
;
323 key_ref_t key_ref
, ret
, err
;
327 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
328 * searchable, but we failed to find a key or we found a negative key;
329 * otherwise we want to return a sample error (probably -EACCES) if
330 * none of the keyrings were searchable
332 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
336 err
= ERR_PTR(-EAGAIN
);
338 /* search the thread keyring first */
339 if (cred
->thread_keyring
) {
340 key_ref
= keyring_search_aux(
341 make_key_ref(cred
->thread_keyring
, 1),
342 cred
, type
, description
, match
);
343 if (!IS_ERR(key_ref
))
346 switch (PTR_ERR(key_ref
)) {
347 case -EAGAIN
: /* no key */
350 case -ENOKEY
: /* negative key */
359 /* search the process keyring second */
360 if (cred
->tgcred
->process_keyring
) {
361 key_ref
= keyring_search_aux(
362 make_key_ref(cred
->tgcred
->process_keyring
, 1),
363 cred
, type
, description
, match
);
364 if (!IS_ERR(key_ref
))
367 switch (PTR_ERR(key_ref
)) {
368 case -EAGAIN
: /* no key */
371 case -ENOKEY
: /* negative key */
380 /* search the session keyring */
381 if (cred
->tgcred
->session_keyring
) {
383 key_ref
= keyring_search_aux(
384 make_key_ref(rcu_dereference(
385 cred
->tgcred
->session_keyring
),
387 cred
, type
, description
, match
);
390 if (!IS_ERR(key_ref
))
393 switch (PTR_ERR(key_ref
)) {
394 case -EAGAIN
: /* no key */
397 case -ENOKEY
: /* negative key */
405 /* or search the user-session keyring */
406 else if (cred
->user
->session_keyring
) {
407 key_ref
= keyring_search_aux(
408 make_key_ref(cred
->user
->session_keyring
, 1),
409 cred
, type
, description
, match
);
410 if (!IS_ERR(key_ref
))
413 switch (PTR_ERR(key_ref
)) {
414 case -EAGAIN
: /* no key */
417 case -ENOKEY
: /* negative key */
426 /* if this process has an instantiation authorisation key, then we also
427 * search the keyrings of the process mentioned there
428 * - we don't permit access to request_key auth keys via this method
430 if (cred
->request_key_auth
&&
431 cred
== current_cred() &&
432 type
!= &key_type_request_key_auth
434 /* defend against the auth key being revoked */
435 down_read(&cred
->request_key_auth
->sem
);
437 if (key_validate(cred
->request_key_auth
) == 0) {
438 rka
= cred
->request_key_auth
->payload
.data
;
440 key_ref
= search_process_keyrings(type
, description
,
443 up_read(&cred
->request_key_auth
->sem
);
445 if (!IS_ERR(key_ref
))
448 switch (PTR_ERR(key_ref
)) {
449 case -EAGAIN
: /* no key */
452 case -ENOKEY
: /* negative key */
460 up_read(&cred
->request_key_auth
->sem
);
464 /* no key - decide on the error we're going to go for */
465 key_ref
= ret
? ret
: err
;
470 } /* end search_process_keyrings() */
472 /*****************************************************************************/
474 * see if the key we're looking at is the target key
476 static int lookup_user_key_possessed(const struct key
*key
, const void *target
)
478 return key
== target
;
480 } /* end lookup_user_key_possessed() */
482 /*****************************************************************************/
484 * lookup a key given a key ID from userspace with a given permissions mask
485 * - don't create special keyrings unless so requested
486 * - partially constructed keys aren't found unless requested
488 key_ref_t
lookup_user_key(key_serial_t id
, int create
, int partial
,
491 struct request_key_auth
*rka
;
492 const struct cred
*cred
;
494 key_ref_t key_ref
, skey_ref
;
498 cred
= get_current_cred();
499 key_ref
= ERR_PTR(-ENOKEY
);
502 case KEY_SPEC_THREAD_KEYRING
:
503 if (!cred
->thread_keyring
) {
507 ret
= install_thread_keyring();
515 key
= cred
->thread_keyring
;
516 atomic_inc(&key
->usage
);
517 key_ref
= make_key_ref(key
, 1);
520 case KEY_SPEC_PROCESS_KEYRING
:
521 if (!cred
->tgcred
->process_keyring
) {
525 ret
= install_process_keyring();
533 key
= cred
->tgcred
->process_keyring
;
534 atomic_inc(&key
->usage
);
535 key_ref
= make_key_ref(key
, 1);
538 case KEY_SPEC_SESSION_KEYRING
:
539 if (!cred
->tgcred
->session_keyring
) {
540 /* always install a session keyring upon access if one
541 * doesn't exist yet */
542 ret
= install_user_keyrings();
545 ret
= install_session_keyring(
546 cred
->user
->session_keyring
);
554 key
= rcu_dereference(cred
->tgcred
->session_keyring
);
555 atomic_inc(&key
->usage
);
557 key_ref
= make_key_ref(key
, 1);
560 case KEY_SPEC_USER_KEYRING
:
561 if (!cred
->user
->uid_keyring
) {
562 ret
= install_user_keyrings();
567 key
= cred
->user
->uid_keyring
;
568 atomic_inc(&key
->usage
);
569 key_ref
= make_key_ref(key
, 1);
572 case KEY_SPEC_USER_SESSION_KEYRING
:
573 if (!cred
->user
->session_keyring
) {
574 ret
= install_user_keyrings();
579 key
= cred
->user
->session_keyring
;
580 atomic_inc(&key
->usage
);
581 key_ref
= make_key_ref(key
, 1);
584 case KEY_SPEC_GROUP_KEYRING
:
585 /* group keyrings are not yet supported */
586 key
= ERR_PTR(-EINVAL
);
589 case KEY_SPEC_REQKEY_AUTH_KEY
:
590 key
= cred
->request_key_auth
;
594 atomic_inc(&key
->usage
);
595 key_ref
= make_key_ref(key
, 1);
598 case KEY_SPEC_REQUESTOR_KEYRING
:
599 if (!cred
->request_key_auth
)
602 down_read(&cred
->request_key_auth
->sem
);
603 if (cred
->request_key_auth
->flags
& KEY_FLAG_REVOKED
) {
604 key_ref
= ERR_PTR(-EKEYREVOKED
);
607 rka
= cred
->request_key_auth
->payload
.data
;
608 key
= rka
->dest_keyring
;
609 atomic_inc(&key
->usage
);
611 up_read(&cred
->request_key_auth
->sem
);
614 key_ref
= make_key_ref(key
, 1);
618 key_ref
= ERR_PTR(-EINVAL
);
622 key
= key_lookup(id
);
624 key_ref
= ERR_CAST(key
);
628 key_ref
= make_key_ref(key
, 0);
630 /* check to see if we possess the key */
631 skey_ref
= search_process_keyrings(key
->type
, key
,
632 lookup_user_key_possessed
,
635 if (!IS_ERR(skey_ref
)) {
644 ret
= wait_for_key_construction(key
, true);
655 ret
= key_validate(key
);
661 if (!partial
&& !test_bit(KEY_FLAG_INSTANTIATED
, &key
->flags
))
664 /* check the permissions */
665 ret
= key_task_permission(key_ref
, cred
, perm
);
674 key_ref_put(key_ref
);
675 key_ref
= ERR_PTR(ret
);
678 /* if we attempted to install a keyring, then it may have caused new
679 * creds to be installed */
684 } /* end lookup_user_key() */
686 /*****************************************************************************/
688 * join the named keyring as the session keyring if possible, or attempt to
689 * create a new one of that name if not
690 * - if the name is NULL, an empty anonymous keyring is installed instead
691 * - named session keyring joining is done with a semaphore held
693 long join_session_keyring(const char *name
)
695 const struct cred
*old
;
700 /* only permit this if there's a single thread in the thread group -
701 * this avoids us having to adjust the creds on all threads and risking
703 if (!is_single_threaded(current
))
706 new = prepare_creds();
709 old
= current_cred();
711 /* if no name is provided, install an anonymous keyring */
713 ret
= install_session_keyring_to_cred(new, NULL
);
717 serial
= new->tgcred
->session_keyring
->serial
;
718 ret
= commit_creds(new);
724 /* allow the user to join or create a named keyring */
725 mutex_lock(&key_session_mutex
);
727 /* look for an existing keyring of this name */
728 keyring
= find_keyring_by_name(name
, false);
729 if (PTR_ERR(keyring
) == -ENOKEY
) {
730 /* not found - try and create a new one */
731 keyring
= keyring_alloc(name
, old
->uid
, old
->gid
, old
,
732 KEY_ALLOC_IN_QUOTA
, NULL
);
733 if (IS_ERR(keyring
)) {
734 ret
= PTR_ERR(keyring
);
737 } else if (IS_ERR(keyring
)) {
738 ret
= PTR_ERR(keyring
);
742 /* we've got a keyring - now to install it */
743 ret
= install_session_keyring_to_cred(new, keyring
);
748 mutex_unlock(&key_session_mutex
);
750 ret
= keyring
->serial
;
756 mutex_unlock(&key_session_mutex
);