1 /* Manage a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/sched/user.h>
16 #include <linux/keyctl.h>
18 #include <linux/err.h>
19 #include <linux/mutex.h>
20 #include <linux/security.h>
21 #include <linux/user_namespace.h>
22 #include <linux/uaccess.h>
25 /* Session keyring create vs join semaphore */
26 static DEFINE_MUTEX(key_session_mutex
);
28 /* User keyring creation semaphore */
29 static DEFINE_MUTEX(key_user_keyring_mutex
);
31 /* The root user's tracking struct */
32 struct key_user root_key_user
= {
33 .usage
= REFCOUNT_INIT(3),
34 .cons_lock
= __MUTEX_INITIALIZER(root_key_user
.cons_lock
),
35 .lock
= __SPIN_LOCK_UNLOCKED(root_key_user
.lock
),
36 .nkeys
= ATOMIC_INIT(2),
37 .nikeys
= ATOMIC_INIT(2),
38 .uid
= GLOBAL_ROOT_UID
,
42 * Install the user and user session keyrings for the current process's UID.
44 int install_user_keyrings(void)
46 struct user_struct
*user
;
47 const struct cred
*cred
;
48 struct key
*uid_keyring
, *session_keyring
;
49 key_perm_t user_keyring_perm
;
54 user_keyring_perm
= (KEY_POS_ALL
& ~KEY_POS_SETATTR
) | KEY_USR_ALL
;
55 cred
= current_cred();
57 uid
= from_kuid(cred
->user_ns
, user
->uid
);
59 kenter("%p{%u}", user
, uid
);
61 if (user
->uid_keyring
&& user
->session_keyring
) {
62 kleave(" = 0 [exist]");
66 mutex_lock(&key_user_keyring_mutex
);
69 if (!user
->uid_keyring
) {
70 /* get the UID-specific keyring
71 * - there may be one in existence already as it may have been
72 * pinned by a session, but the user_struct pointing to it
73 * may have been destroyed by setuid */
74 sprintf(buf
, "_uid.%u", uid
);
76 uid_keyring
= find_keyring_by_name(buf
, true);
77 if (IS_ERR(uid_keyring
)) {
78 uid_keyring
= keyring_alloc(buf
, user
->uid
, INVALID_GID
,
79 cred
, user_keyring_perm
,
82 if (IS_ERR(uid_keyring
)) {
83 ret
= PTR_ERR(uid_keyring
);
88 /* get a default session keyring (which might also exist
90 sprintf(buf
, "_uid_ses.%u", uid
);
92 session_keyring
= find_keyring_by_name(buf
, true);
93 if (IS_ERR(session_keyring
)) {
95 keyring_alloc(buf
, user
->uid
, INVALID_GID
,
96 cred
, user_keyring_perm
,
99 if (IS_ERR(session_keyring
)) {
100 ret
= PTR_ERR(session_keyring
);
104 /* we install a link from the user session keyring to
105 * the user keyring */
106 ret
= key_link(session_keyring
, uid_keyring
);
108 goto error_release_both
;
111 /* install the keyrings */
112 user
->uid_keyring
= uid_keyring
;
113 user
->session_keyring
= session_keyring
;
116 mutex_unlock(&key_user_keyring_mutex
);
121 key_put(session_keyring
);
123 key_put(uid_keyring
);
125 mutex_unlock(&key_user_keyring_mutex
);
126 kleave(" = %d", ret
);
131 * Install a thread keyring to the given credentials struct if it didn't have
132 * one already. This is allowed to overrun the quota.
134 * Return: 0 if a thread keyring is now present; -errno on failure.
136 int install_thread_keyring_to_cred(struct cred
*new)
140 if (new->thread_keyring
)
143 keyring
= keyring_alloc("_tid", new->uid
, new->gid
, new,
144 KEY_POS_ALL
| KEY_USR_VIEW
,
145 KEY_ALLOC_QUOTA_OVERRUN
,
148 return PTR_ERR(keyring
);
150 new->thread_keyring
= keyring
;
155 * Install a thread keyring to the current task if it didn't have one already.
157 * Return: 0 if a thread keyring is now present; -errno on failure.
159 static int install_thread_keyring(void)
164 new = prepare_creds();
168 ret
= install_thread_keyring_to_cred(new);
174 return commit_creds(new);
178 * Install a process keyring to the given credentials struct if it didn't have
179 * one already. This is allowed to overrun the quota.
181 * Return: 0 if a process keyring is now present; -errno on failure.
183 int install_process_keyring_to_cred(struct cred
*new)
187 if (new->process_keyring
)
190 keyring
= keyring_alloc("_pid", new->uid
, new->gid
, new,
191 KEY_POS_ALL
| KEY_USR_VIEW
,
192 KEY_ALLOC_QUOTA_OVERRUN
,
195 return PTR_ERR(keyring
);
197 new->process_keyring
= keyring
;
202 * Install a process keyring to the current task if it didn't have one already.
204 * Return: 0 if a process keyring is now present; -errno on failure.
206 static int install_process_keyring(void)
211 new = prepare_creds();
215 ret
= install_process_keyring_to_cred(new);
221 return commit_creds(new);
225 * Install the given keyring as the session keyring of the given credentials
226 * struct, replacing the existing one if any. If the given keyring is NULL,
227 * then install a new anonymous session keyring.
229 * Return: 0 on success; -errno on failure.
231 int install_session_keyring_to_cred(struct cred
*cred
, struct key
*keyring
)
238 /* create an empty session keyring */
240 flags
= KEY_ALLOC_QUOTA_OVERRUN
;
241 if (cred
->session_keyring
)
242 flags
= KEY_ALLOC_IN_QUOTA
;
244 keyring
= keyring_alloc("_ses", cred
->uid
, cred
->gid
, cred
,
245 KEY_POS_ALL
| KEY_USR_VIEW
| KEY_USR_READ
,
248 return PTR_ERR(keyring
);
253 /* install the keyring */
254 old
= cred
->session_keyring
;
255 rcu_assign_pointer(cred
->session_keyring
, keyring
);
264 * Install the given keyring as the session keyring of the current task,
265 * replacing the existing one if any. If the given keyring is NULL, then
266 * install a new anonymous session keyring.
268 * Return: 0 on success; -errno on failure.
270 static int install_session_keyring(struct key
*keyring
)
275 new = prepare_creds();
279 ret
= install_session_keyring_to_cred(new, keyring
);
285 return commit_creds(new);
289 * Handle the fsuid changing.
291 void key_fsuid_changed(struct task_struct
*tsk
)
293 /* update the ownership of the thread keyring */
295 if (tsk
->cred
->thread_keyring
) {
296 down_write(&tsk
->cred
->thread_keyring
->sem
);
297 tsk
->cred
->thread_keyring
->uid
= tsk
->cred
->fsuid
;
298 up_write(&tsk
->cred
->thread_keyring
->sem
);
303 * Handle the fsgid changing.
305 void key_fsgid_changed(struct task_struct
*tsk
)
307 /* update the ownership of the thread keyring */
309 if (tsk
->cred
->thread_keyring
) {
310 down_write(&tsk
->cred
->thread_keyring
->sem
);
311 tsk
->cred
->thread_keyring
->gid
= tsk
->cred
->fsgid
;
312 up_write(&tsk
->cred
->thread_keyring
->sem
);
317 * Search the process keyrings attached to the supplied cred for the first
320 * The search criteria are the type and the match function. The description is
321 * given to the match function as a parameter, but doesn't otherwise influence
322 * the search. Typically the match function will compare the description
323 * parameter to the key's description.
325 * This can only search keyrings that grant Search permission to the supplied
326 * credentials. Keyrings linked to searched keyrings will also be searched if
327 * they grant Search permission too. Keys can only be found if they grant
328 * Search permission to the credentials.
330 * Returns a pointer to the key with the key usage count incremented if
331 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
332 * matched negative keys.
334 * In the case of a successful return, the possession attribute is set on the
335 * returned key reference.
337 key_ref_t
search_my_process_keyrings(struct keyring_search_context
*ctx
)
339 key_ref_t key_ref
, ret
, err
;
341 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
342 * searchable, but we failed to find a key or we found a negative key;
343 * otherwise we want to return a sample error (probably -EACCES) if
344 * none of the keyrings were searchable
346 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
350 err
= ERR_PTR(-EAGAIN
);
352 /* search the thread keyring first */
353 if (ctx
->cred
->thread_keyring
) {
354 key_ref
= keyring_search_aux(
355 make_key_ref(ctx
->cred
->thread_keyring
, 1), ctx
);
356 if (!IS_ERR(key_ref
))
359 switch (PTR_ERR(key_ref
)) {
360 case -EAGAIN
: /* no key */
361 case -ENOKEY
: /* negative key */
370 /* search the process keyring second */
371 if (ctx
->cred
->process_keyring
) {
372 key_ref
= keyring_search_aux(
373 make_key_ref(ctx
->cred
->process_keyring
, 1), ctx
);
374 if (!IS_ERR(key_ref
))
377 switch (PTR_ERR(key_ref
)) {
378 case -EAGAIN
: /* no key */
381 case -ENOKEY
: /* negative key */
390 /* search the session keyring */
391 if (ctx
->cred
->session_keyring
) {
393 key_ref
= keyring_search_aux(
394 make_key_ref(rcu_dereference(ctx
->cred
->session_keyring
), 1),
398 if (!IS_ERR(key_ref
))
401 switch (PTR_ERR(key_ref
)) {
402 case -EAGAIN
: /* no key */
405 case -ENOKEY
: /* negative key */
413 /* or search the user-session keyring */
414 else if (ctx
->cred
->user
->session_keyring
) {
415 key_ref
= keyring_search_aux(
416 make_key_ref(ctx
->cred
->user
->session_keyring
, 1),
418 if (!IS_ERR(key_ref
))
421 switch (PTR_ERR(key_ref
)) {
422 case -EAGAIN
: /* no key */
425 case -ENOKEY
: /* negative key */
434 /* no key - decide on the error we're going to go for */
435 key_ref
= ret
? ret
: err
;
442 * Search the process keyrings attached to the supplied cred for the first
443 * matching key in the manner of search_my_process_keyrings(), but also search
444 * the keys attached to the assumed authorisation key using its credentials if
447 * Return same as search_my_process_keyrings().
449 key_ref_t
search_process_keyrings(struct keyring_search_context
*ctx
)
451 struct request_key_auth
*rka
;
452 key_ref_t key_ref
, ret
= ERR_PTR(-EACCES
), err
;
456 key_ref
= search_my_process_keyrings(ctx
);
457 if (!IS_ERR(key_ref
))
461 /* if this process has an instantiation authorisation key, then we also
462 * search the keyrings of the process mentioned there
463 * - we don't permit access to request_key auth keys via this method
465 if (ctx
->cred
->request_key_auth
&&
466 ctx
->cred
== current_cred() &&
467 ctx
->index_key
.type
!= &key_type_request_key_auth
469 const struct cred
*cred
= ctx
->cred
;
471 /* defend against the auth key being revoked */
472 down_read(&cred
->request_key_auth
->sem
);
474 if (key_validate(ctx
->cred
->request_key_auth
) == 0) {
475 rka
= ctx
->cred
->request_key_auth
->payload
.data
[0];
477 ctx
->cred
= rka
->cred
;
478 key_ref
= search_process_keyrings(ctx
);
481 up_read(&cred
->request_key_auth
->sem
);
483 if (!IS_ERR(key_ref
))
488 up_read(&cred
->request_key_auth
->sem
);
492 /* no key - decide on the error we're going to go for */
493 if (err
== ERR_PTR(-ENOKEY
) || ret
== ERR_PTR(-ENOKEY
))
494 key_ref
= ERR_PTR(-ENOKEY
);
495 else if (err
== ERR_PTR(-EACCES
))
505 * See if the key we're looking at is the target key.
507 bool lookup_user_key_possessed(const struct key
*key
,
508 const struct key_match_data
*match_data
)
510 return key
== match_data
->raw_data
;
514 * Look up a key ID given us by userspace with a given permissions mask to get
515 * the key it refers to.
517 * Flags can be passed to request that special keyrings be created if referred
518 * to directly, to permit partially constructed keys to be found and to skip
519 * validity and permission checks on the found key.
521 * Returns a pointer to the key with an incremented usage count if successful;
522 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
523 * to a key or the best found key was a negative key; -EKEYREVOKED or
524 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
525 * found key doesn't grant the requested permit or the LSM denied access to it;
526 * or -ENOMEM if a special keyring couldn't be created.
528 * In the case of a successful return, the possession attribute is set on the
529 * returned key reference.
531 key_ref_t
lookup_user_key(key_serial_t id
, unsigned long lflags
,
534 struct keyring_search_context ctx
= {
535 .match_data
.cmp
= lookup_user_key_possessed
,
536 .match_data
.lookup_type
= KEYRING_SEARCH_LOOKUP_DIRECT
,
537 .flags
= KEYRING_SEARCH_NO_STATE_CHECK
,
539 struct request_key_auth
*rka
;
541 key_ref_t key_ref
, skey_ref
;
545 ctx
.cred
= get_current_cred();
546 key_ref
= ERR_PTR(-ENOKEY
);
549 case KEY_SPEC_THREAD_KEYRING
:
550 if (!ctx
.cred
->thread_keyring
) {
551 if (!(lflags
& KEY_LOOKUP_CREATE
))
554 ret
= install_thread_keyring();
556 key_ref
= ERR_PTR(ret
);
562 key
= ctx
.cred
->thread_keyring
;
564 key_ref
= make_key_ref(key
, 1);
567 case KEY_SPEC_PROCESS_KEYRING
:
568 if (!ctx
.cred
->process_keyring
) {
569 if (!(lflags
& KEY_LOOKUP_CREATE
))
572 ret
= install_process_keyring();
574 key_ref
= ERR_PTR(ret
);
580 key
= ctx
.cred
->process_keyring
;
582 key_ref
= make_key_ref(key
, 1);
585 case KEY_SPEC_SESSION_KEYRING
:
586 if (!ctx
.cred
->session_keyring
) {
587 /* always install a session keyring upon access if one
588 * doesn't exist yet */
589 ret
= install_user_keyrings();
592 if (lflags
& KEY_LOOKUP_CREATE
)
593 ret
= join_session_keyring(NULL
);
595 ret
= install_session_keyring(
596 ctx
.cred
->user
->session_keyring
);
601 } else if (ctx
.cred
->session_keyring
==
602 ctx
.cred
->user
->session_keyring
&&
603 lflags
& KEY_LOOKUP_CREATE
) {
604 ret
= join_session_keyring(NULL
);
611 key
= rcu_dereference(ctx
.cred
->session_keyring
);
614 key_ref
= make_key_ref(key
, 1);
617 case KEY_SPEC_USER_KEYRING
:
618 if (!ctx
.cred
->user
->uid_keyring
) {
619 ret
= install_user_keyrings();
624 key
= ctx
.cred
->user
->uid_keyring
;
626 key_ref
= make_key_ref(key
, 1);
629 case KEY_SPEC_USER_SESSION_KEYRING
:
630 if (!ctx
.cred
->user
->session_keyring
) {
631 ret
= install_user_keyrings();
636 key
= ctx
.cred
->user
->session_keyring
;
638 key_ref
= make_key_ref(key
, 1);
641 case KEY_SPEC_GROUP_KEYRING
:
642 /* group keyrings are not yet supported */
643 key_ref
= ERR_PTR(-EINVAL
);
646 case KEY_SPEC_REQKEY_AUTH_KEY
:
647 key
= ctx
.cred
->request_key_auth
;
652 key_ref
= make_key_ref(key
, 1);
655 case KEY_SPEC_REQUESTOR_KEYRING
:
656 if (!ctx
.cred
->request_key_auth
)
659 down_read(&ctx
.cred
->request_key_auth
->sem
);
660 if (test_bit(KEY_FLAG_REVOKED
,
661 &ctx
.cred
->request_key_auth
->flags
)) {
662 key_ref
= ERR_PTR(-EKEYREVOKED
);
665 rka
= ctx
.cred
->request_key_auth
->payload
.data
[0];
666 key
= rka
->dest_keyring
;
669 up_read(&ctx
.cred
->request_key_auth
->sem
);
672 key_ref
= make_key_ref(key
, 1);
676 key_ref
= ERR_PTR(-EINVAL
);
680 key
= key_lookup(id
);
682 key_ref
= ERR_CAST(key
);
686 key_ref
= make_key_ref(key
, 0);
688 /* check to see if we possess the key */
689 ctx
.index_key
.type
= key
->type
;
690 ctx
.index_key
.description
= key
->description
;
691 ctx
.index_key
.desc_len
= strlen(key
->description
);
692 ctx
.match_data
.raw_data
= key
;
693 kdebug("check possessed");
694 skey_ref
= search_process_keyrings(&ctx
);
695 kdebug("possessed=%p", skey_ref
);
697 if (!IS_ERR(skey_ref
)) {
705 /* unlink does not use the nominated key in any way, so can skip all
706 * the permission checks as it is only concerned with the keyring */
707 if (lflags
& KEY_LOOKUP_FOR_UNLINK
) {
712 if (!(lflags
& KEY_LOOKUP_PARTIAL
)) {
713 ret
= wait_for_key_construction(key
, true);
724 ret
= key_validate(key
);
730 if (!(lflags
& KEY_LOOKUP_PARTIAL
) &&
731 !test_bit(KEY_FLAG_INSTANTIATED
, &key
->flags
))
734 /* check the permissions */
735 ret
= key_task_permission(key_ref
, ctx
.cred
, perm
);
739 key
->last_used_at
= current_kernel_time().tv_sec
;
746 key_ref_put(key_ref
);
747 key_ref
= ERR_PTR(ret
);
750 /* if we attempted to install a keyring, then it may have caused new
751 * creds to be installed */
758 * Join the named keyring as the session keyring if possible else attempt to
759 * create a new one of that name and join that.
761 * If the name is NULL, an empty anonymous keyring will be installed as the
764 * Named session keyrings are joined with a semaphore held to prevent the
765 * keyrings from going away whilst the attempt is made to going them and also
766 * to prevent a race in creating compatible session keyrings.
768 long join_session_keyring(const char *name
)
770 const struct cred
*old
;
775 new = prepare_creds();
778 old
= current_cred();
780 /* if no name is provided, install an anonymous keyring */
782 ret
= install_session_keyring_to_cred(new, NULL
);
786 serial
= new->session_keyring
->serial
;
787 ret
= commit_creds(new);
793 /* allow the user to join or create a named keyring */
794 mutex_lock(&key_session_mutex
);
796 /* look for an existing keyring of this name */
797 keyring
= find_keyring_by_name(name
, false);
798 if (PTR_ERR(keyring
) == -ENOKEY
) {
799 /* not found - try and create a new one */
800 keyring
= keyring_alloc(
801 name
, old
->uid
, old
->gid
, old
,
802 KEY_POS_ALL
| KEY_USR_VIEW
| KEY_USR_READ
| KEY_USR_LINK
,
803 KEY_ALLOC_IN_QUOTA
, NULL
, NULL
);
804 if (IS_ERR(keyring
)) {
805 ret
= PTR_ERR(keyring
);
808 } else if (IS_ERR(keyring
)) {
809 ret
= PTR_ERR(keyring
);
811 } else if (keyring
== new->session_keyring
) {
817 /* we've got a keyring - now to install it */
818 ret
= install_session_keyring_to_cred(new, keyring
);
823 mutex_unlock(&key_session_mutex
);
825 ret
= keyring
->serial
;
831 mutex_unlock(&key_session_mutex
);
838 * Replace a process's session keyring on behalf of one of its children when
839 * the target process is about to resume userspace execution.
841 void key_change_session_keyring(struct callback_head
*twork
)
843 const struct cred
*old
= current_cred();
844 struct cred
*new = container_of(twork
, struct cred
, rcu
);
846 if (unlikely(current
->flags
& PF_EXITING
)) {
851 new-> uid
= old
-> uid
;
852 new-> euid
= old
-> euid
;
853 new-> suid
= old
-> suid
;
854 new->fsuid
= old
->fsuid
;
855 new-> gid
= old
-> gid
;
856 new-> egid
= old
-> egid
;
857 new-> sgid
= old
-> sgid
;
858 new->fsgid
= old
->fsgid
;
859 new->user
= get_uid(old
->user
);
860 new->user_ns
= get_user_ns(old
->user_ns
);
861 new->group_info
= get_group_info(old
->group_info
);
863 new->securebits
= old
->securebits
;
864 new->cap_inheritable
= old
->cap_inheritable
;
865 new->cap_permitted
= old
->cap_permitted
;
866 new->cap_effective
= old
->cap_effective
;
867 new->cap_ambient
= old
->cap_ambient
;
868 new->cap_bset
= old
->cap_bset
;
870 new->jit_keyring
= old
->jit_keyring
;
871 new->thread_keyring
= key_get(old
->thread_keyring
);
872 new->process_keyring
= key_get(old
->process_keyring
);
874 security_transfer_creds(new, old
);
880 * Make sure that root's user and user-session keyrings exist.
882 static int __init
init_root_keyring(void)
884 return install_user_keyrings();
887 late_initcall(init_root_keyring
);