1 /* Manage a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/keyctl.h>
17 #include <linux/err.h>
18 #include <linux/mutex.h>
19 #include <linux/security.h>
20 #include <linux/user_namespace.h>
21 #include <asm/uaccess.h>
24 /* Session keyring create vs join semaphore */
25 static DEFINE_MUTEX(key_session_mutex
);
27 /* User keyring creation semaphore */
28 static DEFINE_MUTEX(key_user_keyring_mutex
);
30 /* The root user's tracking struct */
31 struct key_user root_key_user
= {
32 .usage
= ATOMIC_INIT(3),
33 .cons_lock
= __MUTEX_INITIALIZER(root_key_user
.cons_lock
),
34 .lock
= __SPIN_LOCK_UNLOCKED(root_key_user
.lock
),
35 .nkeys
= ATOMIC_INIT(2),
36 .nikeys
= ATOMIC_INIT(2),
38 .user_ns
= &init_user_ns
,
42 * Install the user and user session keyrings for the current process's UID.
44 int install_user_keyrings(void)
46 struct user_struct
*user
;
47 const struct cred
*cred
;
48 struct key
*uid_keyring
, *session_keyring
;
52 cred
= current_cred();
55 kenter("%p{%u}", user
, user
->uid
);
57 if (user
->uid_keyring
) {
58 kleave(" = 0 [exist]");
62 mutex_lock(&key_user_keyring_mutex
);
65 if (!user
->uid_keyring
) {
66 /* get the UID-specific keyring
67 * - there may be one in existence already as it may have been
68 * pinned by a session, but the user_struct pointing to it
69 * may have been destroyed by setuid */
70 sprintf(buf
, "_uid.%u", user
->uid
);
72 uid_keyring
= find_keyring_by_name(buf
, true);
73 if (IS_ERR(uid_keyring
)) {
74 uid_keyring
= keyring_alloc(buf
, user
->uid
, (gid_t
) -1,
75 cred
, KEY_ALLOC_IN_QUOTA
,
77 if (IS_ERR(uid_keyring
)) {
78 ret
= PTR_ERR(uid_keyring
);
83 /* get a default session keyring (which might also exist
85 sprintf(buf
, "_uid_ses.%u", user
->uid
);
87 session_keyring
= find_keyring_by_name(buf
, true);
88 if (IS_ERR(session_keyring
)) {
90 keyring_alloc(buf
, user
->uid
, (gid_t
) -1,
91 cred
, KEY_ALLOC_IN_QUOTA
, NULL
);
92 if (IS_ERR(session_keyring
)) {
93 ret
= PTR_ERR(session_keyring
);
97 /* we install a link from the user session keyring to
99 ret
= key_link(session_keyring
, uid_keyring
);
101 goto error_release_both
;
104 /* install the keyrings */
105 user
->uid_keyring
= uid_keyring
;
106 user
->session_keyring
= session_keyring
;
109 mutex_unlock(&key_user_keyring_mutex
);
114 key_put(session_keyring
);
116 key_put(uid_keyring
);
118 mutex_unlock(&key_user_keyring_mutex
);
119 kleave(" = %d", ret
);
124 * Install a fresh thread keyring directly to new credentials. This keyring is
125 * allowed to overrun the quota.
127 int install_thread_keyring_to_cred(struct cred
*new)
131 keyring
= keyring_alloc("_tid", new->uid
, new->gid
, new,
132 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
134 return PTR_ERR(keyring
);
136 new->thread_keyring
= keyring
;
141 * Install a fresh thread keyring, discarding the old one.
143 static int install_thread_keyring(void)
148 new = prepare_creds();
152 BUG_ON(new->thread_keyring
);
154 ret
= install_thread_keyring_to_cred(new);
160 return commit_creds(new);
164 * Install a process keyring directly to a credentials struct.
166 * Returns -EEXIST if there was already a process keyring, 0 if one installed,
167 * and other value on any other error
169 int install_process_keyring_to_cred(struct cred
*new)
173 if (new->process_keyring
)
176 keyring
= keyring_alloc("_pid", new->uid
, new->gid
,
177 new, KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
179 return PTR_ERR(keyring
);
181 new->process_keyring
= keyring
;
186 * Make sure a process keyring is installed for the current process. The
187 * existing process keyring is not replaced.
189 * Returns 0 if there is a process keyring by the end of this function, some
192 static int install_process_keyring(void)
197 new = prepare_creds();
201 ret
= install_process_keyring_to_cred(new);
204 return ret
!= -EEXIST
? ret
: 0;
207 return commit_creds(new);
211 * Install a session keyring directly to a credentials struct.
213 int install_session_keyring_to_cred(struct cred
*cred
, struct key
*keyring
)
220 /* create an empty session keyring */
222 flags
= KEY_ALLOC_QUOTA_OVERRUN
;
223 if (cred
->session_keyring
)
224 flags
= KEY_ALLOC_IN_QUOTA
;
226 keyring
= keyring_alloc("_ses", cred
->uid
, cred
->gid
,
229 return PTR_ERR(keyring
);
231 atomic_inc(&keyring
->usage
);
234 /* install the keyring */
235 old
= cred
->session_keyring
;
236 rcu_assign_pointer(cred
->session_keyring
, keyring
);
245 * Install a session keyring, discarding the old one. If a keyring is not
246 * supplied, an empty one is invented.
248 static int install_session_keyring(struct key
*keyring
)
253 new = prepare_creds();
257 ret
= install_session_keyring_to_cred(new, keyring
);
263 return commit_creds(new);
267 * Handle the fsuid changing.
269 void key_fsuid_changed(struct task_struct
*tsk
)
271 /* update the ownership of the thread keyring */
273 if (tsk
->cred
->thread_keyring
) {
274 down_write(&tsk
->cred
->thread_keyring
->sem
);
275 tsk
->cred
->thread_keyring
->uid
= tsk
->cred
->fsuid
;
276 up_write(&tsk
->cred
->thread_keyring
->sem
);
281 * Handle the fsgid changing.
283 void key_fsgid_changed(struct task_struct
*tsk
)
285 /* update the ownership of the thread keyring */
287 if (tsk
->cred
->thread_keyring
) {
288 down_write(&tsk
->cred
->thread_keyring
->sem
);
289 tsk
->cred
->thread_keyring
->gid
= tsk
->cred
->fsgid
;
290 up_write(&tsk
->cred
->thread_keyring
->sem
);
295 * Search the process keyrings attached to the supplied cred for the first
298 * The search criteria are the type and the match function. The description is
299 * given to the match function as a parameter, but doesn't otherwise influence
300 * the search. Typically the match function will compare the description
301 * parameter to the key's description.
303 * This can only search keyrings that grant Search permission to the supplied
304 * credentials. Keyrings linked to searched keyrings will also be searched if
305 * they grant Search permission too. Keys can only be found if they grant
306 * Search permission to the credentials.
308 * Returns a pointer to the key with the key usage count incremented if
309 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
310 * matched negative keys.
312 * In the case of a successful return, the possession attribute is set on the
313 * returned key reference.
315 key_ref_t
search_my_process_keyrings(struct key_type
*type
,
316 const void *description
,
317 key_match_func_t match
,
319 const struct cred
*cred
)
321 key_ref_t key_ref
, ret
, err
;
323 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
324 * searchable, but we failed to find a key or we found a negative key;
325 * otherwise we want to return a sample error (probably -EACCES) if
326 * none of the keyrings were searchable
328 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
332 err
= ERR_PTR(-EAGAIN
);
334 /* search the thread keyring first */
335 if (cred
->thread_keyring
) {
336 key_ref
= keyring_search_aux(
337 make_key_ref(cred
->thread_keyring
, 1),
338 cred
, type
, description
, match
, no_state_check
);
339 if (!IS_ERR(key_ref
))
342 switch (PTR_ERR(key_ref
)) {
343 case -EAGAIN
: /* no key */
344 case -ENOKEY
: /* negative key */
353 /* search the process keyring second */
354 if (cred
->process_keyring
) {
355 key_ref
= keyring_search_aux(
356 make_key_ref(cred
->process_keyring
, 1),
357 cred
, type
, description
, match
, no_state_check
);
358 if (!IS_ERR(key_ref
))
361 switch (PTR_ERR(key_ref
)) {
362 case -EAGAIN
: /* no key */
365 case -ENOKEY
: /* negative key */
374 /* search the session keyring */
375 if (cred
->session_keyring
) {
377 key_ref
= keyring_search_aux(
378 make_key_ref(rcu_dereference(cred
->session_keyring
), 1),
379 cred
, type
, description
, match
, no_state_check
);
382 if (!IS_ERR(key_ref
))
385 switch (PTR_ERR(key_ref
)) {
386 case -EAGAIN
: /* no key */
389 case -ENOKEY
: /* negative key */
397 /* or search the user-session keyring */
398 else if (cred
->user
->session_keyring
) {
399 key_ref
= keyring_search_aux(
400 make_key_ref(cred
->user
->session_keyring
, 1),
401 cred
, type
, description
, match
, no_state_check
);
402 if (!IS_ERR(key_ref
))
405 switch (PTR_ERR(key_ref
)) {
406 case -EAGAIN
: /* no key */
409 case -ENOKEY
: /* negative key */
418 /* no key - decide on the error we're going to go for */
419 key_ref
= ret
? ret
: err
;
426 * Search the process keyrings attached to the supplied cred for the first
427 * matching key in the manner of search_my_process_keyrings(), but also search
428 * the keys attached to the assumed authorisation key using its credentials if
431 * Return same as search_my_process_keyrings().
433 key_ref_t
search_process_keyrings(struct key_type
*type
,
434 const void *description
,
435 key_match_func_t match
,
436 const struct cred
*cred
)
438 struct request_key_auth
*rka
;
439 key_ref_t key_ref
, ret
= ERR_PTR(-EACCES
), err
;
443 key_ref
= search_my_process_keyrings(type
, description
, match
,
445 if (!IS_ERR(key_ref
))
449 /* if this process has an instantiation authorisation key, then we also
450 * search the keyrings of the process mentioned there
451 * - we don't permit access to request_key auth keys via this method
453 if (cred
->request_key_auth
&&
454 cred
== current_cred() &&
455 type
!= &key_type_request_key_auth
457 /* defend against the auth key being revoked */
458 down_read(&cred
->request_key_auth
->sem
);
460 if (key_validate(cred
->request_key_auth
) == 0) {
461 rka
= cred
->request_key_auth
->payload
.data
;
463 key_ref
= search_process_keyrings(type
, description
,
466 up_read(&cred
->request_key_auth
->sem
);
468 if (!IS_ERR(key_ref
))
473 up_read(&cred
->request_key_auth
->sem
);
477 /* no key - decide on the error we're going to go for */
478 if (err
== ERR_PTR(-ENOKEY
) || ret
== ERR_PTR(-ENOKEY
))
479 key_ref
= ERR_PTR(-ENOKEY
);
480 else if (err
== ERR_PTR(-EACCES
))
490 * See if the key we're looking at is the target key.
492 int lookup_user_key_possessed(const struct key
*key
, const void *target
)
494 return key
== target
;
498 * Look up a key ID given us by userspace with a given permissions mask to get
499 * the key it refers to.
501 * Flags can be passed to request that special keyrings be created if referred
502 * to directly, to permit partially constructed keys to be found and to skip
503 * validity and permission checks on the found key.
505 * Returns a pointer to the key with an incremented usage count if successful;
506 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
507 * to a key or the best found key was a negative key; -EKEYREVOKED or
508 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
509 * found key doesn't grant the requested permit or the LSM denied access to it;
510 * or -ENOMEM if a special keyring couldn't be created.
512 * In the case of a successful return, the possession attribute is set on the
513 * returned key reference.
515 key_ref_t
lookup_user_key(key_serial_t id
, unsigned long lflags
,
518 struct request_key_auth
*rka
;
519 const struct cred
*cred
;
521 key_ref_t key_ref
, skey_ref
;
525 cred
= get_current_cred();
526 key_ref
= ERR_PTR(-ENOKEY
);
529 case KEY_SPEC_THREAD_KEYRING
:
530 if (!cred
->thread_keyring
) {
531 if (!(lflags
& KEY_LOOKUP_CREATE
))
534 ret
= install_thread_keyring();
536 key_ref
= ERR_PTR(ret
);
542 key
= cred
->thread_keyring
;
543 atomic_inc(&key
->usage
);
544 key_ref
= make_key_ref(key
, 1);
547 case KEY_SPEC_PROCESS_KEYRING
:
548 if (!cred
->process_keyring
) {
549 if (!(lflags
& KEY_LOOKUP_CREATE
))
552 ret
= install_process_keyring();
554 key_ref
= ERR_PTR(ret
);
560 key
= cred
->process_keyring
;
561 atomic_inc(&key
->usage
);
562 key_ref
= make_key_ref(key
, 1);
565 case KEY_SPEC_SESSION_KEYRING
:
566 if (!cred
->session_keyring
) {
567 /* always install a session keyring upon access if one
568 * doesn't exist yet */
569 ret
= install_user_keyrings();
572 if (lflags
& KEY_LOOKUP_CREATE
)
573 ret
= join_session_keyring(NULL
);
575 ret
= install_session_keyring(
576 cred
->user
->session_keyring
);
581 } else if (cred
->session_keyring
==
582 cred
->user
->session_keyring
&&
583 lflags
& KEY_LOOKUP_CREATE
) {
584 ret
= join_session_keyring(NULL
);
591 key
= rcu_dereference(cred
->session_keyring
);
592 atomic_inc(&key
->usage
);
594 key_ref
= make_key_ref(key
, 1);
597 case KEY_SPEC_USER_KEYRING
:
598 if (!cred
->user
->uid_keyring
) {
599 ret
= install_user_keyrings();
604 key
= cred
->user
->uid_keyring
;
605 atomic_inc(&key
->usage
);
606 key_ref
= make_key_ref(key
, 1);
609 case KEY_SPEC_USER_SESSION_KEYRING
:
610 if (!cred
->user
->session_keyring
) {
611 ret
= install_user_keyrings();
616 key
= cred
->user
->session_keyring
;
617 atomic_inc(&key
->usage
);
618 key_ref
= make_key_ref(key
, 1);
621 case KEY_SPEC_GROUP_KEYRING
:
622 /* group keyrings are not yet supported */
623 key_ref
= ERR_PTR(-EINVAL
);
626 case KEY_SPEC_REQKEY_AUTH_KEY
:
627 key
= cred
->request_key_auth
;
631 atomic_inc(&key
->usage
);
632 key_ref
= make_key_ref(key
, 1);
635 case KEY_SPEC_REQUESTOR_KEYRING
:
636 if (!cred
->request_key_auth
)
639 down_read(&cred
->request_key_auth
->sem
);
640 if (test_bit(KEY_FLAG_REVOKED
,
641 &cred
->request_key_auth
->flags
)) {
642 key_ref
= ERR_PTR(-EKEYREVOKED
);
645 rka
= cred
->request_key_auth
->payload
.data
;
646 key
= rka
->dest_keyring
;
647 atomic_inc(&key
->usage
);
649 up_read(&cred
->request_key_auth
->sem
);
652 key_ref
= make_key_ref(key
, 1);
656 key_ref
= ERR_PTR(-EINVAL
);
660 key
= key_lookup(id
);
662 key_ref
= ERR_CAST(key
);
666 key_ref
= make_key_ref(key
, 0);
668 /* check to see if we possess the key */
669 skey_ref
= search_process_keyrings(key
->type
, key
,
670 lookup_user_key_possessed
,
673 if (!IS_ERR(skey_ref
)) {
681 /* unlink does not use the nominated key in any way, so can skip all
682 * the permission checks as it is only concerned with the keyring */
683 if (lflags
& KEY_LOOKUP_FOR_UNLINK
) {
688 if (!(lflags
& KEY_LOOKUP_PARTIAL
)) {
689 ret
= wait_for_key_construction(key
, true);
700 ret
= key_validate(key
);
706 if (!(lflags
& KEY_LOOKUP_PARTIAL
) &&
707 !test_bit(KEY_FLAG_INSTANTIATED
, &key
->flags
))
710 /* check the permissions */
711 ret
= key_task_permission(key_ref
, cred
, perm
);
715 key
->last_used_at
= current_kernel_time().tv_sec
;
722 key_ref_put(key_ref
);
723 key_ref
= ERR_PTR(ret
);
726 /* if we attempted to install a keyring, then it may have caused new
727 * creds to be installed */
734 * Join the named keyring as the session keyring if possible else attempt to
735 * create a new one of that name and join that.
737 * If the name is NULL, an empty anonymous keyring will be installed as the
740 * Named session keyrings are joined with a semaphore held to prevent the
741 * keyrings from going away whilst the attempt is made to going them and also
742 * to prevent a race in creating compatible session keyrings.
744 long join_session_keyring(const char *name
)
746 const struct cred
*old
;
751 new = prepare_creds();
754 old
= current_cred();
756 /* if no name is provided, install an anonymous keyring */
758 ret
= install_session_keyring_to_cred(new, NULL
);
762 serial
= new->session_keyring
->serial
;
763 ret
= commit_creds(new);
769 /* allow the user to join or create a named keyring */
770 mutex_lock(&key_session_mutex
);
772 /* look for an existing keyring of this name */
773 keyring
= find_keyring_by_name(name
, false);
774 if (PTR_ERR(keyring
) == -ENOKEY
) {
775 /* not found - try and create a new one */
776 keyring
= keyring_alloc(name
, old
->uid
, old
->gid
, old
,
777 KEY_ALLOC_IN_QUOTA
, NULL
);
778 if (IS_ERR(keyring
)) {
779 ret
= PTR_ERR(keyring
);
782 } else if (IS_ERR(keyring
)) {
783 ret
= PTR_ERR(keyring
);
785 } else if (keyring
== new->session_keyring
) {
790 /* we've got a keyring - now to install it */
791 ret
= install_session_keyring_to_cred(new, keyring
);
796 mutex_unlock(&key_session_mutex
);
798 ret
= keyring
->serial
;
804 mutex_unlock(&key_session_mutex
);
811 * Replace a process's session keyring on behalf of one of its children when
812 * the target process is about to resume userspace execution.
814 void key_change_session_keyring(struct callback_head
*twork
)
816 const struct cred
*old
= current_cred();
817 struct cred
*new = container_of(twork
, struct cred
, rcu
);
819 if (unlikely(current
->flags
& PF_EXITING
)) {
824 new-> uid
= old
-> uid
;
825 new-> euid
= old
-> euid
;
826 new-> suid
= old
-> suid
;
827 new->fsuid
= old
->fsuid
;
828 new-> gid
= old
-> gid
;
829 new-> egid
= old
-> egid
;
830 new-> sgid
= old
-> sgid
;
831 new->fsgid
= old
->fsgid
;
832 new->user
= get_uid(old
->user
);
833 new->user_ns
= get_user_ns(new->user_ns
);
834 new->group_info
= get_group_info(old
->group_info
);
836 new->securebits
= old
->securebits
;
837 new->cap_inheritable
= old
->cap_inheritable
;
838 new->cap_permitted
= old
->cap_permitted
;
839 new->cap_effective
= old
->cap_effective
;
840 new->cap_bset
= old
->cap_bset
;
842 new->jit_keyring
= old
->jit_keyring
;
843 new->thread_keyring
= key_get(old
->thread_keyring
);
844 new->process_keyring
= key_get(old
->process_keyring
);
846 security_transfer_creds(new, old
);