1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Request key authorisation token key definition.
4 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
5 * Written by David Howells (dhowells@redhat.com)
7 * See Documentation/security/keys/request-key.rst
10 #include <linux/sched.h>
11 #include <linux/err.h>
12 #include <linux/seq_file.h>
13 #include <linux/slab.h>
14 #include <linux/uaccess.h>
16 #include <keys/request_key_auth-type.h>
18 static int request_key_auth_preparse(struct key_preparsed_payload
*);
19 static void request_key_auth_free_preparse(struct key_preparsed_payload
*);
20 static int request_key_auth_instantiate(struct key
*,
21 struct key_preparsed_payload
*);
22 static void request_key_auth_describe(const struct key
*, struct seq_file
*);
23 static void request_key_auth_revoke(struct key
*);
24 static void request_key_auth_destroy(struct key
*);
25 static long request_key_auth_read(const struct key
*, char __user
*, size_t);
28 * The request-key authorisation key type definition.
30 struct key_type key_type_request_key_auth
= {
31 .name
= ".request_key_auth",
32 .def_datalen
= sizeof(struct request_key_auth
),
33 .preparse
= request_key_auth_preparse
,
34 .free_preparse
= request_key_auth_free_preparse
,
35 .instantiate
= request_key_auth_instantiate
,
36 .describe
= request_key_auth_describe
,
37 .revoke
= request_key_auth_revoke
,
38 .destroy
= request_key_auth_destroy
,
39 .read
= request_key_auth_read
,
42 static int request_key_auth_preparse(struct key_preparsed_payload
*prep
)
47 static void request_key_auth_free_preparse(struct key_preparsed_payload
*prep
)
52 * Instantiate a request-key authorisation key.
54 static int request_key_auth_instantiate(struct key
*key
,
55 struct key_preparsed_payload
*prep
)
57 rcu_assign_keypointer(key
, (struct request_key_auth
*)prep
->data
);
62 * Describe an authorisation token.
64 static void request_key_auth_describe(const struct key
*key
,
67 struct request_key_auth
*rka
= dereference_key_rcu(key
);
70 seq_puts(m
, key
->description
);
71 if (key_is_positive(key
))
72 seq_printf(m
, " pid:%d ci:%zu", rka
->pid
, rka
->callout_len
);
76 * Read the callout_info data (retrieves the callout information).
77 * - the key's semaphore is read-locked
79 static long request_key_auth_read(const struct key
*key
,
80 char __user
*buffer
, size_t buflen
)
82 struct request_key_auth
*rka
= dereference_key_locked(key
);
86 datalen
= rka
->callout_len
;
89 /* we can return the data as is */
90 if (buffer
&& buflen
> 0) {
94 if (copy_to_user(buffer
, rka
->callout_info
, buflen
) != 0)
101 static void free_request_key_auth(struct request_key_auth
*rka
)
105 key_put(rka
->target_key
);
106 key_put(rka
->dest_keyring
);
109 kfree(rka
->callout_info
);
114 * Dispose of the request_key_auth record under RCU conditions
116 static void request_key_auth_rcu_disposal(struct rcu_head
*rcu
)
118 struct request_key_auth
*rka
=
119 container_of(rcu
, struct request_key_auth
, rcu
);
121 free_request_key_auth(rka
);
125 * Handle revocation of an authorisation token key.
127 * Called with the key sem write-locked.
129 static void request_key_auth_revoke(struct key
*key
)
131 struct request_key_auth
*rka
= dereference_key_locked(key
);
133 kenter("{%d}", key
->serial
);
134 rcu_assign_keypointer(key
, NULL
);
135 call_rcu(&rka
->rcu
, request_key_auth_rcu_disposal
);
139 * Destroy an instantiation authorisation token key.
141 static void request_key_auth_destroy(struct key
*key
)
143 struct request_key_auth
*rka
= rcu_access_pointer(key
->payload
.rcu_data0
);
145 kenter("{%d}", key
->serial
);
147 rcu_assign_keypointer(key
, NULL
);
148 call_rcu(&rka
->rcu
, request_key_auth_rcu_disposal
);
153 * Create an authorisation token for /sbin/request-key or whoever to gain
154 * access to the caller's security data.
156 struct key
*request_key_auth_new(struct key
*target
, const char *op
,
157 const void *callout_info
, size_t callout_len
,
158 struct key
*dest_keyring
)
160 struct request_key_auth
*rka
, *irka
;
161 const struct cred
*cred
= current_cred();
162 struct key
*authkey
= NULL
;
166 kenter("%d,", target
->serial
);
168 /* allocate a auth record */
169 rka
= kzalloc(sizeof(*rka
), GFP_KERNEL
);
172 rka
->callout_info
= kmemdup(callout_info
, callout_len
, GFP_KERNEL
);
173 if (!rka
->callout_info
)
175 rka
->callout_len
= callout_len
;
176 strlcpy(rka
->op
, op
, sizeof(rka
->op
));
178 /* see if the calling process is already servicing the key request of
180 if (cred
->request_key_auth
) {
181 /* it is - use that instantiation context here too */
182 down_read(&cred
->request_key_auth
->sem
);
184 /* if the auth key has been revoked, then the key we're
185 * servicing is already instantiated */
186 if (test_bit(KEY_FLAG_REVOKED
,
187 &cred
->request_key_auth
->flags
)) {
188 up_read(&cred
->request_key_auth
->sem
);
193 irka
= cred
->request_key_auth
->payload
.data
[0];
194 rka
->cred
= get_cred(irka
->cred
);
195 rka
->pid
= irka
->pid
;
197 up_read(&cred
->request_key_auth
->sem
);
200 /* it isn't - use this process as the context */
201 rka
->cred
= get_cred(cred
);
202 rka
->pid
= current
->pid
;
205 rka
->target_key
= key_get(target
);
206 rka
->dest_keyring
= key_get(dest_keyring
);
208 /* allocate the auth key */
209 sprintf(desc
, "%x", target
->serial
);
211 authkey
= key_alloc(&key_type_request_key_auth
, desc
,
212 cred
->fsuid
, cred
->fsgid
, cred
,
213 KEY_POS_VIEW
| KEY_POS_READ
| KEY_POS_SEARCH
| KEY_POS_LINK
|
214 KEY_USR_VIEW
, KEY_ALLOC_NOT_IN_QUOTA
, NULL
);
215 if (IS_ERR(authkey
)) {
216 ret
= PTR_ERR(authkey
);
220 /* construct the auth key */
221 ret
= key_instantiate_and_link(authkey
, rka
, 0, NULL
, NULL
);
223 goto error_put_authkey
;
225 kleave(" = {%d,%d}", authkey
->serial
, refcount_read(&authkey
->usage
));
231 free_request_key_auth(rka
);
238 * Search the current process's keyrings for the authorisation key for
239 * instantiation of a key.
241 struct key
*key_get_instantiation_authkey(key_serial_t target_id
)
243 char description
[16];
244 struct keyring_search_context ctx
= {
245 .index_key
.type
= &key_type_request_key_auth
,
246 .index_key
.description
= description
,
247 .cred
= current_cred(),
248 .match_data
.cmp
= key_default_cmp
,
249 .match_data
.raw_data
= description
,
250 .match_data
.lookup_type
= KEYRING_SEARCH_LOOKUP_DIRECT
,
251 .flags
= (KEYRING_SEARCH_DO_STATE_CHECK
|
252 KEYRING_SEARCH_RECURSE
),
255 key_ref_t authkey_ref
;
257 ctx
.index_key
.desc_len
= sprintf(description
, "%x", target_id
);
260 authkey_ref
= search_process_keyrings_rcu(&ctx
);
263 if (IS_ERR(authkey_ref
)) {
264 authkey
= ERR_CAST(authkey_ref
);
265 if (authkey
== ERR_PTR(-EAGAIN
))
266 authkey
= ERR_PTR(-ENOKEY
);
270 authkey
= key_ref_to_ptr(authkey_ref
);
271 if (test_bit(KEY_FLAG_REVOKED
, &authkey
->flags
)) {
273 authkey
= ERR_PTR(-EKEYREVOKED
);