1 /* Request key authorisation token key definition.
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * See Documentation/security/keys/request-key.rst
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/err.h>
17 #include <linux/seq_file.h>
18 #include <linux/slab.h>
19 #include <linux/uaccess.h>
21 #include <keys/request_key_auth-type.h>
23 static int request_key_auth_preparse(struct key_preparsed_payload
*);
24 static void request_key_auth_free_preparse(struct key_preparsed_payload
*);
25 static int request_key_auth_instantiate(struct key
*,
26 struct key_preparsed_payload
*);
27 static void request_key_auth_describe(const struct key
*, struct seq_file
*);
28 static void request_key_auth_revoke(struct key
*);
29 static void request_key_auth_destroy(struct key
*);
30 static long request_key_auth_read(const struct key
*, char __user
*, size_t);
33 * The request-key authorisation key type definition.
35 struct key_type key_type_request_key_auth
= {
36 .name
= ".request_key_auth",
37 .def_datalen
= sizeof(struct request_key_auth
),
38 .preparse
= request_key_auth_preparse
,
39 .free_preparse
= request_key_auth_free_preparse
,
40 .instantiate
= request_key_auth_instantiate
,
41 .describe
= request_key_auth_describe
,
42 .revoke
= request_key_auth_revoke
,
43 .destroy
= request_key_auth_destroy
,
44 .read
= request_key_auth_read
,
47 static int request_key_auth_preparse(struct key_preparsed_payload
*prep
)
52 static void request_key_auth_free_preparse(struct key_preparsed_payload
*prep
)
57 * Instantiate a request-key authorisation key.
59 static int request_key_auth_instantiate(struct key
*key
,
60 struct key_preparsed_payload
*prep
)
62 key
->payload
.data
[0] = (struct request_key_auth
*)prep
->data
;
67 * Describe an authorisation token.
69 static void request_key_auth_describe(const struct key
*key
,
72 struct request_key_auth
*rka
= get_request_key_auth(key
);
78 seq_puts(m
, key
->description
);
79 if (key_is_positive(key
))
80 seq_printf(m
, " pid:%d ci:%zu", rka
->pid
, rka
->callout_len
);
84 * Read the callout_info data (retrieves the callout information).
85 * - the key's semaphore is read-locked
87 static long request_key_auth_read(const struct key
*key
,
88 char __user
*buffer
, size_t buflen
)
90 struct request_key_auth
*rka
= get_request_key_auth(key
);
97 datalen
= rka
->callout_len
;
100 /* we can return the data as is */
101 if (buffer
&& buflen
> 0) {
102 if (buflen
> datalen
)
105 if (copy_to_user(buffer
, rka
->callout_info
, buflen
) != 0)
113 * Handle revocation of an authorisation token key.
115 * Called with the key sem write-locked.
117 static void request_key_auth_revoke(struct key
*key
)
119 struct request_key_auth
*rka
= get_request_key_auth(key
);
121 kenter("{%d}", key
->serial
);
129 static void free_request_key_auth(struct request_key_auth
*rka
)
133 key_put(rka
->target_key
);
134 key_put(rka
->dest_keyring
);
137 kfree(rka
->callout_info
);
142 * Destroy an instantiation authorisation token key.
144 static void request_key_auth_destroy(struct key
*key
)
146 struct request_key_auth
*rka
= get_request_key_auth(key
);
148 kenter("{%d}", key
->serial
);
150 free_request_key_auth(rka
);
154 * Create an authorisation token for /sbin/request-key or whoever to gain
155 * access to the caller's security data.
157 struct key
*request_key_auth_new(struct key
*target
, const char *op
,
158 const void *callout_info
, size_t callout_len
,
159 struct key
*dest_keyring
)
161 struct request_key_auth
*rka
, *irka
;
162 const struct cred
*cred
= current
->cred
;
163 struct key
*authkey
= NULL
;
167 kenter("%d,", target
->serial
);
169 /* allocate a auth record */
170 rka
= kzalloc(sizeof(*rka
), GFP_KERNEL
);
173 rka
->callout_info
= kmemdup(callout_info
, callout_len
, GFP_KERNEL
);
174 if (!rka
->callout_info
)
176 rka
->callout_len
= callout_len
;
177 strlcpy(rka
->op
, op
, sizeof(rka
->op
));
179 /* see if the calling process is already servicing the key request of
181 if (cred
->request_key_auth
) {
182 /* it is - use that instantiation context here too */
183 down_read(&cred
->request_key_auth
->sem
);
185 /* if the auth key has been revoked, then the key we're
186 * servicing is already instantiated */
187 if (test_bit(KEY_FLAG_REVOKED
,
188 &cred
->request_key_auth
->flags
)) {
189 up_read(&cred
->request_key_auth
->sem
);
194 irka
= cred
->request_key_auth
->payload
.data
[0];
195 rka
->cred
= get_cred(irka
->cred
);
196 rka
->pid
= irka
->pid
;
198 up_read(&cred
->request_key_auth
->sem
);
201 /* it isn't - use this process as the context */
202 rka
->cred
= get_cred(cred
);
203 rka
->pid
= current
->pid
;
206 rka
->target_key
= key_get(target
);
207 rka
->dest_keyring
= key_get(dest_keyring
);
209 /* allocate the auth key */
210 sprintf(desc
, "%x", target
->serial
);
212 authkey
= key_alloc(&key_type_request_key_auth
, desc
,
213 cred
->fsuid
, cred
->fsgid
, cred
,
214 KEY_POS_VIEW
| KEY_POS_READ
| KEY_POS_SEARCH
|
215 KEY_USR_VIEW
, KEY_ALLOC_NOT_IN_QUOTA
, NULL
);
216 if (IS_ERR(authkey
)) {
217 ret
= PTR_ERR(authkey
);
221 /* construct the auth key */
222 ret
= key_instantiate_and_link(authkey
, rka
, 0, NULL
, NULL
);
224 goto error_put_authkey
;
226 kleave(" = {%d,%d}", authkey
->serial
, refcount_read(&authkey
->usage
));
232 free_request_key_auth(rka
);
239 * Search the current process's keyrings for the authorisation key for
240 * instantiation of a key.
242 struct key
*key_get_instantiation_authkey(key_serial_t target_id
)
244 char description
[16];
245 struct keyring_search_context ctx
= {
246 .index_key
.type
= &key_type_request_key_auth
,
247 .index_key
.description
= description
,
248 .cred
= current_cred(),
249 .match_data
.cmp
= key_default_cmp
,
250 .match_data
.raw_data
= description
,
251 .match_data
.lookup_type
= KEYRING_SEARCH_LOOKUP_DIRECT
,
252 .flags
= KEYRING_SEARCH_DO_STATE_CHECK
,
255 key_ref_t authkey_ref
;
257 ctx
.index_key
.desc_len
= sprintf(description
, "%x", target_id
);
259 authkey_ref
= search_process_keyrings(&ctx
);
261 if (IS_ERR(authkey_ref
)) {
262 authkey
= ERR_CAST(authkey_ref
);
263 if (authkey
== ERR_PTR(-EAGAIN
))
264 authkey
= ERR_PTR(-ENOKEY
);
268 authkey
= key_ref_to_ptr(authkey_ref
);
269 if (test_bit(KEY_FLAG_REVOKED
, &authkey
->flags
)) {
271 authkey
= ERR_PTR(-EKEYREVOKED
);