keyctl.c 39.8 KB
Newer Older
1
/* Userspace key control operations
L
Linus Torvalds 已提交
2
 *
3
 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
L
Linus Torvalds 已提交
4 5 6 7 8 9 10 11 12 13 14 15 16
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/syscalls.h>
17
#include <linux/key.h>
L
Linus Torvalds 已提交
18 19
#include <linux/keyctl.h>
#include <linux/fs.h>
20
#include <linux/capability.h>
21
#include <linux/string.h>
L
Linus Torvalds 已提交
22
#include <linux/err.h>
23
#include <linux/vmalloc.h>
24
#include <linux/security.h>
L
Linus Torvalds 已提交
25 26 27
#include <asm/uaccess.h>
#include "internal.h"

28 29 30 31 32 33 34 35
static int key_get_type_from_user(char *type,
				  const char __user *_type,
				  unsigned len)
{
	int ret;

	ret = strncpy_from_user(type, _type, len);
	if (ret < 0)
36
		return ret;
37 38 39 40 41 42 43 44
	if (ret == 0 || ret >= len)
		return -EINVAL;
	if (type[0] == '.')
		return -EPERM;
	type[len - 1] = '\0';
	return 0;
}

L
Linus Torvalds 已提交
45
/*
46 47 48 49 50 51 52
 * Extract the description of a new key from userspace and either add it as a
 * new key to the specified keyring or update a matching key in that keyring.
 *
 * The keyring must be writable so that we can attach the key to it.
 *
 * If successful, the new key's serial number is returned, otherwise an error
 * code is returned.
L
Linus Torvalds 已提交
53
 */
54 55 56 57 58
SYSCALL_DEFINE5(add_key, const char __user *, _type,
		const char __user *, _description,
		const void __user *, _payload,
		size_t, plen,
		key_serial_t, ringid)
L
Linus Torvalds 已提交
59
{
60
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
61 62
	char type[32], *description;
	void *payload;
63
	long ret;
64
	bool vm;
L
Linus Torvalds 已提交
65 66

	ret = -EINVAL;
67
	if (plen > 1024 * 1024 - 1)
L
Linus Torvalds 已提交
68 69 70
		goto error;

	/* draw all the data into kernel space */
71
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
72 73 74
	if (ret < 0)
		goto error;

75 76 77
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
78
		goto error;
79
	}
L
Linus Torvalds 已提交
80 81 82 83

	/* pull the payload in if one was supplied */
	payload = NULL;

84
	vm = false;
L
Linus Torvalds 已提交
85 86
	if (_payload) {
		ret = -ENOMEM;
87
		payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN);
88 89 90 91 92 93 94 95
		if (!payload) {
			if (plen <= PAGE_SIZE)
				goto error2;
			vm = true;
			payload = vmalloc(plen);
			if (!payload)
				goto error2;
		}
L
Linus Torvalds 已提交
96 97 98 99 100 101 102

		ret = -EFAULT;
		if (copy_from_user(payload, _payload, plen) != 0)
			goto error3;
	}

	/* find the target keyring (which must be writable) */
103
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
104 105
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
106 107 108 109 110
		goto error3;
	}

	/* create or update the requested key and add it to the target
	 * keyring */
111
	key_ref = key_create_or_update(keyring_ref, type, description,
112 113
				       payload, plen, KEY_PERM_UNDEF,
				       KEY_ALLOC_IN_QUOTA);
114 115 116
	if (!IS_ERR(key_ref)) {
		ret = key_ref_to_ptr(key_ref)->serial;
		key_ref_put(key_ref);
L
Linus Torvalds 已提交
117 118
	}
	else {
119
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
120 121
	}

122
	key_ref_put(keyring_ref);
L
Linus Torvalds 已提交
123
 error3:
124 125 126 127
	if (!vm)
		kfree(payload);
	else
		vfree(payload);
L
Linus Torvalds 已提交
128 129 130 131
 error2:
	kfree(description);
 error:
	return ret;
132
}
L
Linus Torvalds 已提交
133 134

/*
135 136 137 138 139 140 141 142 143 144 145
 * Search the process keyrings and keyring trees linked from those for a
 * matching key.  Keyrings must have appropriate Search permission to be
 * searched.
 *
 * If a key is found, it will be attached to the destination keyring if there's
 * one specified and the serial number of the key will be returned.
 *
 * If no key is found, /sbin/request-key will be invoked if _callout_info is
 * non-NULL in an attempt to create a key.  The _callout_info string will be
 * passed to /sbin/request-key to aid with completing the request.  If the
 * _callout_info string is "" then it will be changed to "-".
L
Linus Torvalds 已提交
146
 */
147 148 149 150
SYSCALL_DEFINE4(request_key, const char __user *, _type,
		const char __user *, _description,
		const char __user *, _callout_info,
		key_serial_t, destringid)
L
Linus Torvalds 已提交
151 152
{
	struct key_type *ktype;
153 154
	struct key *key;
	key_ref_t dest_ref;
155
	size_t callout_len;
L
Linus Torvalds 已提交
156
	char type[32], *description, *callout_info;
157
	long ret;
L
Linus Torvalds 已提交
158 159

	/* pull the type into kernel space */
160
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
161 162
	if (ret < 0)
		goto error;
163

L
Linus Torvalds 已提交
164
	/* pull the description into kernel space */
165 166 167
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
168
		goto error;
169
	}
L
Linus Torvalds 已提交
170 171 172

	/* pull the callout info into kernel space */
	callout_info = NULL;
173
	callout_len = 0;
L
Linus Torvalds 已提交
174
	if (_callout_info) {
175 176 177
		callout_info = strndup_user(_callout_info, PAGE_SIZE);
		if (IS_ERR(callout_info)) {
			ret = PTR_ERR(callout_info);
L
Linus Torvalds 已提交
178
			goto error2;
179
		}
180
		callout_len = strlen(callout_info);
L
Linus Torvalds 已提交
181 182 183
	}

	/* get the destination keyring if specified */
184
	dest_ref = NULL;
L
Linus Torvalds 已提交
185
	if (destringid) {
186 187
		dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
					   KEY_WRITE);
188 189
		if (IS_ERR(dest_ref)) {
			ret = PTR_ERR(dest_ref);
L
Linus Torvalds 已提交
190 191 192 193 194 195 196 197 198 199 200 201
			goto error3;
		}
	}

	/* find the key type */
	ktype = key_type_lookup(type);
	if (IS_ERR(ktype)) {
		ret = PTR_ERR(ktype);
		goto error4;
	}

	/* do the search */
202 203
	key = request_key_and_link(ktype, description, callout_info,
				   callout_len, NULL, key_ref_to_ptr(dest_ref),
204
				   KEY_ALLOC_IN_QUOTA);
L
Linus Torvalds 已提交
205 206 207 208 209
	if (IS_ERR(key)) {
		ret = PTR_ERR(key);
		goto error5;
	}

210 211 212 213 214
	/* wait for the key to finish being constructed */
	ret = wait_for_key_construction(key, 1);
	if (ret < 0)
		goto error6;

L
Linus Torvalds 已提交
215 216
	ret = key->serial;

217
error6:
218
 	key_put(key);
219
error5:
L
Linus Torvalds 已提交
220
	key_type_put(ktype);
221
error4:
222
	key_ref_put(dest_ref);
223
error3:
L
Linus Torvalds 已提交
224
	kfree(callout_info);
225
error2:
L
Linus Torvalds 已提交
226
	kfree(description);
227
error:
L
Linus Torvalds 已提交
228
	return ret;
229
}
L
Linus Torvalds 已提交
230 231

/*
232 233 234 235 236
 * Get the ID of the specified process keyring.
 *
 * The requested keyring must have search permission to be found.
 *
 * If successful, the ID of the requested keyring will be returned.
L
Linus Torvalds 已提交
237 238 239
 */
long keyctl_get_keyring_ID(key_serial_t id, int create)
{
240
	key_ref_t key_ref;
241
	unsigned long lflags;
L
Linus Torvalds 已提交
242 243
	long ret;

244 245
	lflags = create ? KEY_LOOKUP_CREATE : 0;
	key_ref = lookup_user_key(id, lflags, KEY_SEARCH);
246 247
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
248 249 250
		goto error;
	}

251 252
	ret = key_ref_to_ptr(key_ref)->serial;
	key_ref_put(key_ref);
253
error:
L
Linus Torvalds 已提交
254
	return ret;
255
}
L
Linus Torvalds 已提交
256 257

/*
258 259 260 261 262 263 264 265
 * Join a (named) session keyring.
 *
 * Create and join an anonymous session keyring or join a named session
 * keyring, creating it if necessary.  A named session keyring must have Search
 * permission for it to be joined.  Session keyrings without this permit will
 * be skipped over.
 *
 * If successful, the ID of the joined session keyring will be returned.
L
Linus Torvalds 已提交
266 267 268 269
 */
long keyctl_join_session_keyring(const char __user *_name)
{
	char *name;
270
	long ret;
L
Linus Torvalds 已提交
271 272 273 274

	/* fetch the name from userspace */
	name = NULL;
	if (_name) {
275 276 277
		name = strndup_user(_name, PAGE_SIZE);
		if (IS_ERR(name)) {
			ret = PTR_ERR(name);
L
Linus Torvalds 已提交
278
			goto error;
279
		}
L
Linus Torvalds 已提交
280 281 282 283
	}

	/* join the session */
	ret = join_session_keyring(name);
284
	kfree(name);
L
Linus Torvalds 已提交
285

286
error:
L
Linus Torvalds 已提交
287
	return ret;
288
}
L
Linus Torvalds 已提交
289 290

/*
291 292 293 294 295 296 297 298
 * Update a key's data payload from the given data.
 *
 * The key must grant the caller Write permission and the key type must support
 * updating for this to work.  A negative key can be positively instantiated
 * with this call.
 *
 * If successful, 0 will be returned.  If the key type does not support
 * updating, then -EOPNOTSUPP will be returned.
L
Linus Torvalds 已提交
299 300 301 302 303
 */
long keyctl_update_key(key_serial_t id,
		       const void __user *_payload,
		       size_t plen)
{
304
	key_ref_t key_ref;
L
Linus Torvalds 已提交
305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325
	void *payload;
	long ret;

	ret = -EINVAL;
	if (plen > PAGE_SIZE)
		goto error;

	/* pull the payload in if one was supplied */
	payload = NULL;
	if (_payload) {
		ret = -ENOMEM;
		payload = kmalloc(plen, GFP_KERNEL);
		if (!payload)
			goto error;

		ret = -EFAULT;
		if (copy_from_user(payload, _payload, plen) != 0)
			goto error2;
	}

	/* find the target key (which must be writable) */
326
	key_ref = lookup_user_key(id, 0, KEY_WRITE);
327 328
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
329 330 331 332
		goto error2;
	}

	/* update the key */
333
	ret = key_update(key_ref, payload, plen);
L
Linus Torvalds 已提交
334

335
	key_ref_put(key_ref);
336
error2:
L
Linus Torvalds 已提交
337
	kfree(payload);
338
error:
L
Linus Torvalds 已提交
339
	return ret;
340
}
L
Linus Torvalds 已提交
341 342

/*
343 344 345 346 347 348 349 350
 * Revoke a key.
 *
 * The key must be grant the caller Write or Setattr permission for this to
 * work.  The key type should give up its quota claim when revoked.  The key
 * and any links to the key will be automatically garbage collected after a
 * certain amount of time (/proc/sys/kernel/keys/gc_delay).
 *
 * If successful, 0 is returned.
L
Linus Torvalds 已提交
351 352 353
 */
long keyctl_revoke_key(key_serial_t id)
{
354
	key_ref_t key_ref;
L
Linus Torvalds 已提交
355 356
	long ret;

357
	key_ref = lookup_user_key(id, 0, KEY_WRITE);
358 359
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
360 361 362 363 364 365 366
		if (ret != -EACCES)
			goto error;
		key_ref = lookup_user_key(id, 0, KEY_SETATTR);
		if (IS_ERR(key_ref)) {
			ret = PTR_ERR(key_ref);
			goto error;
		}
L
Linus Torvalds 已提交
367 368
	}

369
	key_revoke(key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
370 371
	ret = 0;

372
	key_ref_put(key_ref);
373
error:
374
	return ret;
375
}
L
Linus Torvalds 已提交
376

D
David Howells 已提交
377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407
/*
 * Invalidate a key.
 *
 * The key must be grant the caller Invalidate permission for this to work.
 * The key and any links to the key will be automatically garbage collected
 * immediately.
 *
 * If successful, 0 is returned.
 */
long keyctl_invalidate_key(key_serial_t id)
{
	key_ref_t key_ref;
	long ret;

	kenter("%d", id);

	key_ref = lookup_user_key(id, 0, KEY_SEARCH);
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
		goto error;
	}

	key_invalidate(key_ref_to_ptr(key_ref));
	ret = 0;

	key_ref_put(key_ref);
error:
	kleave(" = %ld", ret);
	return ret;
}

L
Linus Torvalds 已提交
408
/*
409 410 411 412 413
 * Clear the specified keyring, creating an empty process keyring if one of the
 * special keyring IDs is used.
 *
 * The keyring must grant the caller Write permission for this to work.  If
 * successful, 0 will be returned.
L
Linus Torvalds 已提交
414 415 416
 */
long keyctl_keyring_clear(key_serial_t ringid)
{
417
	key_ref_t keyring_ref;
L
Linus Torvalds 已提交
418 419
	long ret;

420
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
421 422
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
423 424 425 426 427 428 429 430 431 432 433 434

		/* Root is permitted to invalidate certain special keyrings */
		if (capable(CAP_SYS_ADMIN)) {
			keyring_ref = lookup_user_key(ringid, 0, 0);
			if (IS_ERR(keyring_ref))
				goto error;
			if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR,
				     &key_ref_to_ptr(keyring_ref)->flags))
				goto clear;
			goto error_put;
		}

L
Linus Torvalds 已提交
435 436 437
		goto error;
	}

438
clear:
439
	ret = keyring_clear(key_ref_to_ptr(keyring_ref));
440
error_put:
441
	key_ref_put(keyring_ref);
442
error:
L
Linus Torvalds 已提交
443
	return ret;
444
}
L
Linus Torvalds 已提交
445 446

/*
447 448 449 450 451 452 453 454 455
 * Create a link from a keyring to a key if there's no matching key in the
 * keyring, otherwise replace the link to the matching key with a link to the
 * new key.
 *
 * The key must grant the caller Link permission and the the keyring must grant
 * the caller Write permission.  Furthermore, if an additional link is created,
 * the keyring's quota will be extended.
 *
 * If successful, 0 will be returned.
L
Linus Torvalds 已提交
456 457 458
 */
long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
{
459
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
460 461
	long ret;

462
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
463 464
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
465 466 467
		goto error;
	}

468
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_LINK);
469 470
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
471 472 473
		goto error2;
	}

474
	ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
475

476
	key_ref_put(key_ref);
477
error2:
478
	key_ref_put(keyring_ref);
479
error:
L
Linus Torvalds 已提交
480
	return ret;
481
}
L
Linus Torvalds 已提交
482 483

/*
484 485 486 487 488 489 490
 * Unlink a key from a keyring.
 *
 * The keyring must grant the caller Write permission for this to work; the key
 * itself need not grant the caller anything.  If the last link to a key is
 * removed then that key will be scheduled for destruction.
 *
 * If successful, 0 will be returned.
L
Linus Torvalds 已提交
491 492 493
 */
long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
{
494
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
495 496
	long ret;

497
	keyring_ref = lookup_user_key(ringid, 0, KEY_WRITE);
498 499
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
500 501 502
		goto error;
	}

503
	key_ref = lookup_user_key(id, KEY_LOOKUP_FOR_UNLINK, 0);
504 505
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
506 507 508
		goto error2;
	}

509
	ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
510

511
	key_ref_put(key_ref);
512
error2:
513
	key_ref_put(keyring_ref);
514
error:
L
Linus Torvalds 已提交
515
	return ret;
516
}
L
Linus Torvalds 已提交
517 518

/*
519 520 521 522 523 524 525
 * Return a description of a key to userspace.
 *
 * The key must grant the caller View permission for this to work.
 *
 * If there's a buffer, we place up to buflen bytes of data into it formatted
 * in the following way:
 *
L
Linus Torvalds 已提交
526
 *	type;uid;gid;perm;description<NUL>
527 528 529
 *
 * If successful, we return the amount of description available, irrespective
 * of how much we may have copied into the buffer.
L
Linus Torvalds 已提交
530 531 532 533 534
 */
long keyctl_describe_key(key_serial_t keyid,
			 char __user *buffer,
			 size_t buflen)
{
535
	struct key *key, *instkey;
536
	key_ref_t key_ref;
L
Linus Torvalds 已提交
537 538 539
	char *tmpbuf;
	long ret;

540
	key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
541
	if (IS_ERR(key_ref)) {
542 543
		/* viewing a key under construction is permitted if we have the
		 * authorisation token handy */
544
		if (PTR_ERR(key_ref) == -EACCES) {
545 546 547
			instkey = key_get_instantiation_authkey(keyid);
			if (!IS_ERR(instkey)) {
				key_put(instkey);
548
				key_ref = lookup_user_key(keyid,
549 550
							  KEY_LOOKUP_PARTIAL,
							  0);
551
				if (!IS_ERR(key_ref))
552 553 554 555
					goto okay;
			}
		}

556
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
557 558 559
		goto error;
	}

560
okay:
L
Linus Torvalds 已提交
561 562 563 564 565 566
	/* calculate how much description we're going to return */
	ret = -ENOMEM;
	tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
	if (!tmpbuf)
		goto error2;

567 568
	key = key_ref_to_ptr(key_ref);

L
Linus Torvalds 已提交
569
	ret = snprintf(tmpbuf, PAGE_SIZE - 1,
570
		       "%s;%d;%d;%08x;%s",
571 572 573 574 575
		       key->type->name,
		       key->uid,
		       key->gid,
		       key->perm,
		       key->description ?: "");
L
Linus Torvalds 已提交
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592

	/* include a NUL char at the end of the data */
	if (ret > PAGE_SIZE - 1)
		ret = PAGE_SIZE - 1;
	tmpbuf[ret] = 0;
	ret++;

	/* consider returning the data */
	if (buffer && buflen > 0) {
		if (buflen > ret)
			buflen = ret;

		if (copy_to_user(buffer, tmpbuf, buflen) != 0)
			ret = -EFAULT;
	}

	kfree(tmpbuf);
593
error2:
594
	key_ref_put(key_ref);
595
error:
L
Linus Torvalds 已提交
596
	return ret;
597
}
L
Linus Torvalds 已提交
598 599

/*
600 601 602 603 604 605 606 607
 * Search the specified keyring and any keyrings it links to for a matching
 * key.  Only keyrings that grant the caller Search permission will be searched
 * (this includes the starting keyring).  Only keys with Search permission can
 * be found.
 *
 * If successful, the found key will be linked to the destination keyring if
 * supplied and the key has Link permission, and the found key ID will be
 * returned.
L
Linus Torvalds 已提交
608 609 610 611 612 613 614
 */
long keyctl_keyring_search(key_serial_t ringid,
			   const char __user *_type,
			   const char __user *_description,
			   key_serial_t destringid)
{
	struct key_type *ktype;
615
	key_ref_t keyring_ref, key_ref, dest_ref;
L
Linus Torvalds 已提交
616
	char type[32], *description;
617
	long ret;
L
Linus Torvalds 已提交
618 619

	/* pull the type and description into kernel space */
620
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
621 622 623
	if (ret < 0)
		goto error;

624 625 626
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
627
		goto error;
628
	}
L
Linus Torvalds 已提交
629 630

	/* get the keyring at which to begin the search */
631
	keyring_ref = lookup_user_key(ringid, 0, KEY_SEARCH);
632 633
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
634 635 636 637
		goto error2;
	}

	/* get the destination keyring if specified */
638
	dest_ref = NULL;
L
Linus Torvalds 已提交
639
	if (destringid) {
640 641
		dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
					   KEY_WRITE);
642 643
		if (IS_ERR(dest_ref)) {
			ret = PTR_ERR(dest_ref);
L
Linus Torvalds 已提交
644 645 646 647 648 649 650 651 652 653 654 655
			goto error3;
		}
	}

	/* find the key type */
	ktype = key_type_lookup(type);
	if (IS_ERR(ktype)) {
		ret = PTR_ERR(ktype);
		goto error4;
	}

	/* do the search */
656 657 658
	key_ref = keyring_search(keyring_ref, ktype, description);
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
659 660 661 662 663 664 665 666

		/* treat lack or presence of a negative key the same */
		if (ret == -EAGAIN)
			ret = -ENOKEY;
		goto error5;
	}

	/* link the resulting key to the destination keyring if we can */
667
	if (dest_ref) {
668 669
		ret = key_permission(key_ref, KEY_LINK);
		if (ret < 0)
L
Linus Torvalds 已提交
670 671
			goto error6;

672
		ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
673 674 675 676
		if (ret < 0)
			goto error6;
	}

677
	ret = key_ref_to_ptr(key_ref)->serial;
L
Linus Torvalds 已提交
678

679
error6:
680
	key_ref_put(key_ref);
681
error5:
L
Linus Torvalds 已提交
682
	key_type_put(ktype);
683
error4:
684
	key_ref_put(dest_ref);
685
error3:
686
	key_ref_put(keyring_ref);
687
error2:
L
Linus Torvalds 已提交
688
	kfree(description);
689
error:
L
Linus Torvalds 已提交
690
	return ret;
691
}
L
Linus Torvalds 已提交
692 693

/*
694 695 696 697 698 699 700 701
 * Read a key's payload.
 *
 * The key must either grant the caller Read permission, or it must grant the
 * caller Search permission when searched for from the process keyrings.
 *
 * If successful, we place up to buflen bytes of data into the buffer, if one
 * is provided, and return the amount of data that is available in the key,
 * irrespective of how much we copied into the buffer.
L
Linus Torvalds 已提交
702 703 704
 */
long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
{
705 706
	struct key *key;
	key_ref_t key_ref;
L
Linus Torvalds 已提交
707 708 709
	long ret;

	/* find the key first */
710
	key_ref = lookup_user_key(keyid, 0, 0);
711 712 713
	if (IS_ERR(key_ref)) {
		ret = -ENOKEY;
		goto error;
L
Linus Torvalds 已提交
714 715
	}

716 717 718
	key = key_ref_to_ptr(key_ref);

	/* see if we can read it directly */
719 720
	ret = key_permission(key_ref, KEY_READ);
	if (ret == 0)
721
		goto can_read_key;
722 723
	if (ret != -EACCES)
		goto error;
724 725 726 727 728 729 730 731 732

	/* we can't; see if it's searchable from this process's keyrings
	 * - we automatically take account of the fact that it may be
	 *   dangling off an instantiation key
	 */
	if (!is_key_possessed(key_ref)) {
		ret = -EACCES;
		goto error2;
	}
L
Linus Torvalds 已提交
733 734

	/* the key is probably readable - now try to read it */
735
can_read_key:
L
Linus Torvalds 已提交
736 737 738 739 740 741 742 743 744 745 746 747
	ret = key_validate(key);
	if (ret == 0) {
		ret = -EOPNOTSUPP;
		if (key->type->read) {
			/* read the data with the semaphore held (since we
			 * might sleep) */
			down_read(&key->sem);
			ret = key->type->read(key, buffer, buflen);
			up_read(&key->sem);
		}
	}

748
error2:
L
Linus Torvalds 已提交
749
	key_put(key);
750
error:
L
Linus Torvalds 已提交
751
	return ret;
752
}
L
Linus Torvalds 已提交
753 754

/*
755 756 757 758 759 760 761 762 763 764 765 766 767
 * Change the ownership of a key
 *
 * The key must grant the caller Setattr permission for this to work, though
 * the key need not be fully instantiated yet.  For the UID to be changed, or
 * for the GID to be changed to a group the caller is not a member of, the
 * caller must have sysadmin capability.  If either uid or gid is -1 then that
 * attribute is not changed.
 *
 * If the UID is to be changed, the new user must have sufficient quota to
 * accept the key.  The quota deduction will be removed from the old user to
 * the new user should the attribute be changed.
 *
 * If successful, 0 will be returned.
L
Linus Torvalds 已提交
768 769 770
 */
long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
{
771
	struct key_user *newowner, *zapowner = NULL;
L
Linus Torvalds 已提交
772
	struct key *key;
773
	key_ref_t key_ref;
L
Linus Torvalds 已提交
774 775 776 777 778 779
	long ret;

	ret = 0;
	if (uid == (uid_t) -1 && gid == (gid_t) -1)
		goto error;

780 781
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
782 783
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
784 785 786
		goto error;
	}

787 788
	key = key_ref_to_ptr(key_ref);

L
Linus Torvalds 已提交
789 790 791 792 793 794 795
	/* make the changes with the locks held to prevent chown/chown races */
	ret = -EACCES;
	down_write(&key->sem);

	if (!capable(CAP_SYS_ADMIN)) {
		/* only the sysadmin can chown a key to some other UID */
		if (uid != (uid_t) -1 && key->uid != uid)
796
			goto error_put;
L
Linus Torvalds 已提交
797 798 799 800

		/* only the sysadmin can set the key's GID to a group other
		 * than one of those that the current process subscribes to */
		if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
801
			goto error_put;
L
Linus Torvalds 已提交
802 803
	}

804
	/* change the UID */
L
Linus Torvalds 已提交
805
	if (uid != (uid_t) -1 && uid != key->uid) {
806
		ret = -ENOMEM;
807
		newowner = key_user_lookup(uid, current_user_ns());
808 809 810 811 812
		if (!newowner)
			goto error_put;

		/* transfer the quota burden to the new user */
		if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
813 814 815 816 817
			unsigned maxkeys = (uid == 0) ?
				key_quota_root_maxkeys : key_quota_maxkeys;
			unsigned maxbytes = (uid == 0) ?
				key_quota_root_maxbytes : key_quota_maxbytes;

818
			spin_lock(&newowner->lock);
819 820 821 822
			if (newowner->qnkeys + 1 >= maxkeys ||
			    newowner->qnbytes + key->quotalen >= maxbytes ||
			    newowner->qnbytes + key->quotalen <
			    newowner->qnbytes)
823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845
				goto quota_overrun;

			newowner->qnkeys++;
			newowner->qnbytes += key->quotalen;
			spin_unlock(&newowner->lock);

			spin_lock(&key->user->lock);
			key->user->qnkeys--;
			key->user->qnbytes -= key->quotalen;
			spin_unlock(&key->user->lock);
		}

		atomic_dec(&key->user->nkeys);
		atomic_inc(&newowner->nkeys);

		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
			atomic_dec(&key->user->nikeys);
			atomic_inc(&newowner->nikeys);
		}

		zapowner = key->user;
		key->user = newowner;
		key->uid = uid;
L
Linus Torvalds 已提交
846 847 848 849 850 851 852 853
	}

	/* change the GID */
	if (gid != (gid_t) -1)
		key->gid = gid;

	ret = 0;

854
error_put:
L
Linus Torvalds 已提交
855 856
	up_write(&key->sem);
	key_put(key);
857 858 859
	if (zapowner)
		key_user_put(zapowner);
error:
L
Linus Torvalds 已提交
860 861
	return ret;

862 863 864 865 866
quota_overrun:
	spin_unlock(&newowner->lock);
	zapowner = newowner;
	ret = -EDQUOT;
	goto error_put;
867
}
868

L
Linus Torvalds 已提交
869
/*
870 871 872 873 874
 * Change the permission mask on a key.
 *
 * The key must grant the caller Setattr permission for this to work, though
 * the key need not be fully instantiated yet.  If the caller does not have
 * sysadmin capability, it may only change the permission on keys that it owns.
L
Linus Torvalds 已提交
875 876 877 878
 */
long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
{
	struct key *key;
879
	key_ref_t key_ref;
L
Linus Torvalds 已提交
880 881 882
	long ret;

	ret = -EINVAL;
883
	if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
L
Linus Torvalds 已提交
884 885
		goto error;

886 887
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
888 889
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
890 891 892
		goto error;
	}

893 894
	key = key_ref_to_ptr(key_ref);

895
	/* make the changes with the locks held to prevent chown/chmod races */
L
Linus Torvalds 已提交
896 897 898
	ret = -EACCES;
	down_write(&key->sem);

899
	/* if we're not the sysadmin, we can only change a key that we own */
900
	if (capable(CAP_SYS_ADMIN) || key->uid == current_fsuid()) {
901 902 903
		key->perm = perm;
		ret = 0;
	}
L
Linus Torvalds 已提交
904 905 906

	up_write(&key->sem);
	key_put(key);
907
error:
L
Linus Torvalds 已提交
908
	return ret;
909
}
L
Linus Torvalds 已提交
910

911
/*
912 913
 * Get the destination keyring for instantiation and check that the caller has
 * Write permission on it.
914 915 916 917 918 919 920
 */
static long get_instantiation_keyring(key_serial_t ringid,
				      struct request_key_auth *rka,
				      struct key **_dest_keyring)
{
	key_ref_t dkref;

921 922
	*_dest_keyring = NULL;

923
	/* just return a NULL pointer if we weren't asked to make a link */
924
	if (ringid == 0)
925 926 927 928
		return 0;

	/* if a specific keyring is nominated by ID, then use that */
	if (ringid > 0) {
929
		dkref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
930 931 932 933 934 935 936 937 938 939 940 941
		if (IS_ERR(dkref))
			return PTR_ERR(dkref);
		*_dest_keyring = key_ref_to_ptr(dkref);
		return 0;
	}

	if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
		return -EINVAL;

	/* otherwise specify the destination keyring recorded in the
	 * authorisation key (any KEY_SPEC_*_KEYRING) */
	if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
942
		*_dest_keyring = key_get(rka->dest_keyring);
943 944 945 946 947 948
		return 0;
	}

	return -ENOKEY;
}

D
David Howells 已提交
949
/*
950
 * Change the request_key authorisation key on the current process.
D
David Howells 已提交
951 952 953 954 955 956 957 958 959 960 961 962 963 964 965
 */
static int keyctl_change_reqkey_auth(struct key *key)
{
	struct cred *new;

	new = prepare_creds();
	if (!new)
		return -ENOMEM;

	key_put(new->request_key_auth);
	new->request_key_auth = key_get(key);

	return commit_creds(new);
}

966 967 968 969 970 971 972 973 974 975 976 977 978 979 980
/*
 * Copy the iovec data from userspace
 */
static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
				 unsigned ioc)
{
	for (; ioc > 0; ioc--) {
		if (copy_from_user(buffer, iov->iov_base, iov->iov_len) != 0)
			return -EFAULT;
		buffer += iov->iov_len;
		iov++;
	}
	return 0;
}

L
Linus Torvalds 已提交
981
/*
982 983 984 985 986 987 988
 * Instantiate a key with the specified payload and link the key into the
 * destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
L
Linus Torvalds 已提交
989
 */
990 991 992 993 994
long keyctl_instantiate_key_common(key_serial_t id,
				   const struct iovec *payload_iov,
				   unsigned ioc,
				   size_t plen,
				   key_serial_t ringid)
L
Linus Torvalds 已提交
995
{
D
David Howells 已提交
996
	const struct cred *cred = current_cred();
997
	struct request_key_auth *rka;
998
	struct key *instkey, *dest_keyring;
L
Linus Torvalds 已提交
999 1000
	void *payload;
	long ret;
1001
	bool vm = false;
L
Linus Torvalds 已提交
1002

D
David Howells 已提交
1003 1004
	kenter("%d,,%zu,%d", id, plen, ringid);

L
Linus Torvalds 已提交
1005
	ret = -EINVAL;
1006
	if (plen > 1024 * 1024 - 1)
L
Linus Torvalds 已提交
1007 1008
		goto error;

1009 1010 1011
	/* the appropriate instantiation authorisation key must have been
	 * assumed before calling this */
	ret = -EPERM;
D
David Howells 已提交
1012
	instkey = cred->request_key_auth;
1013 1014 1015 1016 1017 1018 1019
	if (!instkey)
		goto error;

	rka = instkey->payload.data;
	if (rka->target_key->serial != id)
		goto error;

L
Linus Torvalds 已提交
1020 1021 1022
	/* pull the payload in if one was supplied */
	payload = NULL;

1023
	if (payload_iov) {
L
Linus Torvalds 已提交
1024 1025
		ret = -ENOMEM;
		payload = kmalloc(plen, GFP_KERNEL);
1026 1027 1028 1029 1030 1031 1032 1033
		if (!payload) {
			if (plen <= PAGE_SIZE)
				goto error;
			vm = true;
			payload = vmalloc(plen);
			if (!payload)
				goto error;
		}
L
Linus Torvalds 已提交
1034

1035 1036
		ret = copy_from_user_iovec(payload, payload_iov, ioc);
		if (ret < 0)
L
Linus Torvalds 已提交
1037 1038 1039
			goto error2;
	}

1040 1041
	/* find the destination keyring amongst those belonging to the
	 * requesting task */
1042 1043 1044
	ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
	if (ret < 0)
		goto error2;
L
Linus Torvalds 已提交
1045 1046

	/* instantiate the key and link it into a keyring */
1047
	ret = key_instantiate_and_link(rka->target_key, payload, plen,
1048
				       dest_keyring, instkey);
L
Linus Torvalds 已提交
1049

1050
	key_put(dest_keyring);
1051 1052 1053

	/* discard the assumed authority if it's just been disabled by
	 * instantiation of the key */
D
David Howells 已提交
1054 1055
	if (ret == 0)
		keyctl_change_reqkey_auth(NULL);
1056 1057

error2:
1058 1059 1060 1061
	if (!vm)
		kfree(payload);
	else
		vfree(payload);
1062
error:
L
Linus Torvalds 已提交
1063
	return ret;
1064
}
L
Linus Torvalds 已提交
1065

1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112
/*
 * Instantiate a key with the specified payload and link the key into the
 * destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
 */
long keyctl_instantiate_key(key_serial_t id,
			    const void __user *_payload,
			    size_t plen,
			    key_serial_t ringid)
{
	if (_payload && plen) {
		struct iovec iov[1] = {
			[0].iov_base = (void __user *)_payload,
			[0].iov_len  = plen
		};

		return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
	}

	return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
}

/*
 * Instantiate a key with the specified multipart payload and link the key into
 * the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * If successful, 0 will be returned.
 */
long keyctl_instantiate_key_iov(key_serial_t id,
				const struct iovec __user *_payload_iov,
				unsigned ioc,
				key_serial_t ringid)
{
	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
	long ret;

	if (_payload_iov == 0 || ioc == 0)
		goto no_payload;

	ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
1113
				    ARRAY_SIZE(iovstack), iovstack, &iov);
1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131
	if (ret < 0)
		return ret;
	if (ret == 0)
		goto no_payload_free;

	ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);

	if (iov != iovstack)
		kfree(iov);
	return ret;

no_payload_free:
	if (iov != iovstack)
		kfree(iov);
no_payload:
	return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
}

L
Linus Torvalds 已提交
1132
/*
1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145
 * Negatively instantiate the key with the given timeout (in seconds) and link
 * the key into the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * The key and any links to the key will be automatically garbage collected
 * after the timeout expires.
 *
 * Negative keys are used to rate limit repeated request_key() calls by causing
 * them to return -ENOKEY until the negative key expires.
 *
 * If successful, 0 will be returned.
L
Linus Torvalds 已提交
1146 1147
 */
long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168
{
	return keyctl_reject_key(id, timeout, ENOKEY, ringid);
}

/*
 * Negatively instantiate the key with the given timeout (in seconds) and error
 * code and link the key into the destination keyring if one is given.
 *
 * The caller must have the appropriate instantiation permit set for this to
 * work (see keyctl_assume_authority).  No other permissions are required.
 *
 * The key and any links to the key will be automatically garbage collected
 * after the timeout expires.
 *
 * Negative keys are used to rate limit repeated request_key() calls by causing
 * them to return the specified error code until the negative key expires.
 *
 * If successful, 0 will be returned.
 */
long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
		       key_serial_t ringid)
L
Linus Torvalds 已提交
1169
{
D
David Howells 已提交
1170
	const struct cred *cred = current_cred();
1171
	struct request_key_auth *rka;
1172
	struct key *instkey, *dest_keyring;
L
Linus Torvalds 已提交
1173 1174
	long ret;

1175 1176 1177 1178 1179 1180 1181 1182 1183 1184
	kenter("%d,%u,%u,%d", id, timeout, error, ringid);

	/* must be a valid error code and mustn't be a kernel special */
	if (error <= 0 ||
	    error >= MAX_ERRNO ||
	    error == ERESTARTSYS ||
	    error == ERESTARTNOINTR ||
	    error == ERESTARTNOHAND ||
	    error == ERESTART_RESTARTBLOCK)
		return -EINVAL;
D
David Howells 已提交
1185

1186 1187 1188
	/* the appropriate instantiation authorisation key must have been
	 * assumed before calling this */
	ret = -EPERM;
D
David Howells 已提交
1189
	instkey = cred->request_key_auth;
1190
	if (!instkey)
L
Linus Torvalds 已提交
1191 1192
		goto error;

1193
	rka = instkey->payload.data;
1194 1195
	if (rka->target_key->serial != id)
		goto error;
1196

L
Linus Torvalds 已提交
1197 1198
	/* find the destination keyring if present (which must also be
	 * writable) */
1199 1200 1201
	ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
	if (ret < 0)
		goto error;
L
Linus Torvalds 已提交
1202 1203

	/* instantiate the key and link it into a keyring */
1204
	ret = key_reject_and_link(rka->target_key, timeout, error,
1205
				  dest_keyring, instkey);
L
Linus Torvalds 已提交
1206

1207
	key_put(dest_keyring);
1208 1209 1210

	/* discard the assumed authority if it's just been disabled by
	 * instantiation of the key */
D
David Howells 已提交
1211 1212
	if (ret == 0)
		keyctl_change_reqkey_auth(NULL);
1213 1214

error:
L
Linus Torvalds 已提交
1215
	return ret;
1216
}
L
Linus Torvalds 已提交
1217

1218
/*
1219 1220 1221 1222 1223
 * Read or set the default keyring in which request_key() will cache keys and
 * return the old setting.
 *
 * If a process keyring is specified then this will be created if it doesn't
 * yet exist.  The old setting will be returned if successful.
1224 1225 1226
 */
long keyctl_set_reqkey_keyring(int reqkey_defl)
{
D
David Howells 已提交
1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237
	struct cred *new;
	int ret, old_setting;

	old_setting = current_cred_xxx(jit_keyring);

	if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
		return old_setting;

	new = prepare_creds();
	if (!new)
		return -ENOMEM;
1238 1239 1240

	switch (reqkey_defl) {
	case KEY_REQKEY_DEFL_THREAD_KEYRING:
D
David Howells 已提交
1241
		ret = install_thread_keyring_to_cred(new);
1242
		if (ret < 0)
D
David Howells 已提交
1243
			goto error;
1244 1245 1246
		goto set;

	case KEY_REQKEY_DEFL_PROCESS_KEYRING:
D
David Howells 已提交
1247 1248 1249 1250 1251 1252 1253
		ret = install_process_keyring_to_cred(new);
		if (ret < 0) {
			if (ret != -EEXIST)
				goto error;
			ret = 0;
		}
		goto set;
1254 1255 1256 1257 1258

	case KEY_REQKEY_DEFL_DEFAULT:
	case KEY_REQKEY_DEFL_SESSION_KEYRING:
	case KEY_REQKEY_DEFL_USER_KEYRING:
	case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
D
David Howells 已提交
1259 1260
	case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
		goto set;
1261 1262 1263 1264

	case KEY_REQKEY_DEFL_NO_CHANGE:
	case KEY_REQKEY_DEFL_GROUP_KEYRING:
	default:
D
David Howells 已提交
1265 1266
		ret = -EINVAL;
		goto error;
1267 1268
	}

D
David Howells 已提交
1269 1270 1271 1272 1273 1274
set:
	new->jit_keyring = reqkey_defl;
	commit_creds(new);
	return old_setting;
error:
	abort_creds(new);
1275
	return ret;
1276
}
D
David Howells 已提交
1277

1278
/*
1279 1280 1281 1282 1283 1284 1285 1286 1287 1288
 * Set or clear the timeout on a key.
 *
 * Either the key must grant the caller Setattr permission or else the caller
 * must hold an instantiation authorisation token for the key.
 *
 * The timeout is either 0 to clear the timeout, or a number of seconds from
 * the current time.  The key and any links to the key will be automatically
 * garbage collected after the timeout expires.
 *
 * If successful, 0 is returned.
1289 1290 1291
 */
long keyctl_set_timeout(key_serial_t id, unsigned timeout)
{
1292
	struct key *key, *instkey;
1293 1294 1295
	key_ref_t key_ref;
	long ret;

1296 1297
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
1298
	if (IS_ERR(key_ref)) {
1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312
		/* setting the timeout on a key under construction is permitted
		 * if we have the authorisation token handy */
		if (PTR_ERR(key_ref) == -EACCES) {
			instkey = key_get_instantiation_authkey(id);
			if (!IS_ERR(instkey)) {
				key_put(instkey);
				key_ref = lookup_user_key(id,
							  KEY_LOOKUP_PARTIAL,
							  0);
				if (!IS_ERR(key_ref))
					goto okay;
			}
		}

1313 1314 1315 1316
		ret = PTR_ERR(key_ref);
		goto error;
	}

1317
okay:
1318
	key = key_ref_to_ptr(key_ref);
1319
	key_set_timeout(key, timeout);
1320 1321 1322 1323 1324
	key_put(key);

	ret = 0;
error:
	return ret;
1325
}
1326

1327
/*
1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
 * Assume (or clear) the authority to instantiate the specified key.
 *
 * This sets the authoritative token currently in force for key instantiation.
 * This must be done for a key to be instantiated.  It has the effect of making
 * available all the keys from the caller of the request_key() that created a
 * key to request_key() calls made by the caller of this function.
 *
 * The caller must have the instantiation key in their process keyrings with a
 * Search permission grant available to the caller.
 *
 * If the ID given is 0, then the setting will be cleared and 0 returned.
 *
 * If the ID given has a matching an authorisation key, then that key will be
 * set and its ID will be returned.  The authorisation key can be read to get
 * the callout information passed to request_key().
1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355
 */
long keyctl_assume_authority(key_serial_t id)
{
	struct key *authkey;
	long ret;

	/* special key IDs aren't permitted */
	ret = -EINVAL;
	if (id < 0)
		goto error;

	/* we divest ourselves of authority if given an ID of 0 */
	if (id == 0) {
D
David Howells 已提交
1356
		ret = keyctl_change_reqkey_auth(NULL);
1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370
		goto error;
	}

	/* attempt to assume the authority temporarily granted to us whilst we
	 * instantiate the specified key
	 * - the authorisation key must be in the current task's keyrings
	 *   somewhere
	 */
	authkey = key_get_instantiation_authkey(id);
	if (IS_ERR(authkey)) {
		ret = PTR_ERR(authkey);
		goto error;
	}

D
David Howells 已提交
1371 1372 1373 1374
	ret = keyctl_change_reqkey_auth(authkey);
	if (ret < 0)
		goto error;
	key_put(authkey);
1375

D
David Howells 已提交
1376
	ret = authkey->serial;
1377 1378
error:
	return ret;
1379
}
1380

1381
/*
1382 1383 1384 1385 1386 1387 1388 1389
 * Get a key's the LSM security label.
 *
 * The key must grant the caller View permission for this to work.
 *
 * If there's a buffer, then up to buflen bytes of data will be placed into it.
 *
 * If successful, the amount of information available will be returned,
 * irrespective of how much was copied (including the terminal NUL).
1390 1391 1392 1393 1394 1395 1396 1397 1398 1399
 */
long keyctl_get_security(key_serial_t keyid,
			 char __user *buffer,
			 size_t buflen)
{
	struct key *key, *instkey;
	key_ref_t key_ref;
	char *context;
	long ret;

1400
	key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
1401 1402 1403 1404 1405 1406 1407 1408
	if (IS_ERR(key_ref)) {
		if (PTR_ERR(key_ref) != -EACCES)
			return PTR_ERR(key_ref);

		/* viewing a key under construction is also permitted if we
		 * have the authorisation token handy */
		instkey = key_get_instantiation_authkey(keyid);
		if (IS_ERR(instkey))
1409
			return PTR_ERR(instkey);
1410 1411
		key_put(instkey);

1412
		key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, 0);
1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442
		if (IS_ERR(key_ref))
			return PTR_ERR(key_ref);
	}

	key = key_ref_to_ptr(key_ref);
	ret = security_key_getsecurity(key, &context);
	if (ret == 0) {
		/* if no information was returned, give userspace an empty
		 * string */
		ret = 1;
		if (buffer && buflen > 0 &&
		    copy_to_user(buffer, "", 1) != 0)
			ret = -EFAULT;
	} else if (ret > 0) {
		/* return as much data as there's room for */
		if (buffer && buflen > 0) {
			if (buflen > ret)
				buflen = ret;

			if (copy_to_user(buffer, context, buflen) != 0)
				ret = -EFAULT;
		}

		kfree(context);
	}

	key_ref_put(key_ref);
	return ret;
}

1443
/*
1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
 * Attempt to install the calling process's session keyring on the process's
 * parent process.
 *
 * The keyring must exist and must grant the caller LINK permission, and the
 * parent process must be single-threaded and must have the same effective
 * ownership as this process and mustn't be SUID/SGID.
 *
 * The keyring will be emplaced on the parent when it next resumes userspace.
 *
 * If successful, 0 will be returned.
1454 1455 1456 1457 1458
 */
long keyctl_session_to_parent(void)
{
	struct task_struct *me, *parent;
	const struct cred *mycred, *pcred;
A
Al Viro 已提交
1459 1460
	struct kludge *newwork;
	struct task_work *oldwork;
1461
	key_ref_t keyring_r;
1462
	struct cred *cred;
1463 1464 1465 1466 1467 1468
	int ret;

	keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_LINK);
	if (IS_ERR(keyring_r))
		return PTR_ERR(keyring_r);

1469
	ret = -ENOMEM;
A
Al Viro 已提交
1470
	newwork = kmalloc(sizeof(struct kludge), GFP_KERNEL);
1471 1472 1473
	if (!newwork)
		goto error_keyring;

1474 1475 1476 1477 1478
	/* our parent is going to need a new cred struct, a new tgcred struct
	 * and new security data, so we allocate them here to prevent ENOMEM in
	 * our parent */
	cred = cred_alloc_blank();
	if (!cred)
1479
		goto error_newwork;
1480 1481

	cred->tgcred->session_keyring = key_ref_to_ptr(keyring_r);
A
Al Viro 已提交
1482 1483
	init_task_work(&newwork->twork, key_change_session_keyring);
	newwork->cred = cred;
1484 1485

	me = current;
1486
	rcu_read_lock();
1487 1488 1489
	write_lock_irq(&tasklist_lock);

	ret = -EPERM;
1490 1491
	oldwork = NULL;
	parent = me->real_parent;
1492 1493 1494

	/* the parent mustn't be init and mustn't be a kernel thread */
	if (parent->pid <= 1 || !parent->mm)
1495
		goto unlock;
1496 1497

	/* the parent must be single threaded */
1498
	if (!thread_group_empty(parent))
1499
		goto unlock;
1500 1501 1502 1503 1504 1505

	/* the parent and the child must have different session keyrings or
	 * there's no point */
	mycred = current_cred();
	pcred = __task_cred(parent);
	if (mycred == pcred ||
1506 1507 1508 1509
	    mycred->tgcred->session_keyring == pcred->tgcred->session_keyring) {
		ret = 0;
		goto unlock;
	}
1510 1511 1512

	/* the parent must have the same effective ownership and mustn't be
	 * SUID/SGID */
1513
	if (pcred->uid	!= mycred->euid	||
1514 1515
	    pcred->euid	!= mycred->euid	||
	    pcred->suid	!= mycred->euid	||
1516
	    pcred->gid	!= mycred->egid	||
1517 1518
	    pcred->egid	!= mycred->egid	||
	    pcred->sgid	!= mycred->egid)
1519
		goto unlock;
1520 1521

	/* the keyrings must have the same UID */
1522 1523
	if ((pcred->tgcred->session_keyring &&
	     pcred->tgcred->session_keyring->uid != mycred->euid) ||
1524
	    mycred->tgcred->session_keyring->uid != mycred->euid)
1525
		goto unlock;
1526

1527 1528
	/* cancel an already pending keyring replacement */
	oldwork = task_work_cancel(parent, key_change_session_keyring);
1529 1530 1531

	/* the replacement session keyring is applied just prior to userspace
	 * restarting */
A
Al Viro 已提交
1532
	ret = task_work_add(parent, &newwork->twork, true);
1533 1534 1535
	if (!ret)
		newwork = NULL;
unlock:
1536
	write_unlock_irq(&tasklist_lock);
1537
	rcu_read_unlock();
1538
	if (oldwork) {
A
Al Viro 已提交
1539
		put_cred(container_of(oldwork, struct kludge, twork)->cred);
1540 1541 1542
		kfree(oldwork);
	}
	if (newwork) {
A
Al Viro 已提交
1543
		put_cred(newwork->cred);
1544 1545
		kfree(newwork);
	}
1546 1547
	return ret;

1548 1549
error_newwork:
	kfree(newwork);
1550 1551 1552 1553 1554
error_keyring:
	key_ref_put(keyring_r);
	return ret;
}

L
Linus Torvalds 已提交
1555
/*
1556
 * The key control system call
L
Linus Torvalds 已提交
1557
 */
1558 1559
SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
		unsigned long, arg4, unsigned long, arg5)
L
Linus Torvalds 已提交
1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623
{
	switch (option) {
	case KEYCTL_GET_KEYRING_ID:
		return keyctl_get_keyring_ID((key_serial_t) arg2,
					     (int) arg3);

	case KEYCTL_JOIN_SESSION_KEYRING:
		return keyctl_join_session_keyring((const char __user *) arg2);

	case KEYCTL_UPDATE:
		return keyctl_update_key((key_serial_t) arg2,
					 (const void __user *) arg3,
					 (size_t) arg4);

	case KEYCTL_REVOKE:
		return keyctl_revoke_key((key_serial_t) arg2);

	case KEYCTL_DESCRIBE:
		return keyctl_describe_key((key_serial_t) arg2,
					   (char __user *) arg3,
					   (unsigned) arg4);

	case KEYCTL_CLEAR:
		return keyctl_keyring_clear((key_serial_t) arg2);

	case KEYCTL_LINK:
		return keyctl_keyring_link((key_serial_t) arg2,
					   (key_serial_t) arg3);

	case KEYCTL_UNLINK:
		return keyctl_keyring_unlink((key_serial_t) arg2,
					     (key_serial_t) arg3);

	case KEYCTL_SEARCH:
		return keyctl_keyring_search((key_serial_t) arg2,
					     (const char __user *) arg3,
					     (const char __user *) arg4,
					     (key_serial_t) arg5);

	case KEYCTL_READ:
		return keyctl_read_key((key_serial_t) arg2,
				       (char __user *) arg3,
				       (size_t) arg4);

	case KEYCTL_CHOWN:
		return keyctl_chown_key((key_serial_t) arg2,
					(uid_t) arg3,
					(gid_t) arg4);

	case KEYCTL_SETPERM:
		return keyctl_setperm_key((key_serial_t) arg2,
					  (key_perm_t) arg3);

	case KEYCTL_INSTANTIATE:
		return keyctl_instantiate_key((key_serial_t) arg2,
					      (const void __user *) arg3,
					      (size_t) arg4,
					      (key_serial_t) arg5);

	case KEYCTL_NEGATE:
		return keyctl_negate_key((key_serial_t) arg2,
					 (unsigned) arg3,
					 (key_serial_t) arg4);

1624 1625 1626
	case KEYCTL_SET_REQKEY_KEYRING:
		return keyctl_set_reqkey_keyring(arg2);

1627 1628 1629 1630
	case KEYCTL_SET_TIMEOUT:
		return keyctl_set_timeout((key_serial_t) arg2,
					  (unsigned) arg3);

1631 1632 1633
	case KEYCTL_ASSUME_AUTHORITY:
		return keyctl_assume_authority((key_serial_t) arg2);

1634 1635
	case KEYCTL_GET_SECURITY:
		return keyctl_get_security((key_serial_t) arg2,
1636
					   (char __user *) arg3,
1637 1638
					   (size_t) arg4);

1639 1640 1641
	case KEYCTL_SESSION_TO_PARENT:
		return keyctl_session_to_parent();

1642 1643 1644 1645 1646 1647
	case KEYCTL_REJECT:
		return keyctl_reject_key((key_serial_t) arg2,
					 (unsigned) arg3,
					 (unsigned) arg4,
					 (key_serial_t) arg5);

1648 1649 1650 1651 1652 1653 1654
	case KEYCTL_INSTANTIATE_IOV:
		return keyctl_instantiate_key_iov(
			(key_serial_t) arg2,
			(const struct iovec __user *) arg3,
			(unsigned) arg4,
			(key_serial_t) arg5);

D
David Howells 已提交
1655 1656 1657
	case KEYCTL_INVALIDATE:
		return keyctl_invalidate_key((key_serial_t) arg2);

L
Linus Torvalds 已提交
1658 1659 1660
	default:
		return -EOPNOTSUPP;
	}
1661
}