keyctl.c 33.1 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/* keyctl.c: userspace keyctl operations
 *
3
 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
L
Linus Torvalds 已提交
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/syscalls.h>
#include <linux/keyctl.h>
#include <linux/fs.h>
19
#include <linux/capability.h>
20
#include <linux/string.h>
L
Linus Torvalds 已提交
21
#include <linux/err.h>
22
#include <linux/vmalloc.h>
23
#include <linux/security.h>
L
Linus Torvalds 已提交
24 25 26
#include <asm/uaccess.h>
#include "internal.h"

27 28 29 30 31 32 33 34 35
static int key_get_type_from_user(char *type,
				  const char __user *_type,
				  unsigned len)
{
	int ret;

	ret = strncpy_from_user(type, _type, len);

	if (ret < 0)
36
		return ret;
37 38 39 40 41 42 43 44 45 46 47 48

	if (ret == 0 || ret >= len)
		return -EINVAL;

	if (type[0] == '.')
		return -EPERM;

	type[len - 1] = '\0';

	return 0;
}

L
Linus Torvalds 已提交
49 50 51 52 53 54 55 56
/*****************************************************************************/
/*
 * extract the description of a new key from userspace and either add it as a
 * new key to the specified keyring or update a matching key in that keyring
 * - the keyring must be writable
 * - returns the new key's serial number
 * - implements add_key()
 */
57 58 59 60 61
SYSCALL_DEFINE5(add_key, const char __user *, _type,
		const char __user *, _description,
		const void __user *, _payload,
		size_t, plen,
		key_serial_t, ringid)
L
Linus Torvalds 已提交
62
{
63
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
64 65
	char type[32], *description;
	void *payload;
66
	long ret;
67
	bool vm;
L
Linus Torvalds 已提交
68 69

	ret = -EINVAL;
70
	if (plen > 1024 * 1024 - 1)
L
Linus Torvalds 已提交
71 72 73
		goto error;

	/* draw all the data into kernel space */
74
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
75 76 77
	if (ret < 0)
		goto error;

78 79 80
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
81
		goto error;
82
	}
L
Linus Torvalds 已提交
83 84 85 86

	/* pull the payload in if one was supplied */
	payload = NULL;

87
	vm = false;
L
Linus Torvalds 已提交
88 89 90
	if (_payload) {
		ret = -ENOMEM;
		payload = kmalloc(plen, GFP_KERNEL);
91 92 93 94 95 96 97 98
		if (!payload) {
			if (plen <= PAGE_SIZE)
				goto error2;
			vm = true;
			payload = vmalloc(plen);
			if (!payload)
				goto error2;
		}
L
Linus Torvalds 已提交
99 100 101 102 103 104 105

		ret = -EFAULT;
		if (copy_from_user(payload, _payload, plen) != 0)
			goto error3;
	}

	/* find the target keyring (which must be writable) */
106
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
107 108
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
109 110 111 112 113
		goto error3;
	}

	/* create or update the requested key and add it to the target
	 * keyring */
114
	key_ref = key_create_or_update(keyring_ref, type, description,
115 116
				       payload, plen, KEY_PERM_UNDEF,
				       KEY_ALLOC_IN_QUOTA);
117 118 119
	if (!IS_ERR(key_ref)) {
		ret = key_ref_to_ptr(key_ref)->serial;
		key_ref_put(key_ref);
L
Linus Torvalds 已提交
120 121
	}
	else {
122
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
123 124
	}

125
	key_ref_put(keyring_ref);
L
Linus Torvalds 已提交
126
 error3:
127 128 129 130
	if (!vm)
		kfree(payload);
	else
		vfree(payload);
L
Linus Torvalds 已提交
131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148
 error2:
	kfree(description);
 error:
	return ret;

} /* end sys_add_key() */

/*****************************************************************************/
/*
 * search the process keyrings for a matching key
 * - nested keyrings may also be searched if they have Search permission
 * - if a key is found, it will be attached to the destination keyring if
 *   there's one specified
 * - /sbin/request-key will be invoked if _callout_info is non-NULL
 *   - the _callout_info string will be passed to /sbin/request-key
 *   - if the _callout_info string is empty, it will be rendered as "-"
 * - implements request_key()
 */
149 150 151 152
SYSCALL_DEFINE4(request_key, const char __user *, _type,
		const char __user *, _description,
		const char __user *, _callout_info,
		key_serial_t, destringid)
L
Linus Torvalds 已提交
153 154
{
	struct key_type *ktype;
155 156
	struct key *key;
	key_ref_t dest_ref;
157
	size_t callout_len;
L
Linus Torvalds 已提交
158
	char type[32], *description, *callout_info;
159
	long ret;
L
Linus Torvalds 已提交
160 161

	/* pull the type into kernel space */
162
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
163 164
	if (ret < 0)
		goto error;
165

L
Linus Torvalds 已提交
166
	/* pull the description into kernel space */
167 168 169
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
170
		goto error;
171
	}
L
Linus Torvalds 已提交
172 173 174

	/* pull the callout info into kernel space */
	callout_info = NULL;
175
	callout_len = 0;
L
Linus Torvalds 已提交
176
	if (_callout_info) {
177 178 179
		callout_info = strndup_user(_callout_info, PAGE_SIZE);
		if (IS_ERR(callout_info)) {
			ret = PTR_ERR(callout_info);
L
Linus Torvalds 已提交
180
			goto error2;
181
		}
182
		callout_len = strlen(callout_info);
L
Linus Torvalds 已提交
183 184 185
	}

	/* get the destination keyring if specified */
186
	dest_ref = NULL;
L
Linus Torvalds 已提交
187
	if (destringid) {
188 189
		dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
					   KEY_WRITE);
190 191
		if (IS_ERR(dest_ref)) {
			ret = PTR_ERR(dest_ref);
L
Linus Torvalds 已提交
192 193 194 195 196 197 198 199 200 201 202 203
			goto error3;
		}
	}

	/* find the key type */
	ktype = key_type_lookup(type);
	if (IS_ERR(ktype)) {
		ret = PTR_ERR(ktype);
		goto error4;
	}

	/* do the search */
204 205
	key = request_key_and_link(ktype, description, callout_info,
				   callout_len, NULL, key_ref_to_ptr(dest_ref),
206
				   KEY_ALLOC_IN_QUOTA);
L
Linus Torvalds 已提交
207 208 209 210 211 212 213
	if (IS_ERR(key)) {
		ret = PTR_ERR(key);
		goto error5;
	}

	ret = key->serial;

214
 	key_put(key);
215
error5:
L
Linus Torvalds 已提交
216
	key_type_put(ktype);
217
error4:
218
	key_ref_put(dest_ref);
219
error3:
L
Linus Torvalds 已提交
220
	kfree(callout_info);
221
error2:
L
Linus Torvalds 已提交
222
	kfree(description);
223
error:
L
Linus Torvalds 已提交
224 225 226 227 228 229 230 231 232 233 234 235
	return ret;

} /* end sys_request_key() */

/*****************************************************************************/
/*
 * get the ID of the specified process keyring
 * - the keyring must have search permission to be found
 * - implements keyctl(KEYCTL_GET_KEYRING_ID)
 */
long keyctl_get_keyring_ID(key_serial_t id, int create)
{
236
	key_ref_t key_ref;
237
	unsigned long lflags;
L
Linus Torvalds 已提交
238 239
	long ret;

240 241
	lflags = create ? KEY_LOOKUP_CREATE : 0;
	key_ref = lookup_user_key(id, lflags, KEY_SEARCH);
242 243
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
244 245 246
		goto error;
	}

247 248
	ret = key_ref_to_ptr(key_ref)->serial;
	key_ref_put(key_ref);
249
error:
L
Linus Torvalds 已提交
250 251 252 253 254 255 256 257 258 259 260 261
	return ret;

} /* end keyctl_get_keyring_ID() */

/*****************************************************************************/
/*
 * join the session keyring
 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
 */
long keyctl_join_session_keyring(const char __user *_name)
{
	char *name;
262
	long ret;
L
Linus Torvalds 已提交
263 264 265 266

	/* fetch the name from userspace */
	name = NULL;
	if (_name) {
267 268 269
		name = strndup_user(_name, PAGE_SIZE);
		if (IS_ERR(name)) {
			ret = PTR_ERR(name);
L
Linus Torvalds 已提交
270
			goto error;
271
		}
L
Linus Torvalds 已提交
272 273 274 275
	}

	/* join the session */
	ret = join_session_keyring(name);
276
	kfree(name);
L
Linus Torvalds 已提交
277

278
error:
L
Linus Torvalds 已提交
279 280 281 282 283 284 285 286 287 288 289 290 291 292
	return ret;

} /* end keyctl_join_session_keyring() */

/*****************************************************************************/
/*
 * update a key's data payload
 * - the key must be writable
 * - implements keyctl(KEYCTL_UPDATE)
 */
long keyctl_update_key(key_serial_t id,
		       const void __user *_payload,
		       size_t plen)
{
293
	key_ref_t key_ref;
L
Linus Torvalds 已提交
294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
	void *payload;
	long ret;

	ret = -EINVAL;
	if (plen > PAGE_SIZE)
		goto error;

	/* pull the payload in if one was supplied */
	payload = NULL;
	if (_payload) {
		ret = -ENOMEM;
		payload = kmalloc(plen, GFP_KERNEL);
		if (!payload)
			goto error;

		ret = -EFAULT;
		if (copy_from_user(payload, _payload, plen) != 0)
			goto error2;
	}

	/* find the target key (which must be writable) */
315
	key_ref = lookup_user_key(id, 0, KEY_WRITE);
316 317
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
318 319 320 321
		goto error2;
	}

	/* update the key */
322
	ret = key_update(key_ref, payload, plen);
L
Linus Torvalds 已提交
323

324
	key_ref_put(key_ref);
325
error2:
L
Linus Torvalds 已提交
326
	kfree(payload);
327
error:
L
Linus Torvalds 已提交
328 329 330 331 332 333 334 335 336 337 338 339
	return ret;

} /* end keyctl_update_key() */

/*****************************************************************************/
/*
 * revoke a key
 * - the key must be writable
 * - implements keyctl(KEYCTL_REVOKE)
 */
long keyctl_revoke_key(key_serial_t id)
{
340
	key_ref_t key_ref;
L
Linus Torvalds 已提交
341 342
	long ret;

343
	key_ref = lookup_user_key(id, 0, KEY_WRITE);
344 345
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
346 347 348 349 350 351 352
		if (ret != -EACCES)
			goto error;
		key_ref = lookup_user_key(id, 0, KEY_SETATTR);
		if (IS_ERR(key_ref)) {
			ret = PTR_ERR(key_ref);
			goto error;
		}
L
Linus Torvalds 已提交
353 354
	}

355
	key_revoke(key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
356 357
	ret = 0;

358
	key_ref_put(key_ref);
359
error:
360
	return ret;
L
Linus Torvalds 已提交
361 362 363 364 365 366 367 368 369 370 371

} /* end keyctl_revoke_key() */

/*****************************************************************************/
/*
 * clear the specified process keyring
 * - the keyring must be writable
 * - implements keyctl(KEYCTL_CLEAR)
 */
long keyctl_keyring_clear(key_serial_t ringid)
{
372
	key_ref_t keyring_ref;
L
Linus Torvalds 已提交
373 374
	long ret;

375
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
376 377
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
378 379 380
		goto error;
	}

381
	ret = keyring_clear(key_ref_to_ptr(keyring_ref));
L
Linus Torvalds 已提交
382

383
	key_ref_put(keyring_ref);
384
error:
L
Linus Torvalds 已提交
385 386 387 388 389 390 391 392 393 394 395 396 397
	return ret;

} /* end keyctl_keyring_clear() */

/*****************************************************************************/
/*
 * link a key into a keyring
 * - the keyring must be writable
 * - the key must be linkable
 * - implements keyctl(KEYCTL_LINK)
 */
long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
{
398
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
399 400
	long ret;

401
	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
402 403
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
404 405 406
		goto error;
	}

407
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_LINK);
408 409
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
410 411 412
		goto error2;
	}

413
	ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
414

415
	key_ref_put(key_ref);
416
error2:
417
	key_ref_put(keyring_ref);
418
error:
L
Linus Torvalds 已提交
419 420 421 422 423 424 425 426 427 428 429 430 431
	return ret;

} /* end keyctl_keyring_link() */

/*****************************************************************************/
/*
 * unlink the first attachment of a key from a keyring
 * - the keyring must be writable
 * - we don't need any permissions on the key
 * - implements keyctl(KEYCTL_UNLINK)
 */
long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
{
432
	key_ref_t keyring_ref, key_ref;
L
Linus Torvalds 已提交
433 434
	long ret;

435
	keyring_ref = lookup_user_key(ringid, 0, KEY_WRITE);
436 437
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
438 439 440
		goto error;
	}

441
	key_ref = lookup_user_key(id, KEY_LOOKUP_FOR_UNLINK, 0);
442 443
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
444 445 446
		goto error2;
	}

447
	ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
448

449
	key_ref_put(key_ref);
450
error2:
451
	key_ref_put(keyring_ref);
452
error:
L
Linus Torvalds 已提交
453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471
	return ret;

} /* end keyctl_keyring_unlink() */

/*****************************************************************************/
/*
 * describe a user key
 * - the key must have view permission
 * - if there's a buffer, we place up to buflen bytes of data into it
 * - unless there's an error, we return the amount of description available,
 *   irrespective of how much we may have copied
 * - the description is formatted thus:
 *	type;uid;gid;perm;description<NUL>
 * - implements keyctl(KEYCTL_DESCRIBE)
 */
long keyctl_describe_key(key_serial_t keyid,
			 char __user *buffer,
			 size_t buflen)
{
472
	struct key *key, *instkey;
473
	key_ref_t key_ref;
L
Linus Torvalds 已提交
474 475 476
	char *tmpbuf;
	long ret;

477
	key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
478
	if (IS_ERR(key_ref)) {
479 480
		/* viewing a key under construction is permitted if we have the
		 * authorisation token handy */
481
		if (PTR_ERR(key_ref) == -EACCES) {
482 483 484
			instkey = key_get_instantiation_authkey(keyid);
			if (!IS_ERR(instkey)) {
				key_put(instkey);
485
				key_ref = lookup_user_key(keyid,
486 487
							  KEY_LOOKUP_PARTIAL,
							  0);
488
				if (!IS_ERR(key_ref))
489 490 491 492
					goto okay;
			}
		}

493
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
494 495 496
		goto error;
	}

497
okay:
L
Linus Torvalds 已提交
498 499 500 501 502 503
	/* calculate how much description we're going to return */
	ret = -ENOMEM;
	tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
	if (!tmpbuf)
		goto error2;

504 505
	key = key_ref_to_ptr(key_ref);

L
Linus Torvalds 已提交
506
	ret = snprintf(tmpbuf, PAGE_SIZE - 1,
507 508 509 510 511 512 513
		       "%s;%d;%d;%08x;%s",
		       key_ref_to_ptr(key_ref)->type->name,
		       key_ref_to_ptr(key_ref)->uid,
		       key_ref_to_ptr(key_ref)->gid,
		       key_ref_to_ptr(key_ref)->perm,
		       key_ref_to_ptr(key_ref)->description ?
		       key_ref_to_ptr(key_ref)->description : ""
L
Linus Torvalds 已提交
514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531
		       );

	/* include a NUL char at the end of the data */
	if (ret > PAGE_SIZE - 1)
		ret = PAGE_SIZE - 1;
	tmpbuf[ret] = 0;
	ret++;

	/* consider returning the data */
	if (buffer && buflen > 0) {
		if (buflen > ret)
			buflen = ret;

		if (copy_to_user(buffer, tmpbuf, buflen) != 0)
			ret = -EFAULT;
	}

	kfree(tmpbuf);
532
error2:
533
	key_ref_put(key_ref);
534
error:
L
Linus Torvalds 已提交
535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554
	return ret;

} /* end keyctl_describe_key() */

/*****************************************************************************/
/*
 * search the specified keyring for a matching key
 * - the start keyring must be searchable
 * - nested keyrings may also be searched if they are searchable
 * - only keys with search permission may be found
 * - if a key is found, it will be attached to the destination keyring if
 *   there's one specified
 * - implements keyctl(KEYCTL_SEARCH)
 */
long keyctl_keyring_search(key_serial_t ringid,
			   const char __user *_type,
			   const char __user *_description,
			   key_serial_t destringid)
{
	struct key_type *ktype;
555
	key_ref_t keyring_ref, key_ref, dest_ref;
L
Linus Torvalds 已提交
556
	char type[32], *description;
557
	long ret;
L
Linus Torvalds 已提交
558 559

	/* pull the type and description into kernel space */
560
	ret = key_get_type_from_user(type, _type, sizeof(type));
L
Linus Torvalds 已提交
561 562 563
	if (ret < 0)
		goto error;

564 565 566
	description = strndup_user(_description, PAGE_SIZE);
	if (IS_ERR(description)) {
		ret = PTR_ERR(description);
L
Linus Torvalds 已提交
567
		goto error;
568
	}
L
Linus Torvalds 已提交
569 570

	/* get the keyring at which to begin the search */
571
	keyring_ref = lookup_user_key(ringid, 0, KEY_SEARCH);
572 573
	if (IS_ERR(keyring_ref)) {
		ret = PTR_ERR(keyring_ref);
L
Linus Torvalds 已提交
574 575 576 577
		goto error2;
	}

	/* get the destination keyring if specified */
578
	dest_ref = NULL;
L
Linus Torvalds 已提交
579
	if (destringid) {
580 581
		dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
					   KEY_WRITE);
582 583
		if (IS_ERR(dest_ref)) {
			ret = PTR_ERR(dest_ref);
L
Linus Torvalds 已提交
584 585 586 587 588 589 590 591 592 593 594 595
			goto error3;
		}
	}

	/* find the key type */
	ktype = key_type_lookup(type);
	if (IS_ERR(ktype)) {
		ret = PTR_ERR(ktype);
		goto error4;
	}

	/* do the search */
596 597 598
	key_ref = keyring_search(keyring_ref, ktype, description);
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
599 600 601 602 603 604 605 606

		/* treat lack or presence of a negative key the same */
		if (ret == -EAGAIN)
			ret = -ENOKEY;
		goto error5;
	}

	/* link the resulting key to the destination keyring if we can */
607
	if (dest_ref) {
608 609
		ret = key_permission(key_ref, KEY_LINK);
		if (ret < 0)
L
Linus Torvalds 已提交
610 611
			goto error6;

612
		ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
L
Linus Torvalds 已提交
613 614 615 616
		if (ret < 0)
			goto error6;
	}

617
	ret = key_ref_to_ptr(key_ref)->serial;
L
Linus Torvalds 已提交
618

619
error6:
620
	key_ref_put(key_ref);
621
error5:
L
Linus Torvalds 已提交
622
	key_type_put(ktype);
623
error4:
624
	key_ref_put(dest_ref);
625
error3:
626
	key_ref_put(keyring_ref);
627
error2:
L
Linus Torvalds 已提交
628
	kfree(description);
629
error:
L
Linus Torvalds 已提交
630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645
	return ret;

} /* end keyctl_keyring_search() */

/*****************************************************************************/
/*
 * read a user key's payload
 * - the keyring must be readable or the key must be searchable from the
 *   process's keyrings
 * - if there's a buffer, we place up to buflen bytes of data into it
 * - unless there's an error, we return the amount of data in the key,
 *   irrespective of how much we may have copied
 * - implements keyctl(KEYCTL_READ)
 */
long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
{
646 647
	struct key *key;
	key_ref_t key_ref;
L
Linus Torvalds 已提交
648 649 650
	long ret;

	/* find the key first */
651
	key_ref = lookup_user_key(keyid, 0, 0);
652 653 654
	if (IS_ERR(key_ref)) {
		ret = -ENOKEY;
		goto error;
L
Linus Torvalds 已提交
655 656
	}

657 658 659
	key = key_ref_to_ptr(key_ref);

	/* see if we can read it directly */
660 661
	ret = key_permission(key_ref, KEY_READ);
	if (ret == 0)
662
		goto can_read_key;
663 664
	if (ret != -EACCES)
		goto error;
665 666 667 668 669 670 671 672 673

	/* we can't; see if it's searchable from this process's keyrings
	 * - we automatically take account of the fact that it may be
	 *   dangling off an instantiation key
	 */
	if (!is_key_possessed(key_ref)) {
		ret = -EACCES;
		goto error2;
	}
L
Linus Torvalds 已提交
674 675

	/* the key is probably readable - now try to read it */
676
can_read_key:
L
Linus Torvalds 已提交
677 678 679 680 681 682 683 684 685 686 687 688
	ret = key_validate(key);
	if (ret == 0) {
		ret = -EOPNOTSUPP;
		if (key->type->read) {
			/* read the data with the semaphore held (since we
			 * might sleep) */
			down_read(&key->sem);
			ret = key->type->read(key, buffer, buflen);
			up_read(&key->sem);
		}
	}

689
error2:
L
Linus Torvalds 已提交
690
	key_put(key);
691
error:
L
Linus Torvalds 已提交
692 693 694 695 696 697 698 699 700 701 702 703 704
	return ret;

} /* end keyctl_read_key() */

/*****************************************************************************/
/*
 * change the ownership of a key
 * - the keyring owned by the changer
 * - if the uid or gid is -1, then that parameter is not changed
 * - implements keyctl(KEYCTL_CHOWN)
 */
long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
{
705
	struct key_user *newowner, *zapowner = NULL;
L
Linus Torvalds 已提交
706
	struct key *key;
707
	key_ref_t key_ref;
L
Linus Torvalds 已提交
708 709 710 711 712 713
	long ret;

	ret = 0;
	if (uid == (uid_t) -1 && gid == (gid_t) -1)
		goto error;

714 715
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
716 717
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
718 719 720
		goto error;
	}

721 722
	key = key_ref_to_ptr(key_ref);

L
Linus Torvalds 已提交
723 724 725 726 727 728 729
	/* make the changes with the locks held to prevent chown/chown races */
	ret = -EACCES;
	down_write(&key->sem);

	if (!capable(CAP_SYS_ADMIN)) {
		/* only the sysadmin can chown a key to some other UID */
		if (uid != (uid_t) -1 && key->uid != uid)
730
			goto error_put;
L
Linus Torvalds 已提交
731 732 733 734

		/* only the sysadmin can set the key's GID to a group other
		 * than one of those that the current process subscribes to */
		if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
735
			goto error_put;
L
Linus Torvalds 已提交
736 737
	}

738
	/* change the UID */
L
Linus Torvalds 已提交
739
	if (uid != (uid_t) -1 && uid != key->uid) {
740
		ret = -ENOMEM;
741
		newowner = key_user_lookup(uid, current_user_ns());
742 743 744 745 746
		if (!newowner)
			goto error_put;

		/* transfer the quota burden to the new user */
		if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
747 748 749 750 751
			unsigned maxkeys = (uid == 0) ?
				key_quota_root_maxkeys : key_quota_maxkeys;
			unsigned maxbytes = (uid == 0) ?
				key_quota_root_maxbytes : key_quota_maxbytes;

752
			spin_lock(&newowner->lock);
753 754 755 756
			if (newowner->qnkeys + 1 >= maxkeys ||
			    newowner->qnbytes + key->quotalen >= maxbytes ||
			    newowner->qnbytes + key->quotalen <
			    newowner->qnbytes)
757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779
				goto quota_overrun;

			newowner->qnkeys++;
			newowner->qnbytes += key->quotalen;
			spin_unlock(&newowner->lock);

			spin_lock(&key->user->lock);
			key->user->qnkeys--;
			key->user->qnbytes -= key->quotalen;
			spin_unlock(&key->user->lock);
		}

		atomic_dec(&key->user->nkeys);
		atomic_inc(&newowner->nkeys);

		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
			atomic_dec(&key->user->nikeys);
			atomic_inc(&newowner->nikeys);
		}

		zapowner = key->user;
		key->user = newowner;
		key->uid = uid;
L
Linus Torvalds 已提交
780 781 782 783 784 785 786 787
	}

	/* change the GID */
	if (gid != (gid_t) -1)
		key->gid = gid;

	ret = 0;

788
error_put:
L
Linus Torvalds 已提交
789 790
	up_write(&key->sem);
	key_put(key);
791 792 793
	if (zapowner)
		key_user_put(zapowner);
error:
L
Linus Torvalds 已提交
794 795
	return ret;

796 797 798 799 800 801
quota_overrun:
	spin_unlock(&newowner->lock);
	zapowner = newowner;
	ret = -EDQUOT;
	goto error_put;

L
Linus Torvalds 已提交
802 803 804 805 806 807 808 809 810 811 812
} /* end keyctl_chown_key() */

/*****************************************************************************/
/*
 * change the permission mask on a key
 * - the keyring owned by the changer
 * - implements keyctl(KEYCTL_SETPERM)
 */
long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
{
	struct key *key;
813
	key_ref_t key_ref;
L
Linus Torvalds 已提交
814 815 816
	long ret;

	ret = -EINVAL;
817
	if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
L
Linus Torvalds 已提交
818 819
		goto error;

820 821
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
822 823
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
L
Linus Torvalds 已提交
824 825 826
		goto error;
	}

827 828
	key = key_ref_to_ptr(key_ref);

829
	/* make the changes with the locks held to prevent chown/chmod races */
L
Linus Torvalds 已提交
830 831 832
	ret = -EACCES;
	down_write(&key->sem);

833
	/* if we're not the sysadmin, we can only change a key that we own */
834
	if (capable(CAP_SYS_ADMIN) || key->uid == current_fsuid()) {
835 836 837
		key->perm = perm;
		ret = 0;
	}
L
Linus Torvalds 已提交
838 839 840

	up_write(&key->sem);
	key_put(key);
841
error:
L
Linus Torvalds 已提交
842 843 844 845
	return ret;

} /* end keyctl_setperm_key() */

846 847 848 849 850 851 852 853 854
/*
 * get the destination keyring for instantiation
 */
static long get_instantiation_keyring(key_serial_t ringid,
				      struct request_key_auth *rka,
				      struct key **_dest_keyring)
{
	key_ref_t dkref;

855 856
	*_dest_keyring = NULL;

857
	/* just return a NULL pointer if we weren't asked to make a link */
858
	if (ringid == 0)
859 860 861 862
		return 0;

	/* if a specific keyring is nominated by ID, then use that */
	if (ringid > 0) {
863
		dkref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
864 865 866 867 868 869 870 871 872 873 874 875
		if (IS_ERR(dkref))
			return PTR_ERR(dkref);
		*_dest_keyring = key_ref_to_ptr(dkref);
		return 0;
	}

	if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
		return -EINVAL;

	/* otherwise specify the destination keyring recorded in the
	 * authorisation key (any KEY_SPEC_*_KEYRING) */
	if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
876
		*_dest_keyring = key_get(rka->dest_keyring);
877 878 879 880 881 882
		return 0;
	}

	return -ENOKEY;
}

D
David Howells 已提交
883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899
/*
 * change the request_key authorisation key on the current process
 */
static int keyctl_change_reqkey_auth(struct key *key)
{
	struct cred *new;

	new = prepare_creds();
	if (!new)
		return -ENOMEM;

	key_put(new->request_key_auth);
	new->request_key_auth = key_get(key);

	return commit_creds(new);
}

L
Linus Torvalds 已提交
900 901 902 903 904 905 906 907 908 909
/*****************************************************************************/
/*
 * instantiate the key with the specified payload, and, if one is given, link
 * the key into the keyring
 */
long keyctl_instantiate_key(key_serial_t id,
			    const void __user *_payload,
			    size_t plen,
			    key_serial_t ringid)
{
D
David Howells 已提交
910
	const struct cred *cred = current_cred();
911
	struct request_key_auth *rka;
912
	struct key *instkey, *dest_keyring;
L
Linus Torvalds 已提交
913 914
	void *payload;
	long ret;
915
	bool vm = false;
L
Linus Torvalds 已提交
916

D
David Howells 已提交
917 918
	kenter("%d,,%zu,%d", id, plen, ringid);

L
Linus Torvalds 已提交
919
	ret = -EINVAL;
920
	if (plen > 1024 * 1024 - 1)
L
Linus Torvalds 已提交
921 922
		goto error;

923 924 925
	/* the appropriate instantiation authorisation key must have been
	 * assumed before calling this */
	ret = -EPERM;
D
David Howells 已提交
926
	instkey = cred->request_key_auth;
927 928 929 930 931 932 933
	if (!instkey)
		goto error;

	rka = instkey->payload.data;
	if (rka->target_key->serial != id)
		goto error;

L
Linus Torvalds 已提交
934 935 936 937 938 939
	/* pull the payload in if one was supplied */
	payload = NULL;

	if (_payload) {
		ret = -ENOMEM;
		payload = kmalloc(plen, GFP_KERNEL);
940 941 942 943 944 945 946 947
		if (!payload) {
			if (plen <= PAGE_SIZE)
				goto error;
			vm = true;
			payload = vmalloc(plen);
			if (!payload)
				goto error;
		}
L
Linus Torvalds 已提交
948 949 950 951 952 953

		ret = -EFAULT;
		if (copy_from_user(payload, _payload, plen) != 0)
			goto error2;
	}

954 955
	/* find the destination keyring amongst those belonging to the
	 * requesting task */
956 957 958
	ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
	if (ret < 0)
		goto error2;
L
Linus Torvalds 已提交
959 960

	/* instantiate the key and link it into a keyring */
961
	ret = key_instantiate_and_link(rka->target_key, payload, plen,
962
				       dest_keyring, instkey);
L
Linus Torvalds 已提交
963

964
	key_put(dest_keyring);
965 966 967

	/* discard the assumed authority if it's just been disabled by
	 * instantiation of the key */
D
David Howells 已提交
968 969
	if (ret == 0)
		keyctl_change_reqkey_auth(NULL);
970 971

error2:
972 973 974 975
	if (!vm)
		kfree(payload);
	else
		vfree(payload);
976
error:
L
Linus Torvalds 已提交
977 978 979 980 981 982 983 984 985 986 987
	return ret;

} /* end keyctl_instantiate_key() */

/*****************************************************************************/
/*
 * negatively instantiate the key with the given timeout (in seconds), and, if
 * one is given, link the key into the keyring
 */
long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
{
D
David Howells 已提交
988
	const struct cred *cred = current_cred();
989
	struct request_key_auth *rka;
990
	struct key *instkey, *dest_keyring;
L
Linus Torvalds 已提交
991 992
	long ret;

D
David Howells 已提交
993 994
	kenter("%d,%u,%d", id, timeout, ringid);

995 996 997
	/* the appropriate instantiation authorisation key must have been
	 * assumed before calling this */
	ret = -EPERM;
D
David Howells 已提交
998
	instkey = cred->request_key_auth;
999
	if (!instkey)
L
Linus Torvalds 已提交
1000 1001
		goto error;

1002
	rka = instkey->payload.data;
1003 1004
	if (rka->target_key->serial != id)
		goto error;
1005

L
Linus Torvalds 已提交
1006 1007
	/* find the destination keyring if present (which must also be
	 * writable) */
1008 1009 1010
	ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
	if (ret < 0)
		goto error;
L
Linus Torvalds 已提交
1011 1012

	/* instantiate the key and link it into a keyring */
1013
	ret = key_negate_and_link(rka->target_key, timeout,
1014
				  dest_keyring, instkey);
L
Linus Torvalds 已提交
1015

1016
	key_put(dest_keyring);
1017 1018 1019

	/* discard the assumed authority if it's just been disabled by
	 * instantiation of the key */
D
David Howells 已提交
1020 1021
	if (ret == 0)
		keyctl_change_reqkey_auth(NULL);
1022 1023

error:
L
Linus Torvalds 已提交
1024 1025 1026 1027
	return ret;

} /* end keyctl_negate_key() */

1028 1029 1030 1031 1032 1033 1034
/*****************************************************************************/
/*
 * set the default keyring in which request_key() will cache keys
 * - return the old setting
 */
long keyctl_set_reqkey_keyring(int reqkey_defl)
{
D
David Howells 已提交
1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045
	struct cred *new;
	int ret, old_setting;

	old_setting = current_cred_xxx(jit_keyring);

	if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
		return old_setting;

	new = prepare_creds();
	if (!new)
		return -ENOMEM;
1046 1047 1048

	switch (reqkey_defl) {
	case KEY_REQKEY_DEFL_THREAD_KEYRING:
D
David Howells 已提交
1049
		ret = install_thread_keyring_to_cred(new);
1050
		if (ret < 0)
D
David Howells 已提交
1051
			goto error;
1052 1053 1054
		goto set;

	case KEY_REQKEY_DEFL_PROCESS_KEYRING:
D
David Howells 已提交
1055 1056 1057 1058 1059 1060 1061
		ret = install_process_keyring_to_cred(new);
		if (ret < 0) {
			if (ret != -EEXIST)
				goto error;
			ret = 0;
		}
		goto set;
1062 1063 1064 1065 1066

	case KEY_REQKEY_DEFL_DEFAULT:
	case KEY_REQKEY_DEFL_SESSION_KEYRING:
	case KEY_REQKEY_DEFL_USER_KEYRING:
	case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
D
David Howells 已提交
1067 1068
	case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
		goto set;
1069 1070 1071 1072

	case KEY_REQKEY_DEFL_NO_CHANGE:
	case KEY_REQKEY_DEFL_GROUP_KEYRING:
	default:
D
David Howells 已提交
1073 1074
		ret = -EINVAL;
		goto error;
1075 1076
	}

D
David Howells 已提交
1077 1078 1079 1080 1081 1082
set:
	new->jit_keyring = reqkey_defl;
	commit_creds(new);
	return old_setting;
error:
	abort_creds(new);
1083
	return ret;
D
David Howells 已提交
1084

1085 1086
} /* end keyctl_set_reqkey_keyring() */

1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098
/*****************************************************************************/
/*
 * set or clear the timeout for a key
 */
long keyctl_set_timeout(key_serial_t id, unsigned timeout)
{
	struct timespec now;
	struct key *key;
	key_ref_t key_ref;
	time_t expiry;
	long ret;

1099 1100
	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
				  KEY_SETATTR);
1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117
	if (IS_ERR(key_ref)) {
		ret = PTR_ERR(key_ref);
		goto error;
	}

	key = key_ref_to_ptr(key_ref);

	/* make the changes with the locks held to prevent races */
	down_write(&key->sem);

	expiry = 0;
	if (timeout > 0) {
		now = current_kernel_time();
		expiry = now.tv_sec + timeout;
	}

	key->expiry = expiry;
D
David Howells 已提交
1118
	key_schedule_gc(key->expiry + key_gc_delay);
1119 1120 1121 1122 1123 1124 1125 1126 1127 1128

	up_write(&key->sem);
	key_put(key);

	ret = 0;
error:
	return ret;

} /* end keyctl_set_timeout() */

1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144
/*****************************************************************************/
/*
 * assume the authority to instantiate the specified key
 */
long keyctl_assume_authority(key_serial_t id)
{
	struct key *authkey;
	long ret;

	/* special key IDs aren't permitted */
	ret = -EINVAL;
	if (id < 0)
		goto error;

	/* we divest ourselves of authority if given an ID of 0 */
	if (id == 0) {
D
David Howells 已提交
1145
		ret = keyctl_change_reqkey_auth(NULL);
1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159
		goto error;
	}

	/* attempt to assume the authority temporarily granted to us whilst we
	 * instantiate the specified key
	 * - the authorisation key must be in the current task's keyrings
	 *   somewhere
	 */
	authkey = key_get_instantiation_authkey(id);
	if (IS_ERR(authkey)) {
		ret = PTR_ERR(authkey);
		goto error;
	}

D
David Howells 已提交
1160 1161 1162 1163
	ret = keyctl_change_reqkey_auth(authkey);
	if (ret < 0)
		goto error;
	key_put(authkey);
1164

D
David Howells 已提交
1165
	ret = authkey->serial;
1166 1167 1168 1169 1170
error:
	return ret;

} /* end keyctl_assume_authority() */

1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187
/*
 * get the security label of a key
 * - the key must grant us view permission
 * - if there's a buffer, we place up to buflen bytes of data into it
 * - unless there's an error, we return the amount of information available,
 *   irrespective of how much we may have copied (including the terminal NUL)
 * - implements keyctl(KEYCTL_GET_SECURITY)
 */
long keyctl_get_security(key_serial_t keyid,
			 char __user *buffer,
			 size_t buflen)
{
	struct key *key, *instkey;
	key_ref_t key_ref;
	char *context;
	long ret;

1188
	key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
1189 1190 1191 1192 1193 1194 1195 1196
	if (IS_ERR(key_ref)) {
		if (PTR_ERR(key_ref) != -EACCES)
			return PTR_ERR(key_ref);

		/* viewing a key under construction is also permitted if we
		 * have the authorisation token handy */
		instkey = key_get_instantiation_authkey(keyid);
		if (IS_ERR(instkey))
1197
			return PTR_ERR(instkey);
1198 1199
		key_put(instkey);

1200
		key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, 0);
1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
		if (IS_ERR(key_ref))
			return PTR_ERR(key_ref);
	}

	key = key_ref_to_ptr(key_ref);
	ret = security_key_getsecurity(key, &context);
	if (ret == 0) {
		/* if no information was returned, give userspace an empty
		 * string */
		ret = 1;
		if (buffer && buflen > 0 &&
		    copy_to_user(buffer, "", 1) != 0)
			ret = -EFAULT;
	} else if (ret > 0) {
		/* return as much data as there's room for */
		if (buffer && buflen > 0) {
			if (buflen > ret)
				buflen = ret;

			if (copy_to_user(buffer, context, buflen) != 0)
				ret = -EFAULT;
		}

		kfree(context);
	}

	key_ref_put(key_ref);
	return ret;
}

1231 1232 1233 1234 1235 1236 1237 1238
/*
 * attempt to install the calling process's session keyring on the process's
 * parent process
 * - the keyring must exist and must grant us LINK permission
 * - implements keyctl(KEYCTL_SESSION_TO_PARENT)
 */
long keyctl_session_to_parent(void)
{
1239
#ifdef TIF_NOTIFY_RESUME
1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271
	struct task_struct *me, *parent;
	const struct cred *mycred, *pcred;
	struct cred *cred, *oldcred;
	key_ref_t keyring_r;
	int ret;

	keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_LINK);
	if (IS_ERR(keyring_r))
		return PTR_ERR(keyring_r);

	/* our parent is going to need a new cred struct, a new tgcred struct
	 * and new security data, so we allocate them here to prevent ENOMEM in
	 * our parent */
	ret = -ENOMEM;
	cred = cred_alloc_blank();
	if (!cred)
		goto error_keyring;

	cred->tgcred->session_keyring = key_ref_to_ptr(keyring_r);
	keyring_r = NULL;

	me = current;
	write_lock_irq(&tasklist_lock);

	parent = me->real_parent;
	ret = -EPERM;

	/* the parent mustn't be init and mustn't be a kernel thread */
	if (parent->pid <= 1 || !parent->mm)
		goto not_permitted;

	/* the parent must be single threaded */
1272
	if (!thread_group_empty(parent))
1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284
		goto not_permitted;

	/* the parent and the child must have different session keyrings or
	 * there's no point */
	mycred = current_cred();
	pcred = __task_cred(parent);
	if (mycred == pcred ||
	    mycred->tgcred->session_keyring == pcred->tgcred->session_keyring)
		goto already_same;

	/* the parent must have the same effective ownership and mustn't be
	 * SUID/SGID */
1285
	if (pcred->uid	!= mycred->euid	||
1286 1287
	    pcred->euid	!= mycred->euid	||
	    pcred->suid	!= mycred->euid	||
1288
	    pcred->gid	!= mycred->egid	||
1289 1290 1291 1292 1293
	    pcred->egid	!= mycred->egid	||
	    pcred->sgid	!= mycred->egid)
		goto not_permitted;

	/* the keyrings must have the same UID */
1294
	if (pcred->tgcred->session_keyring->uid != mycred->euid ||
1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315
	    mycred->tgcred->session_keyring->uid != mycred->euid)
		goto not_permitted;

	/* if there's an already pending keyring replacement, then we replace
	 * that */
	oldcred = parent->replacement_session_keyring;

	/* the replacement session keyring is applied just prior to userspace
	 * restarting */
	parent->replacement_session_keyring = cred;
	cred = NULL;
	set_ti_thread_flag(task_thread_info(parent), TIF_NOTIFY_RESUME);

	write_unlock_irq(&tasklist_lock);
	if (oldcred)
		put_cred(oldcred);
	return 0;

already_same:
	ret = 0;
not_permitted:
1316
	write_unlock_irq(&tasklist_lock);
1317 1318 1319 1320 1321 1322
	put_cred(cred);
	return ret;

error_keyring:
	key_ref_put(keyring_r);
	return ret;
1323 1324 1325 1326 1327 1328 1329 1330 1331

#else /* !TIF_NOTIFY_RESUME */
	/*
	 * To be removed when TIF_NOTIFY_RESUME has been implemented on
	 * m68k/xtensa
	 */
#warning TIF_NOTIFY_RESUME not implemented
	return -EOPNOTSUPP;
#endif /* !TIF_NOTIFY_RESUME */
1332 1333
}

L
Linus Torvalds 已提交
1334 1335 1336 1337
/*****************************************************************************/
/*
 * the key control system call
 */
1338 1339
SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
		unsigned long, arg4, unsigned long, arg5)
L
Linus Torvalds 已提交
1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403
{
	switch (option) {
	case KEYCTL_GET_KEYRING_ID:
		return keyctl_get_keyring_ID((key_serial_t) arg2,
					     (int) arg3);

	case KEYCTL_JOIN_SESSION_KEYRING:
		return keyctl_join_session_keyring((const char __user *) arg2);

	case KEYCTL_UPDATE:
		return keyctl_update_key((key_serial_t) arg2,
					 (const void __user *) arg3,
					 (size_t) arg4);

	case KEYCTL_REVOKE:
		return keyctl_revoke_key((key_serial_t) arg2);

	case KEYCTL_DESCRIBE:
		return keyctl_describe_key((key_serial_t) arg2,
					   (char __user *) arg3,
					   (unsigned) arg4);

	case KEYCTL_CLEAR:
		return keyctl_keyring_clear((key_serial_t) arg2);

	case KEYCTL_LINK:
		return keyctl_keyring_link((key_serial_t) arg2,
					   (key_serial_t) arg3);

	case KEYCTL_UNLINK:
		return keyctl_keyring_unlink((key_serial_t) arg2,
					     (key_serial_t) arg3);

	case KEYCTL_SEARCH:
		return keyctl_keyring_search((key_serial_t) arg2,
					     (const char __user *) arg3,
					     (const char __user *) arg4,
					     (key_serial_t) arg5);

	case KEYCTL_READ:
		return keyctl_read_key((key_serial_t) arg2,
				       (char __user *) arg3,
				       (size_t) arg4);

	case KEYCTL_CHOWN:
		return keyctl_chown_key((key_serial_t) arg2,
					(uid_t) arg3,
					(gid_t) arg4);

	case KEYCTL_SETPERM:
		return keyctl_setperm_key((key_serial_t) arg2,
					  (key_perm_t) arg3);

	case KEYCTL_INSTANTIATE:
		return keyctl_instantiate_key((key_serial_t) arg2,
					      (const void __user *) arg3,
					      (size_t) arg4,
					      (key_serial_t) arg5);

	case KEYCTL_NEGATE:
		return keyctl_negate_key((key_serial_t) arg2,
					 (unsigned) arg3,
					 (key_serial_t) arg4);

1404 1405 1406
	case KEYCTL_SET_REQKEY_KEYRING:
		return keyctl_set_reqkey_keyring(arg2);

1407 1408 1409 1410
	case KEYCTL_SET_TIMEOUT:
		return keyctl_set_timeout((key_serial_t) arg2,
					  (unsigned) arg3);

1411 1412 1413
	case KEYCTL_ASSUME_AUTHORITY:
		return keyctl_assume_authority((key_serial_t) arg2);

1414 1415
	case KEYCTL_GET_SECURITY:
		return keyctl_get_security((key_serial_t) arg2,
1416
					   (char __user *) arg3,
1417 1418
					   (size_t) arg4);

1419 1420 1421
	case KEYCTL_SESSION_TO_PARENT:
		return keyctl_session_to_parent();

L
Linus Torvalds 已提交
1422 1423 1424 1425 1426
	default:
		return -EOPNOTSUPP;
	}

} /* end sys_keyctl() */