key.c 28.0 KB
Newer Older
1
/* Basic authentication token and access key management
L
Linus Torvalds 已提交
2
 *
3
 * Copyright (C) 2004-2008 Red Hat, Inc. All Rights Reserved.
L
Linus Torvalds 已提交
4 5 6 7 8 9 10 11 12 13
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>
#include <linux/init.h>
14
#include <linux/poison.h>
L
Linus Torvalds 已提交
15 16
#include <linux/sched.h>
#include <linux/slab.h>
17
#include <linux/security.h>
L
Linus Torvalds 已提交
18
#include <linux/workqueue.h>
19
#include <linux/random.h>
L
Linus Torvalds 已提交
20
#include <linux/err.h>
21
#include <linux/user_namespace.h>
L
Linus Torvalds 已提交
22 23
#include "internal.h"

24
static struct kmem_cache	*key_jar;
L
Linus Torvalds 已提交
25 26 27 28 29 30
struct rb_root		key_serial_tree; /* tree of keys indexed by serial */
DEFINE_SPINLOCK(key_serial_lock);

struct rb_root	key_user_tree; /* tree of quota records indexed by UID */
DEFINE_SPINLOCK(key_user_lock);

31 32 33 34 35
unsigned int key_quota_root_maxkeys = 200;	/* root's key count quota */
unsigned int key_quota_root_maxbytes = 20000;	/* root's key space quota */
unsigned int key_quota_maxkeys = 200;		/* general key count quota */
unsigned int key_quota_maxbytes = 20000;	/* general key space quota */

L
Linus Torvalds 已提交
36 37 38
static LIST_HEAD(key_types_list);
static DECLARE_RWSEM(key_types_sem);

39 40
static void key_cleanup(struct work_struct *work);
static DECLARE_WORK(key_cleanup_task, key_cleanup);
L
Linus Torvalds 已提交
41

42
/* We serialise key instantiation and link */
43
DEFINE_MUTEX(key_construction_mutex);
L
Linus Torvalds 已提交
44

45
/* Any key who's type gets unegistered will be re-typed to this */
46
static struct key_type key_type_dead = {
L
Linus Torvalds 已提交
47 48 49 50 51 52 53 54 55 56 57 58 59
	.name		= "dead",
};

#ifdef KEY_DEBUGGING
void __key_check(const struct key *key)
{
	printk("__key_check: key %p {%08x} should be {%08x}\n",
	       key, key->magic, KEY_DEBUG_MAGIC);
	BUG();
}
#endif

/*
60 61
 * Get the key quota record for a user, allocating a new record if one doesn't
 * already exist.
L
Linus Torvalds 已提交
62
 */
63
struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
L
Linus Torvalds 已提交
64 65 66 67 68
{
	struct key_user *candidate = NULL, *user;
	struct rb_node *parent = NULL;
	struct rb_node **p;

69
try_again:
L
Linus Torvalds 已提交
70 71 72 73 74 75 76 77 78 79 80 81
	p = &key_user_tree.rb_node;
	spin_lock(&key_user_lock);

	/* search the tree for a user record with a matching UID */
	while (*p) {
		parent = *p;
		user = rb_entry(parent, struct key_user, node);

		if (uid < user->uid)
			p = &(*p)->rb_left;
		else if (uid > user->uid)
			p = &(*p)->rb_right;
82 83 84 85
		else if (user_ns < user->user_ns)
			p = &(*p)->rb_left;
		else if (user_ns > user->user_ns)
			p = &(*p)->rb_right;
L
Linus Torvalds 已提交
86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112
		else
			goto found;
	}

	/* if we get here, we failed to find a match in the tree */
	if (!candidate) {
		/* allocate a candidate user record if we don't already have
		 * one */
		spin_unlock(&key_user_lock);

		user = NULL;
		candidate = kmalloc(sizeof(struct key_user), GFP_KERNEL);
		if (unlikely(!candidate))
			goto out;

		/* the allocation may have scheduled, so we need to repeat the
		 * search lest someone else added the record whilst we were
		 * asleep */
		goto try_again;
	}

	/* if we get here, then the user record still hadn't appeared on the
	 * second pass - so we use the candidate record */
	atomic_set(&candidate->usage, 1);
	atomic_set(&candidate->nkeys, 0);
	atomic_set(&candidate->nikeys, 0);
	candidate->uid = uid;
113
	candidate->user_ns = get_user_ns(user_ns);
L
Linus Torvalds 已提交
114 115 116
	candidate->qnkeys = 0;
	candidate->qnbytes = 0;
	spin_lock_init(&candidate->lock);
117
	mutex_init(&candidate->cons_lock);
L
Linus Torvalds 已提交
118 119 120 121 122 123 124 125

	rb_link_node(&candidate->node, parent, p);
	rb_insert_color(&candidate->node, &key_user_tree);
	spin_unlock(&key_user_lock);
	user = candidate;
	goto out;

	/* okay - we found a user record for this UID */
126
found:
L
Linus Torvalds 已提交
127 128
	atomic_inc(&user->usage);
	spin_unlock(&key_user_lock);
J
Jesper Juhl 已提交
129
	kfree(candidate);
130
out:
L
Linus Torvalds 已提交
131
	return user;
132
}
L
Linus Torvalds 已提交
133 134

/*
135
 * Dispose of a user structure
L
Linus Torvalds 已提交
136 137 138 139 140 141
 */
void key_user_put(struct key_user *user)
{
	if (atomic_dec_and_lock(&user->usage, &key_user_lock)) {
		rb_erase(&user->node, &key_user_tree);
		spin_unlock(&key_user_lock);
142
		put_user_ns(user->user_ns);
L
Linus Torvalds 已提交
143 144 145

		kfree(user);
	}
146
}
L
Linus Torvalds 已提交
147 148

/*
149 150
 * Allocate a serial number for a key.  These are assigned randomly to avoid
 * security issues through covert channel problems.
L
Linus Torvalds 已提交
151 152 153 154 155 156
 */
static inline void key_alloc_serial(struct key *key)
{
	struct rb_node *parent, **p;
	struct key *xkey;

157
	/* propose a random serial number and look for a hole for it in the
L
Linus Torvalds 已提交
158
	 * serial number tree */
159 160 161 162 163 164 165
	do {
		get_random_bytes(&key->serial, sizeof(key->serial));

		key->serial >>= 1; /* negative numbers are not permitted */
	} while (key->serial < 3);

	spin_lock(&key_serial_lock);
L
Linus Torvalds 已提交
166

167
attempt_insertion:
L
Linus Torvalds 已提交
168 169 170 171 172 173 174 175 176 177 178 179 180 181
	parent = NULL;
	p = &key_serial_tree.rb_node;

	while (*p) {
		parent = *p;
		xkey = rb_entry(parent, struct key, serial_node);

		if (key->serial < xkey->serial)
			p = &(*p)->rb_left;
		else if (key->serial > xkey->serial)
			p = &(*p)->rb_right;
		else
			goto serial_exists;
	}
182 183 184 185 186 187 188

	/* we've found a suitable hole - arrange for this key to occupy it */
	rb_link_node(&key->serial_node, parent, p);
	rb_insert_color(&key->serial_node, &key_serial_tree);

	spin_unlock(&key_serial_lock);
	return;
L
Linus Torvalds 已提交
189 190 191

	/* we found a key with the proposed serial number - walk the tree from
	 * that point looking for the next unused serial number */
192
serial_exists:
L
Linus Torvalds 已提交
193
	for (;;) {
194
		key->serial++;
195 196 197 198
		if (key->serial < 3) {
			key->serial = 3;
			goto attempt_insertion;
		}
L
Linus Torvalds 已提交
199 200 201

		parent = rb_next(parent);
		if (!parent)
202
			goto attempt_insertion;
L
Linus Torvalds 已提交
203 204 205

		xkey = rb_entry(parent, struct key, serial_node);
		if (key->serial < xkey->serial)
206
			goto attempt_insertion;
L
Linus Torvalds 已提交
207
	}
208
}
L
Linus Torvalds 已提交
209

210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237
/**
 * key_alloc - Allocate a key of the specified type.
 * @type: The type of key to allocate.
 * @desc: The key description to allow the key to be searched out.
 * @uid: The owner of the new key.
 * @gid: The group ID for the new key's group permissions.
 * @cred: The credentials specifying UID namespace.
 * @perm: The permissions mask of the new key.
 * @flags: Flags specifying quota properties.
 *
 * Allocate a key of the specified type with the attributes given.  The key is
 * returned in an uninstantiated state and the caller needs to instantiate the
 * key before returning.
 *
 * The user's key count quota is updated to reflect the creation of the key and
 * the user's key data quota has the default for the key type reserved.  The
 * instantiation function should amend this as necessary.  If insufficient
 * quota is available, -EDQUOT will be returned.
 *
 * The LSM security modules can prevent a key being created, in which case
 * -EACCES will be returned.
 *
 * Returns a pointer to the new key if successful and an error code otherwise.
 *
 * Note that the caller needs to ensure the key type isn't uninstantiated.
 * Internally this can be done by locking key_types_sem.  Externally, this can
 * be done by either never unregistering the key type, or making sure
 * key_alloc() calls don't race with module unloading.
L
Linus Torvalds 已提交
238 239
 */
struct key *key_alloc(struct key_type *type, const char *desc,
D
David Howells 已提交
240
		      uid_t uid, gid_t gid, const struct cred *cred,
241
		      key_perm_t perm, unsigned long flags)
L
Linus Torvalds 已提交
242 243 244 245
{
	struct key_user *user = NULL;
	struct key *key;
	size_t desclen, quotalen;
246
	int ret;
L
Linus Torvalds 已提交
247 248 249 250 251 252 253 254 255

	key = ERR_PTR(-EINVAL);
	if (!desc || !*desc)
		goto error;

	desclen = strlen(desc) + 1;
	quotalen = desclen + type->def_datalen;

	/* get hold of the key tracking for this user */
256
	user = key_user_lookup(uid, cred->user->user_ns);
L
Linus Torvalds 已提交
257 258 259 260 261
	if (!user)
		goto no_memory_1;

	/* check that the user's quota permits allocation of another key and
	 * its description */
262
	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
263 264 265 266 267
		unsigned maxkeys = (uid == 0) ?
			key_quota_root_maxkeys : key_quota_maxkeys;
		unsigned maxbytes = (uid == 0) ?
			key_quota_root_maxbytes : key_quota_maxbytes;

L
Linus Torvalds 已提交
268
		spin_lock(&user->lock);
269
		if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
270 271 272
			if (user->qnkeys + 1 >= maxkeys ||
			    user->qnbytes + quotalen >= maxbytes ||
			    user->qnbytes + quotalen < user->qnbytes)
273 274
				goto no_quota;
		}
L
Linus Torvalds 已提交
275 276 277 278 279 280 281

		user->qnkeys++;
		user->qnbytes += quotalen;
		spin_unlock(&user->lock);
	}

	/* allocate and initialise the key and its description */
282
	key = kmem_cache_alloc(key_jar, GFP_KERNEL);
L
Linus Torvalds 已提交
283 284 285 286
	if (!key)
		goto no_memory_2;

	if (desc) {
287
		key->description = kmemdup(desc, desclen, GFP_KERNEL);
L
Linus Torvalds 已提交
288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303
		if (!key->description)
			goto no_memory_3;
	}

	atomic_set(&key->usage, 1);
	init_rwsem(&key->sem);
	key->type = type;
	key->user = user;
	key->quotalen = quotalen;
	key->datalen = type->def_datalen;
	key->uid = uid;
	key->gid = gid;
	key->perm = perm;
	key->flags = 0;
	key->expiry = 0;
	key->payload.data = NULL;
304
	key->security = NULL;
L
Linus Torvalds 已提交
305

306
	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
307
		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
L
Linus Torvalds 已提交
308 309 310 311 312 313 314

	memset(&key->type_data, 0, sizeof(key->type_data));

#ifdef KEY_DEBUGGING
	key->magic = KEY_DEBUG_MAGIC;
#endif

315
	/* let the security module know about the key */
D
David Howells 已提交
316
	ret = security_key_alloc(key, cred, flags);
317 318 319
	if (ret < 0)
		goto security_error;

L
Linus Torvalds 已提交
320 321 322 323
	/* publish the key by giving it a serial number */
	atomic_inc(&user->nkeys);
	key_alloc_serial(key);

324
error:
L
Linus Torvalds 已提交
325 326
	return key;

327 328
security_error:
	kfree(key->description);
L
Linus Torvalds 已提交
329
	kmem_cache_free(key_jar, key);
330
	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
L
Linus Torvalds 已提交
331 332 333 334 335 336
		spin_lock(&user->lock);
		user->qnkeys--;
		user->qnbytes -= quotalen;
		spin_unlock(&user->lock);
	}
	key_user_put(user);
337 338 339 340 341 342
	key = ERR_PTR(ret);
	goto error;

no_memory_3:
	kmem_cache_free(key_jar, key);
no_memory_2:
343
	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) {
344 345 346 347 348 349 350
		spin_lock(&user->lock);
		user->qnkeys--;
		user->qnbytes -= quotalen;
		spin_unlock(&user->lock);
	}
	key_user_put(user);
no_memory_1:
L
Linus Torvalds 已提交
351 352 353
	key = ERR_PTR(-ENOMEM);
	goto error;

354
no_quota:
L
Linus Torvalds 已提交
355 356 357 358
	spin_unlock(&user->lock);
	key_user_put(user);
	key = ERR_PTR(-EDQUOT);
	goto error;
359
}
L
Linus Torvalds 已提交
360 361
EXPORT_SYMBOL(key_alloc);

362 363 364 365 366 367 368 369 370 371
/**
 * key_payload_reserve - Adjust data quota reservation for the key's payload
 * @key: The key to make the reservation for.
 * @datalen: The amount of data payload the caller now wants.
 *
 * Adjust the amount of the owning user's key data quota that a key reserves.
 * If the amount is increased, then -EDQUOT may be returned if there isn't
 * enough free quota available.
 *
 * If successful, 0 is returned.
L
Linus Torvalds 已提交
372 373 374
 */
int key_payload_reserve(struct key *key, size_t datalen)
{
375
	int delta = (int)datalen - key->datalen;
L
Linus Torvalds 已提交
376 377 378 379 380
	int ret = 0;

	key_check(key);

	/* contemplate the quota adjustment */
381
	if (delta != 0 && test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
382 383 384
		unsigned maxbytes = (key->user->uid == 0) ?
			key_quota_root_maxbytes : key_quota_maxbytes;

L
Linus Torvalds 已提交
385 386 387
		spin_lock(&key->user->lock);

		if (delta > 0 &&
388 389
		    (key->user->qnbytes + delta >= maxbytes ||
		     key->user->qnbytes + delta < key->user->qnbytes)) {
L
Linus Torvalds 已提交
390 391 392 393 394 395 396 397 398 399 400 401 402 403
			ret = -EDQUOT;
		}
		else {
			key->user->qnbytes += delta;
			key->quotalen += delta;
		}
		spin_unlock(&key->user->lock);
	}

	/* change the recorded data length if that didn't generate an error */
	if (ret == 0)
		key->datalen = datalen;

	return ret;
404
}
L
Linus Torvalds 已提交
405 406 407
EXPORT_SYMBOL(key_payload_reserve);

/*
408 409 410 411
 * Instantiate a key and link it into the target keyring atomically.  Must be
 * called with the target keyring's semaphore writelocked.  The target key's
 * semaphore need not be locked as instantiation is serialised by
 * key_construction_mutex.
L
Linus Torvalds 已提交
412 413 414 415
 */
static int __key_instantiate_and_link(struct key *key,
				      const void *data,
				      size_t datalen,
416
				      struct key *keyring,
417
				      struct key *authkey,
418
				      unsigned long *_prealloc)
L
Linus Torvalds 已提交
419 420 421 422 423 424 425 426 427
{
	int ret, awaken;

	key_check(key);
	key_check(keyring);

	awaken = 0;
	ret = -EBUSY;

428
	mutex_lock(&key_construction_mutex);
L
Linus Torvalds 已提交
429 430

	/* can't instantiate twice */
431
	if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
L
Linus Torvalds 已提交
432 433 434 435 436 437
		/* instantiate the key */
		ret = key->type->instantiate(key, data, datalen);

		if (ret == 0) {
			/* mark the key as being instantiated */
			atomic_inc(&key->user->nikeys);
438
			set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
L
Linus Torvalds 已提交
439

440
			if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
L
Linus Torvalds 已提交
441 442 443 444
				awaken = 1;

			/* and link it into the destination keyring */
			if (keyring)
445
				__key_link(keyring, key, _prealloc);
446 447

			/* disable the authorisation key */
D
David Howells 已提交
448 449
			if (authkey)
				key_revoke(authkey);
L
Linus Torvalds 已提交
450 451 452
		}
	}

453
	mutex_unlock(&key_construction_mutex);
L
Linus Torvalds 已提交
454 455 456

	/* wake up anyone waiting for a key to be constructed */
	if (awaken)
457
		wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
L
Linus Torvalds 已提交
458 459

	return ret;
460
}
L
Linus Torvalds 已提交
461

462 463 464 465 466 467 468 469 470 471 472 473 474 475 476
/**
 * key_instantiate_and_link - Instantiate a key and link it into the keyring.
 * @key: The key to instantiate.
 * @data: The data to use to instantiate the keyring.
 * @datalen: The length of @data.
 * @keyring: Keyring to create a link in on success (or NULL).
 * @authkey: The authorisation token permitting instantiation.
 *
 * Instantiate a key that's in the uninstantiated state using the provided data
 * and, if successful, link it in to the destination keyring if one is
 * supplied.
 *
 * If successful, 0 is returned, the authorisation token is revoked and anyone
 * waiting for the key is woken up.  If the key was already instantiated,
 * -EBUSY will be returned.
L
Linus Torvalds 已提交
477 478 479 480
 */
int key_instantiate_and_link(struct key *key,
			     const void *data,
			     size_t datalen,
481
			     struct key *keyring,
D
David Howells 已提交
482
			     struct key *authkey)
L
Linus Torvalds 已提交
483
{
484
	unsigned long prealloc;
L
Linus Torvalds 已提交
485 486
	int ret;

487 488 489 490 491 492
	if (keyring) {
		ret = __key_link_begin(keyring, key->type, key->description,
				       &prealloc);
		if (ret < 0)
			return ret;
	}
L
Linus Torvalds 已提交
493

494 495
	ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey,
					 &prealloc);
L
Linus Torvalds 已提交
496 497

	if (keyring)
498
		__key_link_end(keyring, key->type, prealloc);
L
Linus Torvalds 已提交
499 500

	return ret;
501
}
L
Linus Torvalds 已提交
502 503 504

EXPORT_SYMBOL(key_instantiate_and_link);

505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522
/**
 * key_negate_and_link - Negatively instantiate a key and link it into the keyring.
 * @key: The key to instantiate.
 * @timeout: The timeout on the negative key.
 * @keyring: Keyring to create a link in on success (or NULL).
 * @authkey: The authorisation token permitting instantiation.
 *
 * Negatively instantiate a key that's in the uninstantiated state and, if
 * successful, set its timeout and link it in to the destination keyring if one
 * is supplied.  The key and any links to the key will be automatically garbage
 * collected after the timeout expires.
 *
 * Negative keys are used to rate limit repeated request_key() calls by causing
 * them to return -ENOKEY until the negative key expires.
 *
 * If successful, 0 is returned, the authorisation token is revoked and anyone
 * waiting for the key is woken up.  If the key was already instantiated,
 * -EBUSY will be returned.
L
Linus Torvalds 已提交
523 524 525
 */
int key_negate_and_link(struct key *key,
			unsigned timeout,
526
			struct key *keyring,
D
David Howells 已提交
527
			struct key *authkey)
L
Linus Torvalds 已提交
528
{
529
	unsigned long prealloc;
L
Linus Torvalds 已提交
530
	struct timespec now;
531
	int ret, awaken, link_ret = 0;
L
Linus Torvalds 已提交
532 533 534 535 536 537 538 539

	key_check(key);
	key_check(keyring);

	awaken = 0;
	ret = -EBUSY;

	if (keyring)
540 541
		link_ret = __key_link_begin(keyring, key->type,
					    key->description, &prealloc);
L
Linus Torvalds 已提交
542

543
	mutex_lock(&key_construction_mutex);
L
Linus Torvalds 已提交
544 545

	/* can't instantiate twice */
546
	if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
L
Linus Torvalds 已提交
547 548
		/* mark the key as being negatively instantiated */
		atomic_inc(&key->user->nikeys);
549 550
		set_bit(KEY_FLAG_NEGATIVE, &key->flags);
		set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
L
Linus Torvalds 已提交
551 552
		now = current_kernel_time();
		key->expiry = now.tv_sec + timeout;
D
David Howells 已提交
553
		key_schedule_gc(key->expiry + key_gc_delay);
L
Linus Torvalds 已提交
554

555
		if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
L
Linus Torvalds 已提交
556 557 558 559 560
			awaken = 1;

		ret = 0;

		/* and link it into the destination keyring */
561 562
		if (keyring && link_ret == 0)
			__key_link(keyring, key, &prealloc);
563 564

		/* disable the authorisation key */
D
David Howells 已提交
565 566
		if (authkey)
			key_revoke(authkey);
L
Linus Torvalds 已提交
567 568
	}

569
	mutex_unlock(&key_construction_mutex);
L
Linus Torvalds 已提交
570 571

	if (keyring)
572
		__key_link_end(keyring, key->type, prealloc);
L
Linus Torvalds 已提交
573 574 575

	/* wake up anyone waiting for a key to be constructed */
	if (awaken)
576
		wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
L
Linus Torvalds 已提交
577

578
	return ret == 0 ? link_ret : ret;
579
}
L
Linus Torvalds 已提交
580 581 582 583

EXPORT_SYMBOL(key_negate_and_link);

/*
584 585 586 587 588
 * Garbage collect keys in process context so that we don't have to disable
 * interrupts all over the place.
 *
 * key_put() schedules this rather than trying to do the cleanup itself, which
 * means key_put() doesn't have to sleep.
L
Linus Torvalds 已提交
589
 */
590
static void key_cleanup(struct work_struct *work)
L
Linus Torvalds 已提交
591 592 593 594
{
	struct rb_node *_n;
	struct key *key;

595
go_again:
L
Linus Torvalds 已提交
596 597 598 599 600 601 602 603 604 605 606 607 608
	/* look for a dead key in the tree */
	spin_lock(&key_serial_lock);

	for (_n = rb_first(&key_serial_tree); _n; _n = rb_next(_n)) {
		key = rb_entry(_n, struct key, serial_node);

		if (atomic_read(&key->usage) == 0)
			goto found_dead_key;
	}

	spin_unlock(&key_serial_lock);
	return;

609
found_dead_key:
L
Linus Torvalds 已提交
610 611 612 613 614
	/* we found a dead key - once we've removed it from the tree, we can
	 * drop the lock */
	rb_erase(&key->serial_node, &key_serial_tree);
	spin_unlock(&key_serial_lock);

615 616
	key_check(key);

617 618
	security_key_free(key);

L
Linus Torvalds 已提交
619
	/* deal with the user's key tracking and quota */
620
	if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
L
Linus Torvalds 已提交
621 622 623 624 625 626 627
		spin_lock(&key->user->lock);
		key->user->qnkeys--;
		key->user->qnbytes -= key->quotalen;
		spin_unlock(&key->user->lock);
	}

	atomic_dec(&key->user->nkeys);
628
	if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
L
Linus Torvalds 已提交
629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645
		atomic_dec(&key->user->nikeys);

	key_user_put(key->user);

	/* now throw away the key memory */
	if (key->type->destroy)
		key->type->destroy(key);

	kfree(key->description);

#ifdef KEY_DEBUGGING
	key->magic = KEY_DEBUG_MAGIC_X;
#endif
	kmem_cache_free(key_jar, key);

	/* there may, of course, be more than one key to destroy */
	goto go_again;
646
}
L
Linus Torvalds 已提交
647

648 649 650 651 652 653 654
/**
 * key_put - Discard a reference to a key.
 * @key: The key to discard a reference from.
 *
 * Discard a reference to a key, and when all the references are gone, we
 * schedule the cleanup task to come and pull it out of the tree in process
 * context at some later time.
L
Linus Torvalds 已提交
655 656 657 658 659 660 661 662 663
 */
void key_put(struct key *key)
{
	if (key) {
		key_check(key);

		if (atomic_dec_and_test(&key->usage))
			schedule_work(&key_cleanup_task);
	}
664
}
L
Linus Torvalds 已提交
665 666 667
EXPORT_SYMBOL(key_put);

/*
668
 * Find a key by its serial number.
L
Linus Torvalds 已提交
669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689
 */
struct key *key_lookup(key_serial_t id)
{
	struct rb_node *n;
	struct key *key;

	spin_lock(&key_serial_lock);

	/* search the tree for the specified key */
	n = key_serial_tree.rb_node;
	while (n) {
		key = rb_entry(n, struct key, serial_node);

		if (id < key->serial)
			n = n->rb_left;
		else if (id > key->serial)
			n = n->rb_right;
		else
			goto found;
	}

690
not_found:
L
Linus Torvalds 已提交
691 692 693
	key = ERR_PTR(-ENOKEY);
	goto error;

694
found:
695 696
	/* pretend it doesn't exist if it is awaiting deletion */
	if (atomic_read(&key->usage) == 0)
L
Linus Torvalds 已提交
697 698 699 700 701 702 703
		goto not_found;

	/* this races with key_put(), but that doesn't matter since key_put()
	 * doesn't actually change the key
	 */
	atomic_inc(&key->usage);

704
error:
L
Linus Torvalds 已提交
705 706
	spin_unlock(&key_serial_lock);
	return key;
707
}
L
Linus Torvalds 已提交
708 709

/*
710 711 712 713
 * Find and lock the specified key type against removal.
 *
 * We return with the sem read-locked if successful.  If the type wasn't
 * available -ENOKEY is returned instead.
L
Linus Torvalds 已提交
714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730
 */
struct key_type *key_type_lookup(const char *type)
{
	struct key_type *ktype;

	down_read(&key_types_sem);

	/* look up the key type to see if it's one of the registered kernel
	 * types */
	list_for_each_entry(ktype, &key_types_list, link) {
		if (strcmp(ktype->name, type) == 0)
			goto found_kernel_type;
	}

	up_read(&key_types_sem);
	ktype = ERR_PTR(-ENOKEY);

731
found_kernel_type:
L
Linus Torvalds 已提交
732
	return ktype;
733
}
L
Linus Torvalds 已提交
734 735

/*
736
 * Unlock a key type locked by key_type_lookup().
L
Linus Torvalds 已提交
737 738 739 740
 */
void key_type_put(struct key_type *ktype)
{
	up_read(&key_types_sem);
741
}
L
Linus Torvalds 已提交
742 743

/*
744 745 746 747
 * Attempt to update an existing key.
 *
 * The key is given to us with an incremented refcount that we need to discard
 * if we get an error.
L
Linus Torvalds 已提交
748
 */
749 750
static inline key_ref_t __key_update(key_ref_t key_ref,
				     const void *payload, size_t plen)
L
Linus Torvalds 已提交
751
{
752
	struct key *key = key_ref_to_ptr(key_ref);
L
Linus Torvalds 已提交
753 754 755
	int ret;

	/* need write permission on the key to update it */
756 757
	ret = key_permission(key_ref, KEY_WRITE);
	if (ret < 0)
L
Linus Torvalds 已提交
758 759 760 761 762 763 764 765 766
		goto error;

	ret = -EEXIST;
	if (!key->type->update)
		goto error;

	down_write(&key->sem);

	ret = key->type->update(key, payload, plen);
767
	if (ret == 0)
L
Linus Torvalds 已提交
768
		/* updating a negative key instantiates it */
769
		clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
L
Linus Torvalds 已提交
770 771 772 773 774

	up_write(&key->sem);

	if (ret < 0)
		goto error;
775 776
out:
	return key_ref;
L
Linus Torvalds 已提交
777

778
error:
L
Linus Torvalds 已提交
779
	key_put(key);
780
	key_ref = ERR_PTR(ret);
L
Linus Torvalds 已提交
781
	goto out;
782
}
L
Linus Torvalds 已提交
783

784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807
/**
 * key_create_or_update - Update or create and instantiate a key.
 * @keyring_ref: A pointer to the destination keyring with possession flag.
 * @type: The type of key.
 * @description: The searchable description for the key.
 * @payload: The data to use to instantiate or update the key.
 * @plen: The length of @payload.
 * @perm: The permissions mask for a new key.
 * @flags: The quota flags for a new key.
 *
 * Search the destination keyring for a key of the same description and if one
 * is found, update it, otherwise create and instantiate a new one and create a
 * link to it from that keyring.
 *
 * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be
 * concocted.
 *
 * Returns a pointer to the new key if successful, -ENODEV if the key type
 * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the
 * caller isn't permitted to modify the keyring or the LSM did not permit
 * creation of the key.
 *
 * On success, the possession flag from the keyring ref will be tacked on to
 * the key ref before it is returned.
L
Linus Torvalds 已提交
808
 */
809 810 811 812 813
key_ref_t key_create_or_update(key_ref_t keyring_ref,
			       const char *type,
			       const char *description,
			       const void *payload,
			       size_t plen,
814
			       key_perm_t perm,
815
			       unsigned long flags)
L
Linus Torvalds 已提交
816
{
817
	unsigned long prealloc;
D
David Howells 已提交
818
	const struct cred *cred = current_cred();
L
Linus Torvalds 已提交
819
	struct key_type *ktype;
820 821
	struct key *keyring, *key = NULL;
	key_ref_t key_ref;
L
Linus Torvalds 已提交
822 823 824 825 826 827
	int ret;

	/* look up the key type to see if it's one of the registered kernel
	 * types */
	ktype = key_type_lookup(type);
	if (IS_ERR(ktype)) {
828
		key_ref = ERR_PTR(-ENODEV);
L
Linus Torvalds 已提交
829 830 831
		goto error;
	}

832
	key_ref = ERR_PTR(-EINVAL);
L
Linus Torvalds 已提交
833 834 835
	if (!ktype->match || !ktype->instantiate)
		goto error_2;

836 837 838 839
	keyring = key_ref_to_ptr(keyring_ref);

	key_check(keyring);

840 841 842 843
	key_ref = ERR_PTR(-ENOTDIR);
	if (keyring->type != &key_type_keyring)
		goto error_2;

844 845 846
	ret = __key_link_begin(keyring, ktype, description, &prealloc);
	if (ret < 0)
		goto error_2;
847 848 849

	/* if we're going to allocate a new key, we're going to have
	 * to modify the keyring */
850 851 852
	ret = key_permission(keyring_ref, KEY_WRITE);
	if (ret < 0) {
		key_ref = ERR_PTR(ret);
853
		goto error_3;
854
	}
855

856 857 858
	/* if it's possible to update this type of key, search for an existing
	 * key of the same type and description in the destination keyring and
	 * update that instead if possible
L
Linus Torvalds 已提交
859
	 */
860 861 862 863 864 865
	if (ktype->update) {
		key_ref = __keyring_search_one(keyring_ref, ktype, description,
					       0);
		if (!IS_ERR(key_ref))
			goto found_matching_key;
	}
L
Linus Torvalds 已提交
866

867 868 869 870
	/* if the client doesn't provide, decide on the permissions we want */
	if (perm == KEY_PERM_UNDEF) {
		perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
		perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
L
Linus Torvalds 已提交
871

872 873
		if (ktype->read)
			perm |= KEY_POS_READ | KEY_USR_READ;
L
Linus Torvalds 已提交
874

875 876 877
		if (ktype == &key_type_keyring || ktype->update)
			perm |= KEY_USR_WRITE;
	}
L
Linus Torvalds 已提交
878 879

	/* allocate a new key */
D
David Howells 已提交
880 881
	key = key_alloc(ktype, description, cred->fsuid, cred->fsgid, cred,
			perm, flags);
L
Linus Torvalds 已提交
882
	if (IS_ERR(key)) {
883
		key_ref = ERR_CAST(key);
L
Linus Torvalds 已提交
884 885 886 887
		goto error_3;
	}

	/* instantiate it and link it into the target keyring */
888 889
	ret = __key_instantiate_and_link(key, payload, plen, keyring, NULL,
					 &prealloc);
L
Linus Torvalds 已提交
890 891
	if (ret < 0) {
		key_put(key);
892 893
		key_ref = ERR_PTR(ret);
		goto error_3;
L
Linus Torvalds 已提交
894 895
	}

896 897
	key_ref = make_key_ref(key, is_key_possessed(keyring_ref));

L
Linus Torvalds 已提交
898
 error_3:
899
	__key_link_end(keyring, ktype, prealloc);
L
Linus Torvalds 已提交
900 901 902
 error_2:
	key_type_put(ktype);
 error:
903
	return key_ref;
L
Linus Torvalds 已提交
904 905 906 907 908

 found_matching_key:
	/* we found a matching key, so we're going to try to update it
	 * - we can drop the locks first as we have the key pinned
	 */
909
	__key_link_end(keyring, ktype, prealloc);
L
Linus Torvalds 已提交
910 911
	key_type_put(ktype);

912
	key_ref = __key_update(key_ref, payload, plen);
L
Linus Torvalds 已提交
913
	goto error;
914
}
L
Linus Torvalds 已提交
915 916
EXPORT_SYMBOL(key_create_or_update);

917 918 919 920 921 922 923 924 925 926 927 928
/**
 * key_update - Update a key's contents.
 * @key_ref: The pointer (plus possession flag) to the key.
 * @payload: The data to be used to update the key.
 * @plen: The length of @payload.
 *
 * Attempt to update the contents of a key with the given payload data.  The
 * caller must be granted Write permission on the key.  Negative keys can be
 * instantiated by this method.
 *
 * Returns 0 on success, -EACCES if not permitted and -EOPNOTSUPP if the key
 * type does not support updating.  The key type may return other errors.
L
Linus Torvalds 已提交
929
 */
930
int key_update(key_ref_t key_ref, const void *payload, size_t plen)
L
Linus Torvalds 已提交
931
{
932
	struct key *key = key_ref_to_ptr(key_ref);
L
Linus Torvalds 已提交
933 934 935 936 937
	int ret;

	key_check(key);

	/* the key must be writable */
938 939
	ret = key_permission(key_ref, KEY_WRITE);
	if (ret < 0)
L
Linus Torvalds 已提交
940 941 942 943 944 945 946
		goto error;

	/* attempt to update it if supported */
	ret = -EOPNOTSUPP;
	if (key->type->update) {
		down_write(&key->sem);

947
		ret = key->type->update(key, payload, plen);
948
		if (ret == 0)
L
Linus Torvalds 已提交
949
			/* updating a negative key instantiates it */
950
			clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
L
Linus Torvalds 已提交
951 952 953 954 955 956

		up_write(&key->sem);
	}

 error:
	return ret;
957
}
L
Linus Torvalds 已提交
958 959
EXPORT_SYMBOL(key_update);

960 961 962 963 964 965 966 967
/**
 * key_revoke - Revoke a key.
 * @key: The key to be revoked.
 *
 * Mark a key as being revoked and ask the type to free up its resources.  The
 * revocation timeout is set and the key and all its links will be
 * automatically garbage collected after key_gc_delay amount of time if they
 * are not manually dealt with first.
L
Linus Torvalds 已提交
968 969 970
 */
void key_revoke(struct key *key)
{
971 972 973
	struct timespec now;
	time_t time;

L
Linus Torvalds 已提交
974 975
	key_check(key);

976 977 978 979 980 981 982 983
	/* make sure no one's trying to change or use the key when we mark it
	 * - we tell lockdep that we might nest because we might be revoking an
	 *   authorisation key whilst holding the sem on a key we've just
	 *   instantiated
	 */
	down_write_nested(&key->sem, 1);
	if (!test_and_set_bit(KEY_FLAG_REVOKED, &key->flags) &&
	    key->type->revoke)
984 985
		key->type->revoke(key);

986 987 988 989 990
	/* set the death time to no more than the expiry time */
	now = current_kernel_time();
	time = now.tv_sec;
	if (key->revoked_at == 0 || key->revoked_at > time) {
		key->revoked_at = time;
D
David Howells 已提交
991
		key_schedule_gc(key->revoked_at + key_gc_delay);
992 993
	}

L
Linus Torvalds 已提交
994
	up_write(&key->sem);
995
}
L
Linus Torvalds 已提交
996 997
EXPORT_SYMBOL(key_revoke);

998 999 1000 1001 1002 1003 1004
/**
 * register_key_type - Register a type of key.
 * @ktype: The new key type.
 *
 * Register a new key type.
 *
 * Returns 0 on success or -EEXIST if a type of this name already exists.
L
Linus Torvalds 已提交
1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023
 */
int register_key_type(struct key_type *ktype)
{
	struct key_type *p;
	int ret;

	ret = -EEXIST;
	down_write(&key_types_sem);

	/* disallow key types with the same name */
	list_for_each_entry(p, &key_types_list, link) {
		if (strcmp(p->name, ktype->name) == 0)
			goto out;
	}

	/* store the type */
	list_add(&ktype->link, &key_types_list);
	ret = 0;

1024
out:
L
Linus Torvalds 已提交
1025 1026
	up_write(&key_types_sem);
	return ret;
1027
}
L
Linus Torvalds 已提交
1028 1029
EXPORT_SYMBOL(register_key_type);

1030 1031 1032 1033 1034 1035 1036
/**
 * unregister_key_type - Unregister a type of key.
 * @ktype: The key type.
 *
 * Unregister a key type and mark all the extant keys of this type as dead.
 * Those keys of this type are then destroyed to get rid of their payloads and
 * they and their links will be garbage collected as soon as possible.
L
Linus Torvalds 已提交
1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047
 */
void unregister_key_type(struct key_type *ktype)
{
	struct rb_node *_n;
	struct key *key;

	down_write(&key_types_sem);

	/* withdraw the key type */
	list_del_init(&ktype->link);

1048
	/* mark all the keys of this type dead */
L
Linus Torvalds 已提交
1049 1050 1051 1052 1053
	spin_lock(&key_serial_lock);

	for (_n = rb_first(&key_serial_tree); _n; _n = rb_next(_n)) {
		key = rb_entry(_n, struct key, serial_node);

1054
		if (key->type == ktype) {
1055
			key->type = &key_type_dead;
1056 1057
			set_bit(KEY_FLAG_DEAD, &key->flags);
		}
1058 1059 1060 1061 1062
	}

	spin_unlock(&key_serial_lock);

	/* make sure everyone revalidates their keys */
1063
	synchronize_rcu();
1064 1065 1066 1067

	/* we should now be able to destroy the payloads of all the keys of
	 * this type with impunity */
	spin_lock(&key_serial_lock);
L
Linus Torvalds 已提交
1068

1069 1070
	for (_n = rb_first(&key_serial_tree); _n; _n = rb_next(_n)) {
		key = rb_entry(_n, struct key, serial_node);
L
Linus Torvalds 已提交
1071

1072 1073 1074
		if (key->type == ktype) {
			if (ktype->destroy)
				ktype->destroy(key);
1075
			memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
1076
		}
L
Linus Torvalds 已提交
1077 1078 1079 1080 1081
	}

	spin_unlock(&key_serial_lock);
	up_write(&key_types_sem);

1082
	key_schedule_gc(0);
1083
}
L
Linus Torvalds 已提交
1084 1085 1086
EXPORT_SYMBOL(unregister_key_type);

/*
1087
 * Initialise the key management state.
L
Linus Torvalds 已提交
1088 1089 1090 1091 1092
 */
void __init key_init(void)
{
	/* allocate a slab in which we can store keys */
	key_jar = kmem_cache_create("key_jar", sizeof(struct key),
1093
			0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
L
Linus Torvalds 已提交
1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106

	/* add the special key types */
	list_add_tail(&key_type_keyring.link, &key_types_list);
	list_add_tail(&key_type_dead.link, &key_types_list);
	list_add_tail(&key_type_user.link, &key_types_list);

	/* record the root user tracking */
	rb_link_node(&root_key_user.node,
		     NULL,
		     &key_user_tree.rb_node);

	rb_insert_color(&root_key_user.node,
			&key_user_tree);
1107
}