blob: e6d50172872fb2b516f7c88fa3e4ba3e814ffa1a [file] [log] [blame]
David Howells973c9f42011-01-20 16:38:33 +00001/* Manage a process's keyrings
Linus Torvalds1da177e2005-04-16 15:20:36 -07002 *
David Howells69664cf2008-04-29 01:01:31 -07003 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015#include <linux/keyctl.h>
16#include <linux/fs.h>
17#include <linux/err.h>
Ingo Molnarbb003072006-03-22 00:09:14 -080018#include <linux/mutex.h>
David Howellsee18d642009-09-02 09:14:21 +010019#include <linux/security.h>
Serge E. Hallyn1d1e9752009-02-26 18:27:38 -060020#include <linux/user_namespace.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070021#include <asm/uaccess.h>
22#include "internal.h"
23
David Howells973c9f42011-01-20 16:38:33 +000024/* Session keyring create vs join semaphore */
Ingo Molnarbb003072006-03-22 00:09:14 -080025static DEFINE_MUTEX(key_session_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -070026
David Howells973c9f42011-01-20 16:38:33 +000027/* User keyring creation semaphore */
David Howells69664cf2008-04-29 01:01:31 -070028static DEFINE_MUTEX(key_user_keyring_mutex);
29
David Howells973c9f42011-01-20 16:38:33 +000030/* The root user's tracking struct */
Linus Torvalds1da177e2005-04-16 15:20:36 -070031struct key_user root_key_user = {
32 .usage = ATOMIC_INIT(3),
David Howells76181c12007-10-16 23:29:46 -070033 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
Peter Zijlstra6cfd76a2006-12-06 20:37:22 -080034 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
Linus Torvalds1da177e2005-04-16 15:20:36 -070035 .nkeys = ATOMIC_INIT(2),
36 .nikeys = ATOMIC_INIT(2),
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080037 .uid = GLOBAL_ROOT_UID,
Linus Torvalds1da177e2005-04-16 15:20:36 -070038};
39
Linus Torvalds1da177e2005-04-16 15:20:36 -070040/*
David Howells973c9f42011-01-20 16:38:33 +000041 * Install the user and user session keyrings for the current process's UID.
Linus Torvalds1da177e2005-04-16 15:20:36 -070042 */
David Howells8bbf49762008-11-14 10:39:14 +110043int install_user_keyrings(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -070044{
David Howellsd84f4f92008-11-14 10:39:23 +110045 struct user_struct *user;
46 const struct cred *cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -070047 struct key *uid_keyring, *session_keyring;
David Howells96b5c8f2012-10-02 19:24:56 +010048 key_perm_t user_keyring_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -070049 char buf[20];
50 int ret;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080051 uid_t uid;
Linus Torvalds1da177e2005-04-16 15:20:36 -070052
David Howells96b5c8f2012-10-02 19:24:56 +010053 user_keyring_perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL;
David Howellsd84f4f92008-11-14 10:39:23 +110054 cred = current_cred();
55 user = cred->user;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080056 uid = from_kuid(cred->user_ns, user->uid);
David Howellsd84f4f92008-11-14 10:39:23 +110057
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080058 kenter("%p{%u}", user, uid);
Linus Torvalds1da177e2005-04-16 15:20:36 -070059
David Howells0da9dfd2013-03-12 16:44:31 +110060 if (user->uid_keyring && user->session_keyring) {
David Howells69664cf2008-04-29 01:01:31 -070061 kleave(" = 0 [exist]");
62 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070063 }
64
David Howells69664cf2008-04-29 01:01:31 -070065 mutex_lock(&key_user_keyring_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -070066 ret = 0;
67
David Howells69664cf2008-04-29 01:01:31 -070068 if (!user->uid_keyring) {
69 /* get the UID-specific keyring
70 * - there may be one in existence already as it may have been
71 * pinned by a session, but the user_struct pointing to it
72 * may have been destroyed by setuid */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080073 sprintf(buf, "_uid.%u", uid);
Linus Torvalds1da177e2005-04-16 15:20:36 -070074
David Howells69664cf2008-04-29 01:01:31 -070075 uid_keyring = find_keyring_by_name(buf, true);
76 if (IS_ERR(uid_keyring)) {
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080077 uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID,
David Howells96b5c8f2012-10-02 19:24:56 +010078 cred, user_keyring_perm,
79 KEY_ALLOC_IN_QUOTA, NULL);
David Howells69664cf2008-04-29 01:01:31 -070080 if (IS_ERR(uid_keyring)) {
81 ret = PTR_ERR(uid_keyring);
82 goto error;
83 }
84 }
85
86 /* get a default session keyring (which might also exist
87 * already) */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080088 sprintf(buf, "_uid_ses.%u", uid);
David Howells69664cf2008-04-29 01:01:31 -070089
90 session_keyring = find_keyring_by_name(buf, true);
91 if (IS_ERR(session_keyring)) {
92 session_keyring =
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080093 keyring_alloc(buf, user->uid, INVALID_GID,
David Howells96b5c8f2012-10-02 19:24:56 +010094 cred, user_keyring_perm,
95 KEY_ALLOC_IN_QUOTA, NULL);
David Howells69664cf2008-04-29 01:01:31 -070096 if (IS_ERR(session_keyring)) {
97 ret = PTR_ERR(session_keyring);
98 goto error_release;
99 }
100
101 /* we install a link from the user session keyring to
102 * the user keyring */
103 ret = key_link(session_keyring, uid_keyring);
104 if (ret < 0)
105 goto error_release_both;
106 }
107
108 /* install the keyrings */
109 user->uid_keyring = uid_keyring;
110 user->session_keyring = session_keyring;
111 }
112
113 mutex_unlock(&key_user_keyring_mutex);
114 kleave(" = 0");
115 return 0;
116
117error_release_both:
118 key_put(session_keyring);
119error_release:
120 key_put(uid_keyring);
121error:
122 mutex_unlock(&key_user_keyring_mutex);
123 kleave(" = %d", ret);
124 return ret;
125}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700126
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127/*
David Howells973c9f42011-01-20 16:38:33 +0000128 * Install a fresh thread keyring directly to new credentials. This keyring is
129 * allowed to overrun the quota.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700130 */
David Howellsd84f4f92008-11-14 10:39:23 +1100131int install_thread_keyring_to_cred(struct cred *new)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132{
David Howellsd84f4f92008-11-14 10:39:23 +1100133 struct key *keyring;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700134
David Howellsd84f4f92008-11-14 10:39:23 +1100135 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
David Howells96b5c8f2012-10-02 19:24:56 +0100136 KEY_POS_ALL | KEY_USR_VIEW,
David Howellsd84f4f92008-11-14 10:39:23 +1100137 KEY_ALLOC_QUOTA_OVERRUN, NULL);
138 if (IS_ERR(keyring))
139 return PTR_ERR(keyring);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140
David Howellsd84f4f92008-11-14 10:39:23 +1100141 new->thread_keyring = keyring;
142 return 0;
143}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700144
Linus Torvalds1da177e2005-04-16 15:20:36 -0700145/*
David Howells973c9f42011-01-20 16:38:33 +0000146 * Install a fresh thread keyring, discarding the old one.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700147 */
David Howellsd84f4f92008-11-14 10:39:23 +1100148static int install_thread_keyring(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700149{
David Howellsd84f4f92008-11-14 10:39:23 +1100150 struct cred *new;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151 int ret;
152
David Howellsd84f4f92008-11-14 10:39:23 +1100153 new = prepare_creds();
154 if (!new)
155 return -ENOMEM;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700156
David Howellsd84f4f92008-11-14 10:39:23 +1100157 BUG_ON(new->thread_keyring);
158
159 ret = install_thread_keyring_to_cred(new);
160 if (ret < 0) {
161 abort_creds(new);
162 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700163 }
164
David Howellsd84f4f92008-11-14 10:39:23 +1100165 return commit_creds(new);
166}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700167
David Howellsd84f4f92008-11-14 10:39:23 +1100168/*
David Howells973c9f42011-01-20 16:38:33 +0000169 * Install a process keyring directly to a credentials struct.
170 *
171 * Returns -EEXIST if there was already a process keyring, 0 if one installed,
172 * and other value on any other error
David Howellsd84f4f92008-11-14 10:39:23 +1100173 */
174int install_process_keyring_to_cred(struct cred *new)
175{
176 struct key *keyring;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177
David Howells3a505972012-10-02 19:24:29 +0100178 if (new->process_keyring)
David Howellsd84f4f92008-11-14 10:39:23 +1100179 return -EEXIST;
180
David Howells96b5c8f2012-10-02 19:24:56 +0100181 keyring = keyring_alloc("_pid", new->uid, new->gid, new,
182 KEY_POS_ALL | KEY_USR_VIEW,
183 KEY_ALLOC_QUOTA_OVERRUN, NULL);
David Howellsd84f4f92008-11-14 10:39:23 +1100184 if (IS_ERR(keyring))
185 return PTR_ERR(keyring);
186
David Howells3a505972012-10-02 19:24:29 +0100187 new->process_keyring = keyring;
188 return 0;
David Howellsd84f4f92008-11-14 10:39:23 +1100189}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700190
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191/*
David Howells973c9f42011-01-20 16:38:33 +0000192 * Make sure a process keyring is installed for the current process. The
193 * existing process keyring is not replaced.
194 *
195 * Returns 0 if there is a process keyring by the end of this function, some
196 * error otherwise.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700197 */
David Howellsd84f4f92008-11-14 10:39:23 +1100198static int install_process_keyring(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700199{
David Howellsd84f4f92008-11-14 10:39:23 +1100200 struct cred *new;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700201 int ret;
202
David Howellsd84f4f92008-11-14 10:39:23 +1100203 new = prepare_creds();
204 if (!new)
205 return -ENOMEM;
David Howells1a26feb2006-04-10 22:54:26 -0700206
David Howellsd84f4f92008-11-14 10:39:23 +1100207 ret = install_process_keyring_to_cred(new);
208 if (ret < 0) {
209 abort_creds(new);
Andi Kleen27d63792010-10-28 13:16:13 +0100210 return ret != -EEXIST ? ret : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 }
212
David Howellsd84f4f92008-11-14 10:39:23 +1100213 return commit_creds(new);
214}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216/*
David Howells973c9f42011-01-20 16:38:33 +0000217 * Install a session keyring directly to a credentials struct.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 */
Oleg Nesterov685bfd22010-05-26 14:43:00 -0700219int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220{
David Howells7e047ef2006-06-26 00:24:50 -0700221 unsigned long flags;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 struct key *old;
David Howells1a26feb2006-04-10 22:54:26 -0700223
224 might_sleep();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225
226 /* create an empty session keyring */
227 if (!keyring) {
David Howells7e047ef2006-06-26 00:24:50 -0700228 flags = KEY_ALLOC_QUOTA_OVERRUN;
David Howells3a505972012-10-02 19:24:29 +0100229 if (cred->session_keyring)
David Howells7e047ef2006-06-26 00:24:50 -0700230 flags = KEY_ALLOC_IN_QUOTA;
231
David Howells96b5c8f2012-10-02 19:24:56 +0100232 keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred,
233 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
234 flags, NULL);
David Howells1a26feb2006-04-10 22:54:26 -0700235 if (IS_ERR(keyring))
236 return PTR_ERR(keyring);
David Howellsd84f4f92008-11-14 10:39:23 +1100237 } else {
David Howellsccc3e6d2013-09-24 10:35:16 +0100238 __key_get(keyring);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239 }
240
241 /* install the keyring */
David Howells3a505972012-10-02 19:24:29 +0100242 old = cred->session_keyring;
243 rcu_assign_pointer(cred->session_keyring, keyring);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244
David Howells3a505972012-10-02 19:24:29 +0100245 if (old)
David Howells1a26feb2006-04-10 22:54:26 -0700246 key_put(old);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247
David Howells1a26feb2006-04-10 22:54:26 -0700248 return 0;
David Howellsd84f4f92008-11-14 10:39:23 +1100249}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251/*
David Howells973c9f42011-01-20 16:38:33 +0000252 * Install a session keyring, discarding the old one. If a keyring is not
253 * supplied, an empty one is invented.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254 */
David Howellsd84f4f92008-11-14 10:39:23 +1100255static int install_session_keyring(struct key *keyring)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256{
David Howellsd84f4f92008-11-14 10:39:23 +1100257 struct cred *new;
258 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700259
David Howellsd84f4f92008-11-14 10:39:23 +1100260 new = prepare_creds();
261 if (!new)
262 return -ENOMEM;
David Howellsb5f545c2006-01-08 01:02:47 -0800263
David Howells995995372011-08-22 14:08:33 +0100264 ret = install_session_keyring_to_cred(new, keyring);
David Howellsd84f4f92008-11-14 10:39:23 +1100265 if (ret < 0) {
266 abort_creds(new);
267 return ret;
268 }
David Howellsb5f545c2006-01-08 01:02:47 -0800269
David Howellsd84f4f92008-11-14 10:39:23 +1100270 return commit_creds(new);
271}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700272
Linus Torvalds1da177e2005-04-16 15:20:36 -0700273/*
David Howells973c9f42011-01-20 16:38:33 +0000274 * Handle the fsuid changing.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700275 */
276void key_fsuid_changed(struct task_struct *tsk)
277{
278 /* update the ownership of the thread keyring */
David Howellsb6dff3e2008-11-14 10:39:16 +1100279 BUG_ON(!tsk->cred);
280 if (tsk->cred->thread_keyring) {
281 down_write(&tsk->cred->thread_keyring->sem);
282 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
283 up_write(&tsk->cred->thread_keyring->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700284 }
David Howellsa8b17ed2011-01-20 16:38:27 +0000285}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700286
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287/*
David Howells973c9f42011-01-20 16:38:33 +0000288 * Handle the fsgid changing.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289 */
290void key_fsgid_changed(struct task_struct *tsk)
291{
292 /* update the ownership of the thread keyring */
David Howellsb6dff3e2008-11-14 10:39:16 +1100293 BUG_ON(!tsk->cred);
294 if (tsk->cred->thread_keyring) {
295 down_write(&tsk->cred->thread_keyring->sem);
296 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
297 up_write(&tsk->cred->thread_keyring->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700298 }
David Howellsa8b17ed2011-01-20 16:38:27 +0000299}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300
Linus Torvalds1da177e2005-04-16 15:20:36 -0700301/*
David Howells973c9f42011-01-20 16:38:33 +0000302 * Search the process keyrings attached to the supplied cred for the first
303 * matching key.
304 *
305 * The search criteria are the type and the match function. The description is
306 * given to the match function as a parameter, but doesn't otherwise influence
307 * the search. Typically the match function will compare the description
308 * parameter to the key's description.
309 *
310 * This can only search keyrings that grant Search permission to the supplied
311 * credentials. Keyrings linked to searched keyrings will also be searched if
312 * they grant Search permission too. Keys can only be found if they grant
313 * Search permission to the credentials.
314 *
315 * Returns a pointer to the key with the key usage count incremented if
316 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
317 * matched negative keys.
318 *
319 * In the case of a successful return, the possession attribute is set on the
320 * returned key reference.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700321 */
David Howells4bdf0bc2013-09-24 10:35:15 +0100322key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700323{
David Howellsb5f545c2006-01-08 01:02:47 -0800324 key_ref_t key_ref, ret, err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700325
326 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
327 * searchable, but we failed to find a key or we found a negative key;
328 * otherwise we want to return a sample error (probably -EACCES) if
329 * none of the keyrings were searchable
330 *
331 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
332 */
David Howells664cceb2005-09-28 17:03:15 +0100333 key_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700334 ret = NULL;
335 err = ERR_PTR(-EAGAIN);
336
337 /* search the thread keyring first */
David Howells4bdf0bc2013-09-24 10:35:15 +0100338 if (ctx->cred->thread_keyring) {
David Howells664cceb2005-09-28 17:03:15 +0100339 key_ref = keyring_search_aux(
David Howells4bdf0bc2013-09-24 10:35:15 +0100340 make_key_ref(ctx->cred->thread_keyring, 1), ctx);
David Howells664cceb2005-09-28 17:03:15 +0100341 if (!IS_ERR(key_ref))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700342 goto found;
343
David Howells664cceb2005-09-28 17:03:15 +0100344 switch (PTR_ERR(key_ref)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700345 case -EAGAIN: /* no key */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700346 case -ENOKEY: /* negative key */
David Howells664cceb2005-09-28 17:03:15 +0100347 ret = key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700348 break;
349 default:
David Howells664cceb2005-09-28 17:03:15 +0100350 err = key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700351 break;
352 }
353 }
354
355 /* search the process keyring second */
David Howells4bdf0bc2013-09-24 10:35:15 +0100356 if (ctx->cred->process_keyring) {
David Howells664cceb2005-09-28 17:03:15 +0100357 key_ref = keyring_search_aux(
David Howells4bdf0bc2013-09-24 10:35:15 +0100358 make_key_ref(ctx->cred->process_keyring, 1), ctx);
David Howells664cceb2005-09-28 17:03:15 +0100359 if (!IS_ERR(key_ref))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700360 goto found;
361
David Howells664cceb2005-09-28 17:03:15 +0100362 switch (PTR_ERR(key_ref)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700363 case -EAGAIN: /* no key */
David Howellsfe9453a2013-02-21 12:00:25 +0000364 if (ret)
365 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700366 case -ENOKEY: /* negative key */
David Howells664cceb2005-09-28 17:03:15 +0100367 ret = key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700368 break;
369 default:
David Howells664cceb2005-09-28 17:03:15 +0100370 err = key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700371 break;
372 }
373 }
374
David Howells3e301482005-06-23 22:00:56 -0700375 /* search the session keyring */
David Howells4bdf0bc2013-09-24 10:35:15 +0100376 if (ctx->cred->session_keyring) {
David Howells8589b4e2005-06-23 22:00:53 -0700377 rcu_read_lock();
David Howells664cceb2005-09-28 17:03:15 +0100378 key_ref = keyring_search_aux(
David Howells4bdf0bc2013-09-24 10:35:15 +0100379 make_key_ref(rcu_dereference(ctx->cred->session_keyring), 1),
380 ctx);
David Howells8589b4e2005-06-23 22:00:53 -0700381 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700382
David Howells664cceb2005-09-28 17:03:15 +0100383 if (!IS_ERR(key_ref))
David Howells3e301482005-06-23 22:00:56 -0700384 goto found;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385
David Howells664cceb2005-09-28 17:03:15 +0100386 switch (PTR_ERR(key_ref)) {
David Howells3e301482005-06-23 22:00:56 -0700387 case -EAGAIN: /* no key */
388 if (ret)
389 break;
390 case -ENOKEY: /* negative key */
David Howells664cceb2005-09-28 17:03:15 +0100391 ret = key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 break;
David Howells3e301482005-06-23 22:00:56 -0700393 default:
David Howells664cceb2005-09-28 17:03:15 +0100394 err = key_ref;
David Howells3e301482005-06-23 22:00:56 -0700395 break;
396 }
David Howells3e301482005-06-23 22:00:56 -0700397 }
398 /* or search the user-session keyring */
David Howells4bdf0bc2013-09-24 10:35:15 +0100399 else if (ctx->cred->user->session_keyring) {
David Howells664cceb2005-09-28 17:03:15 +0100400 key_ref = keyring_search_aux(
David Howells4bdf0bc2013-09-24 10:35:15 +0100401 make_key_ref(ctx->cred->user->session_keyring, 1),
402 ctx);
David Howells664cceb2005-09-28 17:03:15 +0100403 if (!IS_ERR(key_ref))
David Howells3e301482005-06-23 22:00:56 -0700404 goto found;
405
David Howells664cceb2005-09-28 17:03:15 +0100406 switch (PTR_ERR(key_ref)) {
David Howells3e301482005-06-23 22:00:56 -0700407 case -EAGAIN: /* no key */
408 if (ret)
409 break;
410 case -ENOKEY: /* negative key */
David Howells664cceb2005-09-28 17:03:15 +0100411 ret = key_ref;
David Howells3e301482005-06-23 22:00:56 -0700412 break;
413 default:
David Howells664cceb2005-09-28 17:03:15 +0100414 err = key_ref;
David Howells3e301482005-06-23 22:00:56 -0700415 break;
416 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700417 }
418
David Howells927942a2010-06-11 17:31:10 +0100419 /* no key - decide on the error we're going to go for */
420 key_ref = ret ? ret : err;
421
422found:
423 return key_ref;
424}
425
David Howells927942a2010-06-11 17:31:10 +0100426/*
David Howells973c9f42011-01-20 16:38:33 +0000427 * Search the process keyrings attached to the supplied cred for the first
428 * matching key in the manner of search_my_process_keyrings(), but also search
429 * the keys attached to the assumed authorisation key using its credentials if
430 * one is available.
431 *
432 * Return same as search_my_process_keyrings().
David Howells927942a2010-06-11 17:31:10 +0100433 */
David Howells4bdf0bc2013-09-24 10:35:15 +0100434key_ref_t search_process_keyrings(struct keyring_search_context *ctx)
David Howells927942a2010-06-11 17:31:10 +0100435{
436 struct request_key_auth *rka;
437 key_ref_t key_ref, ret = ERR_PTR(-EACCES), err;
438
439 might_sleep();
440
David Howells4bdf0bc2013-09-24 10:35:15 +0100441 key_ref = search_my_process_keyrings(ctx);
David Howells927942a2010-06-11 17:31:10 +0100442 if (!IS_ERR(key_ref))
443 goto found;
444 err = key_ref;
445
David Howellsb5f545c2006-01-08 01:02:47 -0800446 /* if this process has an instantiation authorisation key, then we also
447 * search the keyrings of the process mentioned there
448 * - we don't permit access to request_key auth keys via this method
449 */
David Howells4bdf0bc2013-09-24 10:35:15 +0100450 if (ctx->cred->request_key_auth &&
451 ctx->cred == current_cred() &&
452 ctx->index_key.type != &key_type_request_key_auth
David Howellsb5f545c2006-01-08 01:02:47 -0800453 ) {
David Howells4bdf0bc2013-09-24 10:35:15 +0100454 const struct cred *cred = ctx->cred;
455
David Howells04c567d2006-06-22 14:47:18 -0700456 /* defend against the auth key being revoked */
David Howellsc69e8d92008-11-14 10:39:19 +1100457 down_read(&cred->request_key_auth->sem);
David Howells3e301482005-06-23 22:00:56 -0700458
David Howells4bdf0bc2013-09-24 10:35:15 +0100459 if (key_validate(ctx->cred->request_key_auth) == 0) {
David Howells146aa8b2015-10-21 14:04:48 +0100460 rka = ctx->cred->request_key_auth->payload.data[0];
David Howellsb5f545c2006-01-08 01:02:47 -0800461
David Howells4bdf0bc2013-09-24 10:35:15 +0100462 ctx->cred = rka->cred;
463 key_ref = search_process_keyrings(ctx);
464 ctx->cred = cred;
David Howellsb5f545c2006-01-08 01:02:47 -0800465
David Howellsc69e8d92008-11-14 10:39:19 +1100466 up_read(&cred->request_key_auth->sem);
David Howells04c567d2006-06-22 14:47:18 -0700467
468 if (!IS_ERR(key_ref))
469 goto found;
470
David Howells927942a2010-06-11 17:31:10 +0100471 ret = key_ref;
David Howells04c567d2006-06-22 14:47:18 -0700472 } else {
David Howellsc69e8d92008-11-14 10:39:19 +1100473 up_read(&cred->request_key_auth->sem);
David Howellsb5f545c2006-01-08 01:02:47 -0800474 }
475 }
476
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477 /* no key - decide on the error we're going to go for */
David Howells927942a2010-06-11 17:31:10 +0100478 if (err == ERR_PTR(-ENOKEY) || ret == ERR_PTR(-ENOKEY))
479 key_ref = ERR_PTR(-ENOKEY);
480 else if (err == ERR_PTR(-EACCES))
481 key_ref = ret;
482 else
483 key_ref = err;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700484
David Howells3e301482005-06-23 22:00:56 -0700485found:
David Howells664cceb2005-09-28 17:03:15 +0100486 return key_ref;
David Howellsa8b17ed2011-01-20 16:38:27 +0000487}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700488
Linus Torvalds1da177e2005-04-16 15:20:36 -0700489/*
David Howells973c9f42011-01-20 16:38:33 +0000490 * See if the key we're looking at is the target key.
David Howells664cceb2005-09-28 17:03:15 +0100491 */
David Howells0c903ab2014-09-16 17:36:08 +0100492bool lookup_user_key_possessed(const struct key *key,
493 const struct key_match_data *match_data)
David Howells664cceb2005-09-28 17:03:15 +0100494{
David Howells46291952014-09-16 17:36:02 +0100495 return key == match_data->raw_data;
David Howellsa8b17ed2011-01-20 16:38:27 +0000496}
David Howells664cceb2005-09-28 17:03:15 +0100497
David Howells664cceb2005-09-28 17:03:15 +0100498/*
David Howells973c9f42011-01-20 16:38:33 +0000499 * Look up a key ID given us by userspace with a given permissions mask to get
500 * the key it refers to.
501 *
502 * Flags can be passed to request that special keyrings be created if referred
503 * to directly, to permit partially constructed keys to be found and to skip
504 * validity and permission checks on the found key.
505 *
506 * Returns a pointer to the key with an incremented usage count if successful;
507 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
508 * to a key or the best found key was a negative key; -EKEYREVOKED or
509 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
510 * found key doesn't grant the requested permit or the LSM denied access to it;
511 * or -ENOMEM if a special keyring couldn't be created.
512 *
513 * In the case of a successful return, the possession attribute is set on the
514 * returned key reference.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700515 */
David Howells55931222009-09-02 09:13:45 +0100516key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
David Howells8bbf49762008-11-14 10:39:14 +1100517 key_perm_t perm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700518{
David Howells4bdf0bc2013-09-24 10:35:15 +0100519 struct keyring_search_context ctx = {
David Howells46291952014-09-16 17:36:02 +0100520 .match_data.cmp = lookup_user_key_possessed,
521 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
522 .flags = KEYRING_SEARCH_NO_STATE_CHECK,
David Howells4bdf0bc2013-09-24 10:35:15 +0100523 };
David Howells8bbf49762008-11-14 10:39:14 +1100524 struct request_key_auth *rka;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 struct key *key;
David Howellsb6dff3e2008-11-14 10:39:16 +1100526 key_ref_t key_ref, skey_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 int ret;
528
David Howellsbb952bb2008-11-14 10:39:20 +1100529try_again:
David Howells4bdf0bc2013-09-24 10:35:15 +0100530 ctx.cred = get_current_cred();
David Howells664cceb2005-09-28 17:03:15 +0100531 key_ref = ERR_PTR(-ENOKEY);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700532
533 switch (id) {
534 case KEY_SPEC_THREAD_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100535 if (!ctx.cred->thread_keyring) {
David Howells55931222009-09-02 09:13:45 +0100536 if (!(lflags & KEY_LOOKUP_CREATE))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537 goto error;
538
David Howells8bbf49762008-11-14 10:39:14 +1100539 ret = install_thread_keyring();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700540 if (ret < 0) {
Dan Carpenter4d09ec02010-05-17 14:42:35 +0100541 key_ref = ERR_PTR(ret);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700542 goto error;
543 }
David Howellsbb952bb2008-11-14 10:39:20 +1100544 goto reget_creds;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700545 }
546
David Howells4bdf0bc2013-09-24 10:35:15 +0100547 key = ctx.cred->thread_keyring;
David Howellsccc3e6d2013-09-24 10:35:16 +0100548 __key_get(key);
David Howells664cceb2005-09-28 17:03:15 +0100549 key_ref = make_key_ref(key, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 break;
551
552 case KEY_SPEC_PROCESS_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100553 if (!ctx.cred->process_keyring) {
David Howells55931222009-09-02 09:13:45 +0100554 if (!(lflags & KEY_LOOKUP_CREATE))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700555 goto error;
556
David Howells8bbf49762008-11-14 10:39:14 +1100557 ret = install_process_keyring();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700558 if (ret < 0) {
Dan Carpenter4d09ec02010-05-17 14:42:35 +0100559 key_ref = ERR_PTR(ret);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700560 goto error;
561 }
David Howellsbb952bb2008-11-14 10:39:20 +1100562 goto reget_creds;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700563 }
564
David Howells4bdf0bc2013-09-24 10:35:15 +0100565 key = ctx.cred->process_keyring;
David Howellsccc3e6d2013-09-24 10:35:16 +0100566 __key_get(key);
David Howells664cceb2005-09-28 17:03:15 +0100567 key_ref = make_key_ref(key, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568 break;
569
570 case KEY_SPEC_SESSION_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100571 if (!ctx.cred->session_keyring) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700572 /* always install a session keyring upon access if one
573 * doesn't exist yet */
David Howells8bbf49762008-11-14 10:39:14 +1100574 ret = install_user_keyrings();
David Howells69664cf2008-04-29 01:01:31 -0700575 if (ret < 0)
576 goto error;
David Howells3ecf1b42011-08-22 14:08:43 +0100577 if (lflags & KEY_LOOKUP_CREATE)
578 ret = join_session_keyring(NULL);
579 else
580 ret = install_session_keyring(
David Howells4bdf0bc2013-09-24 10:35:15 +0100581 ctx.cred->user->session_keyring);
David Howellsd84f4f92008-11-14 10:39:23 +1100582
Linus Torvalds1da177e2005-04-16 15:20:36 -0700583 if (ret < 0)
584 goto error;
David Howellsbb952bb2008-11-14 10:39:20 +1100585 goto reget_creds;
David Howells4bdf0bc2013-09-24 10:35:15 +0100586 } else if (ctx.cred->session_keyring ==
587 ctx.cred->user->session_keyring &&
David Howells3ecf1b42011-08-22 14:08:43 +0100588 lflags & KEY_LOOKUP_CREATE) {
589 ret = join_session_keyring(NULL);
590 if (ret < 0)
591 goto error;
592 goto reget_creds;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 }
594
David Howells3e301482005-06-23 22:00:56 -0700595 rcu_read_lock();
David Howells4bdf0bc2013-09-24 10:35:15 +0100596 key = rcu_dereference(ctx.cred->session_keyring);
David Howellsccc3e6d2013-09-24 10:35:16 +0100597 __key_get(key);
David Howells3e301482005-06-23 22:00:56 -0700598 rcu_read_unlock();
David Howells664cceb2005-09-28 17:03:15 +0100599 key_ref = make_key_ref(key, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600 break;
601
602 case KEY_SPEC_USER_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100603 if (!ctx.cred->user->uid_keyring) {
David Howells8bbf49762008-11-14 10:39:14 +1100604 ret = install_user_keyrings();
David Howells69664cf2008-04-29 01:01:31 -0700605 if (ret < 0)
606 goto error;
607 }
608
David Howells4bdf0bc2013-09-24 10:35:15 +0100609 key = ctx.cred->user->uid_keyring;
David Howellsccc3e6d2013-09-24 10:35:16 +0100610 __key_get(key);
David Howells664cceb2005-09-28 17:03:15 +0100611 key_ref = make_key_ref(key, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700612 break;
613
614 case KEY_SPEC_USER_SESSION_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100615 if (!ctx.cred->user->session_keyring) {
David Howells8bbf49762008-11-14 10:39:14 +1100616 ret = install_user_keyrings();
David Howells69664cf2008-04-29 01:01:31 -0700617 if (ret < 0)
618 goto error;
619 }
620
David Howells4bdf0bc2013-09-24 10:35:15 +0100621 key = ctx.cred->user->session_keyring;
David Howellsccc3e6d2013-09-24 10:35:16 +0100622 __key_get(key);
David Howells664cceb2005-09-28 17:03:15 +0100623 key_ref = make_key_ref(key, 1);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700624 break;
625
626 case KEY_SPEC_GROUP_KEYRING:
627 /* group keyrings are not yet supported */
Dan Carpenter4d09ec02010-05-17 14:42:35 +0100628 key_ref = ERR_PTR(-EINVAL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700629 goto error;
630
David Howellsb5f545c2006-01-08 01:02:47 -0800631 case KEY_SPEC_REQKEY_AUTH_KEY:
David Howells4bdf0bc2013-09-24 10:35:15 +0100632 key = ctx.cred->request_key_auth;
David Howellsb5f545c2006-01-08 01:02:47 -0800633 if (!key)
634 goto error;
635
David Howellsccc3e6d2013-09-24 10:35:16 +0100636 __key_get(key);
David Howellsb5f545c2006-01-08 01:02:47 -0800637 key_ref = make_key_ref(key, 1);
638 break;
639
David Howells8bbf49762008-11-14 10:39:14 +1100640 case KEY_SPEC_REQUESTOR_KEYRING:
David Howells4bdf0bc2013-09-24 10:35:15 +0100641 if (!ctx.cred->request_key_auth)
David Howells8bbf49762008-11-14 10:39:14 +1100642 goto error;
643
David Howells4bdf0bc2013-09-24 10:35:15 +0100644 down_read(&ctx.cred->request_key_auth->sem);
Dan Carpenterf67dabb2012-03-06 13:32:16 +0000645 if (test_bit(KEY_FLAG_REVOKED,
David Howells4bdf0bc2013-09-24 10:35:15 +0100646 &ctx.cred->request_key_auth->flags)) {
David Howells8bbf49762008-11-14 10:39:14 +1100647 key_ref = ERR_PTR(-EKEYREVOKED);
648 key = NULL;
649 } else {
David Howells146aa8b2015-10-21 14:04:48 +0100650 rka = ctx.cred->request_key_auth->payload.data[0];
David Howells8bbf49762008-11-14 10:39:14 +1100651 key = rka->dest_keyring;
David Howellsccc3e6d2013-09-24 10:35:16 +0100652 __key_get(key);
David Howells8bbf49762008-11-14 10:39:14 +1100653 }
David Howells4bdf0bc2013-09-24 10:35:15 +0100654 up_read(&ctx.cred->request_key_auth->sem);
David Howells8bbf49762008-11-14 10:39:14 +1100655 if (!key)
656 goto error;
657 key_ref = make_key_ref(key, 1);
658 break;
659
Linus Torvalds1da177e2005-04-16 15:20:36 -0700660 default:
David Howells664cceb2005-09-28 17:03:15 +0100661 key_ref = ERR_PTR(-EINVAL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700662 if (id < 1)
663 goto error;
664
665 key = key_lookup(id);
David Howells664cceb2005-09-28 17:03:15 +0100666 if (IS_ERR(key)) {
David Howellse231c2e2008-02-07 00:15:26 -0800667 key_ref = ERR_CAST(key);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700668 goto error;
David Howells664cceb2005-09-28 17:03:15 +0100669 }
670
671 key_ref = make_key_ref(key, 0);
672
673 /* check to see if we possess the key */
David Howells4bdf0bc2013-09-24 10:35:15 +0100674 ctx.index_key.type = key->type;
675 ctx.index_key.description = key->description;
676 ctx.index_key.desc_len = strlen(key->description);
David Howells46291952014-09-16 17:36:02 +0100677 ctx.match_data.raw_data = key;
David Howells4bdf0bc2013-09-24 10:35:15 +0100678 kdebug("check possessed");
679 skey_ref = search_process_keyrings(&ctx);
680 kdebug("possessed=%p", skey_ref);
David Howells664cceb2005-09-28 17:03:15 +0100681
682 if (!IS_ERR(skey_ref)) {
683 key_put(key);
684 key_ref = skey_ref;
685 }
686
Linus Torvalds1da177e2005-04-16 15:20:36 -0700687 break;
688 }
689
David Howells55931222009-09-02 09:13:45 +0100690 /* unlink does not use the nominated key in any way, so can skip all
691 * the permission checks as it is only concerned with the keyring */
692 if (lflags & KEY_LOOKUP_FOR_UNLINK) {
693 ret = 0;
694 goto error;
695 }
696
697 if (!(lflags & KEY_LOOKUP_PARTIAL)) {
David Howells76181c12007-10-16 23:29:46 -0700698 ret = wait_for_key_construction(key, true);
699 switch (ret) {
700 case -ERESTARTSYS:
701 goto invalid_key;
702 default:
703 if (perm)
704 goto invalid_key;
705 case 0:
706 break;
707 }
708 } else if (perm) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700709 ret = key_validate(key);
710 if (ret < 0)
711 goto invalid_key;
712 }
713
714 ret = -EIO;
David Howells55931222009-09-02 09:13:45 +0100715 if (!(lflags & KEY_LOOKUP_PARTIAL) &&
716 !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700717 goto invalid_key;
718
David Howells3e301482005-06-23 22:00:56 -0700719 /* check the permissions */
David Howells4bdf0bc2013-09-24 10:35:15 +0100720 ret = key_task_permission(key_ref, ctx.cred, perm);
David Howells29db9192005-10-30 15:02:44 -0800721 if (ret < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700722 goto invalid_key;
723
David Howells31d5a792012-05-11 10:56:56 +0100724 key->last_used_at = current_kernel_time().tv_sec;
725
David Howells664cceb2005-09-28 17:03:15 +0100726error:
David Howells4bdf0bc2013-09-24 10:35:15 +0100727 put_cred(ctx.cred);
David Howells664cceb2005-09-28 17:03:15 +0100728 return key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700729
David Howells664cceb2005-09-28 17:03:15 +0100730invalid_key:
731 key_ref_put(key_ref);
732 key_ref = ERR_PTR(ret);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700733 goto error;
734
David Howellsbb952bb2008-11-14 10:39:20 +1100735 /* if we attempted to install a keyring, then it may have caused new
736 * creds to be installed */
737reget_creds:
David Howells4bdf0bc2013-09-24 10:35:15 +0100738 put_cred(ctx.cred);
David Howellsbb952bb2008-11-14 10:39:20 +1100739 goto try_again;
David Howellsa8b17ed2011-01-20 16:38:27 +0000740}
David Howellsbb952bb2008-11-14 10:39:20 +1100741
Linus Torvalds1da177e2005-04-16 15:20:36 -0700742/*
David Howells973c9f42011-01-20 16:38:33 +0000743 * Join the named keyring as the session keyring if possible else attempt to
744 * create a new one of that name and join that.
745 *
746 * If the name is NULL, an empty anonymous keyring will be installed as the
747 * session keyring.
748 *
749 * Named session keyrings are joined with a semaphore held to prevent the
750 * keyrings from going away whilst the attempt is made to going them and also
751 * to prevent a race in creating compatible session keyrings.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700752 */
753long join_session_keyring(const char *name)
754{
David Howellsd84f4f92008-11-14 10:39:23 +1100755 const struct cred *old;
756 struct cred *new;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700757 struct key *keyring;
David Howellsd84f4f92008-11-14 10:39:23 +1100758 long ret, serial;
759
David Howellsd84f4f92008-11-14 10:39:23 +1100760 new = prepare_creds();
761 if (!new)
762 return -ENOMEM;
763 old = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700764
765 /* if no name is provided, install an anonymous keyring */
766 if (!name) {
David Howellsd84f4f92008-11-14 10:39:23 +1100767 ret = install_session_keyring_to_cred(new, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700768 if (ret < 0)
769 goto error;
770
David Howells3a505972012-10-02 19:24:29 +0100771 serial = new->session_keyring->serial;
David Howellsd84f4f92008-11-14 10:39:23 +1100772 ret = commit_creds(new);
773 if (ret == 0)
774 ret = serial;
775 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700776 }
777
778 /* allow the user to join or create a named keyring */
Ingo Molnarbb003072006-03-22 00:09:14 -0800779 mutex_lock(&key_session_mutex);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700780
781 /* look for an existing keyring of this name */
David Howells69664cf2008-04-29 01:01:31 -0700782 keyring = find_keyring_by_name(name, false);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700783 if (PTR_ERR(keyring) == -ENOKEY) {
784 /* not found - try and create a new one */
David Howells96b5c8f2012-10-02 19:24:56 +0100785 keyring = keyring_alloc(
786 name, old->uid, old->gid, old,
787 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK,
788 KEY_ALLOC_IN_QUOTA, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700789 if (IS_ERR(keyring)) {
790 ret = PTR_ERR(keyring);
David Howellsbcf945d2005-08-04 13:07:06 -0700791 goto error2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700792 }
David Howellsd84f4f92008-11-14 10:39:23 +1100793 } else if (IS_ERR(keyring)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700794 ret = PTR_ERR(keyring);
795 goto error2;
David Howells3a505972012-10-02 19:24:29 +0100796 } else if (keyring == new->session_keyring) {
Yevgeny Pats23567fd2016-01-19 22:09:04 +0000797 key_put(keyring);
David Howells3a505972012-10-02 19:24:29 +0100798 ret = 0;
799 goto error2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700800 }
801
802 /* we've got a keyring - now to install it */
David Howellsd84f4f92008-11-14 10:39:23 +1100803 ret = install_session_keyring_to_cred(new, keyring);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804 if (ret < 0)
805 goto error2;
806
David Howellsd84f4f92008-11-14 10:39:23 +1100807 commit_creds(new);
808 mutex_unlock(&key_session_mutex);
809
Linus Torvalds1da177e2005-04-16 15:20:36 -0700810 ret = keyring->serial;
811 key_put(keyring);
David Howellsd84f4f92008-11-14 10:39:23 +1100812okay:
813 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700814
David Howells664cceb2005-09-28 17:03:15 +0100815error2:
Ingo Molnarbb003072006-03-22 00:09:14 -0800816 mutex_unlock(&key_session_mutex);
David Howells664cceb2005-09-28 17:03:15 +0100817error:
David Howellsd84f4f92008-11-14 10:39:23 +1100818 abort_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700819 return ret;
David Howellsd84f4f92008-11-14 10:39:23 +1100820}
David Howellsee18d642009-09-02 09:14:21 +0100821
822/*
David Howells973c9f42011-01-20 16:38:33 +0000823 * Replace a process's session keyring on behalf of one of its children when
824 * the target process is about to resume userspace execution.
David Howellsee18d642009-09-02 09:14:21 +0100825 */
Al Viro67d12142012-06-27 11:07:19 +0400826void key_change_session_keyring(struct callback_head *twork)
David Howellsee18d642009-09-02 09:14:21 +0100827{
Oleg Nesterov413cd3d2012-05-11 10:59:08 +1000828 const struct cred *old = current_cred();
Al Viro67d12142012-06-27 11:07:19 +0400829 struct cred *new = container_of(twork, struct cred, rcu);
David Howellsee18d642009-09-02 09:14:21 +0100830
Oleg Nesterov413cd3d2012-05-11 10:59:08 +1000831 if (unlikely(current->flags & PF_EXITING)) {
832 put_cred(new);
David Howellsee18d642009-09-02 09:14:21 +0100833 return;
Oleg Nesterov413cd3d2012-05-11 10:59:08 +1000834 }
David Howellsee18d642009-09-02 09:14:21 +0100835
David Howellsee18d642009-09-02 09:14:21 +0100836 new-> uid = old-> uid;
837 new-> euid = old-> euid;
838 new-> suid = old-> suid;
839 new->fsuid = old->fsuid;
840 new-> gid = old-> gid;
841 new-> egid = old-> egid;
842 new-> sgid = old-> sgid;
843 new->fsgid = old->fsgid;
844 new->user = get_uid(old->user);
Eric W. Biedermanba0e3422013-03-02 19:14:03 -0800845 new->user_ns = get_user_ns(old->user_ns);
David Howellsee18d642009-09-02 09:14:21 +0100846 new->group_info = get_group_info(old->group_info);
847
848 new->securebits = old->securebits;
849 new->cap_inheritable = old->cap_inheritable;
850 new->cap_permitted = old->cap_permitted;
851 new->cap_effective = old->cap_effective;
Andy Lutomirski58319052015-09-04 15:42:45 -0700852 new->cap_ambient = old->cap_ambient;
David Howellsee18d642009-09-02 09:14:21 +0100853 new->cap_bset = old->cap_bset;
854
855 new->jit_keyring = old->jit_keyring;
856 new->thread_keyring = key_get(old->thread_keyring);
David Howells3a505972012-10-02 19:24:29 +0100857 new->process_keyring = key_get(old->process_keyring);
David Howellsee18d642009-09-02 09:14:21 +0100858
859 security_transfer_creds(new, old);
860
861 commit_creds(new);
862}
Mimi Zoharc124bde2013-09-04 13:26:22 +0100863
864/*
865 * Make sure that root's user and user-session keyrings exist.
866 */
867static int __init init_root_keyring(void)
868{
869 return install_user_keyrings();
870}
871
872late_initcall(init_root_keyring);