blob: 4b5c948eb41426c76ef1810239cb0a98f9c4f918 [file] [log] [blame]
David Howells973c9f42011-01-20 16:38:33 +00001/* Userspace key control operations
Linus Torvalds1da177e2005-04-16 15:20:36 -07002 *
David Howells3e301482005-06-23 22:00:56 -07003 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
16#include <linux/syscalls.h>
Bryan Schumaker59e6b9c2012-02-24 14:14:50 -050017#include <linux/key.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070018#include <linux/keyctl.h>
19#include <linux/fs.h>
Randy.Dunlapc59ede72006-01-11 12:17:46 -080020#include <linux/capability.h>
Davi Arnaut0cb409d2006-03-24 03:18:43 -080021#include <linux/string.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070022#include <linux/err.h>
David Howells38bbca62008-04-29 01:01:19 -070023#include <linux/vmalloc.h>
David Howells70a5bb72008-04-29 01:01:26 -070024#include <linux/security.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070025#include <asm/uaccess.h>
26#include "internal.h"
27
Davi Arnaut0cb409d2006-03-24 03:18:43 -080028static int key_get_type_from_user(char *type,
29 const char __user *_type,
30 unsigned len)
31{
32 int ret;
33
34 ret = strncpy_from_user(type, _type, len);
Davi Arnaut0cb409d2006-03-24 03:18:43 -080035 if (ret < 0)
Dan Carpenter4303ef12010-06-11 17:30:05 +010036 return ret;
Davi Arnaut0cb409d2006-03-24 03:18:43 -080037 if (ret == 0 || ret >= len)
38 return -EINVAL;
Davi Arnaut0cb409d2006-03-24 03:18:43 -080039 if (type[0] == '.')
40 return -EPERM;
Davi Arnaut0cb409d2006-03-24 03:18:43 -080041 type[len - 1] = '\0';
Davi Arnaut0cb409d2006-03-24 03:18:43 -080042 return 0;
43}
44
Linus Torvalds1da177e2005-04-16 15:20:36 -070045/*
David Howells973c9f42011-01-20 16:38:33 +000046 * Extract the description of a new key from userspace and either add it as a
47 * new key to the specified keyring or update a matching key in that keyring.
48 *
David Howellscf7f6012012-09-13 13:06:29 +010049 * If the description is NULL or an empty string, the key type is asked to
50 * generate one from the payload.
51 *
David Howells973c9f42011-01-20 16:38:33 +000052 * The keyring must be writable so that we can attach the key to it.
53 *
54 * If successful, the new key's serial number is returned, otherwise an error
55 * code is returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -070056 */
Heiko Carstens1e7bfb22009-01-14 14:14:29 +010057SYSCALL_DEFINE5(add_key, const char __user *, _type,
58 const char __user *, _description,
59 const void __user *, _payload,
60 size_t, plen,
61 key_serial_t, ringid)
Linus Torvalds1da177e2005-04-16 15:20:36 -070062{
David Howells664cceb2005-09-28 17:03:15 +010063 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -070064 char type[32], *description;
65 void *payload;
Davi Arnaut0cb409d2006-03-24 03:18:43 -080066 long ret;
David Howells38bbca62008-04-29 01:01:19 -070067 bool vm;
Linus Torvalds1da177e2005-04-16 15:20:36 -070068
69 ret = -EINVAL;
David Howells38bbca62008-04-29 01:01:19 -070070 if (plen > 1024 * 1024 - 1)
Linus Torvalds1da177e2005-04-16 15:20:36 -070071 goto error;
72
73 /* draw all the data into kernel space */
Davi Arnaut0cb409d2006-03-24 03:18:43 -080074 ret = key_get_type_from_user(type, _type, sizeof(type));
Linus Torvalds1da177e2005-04-16 15:20:36 -070075 if (ret < 0)
76 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -070077
David Howellscf7f6012012-09-13 13:06:29 +010078 description = NULL;
79 if (_description) {
80 description = strndup_user(_description, PAGE_SIZE);
81 if (IS_ERR(description)) {
82 ret = PTR_ERR(description);
83 goto error;
84 }
85 if (!*description) {
86 kfree(description);
87 description = NULL;
88 }
Davi Arnaut0cb409d2006-03-24 03:18:43 -080089 }
Linus Torvalds1da177e2005-04-16 15:20:36 -070090
91 /* pull the payload in if one was supplied */
92 payload = NULL;
93
David Howells38bbca62008-04-29 01:01:19 -070094 vm = false;
Linus Torvalds1da177e2005-04-16 15:20:36 -070095 if (_payload) {
96 ret = -ENOMEM;
Andrew Morton4f1c28d2012-05-31 16:26:02 -070097 payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN);
David Howells38bbca62008-04-29 01:01:19 -070098 if (!payload) {
99 if (plen <= PAGE_SIZE)
100 goto error2;
101 vm = true;
102 payload = vmalloc(plen);
103 if (!payload)
104 goto error2;
105 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700106
107 ret = -EFAULT;
108 if (copy_from_user(payload, _payload, plen) != 0)
109 goto error3;
110 }
111
112 /* find the target keyring (which must be writable) */
David Howells55931222009-09-02 09:13:45 +0100113 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100114 if (IS_ERR(keyring_ref)) {
115 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 goto error3;
117 }
118
119 /* create or update the requested key and add it to the target
120 * keyring */
David Howells664cceb2005-09-28 17:03:15 +0100121 key_ref = key_create_or_update(keyring_ref, type, description,
Arun Raghavan6b79ccb2008-04-29 01:01:28 -0700122 payload, plen, KEY_PERM_UNDEF,
123 KEY_ALLOC_IN_QUOTA);
David Howells664cceb2005-09-28 17:03:15 +0100124 if (!IS_ERR(key_ref)) {
125 ret = key_ref_to_ptr(key_ref)->serial;
126 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127 }
128 else {
David Howells664cceb2005-09-28 17:03:15 +0100129 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700130 }
131
David Howells664cceb2005-09-28 17:03:15 +0100132 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700133 error3:
David Howells38bbca62008-04-29 01:01:19 -0700134 if (!vm)
135 kfree(payload);
136 else
137 vfree(payload);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700138 error2:
139 kfree(description);
140 error:
141 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000142}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700143
Linus Torvalds1da177e2005-04-16 15:20:36 -0700144/*
David Howells973c9f42011-01-20 16:38:33 +0000145 * Search the process keyrings and keyring trees linked from those for a
146 * matching key. Keyrings must have appropriate Search permission to be
147 * searched.
148 *
149 * If a key is found, it will be attached to the destination keyring if there's
150 * one specified and the serial number of the key will be returned.
151 *
152 * If no key is found, /sbin/request-key will be invoked if _callout_info is
153 * non-NULL in an attempt to create a key. The _callout_info string will be
154 * passed to /sbin/request-key to aid with completing the request. If the
155 * _callout_info string is "" then it will be changed to "-".
Linus Torvalds1da177e2005-04-16 15:20:36 -0700156 */
Heiko Carstens1e7bfb22009-01-14 14:14:29 +0100157SYSCALL_DEFINE4(request_key, const char __user *, _type,
158 const char __user *, _description,
159 const char __user *, _callout_info,
160 key_serial_t, destringid)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700161{
162 struct key_type *ktype;
David Howells664cceb2005-09-28 17:03:15 +0100163 struct key *key;
164 key_ref_t dest_ref;
David Howells4a38e122008-04-29 01:01:24 -0700165 size_t callout_len;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700166 char type[32], *description, *callout_info;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800167 long ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168
169 /* pull the type into kernel space */
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800170 ret = key_get_type_from_user(type, _type, sizeof(type));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171 if (ret < 0)
172 goto error;
David Howells1260f802005-08-04 11:50:01 +0100173
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 /* pull the description into kernel space */
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800175 description = strndup_user(_description, PAGE_SIZE);
176 if (IS_ERR(description)) {
177 ret = PTR_ERR(description);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178 goto error;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800179 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180
181 /* pull the callout info into kernel space */
182 callout_info = NULL;
David Howells4a38e122008-04-29 01:01:24 -0700183 callout_len = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184 if (_callout_info) {
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800185 callout_info = strndup_user(_callout_info, PAGE_SIZE);
186 if (IS_ERR(callout_info)) {
187 ret = PTR_ERR(callout_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188 goto error2;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800189 }
David Howells4a38e122008-04-29 01:01:24 -0700190 callout_len = strlen(callout_info);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191 }
192
193 /* get the destination keyring if specified */
David Howells664cceb2005-09-28 17:03:15 +0100194 dest_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700195 if (destringid) {
David Howells55931222009-09-02 09:13:45 +0100196 dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
197 KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100198 if (IS_ERR(dest_ref)) {
199 ret = PTR_ERR(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200 goto error3;
201 }
202 }
203
204 /* find the key type */
205 ktype = key_type_lookup(type);
206 if (IS_ERR(ktype)) {
207 ret = PTR_ERR(ktype);
208 goto error4;
209 }
210
211 /* do the search */
David Howells4a38e122008-04-29 01:01:24 -0700212 key = request_key_and_link(ktype, description, callout_info,
213 callout_len, NULL, key_ref_to_ptr(dest_ref),
David Howells7e047ef2006-06-26 00:24:50 -0700214 KEY_ALLOC_IN_QUOTA);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 if (IS_ERR(key)) {
216 ret = PTR_ERR(key);
217 goto error5;
218 }
219
David Howells4aab1e82011-03-11 17:57:33 +0000220 /* wait for the key to finish being constructed */
221 ret = wait_for_key_construction(key, 1);
222 if (ret < 0)
223 goto error6;
224
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225 ret = key->serial;
226
David Howells4aab1e82011-03-11 17:57:33 +0000227error6:
David Howells3e301482005-06-23 22:00:56 -0700228 key_put(key);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700229error5:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700230 key_type_put(ktype);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700231error4:
David Howells664cceb2005-09-28 17:03:15 +0100232 key_ref_put(dest_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700233error3:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234 kfree(callout_info);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700235error2:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236 kfree(description);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700237error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000239}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700240
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241/*
David Howells973c9f42011-01-20 16:38:33 +0000242 * Get the ID of the specified process keyring.
243 *
244 * The requested keyring must have search permission to be found.
245 *
246 * If successful, the ID of the requested keyring will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247 */
248long keyctl_get_keyring_ID(key_serial_t id, int create)
249{
David Howells664cceb2005-09-28 17:03:15 +0100250 key_ref_t key_ref;
David Howells55931222009-09-02 09:13:45 +0100251 unsigned long lflags;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 long ret;
253
David Howells55931222009-09-02 09:13:45 +0100254 lflags = create ? KEY_LOOKUP_CREATE : 0;
255 key_ref = lookup_user_key(id, lflags, KEY_SEARCH);
David Howells664cceb2005-09-28 17:03:15 +0100256 if (IS_ERR(key_ref)) {
257 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700258 goto error;
259 }
260
David Howells664cceb2005-09-28 17:03:15 +0100261 ret = key_ref_to_ptr(key_ref)->serial;
262 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700263error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700264 return ret;
David Howells973c9f42011-01-20 16:38:33 +0000265}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267/*
David Howells973c9f42011-01-20 16:38:33 +0000268 * Join a (named) session keyring.
269 *
270 * Create and join an anonymous session keyring or join a named session
271 * keyring, creating it if necessary. A named session keyring must have Search
272 * permission for it to be joined. Session keyrings without this permit will
273 * be skipped over.
274 *
275 * If successful, the ID of the joined session keyring will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700276 */
277long keyctl_join_session_keyring(const char __user *_name)
278{
279 char *name;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800280 long ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700281
282 /* fetch the name from userspace */
283 name = NULL;
284 if (_name) {
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800285 name = strndup_user(_name, PAGE_SIZE);
286 if (IS_ERR(name)) {
287 ret = PTR_ERR(name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700288 goto error;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800289 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700290 }
291
292 /* join the session */
293 ret = join_session_keyring(name);
Vegard Nossum0d54ee12009-01-17 17:45:45 +0100294 kfree(name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700295
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700296error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700297 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000298}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700299
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300/*
David Howells973c9f42011-01-20 16:38:33 +0000301 * Update a key's data payload from the given data.
302 *
303 * The key must grant the caller Write permission and the key type must support
304 * updating for this to work. A negative key can be positively instantiated
305 * with this call.
306 *
307 * If successful, 0 will be returned. If the key type does not support
308 * updating, then -EOPNOTSUPP will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309 */
310long keyctl_update_key(key_serial_t id,
311 const void __user *_payload,
312 size_t plen)
313{
David Howells664cceb2005-09-28 17:03:15 +0100314 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315 void *payload;
316 long ret;
317
318 ret = -EINVAL;
319 if (plen > PAGE_SIZE)
320 goto error;
321
322 /* pull the payload in if one was supplied */
323 payload = NULL;
324 if (_payload) {
325 ret = -ENOMEM;
326 payload = kmalloc(plen, GFP_KERNEL);
327 if (!payload)
328 goto error;
329
330 ret = -EFAULT;
331 if (copy_from_user(payload, _payload, plen) != 0)
332 goto error2;
333 }
334
335 /* find the target key (which must be writable) */
David Howells55931222009-09-02 09:13:45 +0100336 key_ref = lookup_user_key(id, 0, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100337 if (IS_ERR(key_ref)) {
338 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700339 goto error2;
340 }
341
342 /* update the key */
David Howells664cceb2005-09-28 17:03:15 +0100343 ret = key_update(key_ref, payload, plen);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700344
David Howells664cceb2005-09-28 17:03:15 +0100345 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700346error2:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347 kfree(payload);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700348error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000350}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700351
Linus Torvalds1da177e2005-04-16 15:20:36 -0700352/*
David Howells973c9f42011-01-20 16:38:33 +0000353 * Revoke a key.
354 *
355 * The key must be grant the caller Write or Setattr permission for this to
356 * work. The key type should give up its quota claim when revoked. The key
357 * and any links to the key will be automatically garbage collected after a
358 * certain amount of time (/proc/sys/kernel/keys/gc_delay).
359 *
360 * If successful, 0 is returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700361 */
362long keyctl_revoke_key(key_serial_t id)
363{
David Howells664cceb2005-09-28 17:03:15 +0100364 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365 long ret;
366
David Howells55931222009-09-02 09:13:45 +0100367 key_ref = lookup_user_key(id, 0, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100368 if (IS_ERR(key_ref)) {
369 ret = PTR_ERR(key_ref);
David Howells0c2c9a32009-09-02 09:13:50 +0100370 if (ret != -EACCES)
371 goto error;
372 key_ref = lookup_user_key(id, 0, KEY_SETATTR);
373 if (IS_ERR(key_ref)) {
374 ret = PTR_ERR(key_ref);
375 goto error;
376 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377 }
378
David Howells664cceb2005-09-28 17:03:15 +0100379 key_revoke(key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380 ret = 0;
381
David Howells664cceb2005-09-28 17:03:15 +0100382 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700383error:
David Howells1260f802005-08-04 11:50:01 +0100384 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000385}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700386
Linus Torvalds1da177e2005-04-16 15:20:36 -0700387/*
David Howellsfd758152012-05-11 10:56:56 +0100388 * Invalidate a key.
389 *
390 * The key must be grant the caller Invalidate permission for this to work.
391 * The key and any links to the key will be automatically garbage collected
392 * immediately.
393 *
394 * If successful, 0 is returned.
395 */
396long keyctl_invalidate_key(key_serial_t id)
397{
398 key_ref_t key_ref;
399 long ret;
400
401 kenter("%d", id);
402
403 key_ref = lookup_user_key(id, 0, KEY_SEARCH);
404 if (IS_ERR(key_ref)) {
405 ret = PTR_ERR(key_ref);
406 goto error;
407 }
408
409 key_invalidate(key_ref_to_ptr(key_ref));
410 ret = 0;
411
412 key_ref_put(key_ref);
413error:
414 kleave(" = %ld", ret);
415 return ret;
416}
417
418/*
David Howells973c9f42011-01-20 16:38:33 +0000419 * Clear the specified keyring, creating an empty process keyring if one of the
420 * special keyring IDs is used.
421 *
422 * The keyring must grant the caller Write permission for this to work. If
423 * successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 */
425long keyctl_keyring_clear(key_serial_t ringid)
426{
David Howells664cceb2005-09-28 17:03:15 +0100427 key_ref_t keyring_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700428 long ret;
429
David Howells55931222009-09-02 09:13:45 +0100430 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100431 if (IS_ERR(keyring_ref)) {
432 ret = PTR_ERR(keyring_ref);
David Howells700920e2012-01-18 15:31:45 +0000433
434 /* Root is permitted to invalidate certain special keyrings */
435 if (capable(CAP_SYS_ADMIN)) {
436 keyring_ref = lookup_user_key(ringid, 0, 0);
437 if (IS_ERR(keyring_ref))
438 goto error;
439 if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR,
440 &key_ref_to_ptr(keyring_ref)->flags))
441 goto clear;
442 goto error_put;
443 }
444
Linus Torvalds1da177e2005-04-16 15:20:36 -0700445 goto error;
446 }
447
David Howells700920e2012-01-18 15:31:45 +0000448clear:
David Howells664cceb2005-09-28 17:03:15 +0100449 ret = keyring_clear(key_ref_to_ptr(keyring_ref));
David Howells700920e2012-01-18 15:31:45 +0000450error_put:
David Howells664cceb2005-09-28 17:03:15 +0100451 key_ref_put(keyring_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700452error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700453 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000454}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700455
Linus Torvalds1da177e2005-04-16 15:20:36 -0700456/*
David Howells973c9f42011-01-20 16:38:33 +0000457 * Create a link from a keyring to a key if there's no matching key in the
458 * keyring, otherwise replace the link to the matching key with a link to the
459 * new key.
460 *
461 * The key must grant the caller Link permission and the the keyring must grant
462 * the caller Write permission. Furthermore, if an additional link is created,
463 * the keyring's quota will be extended.
464 *
465 * If successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700466 */
467long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
468{
David Howells664cceb2005-09-28 17:03:15 +0100469 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700470 long ret;
471
David Howells55931222009-09-02 09:13:45 +0100472 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100473 if (IS_ERR(keyring_ref)) {
474 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700475 goto error;
476 }
477
David Howells55931222009-09-02 09:13:45 +0100478 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_LINK);
David Howells664cceb2005-09-28 17:03:15 +0100479 if (IS_ERR(key_ref)) {
480 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700481 goto error2;
482 }
483
David Howells664cceb2005-09-28 17:03:15 +0100484 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700485
David Howells664cceb2005-09-28 17:03:15 +0100486 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700487error2:
David Howells664cceb2005-09-28 17:03:15 +0100488 key_ref_put(keyring_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700489error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700490 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000491}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700492
Linus Torvalds1da177e2005-04-16 15:20:36 -0700493/*
David Howells973c9f42011-01-20 16:38:33 +0000494 * Unlink a key from a keyring.
495 *
496 * The keyring must grant the caller Write permission for this to work; the key
497 * itself need not grant the caller anything. If the last link to a key is
498 * removed then that key will be scheduled for destruction.
499 *
500 * If successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700501 */
502long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
503{
David Howells664cceb2005-09-28 17:03:15 +0100504 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505 long ret;
506
David Howells55931222009-09-02 09:13:45 +0100507 keyring_ref = lookup_user_key(ringid, 0, KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100508 if (IS_ERR(keyring_ref)) {
509 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700510 goto error;
511 }
512
David Howells55931222009-09-02 09:13:45 +0100513 key_ref = lookup_user_key(id, KEY_LOOKUP_FOR_UNLINK, 0);
David Howells664cceb2005-09-28 17:03:15 +0100514 if (IS_ERR(key_ref)) {
515 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700516 goto error2;
517 }
518
David Howells664cceb2005-09-28 17:03:15 +0100519 ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700520
David Howells664cceb2005-09-28 17:03:15 +0100521 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700522error2:
David Howells664cceb2005-09-28 17:03:15 +0100523 key_ref_put(keyring_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700524error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000526}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527
Linus Torvalds1da177e2005-04-16 15:20:36 -0700528/*
David Howells973c9f42011-01-20 16:38:33 +0000529 * Return a description of a key to userspace.
530 *
531 * The key must grant the caller View permission for this to work.
532 *
533 * If there's a buffer, we place up to buflen bytes of data into it formatted
534 * in the following way:
535 *
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 * type;uid;gid;perm;description<NUL>
David Howells973c9f42011-01-20 16:38:33 +0000537 *
538 * If successful, we return the amount of description available, irrespective
539 * of how much we may have copied into the buffer.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700540 */
541long keyctl_describe_key(key_serial_t keyid,
542 char __user *buffer,
543 size_t buflen)
544{
David Howells3e301482005-06-23 22:00:56 -0700545 struct key *key, *instkey;
David Howells664cceb2005-09-28 17:03:15 +0100546 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700547 char *tmpbuf;
548 long ret;
549
David Howells55931222009-09-02 09:13:45 +0100550 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
David Howells664cceb2005-09-28 17:03:15 +0100551 if (IS_ERR(key_ref)) {
David Howells3e301482005-06-23 22:00:56 -0700552 /* viewing a key under construction is permitted if we have the
553 * authorisation token handy */
David Howells664cceb2005-09-28 17:03:15 +0100554 if (PTR_ERR(key_ref) == -EACCES) {
David Howells3e301482005-06-23 22:00:56 -0700555 instkey = key_get_instantiation_authkey(keyid);
556 if (!IS_ERR(instkey)) {
557 key_put(instkey);
David Howells8bbf49762008-11-14 10:39:14 +1100558 key_ref = lookup_user_key(keyid,
David Howells55931222009-09-02 09:13:45 +0100559 KEY_LOOKUP_PARTIAL,
560 0);
David Howells664cceb2005-09-28 17:03:15 +0100561 if (!IS_ERR(key_ref))
David Howells3e301482005-06-23 22:00:56 -0700562 goto okay;
563 }
564 }
565
David Howells664cceb2005-09-28 17:03:15 +0100566 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700567 goto error;
568 }
569
David Howells3e301482005-06-23 22:00:56 -0700570okay:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571 /* calculate how much description we're going to return */
572 ret = -ENOMEM;
573 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
574 if (!tmpbuf)
575 goto error2;
576
David Howells664cceb2005-09-28 17:03:15 +0100577 key = key_ref_to_ptr(key_ref);
578
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579 ret = snprintf(tmpbuf, PAGE_SIZE - 1,
David Howells664cceb2005-09-28 17:03:15 +0100580 "%s;%d;%d;%08x;%s",
David Howells94fd8402010-06-28 14:05:04 +0100581 key->type->name,
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800582 from_kuid_munged(current_user_ns(), key->uid),
583 from_kgid_munged(current_user_ns(), key->gid),
David Howells94fd8402010-06-28 14:05:04 +0100584 key->perm,
585 key->description ?: "");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
587 /* include a NUL char at the end of the data */
588 if (ret > PAGE_SIZE - 1)
589 ret = PAGE_SIZE - 1;
590 tmpbuf[ret] = 0;
591 ret++;
592
593 /* consider returning the data */
594 if (buffer && buflen > 0) {
595 if (buflen > ret)
596 buflen = ret;
597
598 if (copy_to_user(buffer, tmpbuf, buflen) != 0)
599 ret = -EFAULT;
600 }
601
602 kfree(tmpbuf);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700603error2:
David Howells664cceb2005-09-28 17:03:15 +0100604 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700605error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000607}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700608
Linus Torvalds1da177e2005-04-16 15:20:36 -0700609/*
David Howells973c9f42011-01-20 16:38:33 +0000610 * Search the specified keyring and any keyrings it links to for a matching
611 * key. Only keyrings that grant the caller Search permission will be searched
612 * (this includes the starting keyring). Only keys with Search permission can
613 * be found.
614 *
615 * If successful, the found key will be linked to the destination keyring if
616 * supplied and the key has Link permission, and the found key ID will be
617 * returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700618 */
619long keyctl_keyring_search(key_serial_t ringid,
620 const char __user *_type,
621 const char __user *_description,
622 key_serial_t destringid)
623{
624 struct key_type *ktype;
David Howells664cceb2005-09-28 17:03:15 +0100625 key_ref_t keyring_ref, key_ref, dest_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700626 char type[32], *description;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800627 long ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700628
629 /* pull the type and description into kernel space */
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800630 ret = key_get_type_from_user(type, _type, sizeof(type));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700631 if (ret < 0)
632 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700633
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800634 description = strndup_user(_description, PAGE_SIZE);
635 if (IS_ERR(description)) {
636 ret = PTR_ERR(description);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700637 goto error;
Davi Arnaut0cb409d2006-03-24 03:18:43 -0800638 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700639
640 /* get the keyring at which to begin the search */
David Howells55931222009-09-02 09:13:45 +0100641 keyring_ref = lookup_user_key(ringid, 0, KEY_SEARCH);
David Howells664cceb2005-09-28 17:03:15 +0100642 if (IS_ERR(keyring_ref)) {
643 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700644 goto error2;
645 }
646
647 /* get the destination keyring if specified */
David Howells664cceb2005-09-28 17:03:15 +0100648 dest_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700649 if (destringid) {
David Howells55931222009-09-02 09:13:45 +0100650 dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,
651 KEY_WRITE);
David Howells664cceb2005-09-28 17:03:15 +0100652 if (IS_ERR(dest_ref)) {
653 ret = PTR_ERR(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700654 goto error3;
655 }
656 }
657
658 /* find the key type */
659 ktype = key_type_lookup(type);
660 if (IS_ERR(ktype)) {
661 ret = PTR_ERR(ktype);
662 goto error4;
663 }
664
665 /* do the search */
David Howells664cceb2005-09-28 17:03:15 +0100666 key_ref = keyring_search(keyring_ref, ktype, description);
667 if (IS_ERR(key_ref)) {
668 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700669
670 /* treat lack or presence of a negative key the same */
671 if (ret == -EAGAIN)
672 ret = -ENOKEY;
673 goto error5;
674 }
675
676 /* link the resulting key to the destination keyring if we can */
David Howells664cceb2005-09-28 17:03:15 +0100677 if (dest_ref) {
David Howells29db9192005-10-30 15:02:44 -0800678 ret = key_permission(key_ref, KEY_LINK);
679 if (ret < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700680 goto error6;
681
David Howells664cceb2005-09-28 17:03:15 +0100682 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700683 if (ret < 0)
684 goto error6;
685 }
686
David Howells664cceb2005-09-28 17:03:15 +0100687 ret = key_ref_to_ptr(key_ref)->serial;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700688
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700689error6:
David Howells664cceb2005-09-28 17:03:15 +0100690 key_ref_put(key_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700691error5:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700692 key_type_put(ktype);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700693error4:
David Howells664cceb2005-09-28 17:03:15 +0100694 key_ref_put(dest_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700695error3:
David Howells664cceb2005-09-28 17:03:15 +0100696 key_ref_put(keyring_ref);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700697error2:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700698 kfree(description);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700699error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700700 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000701}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700702
Linus Torvalds1da177e2005-04-16 15:20:36 -0700703/*
David Howells973c9f42011-01-20 16:38:33 +0000704 * Read a key's payload.
705 *
706 * The key must either grant the caller Read permission, or it must grant the
707 * caller Search permission when searched for from the process keyrings.
708 *
709 * If successful, we place up to buflen bytes of data into the buffer, if one
710 * is provided, and return the amount of data that is available in the key,
711 * irrespective of how much we copied into the buffer.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700712 */
713long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
714{
David Howells664cceb2005-09-28 17:03:15 +0100715 struct key *key;
716 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700717 long ret;
718
719 /* find the key first */
David Howells55931222009-09-02 09:13:45 +0100720 key_ref = lookup_user_key(keyid, 0, 0);
David Howells664cceb2005-09-28 17:03:15 +0100721 if (IS_ERR(key_ref)) {
722 ret = -ENOKEY;
723 goto error;
724 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700725
David Howells664cceb2005-09-28 17:03:15 +0100726 key = key_ref_to_ptr(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700727
David Howells664cceb2005-09-28 17:03:15 +0100728 /* see if we can read it directly */
David Howells29db9192005-10-30 15:02:44 -0800729 ret = key_permission(key_ref, KEY_READ);
730 if (ret == 0)
David Howells664cceb2005-09-28 17:03:15 +0100731 goto can_read_key;
David Howells29db9192005-10-30 15:02:44 -0800732 if (ret != -EACCES)
733 goto error;
David Howells664cceb2005-09-28 17:03:15 +0100734
735 /* we can't; see if it's searchable from this process's keyrings
736 * - we automatically take account of the fact that it may be
737 * dangling off an instantiation key
738 */
739 if (!is_key_possessed(key_ref)) {
740 ret = -EACCES;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700741 goto error2;
742 }
743
Linus Torvalds1da177e2005-04-16 15:20:36 -0700744 /* the key is probably readable - now try to read it */
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700745can_read_key:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700746 ret = key_validate(key);
747 if (ret == 0) {
748 ret = -EOPNOTSUPP;
749 if (key->type->read) {
750 /* read the data with the semaphore held (since we
751 * might sleep) */
752 down_read(&key->sem);
753 ret = key->type->read(key, buffer, buflen);
754 up_read(&key->sem);
755 }
756 }
757
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700758error2:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759 key_put(key);
Justin P. Mattockc5b60b52010-04-21 00:02:11 -0700760error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700761 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000762}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700763
Linus Torvalds1da177e2005-04-16 15:20:36 -0700764/*
David Howells973c9f42011-01-20 16:38:33 +0000765 * Change the ownership of a key
766 *
767 * The key must grant the caller Setattr permission for this to work, though
768 * the key need not be fully instantiated yet. For the UID to be changed, or
769 * for the GID to be changed to a group the caller is not a member of, the
770 * caller must have sysadmin capability. If either uid or gid is -1 then that
771 * attribute is not changed.
772 *
773 * If the UID is to be changed, the new user must have sufficient quota to
774 * accept the key. The quota deduction will be removed from the old user to
775 * the new user should the attribute be changed.
776 *
777 * If successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700778 */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800779long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700780{
Fredrik Tolf58016492006-06-26 00:24:51 -0700781 struct key_user *newowner, *zapowner = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700782 struct key *key;
David Howells664cceb2005-09-28 17:03:15 +0100783 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700784 long ret;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800785 kuid_t uid;
786 kgid_t gid;
787
788 uid = make_kuid(current_user_ns(), user);
789 gid = make_kgid(current_user_ns(), group);
790 ret = -EINVAL;
791 if ((user != (uid_t) -1) && !uid_valid(uid))
792 goto error;
793 if ((group != (gid_t) -1) && !gid_valid(gid))
794 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700795
796 ret = 0;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800797 if (user == (uid_t) -1 && group == (gid_t) -1)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700798 goto error;
799
David Howells55931222009-09-02 09:13:45 +0100800 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
801 KEY_SETATTR);
David Howells664cceb2005-09-28 17:03:15 +0100802 if (IS_ERR(key_ref)) {
803 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700804 goto error;
805 }
806
David Howells664cceb2005-09-28 17:03:15 +0100807 key = key_ref_to_ptr(key_ref);
808
Linus Torvalds1da177e2005-04-16 15:20:36 -0700809 /* make the changes with the locks held to prevent chown/chown races */
810 ret = -EACCES;
811 down_write(&key->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700812
813 if (!capable(CAP_SYS_ADMIN)) {
814 /* only the sysadmin can chown a key to some other UID */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800815 if (user != (uid_t) -1 && !uid_eq(key->uid, uid))
Fredrik Tolf58016492006-06-26 00:24:51 -0700816 goto error_put;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700817
818 /* only the sysadmin can set the key's GID to a group other
819 * than one of those that the current process subscribes to */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800820 if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid))
Fredrik Tolf58016492006-06-26 00:24:51 -0700821 goto error_put;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700822 }
823
Fredrik Tolf58016492006-06-26 00:24:51 -0700824 /* change the UID */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800825 if (user != (uid_t) -1 && !uid_eq(uid, key->uid)) {
Fredrik Tolf58016492006-06-26 00:24:51 -0700826 ret = -ENOMEM;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800827 newowner = key_user_lookup(uid);
Fredrik Tolf58016492006-06-26 00:24:51 -0700828 if (!newowner)
829 goto error_put;
830
831 /* transfer the quota burden to the new user */
832 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800833 unsigned maxkeys = uid_eq(uid, GLOBAL_ROOT_UID) ?
David Howells0b77f5b2008-04-29 01:01:32 -0700834 key_quota_root_maxkeys : key_quota_maxkeys;
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800835 unsigned maxbytes = uid_eq(uid, GLOBAL_ROOT_UID) ?
David Howells0b77f5b2008-04-29 01:01:32 -0700836 key_quota_root_maxbytes : key_quota_maxbytes;
837
Fredrik Tolf58016492006-06-26 00:24:51 -0700838 spin_lock(&newowner->lock);
David Howells0b77f5b2008-04-29 01:01:32 -0700839 if (newowner->qnkeys + 1 >= maxkeys ||
840 newowner->qnbytes + key->quotalen >= maxbytes ||
841 newowner->qnbytes + key->quotalen <
842 newowner->qnbytes)
Fredrik Tolf58016492006-06-26 00:24:51 -0700843 goto quota_overrun;
844
845 newowner->qnkeys++;
846 newowner->qnbytes += key->quotalen;
847 spin_unlock(&newowner->lock);
848
849 spin_lock(&key->user->lock);
850 key->user->qnkeys--;
851 key->user->qnbytes -= key->quotalen;
852 spin_unlock(&key->user->lock);
853 }
854
855 atomic_dec(&key->user->nkeys);
856 atomic_inc(&newowner->nkeys);
857
858 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
859 atomic_dec(&key->user->nikeys);
860 atomic_inc(&newowner->nikeys);
861 }
862
863 zapowner = key->user;
864 key->user = newowner;
865 key->uid = uid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700866 }
867
868 /* change the GID */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800869 if (group != (gid_t) -1)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700870 key->gid = gid;
871
872 ret = 0;
873
Fredrik Tolf58016492006-06-26 00:24:51 -0700874error_put:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700875 up_write(&key->sem);
876 key_put(key);
Fredrik Tolf58016492006-06-26 00:24:51 -0700877 if (zapowner)
878 key_user_put(zapowner);
879error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700880 return ret;
881
Fredrik Tolf58016492006-06-26 00:24:51 -0700882quota_overrun:
883 spin_unlock(&newowner->lock);
884 zapowner = newowner;
885 ret = -EDQUOT;
886 goto error_put;
David Howellsa8b17ed2011-01-20 16:38:27 +0000887}
Fredrik Tolf58016492006-06-26 00:24:51 -0700888
Linus Torvalds1da177e2005-04-16 15:20:36 -0700889/*
David Howells973c9f42011-01-20 16:38:33 +0000890 * Change the permission mask on a key.
891 *
892 * The key must grant the caller Setattr permission for this to work, though
893 * the key need not be fully instantiated yet. If the caller does not have
894 * sysadmin capability, it may only change the permission on keys that it owns.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700895 */
896long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
897{
898 struct key *key;
David Howells664cceb2005-09-28 17:03:15 +0100899 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700900 long ret;
901
902 ret = -EINVAL;
David Howells664cceb2005-09-28 17:03:15 +0100903 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700904 goto error;
905
David Howells55931222009-09-02 09:13:45 +0100906 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
907 KEY_SETATTR);
David Howells664cceb2005-09-28 17:03:15 +0100908 if (IS_ERR(key_ref)) {
909 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700910 goto error;
911 }
912
David Howells664cceb2005-09-28 17:03:15 +0100913 key = key_ref_to_ptr(key_ref);
914
David Howells76d8aea2005-06-23 22:00:49 -0700915 /* make the changes with the locks held to prevent chown/chmod races */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700916 ret = -EACCES;
917 down_write(&key->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700918
David Howells76d8aea2005-06-23 22:00:49 -0700919 /* if we're not the sysadmin, we can only change a key that we own */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -0800920 if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) {
David Howells76d8aea2005-06-23 22:00:49 -0700921 key->perm = perm;
922 ret = 0;
923 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700924
Linus Torvalds1da177e2005-04-16 15:20:36 -0700925 up_write(&key->sem);
926 key_put(key);
David Howells76d8aea2005-06-23 22:00:49 -0700927error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700928 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +0000929}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700930
David Howells8bbf49762008-11-14 10:39:14 +1100931/*
David Howells973c9f42011-01-20 16:38:33 +0000932 * Get the destination keyring for instantiation and check that the caller has
933 * Write permission on it.
David Howells8bbf49762008-11-14 10:39:14 +1100934 */
935static long get_instantiation_keyring(key_serial_t ringid,
936 struct request_key_auth *rka,
937 struct key **_dest_keyring)
938{
939 key_ref_t dkref;
940
David Howellseca1bf52008-12-29 00:41:51 +0000941 *_dest_keyring = NULL;
942
David Howells8bbf49762008-11-14 10:39:14 +1100943 /* just return a NULL pointer if we weren't asked to make a link */
David Howellseca1bf52008-12-29 00:41:51 +0000944 if (ringid == 0)
David Howells8bbf49762008-11-14 10:39:14 +1100945 return 0;
David Howells8bbf49762008-11-14 10:39:14 +1100946
947 /* if a specific keyring is nominated by ID, then use that */
948 if (ringid > 0) {
David Howells55931222009-09-02 09:13:45 +0100949 dkref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);
David Howells8bbf49762008-11-14 10:39:14 +1100950 if (IS_ERR(dkref))
951 return PTR_ERR(dkref);
952 *_dest_keyring = key_ref_to_ptr(dkref);
953 return 0;
954 }
955
956 if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
957 return -EINVAL;
958
959 /* otherwise specify the destination keyring recorded in the
960 * authorisation key (any KEY_SPEC_*_KEYRING) */
961 if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
David Howells21279cf2009-10-15 10:14:35 +0100962 *_dest_keyring = key_get(rka->dest_keyring);
David Howells8bbf49762008-11-14 10:39:14 +1100963 return 0;
964 }
965
966 return -ENOKEY;
967}
968
David Howellsd84f4f92008-11-14 10:39:23 +1100969/*
David Howells973c9f42011-01-20 16:38:33 +0000970 * Change the request_key authorisation key on the current process.
David Howellsd84f4f92008-11-14 10:39:23 +1100971 */
972static int keyctl_change_reqkey_auth(struct key *key)
973{
974 struct cred *new;
975
976 new = prepare_creds();
977 if (!new)
978 return -ENOMEM;
979
980 key_put(new->request_key_auth);
981 new->request_key_auth = key_get(key);
982
983 return commit_creds(new);
984}
985
Linus Torvalds1da177e2005-04-16 15:20:36 -0700986/*
David Howellsee009e4a02011-03-07 15:06:20 +0000987 * Copy the iovec data from userspace
988 */
989static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
990 unsigned ioc)
991{
992 for (; ioc > 0; ioc--) {
993 if (copy_from_user(buffer, iov->iov_base, iov->iov_len) != 0)
994 return -EFAULT;
995 buffer += iov->iov_len;
996 iov++;
997 }
998 return 0;
999}
1000
1001/*
David Howells973c9f42011-01-20 16:38:33 +00001002 * Instantiate a key with the specified payload and link the key into the
1003 * destination keyring if one is given.
1004 *
1005 * The caller must have the appropriate instantiation permit set for this to
1006 * work (see keyctl_assume_authority). No other permissions are required.
1007 *
1008 * If successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001009 */
David Howellsee009e4a02011-03-07 15:06:20 +00001010long keyctl_instantiate_key_common(key_serial_t id,
1011 const struct iovec *payload_iov,
1012 unsigned ioc,
1013 size_t plen,
1014 key_serial_t ringid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001015{
David Howellsd84f4f92008-11-14 10:39:23 +11001016 const struct cred *cred = current_cred();
David Howells3e301482005-06-23 22:00:56 -07001017 struct request_key_auth *rka;
David Howells8bbf49762008-11-14 10:39:14 +11001018 struct key *instkey, *dest_keyring;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001019 void *payload;
1020 long ret;
David Howells38bbca62008-04-29 01:01:19 -07001021 bool vm = false;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001022
David Howellsd84f4f92008-11-14 10:39:23 +11001023 kenter("%d,,%zu,%d", id, plen, ringid);
1024
Linus Torvalds1da177e2005-04-16 15:20:36 -07001025 ret = -EINVAL;
David Howells38bbca62008-04-29 01:01:19 -07001026 if (plen > 1024 * 1024 - 1)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001027 goto error;
1028
David Howellsb5f545c2006-01-08 01:02:47 -08001029 /* the appropriate instantiation authorisation key must have been
1030 * assumed before calling this */
1031 ret = -EPERM;
David Howellsd84f4f92008-11-14 10:39:23 +11001032 instkey = cred->request_key_auth;
David Howellsb5f545c2006-01-08 01:02:47 -08001033 if (!instkey)
1034 goto error;
1035
1036 rka = instkey->payload.data;
1037 if (rka->target_key->serial != id)
1038 goto error;
1039
Linus Torvalds1da177e2005-04-16 15:20:36 -07001040 /* pull the payload in if one was supplied */
1041 payload = NULL;
1042
David Howellsee009e4a02011-03-07 15:06:20 +00001043 if (payload_iov) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001044 ret = -ENOMEM;
1045 payload = kmalloc(plen, GFP_KERNEL);
David Howells38bbca62008-04-29 01:01:19 -07001046 if (!payload) {
1047 if (plen <= PAGE_SIZE)
1048 goto error;
1049 vm = true;
1050 payload = vmalloc(plen);
1051 if (!payload)
1052 goto error;
1053 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001054
David Howellsee009e4a02011-03-07 15:06:20 +00001055 ret = copy_from_user_iovec(payload, payload_iov, ioc);
1056 if (ret < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001057 goto error2;
1058 }
1059
David Howells3e301482005-06-23 22:00:56 -07001060 /* find the destination keyring amongst those belonging to the
1061 * requesting task */
David Howells8bbf49762008-11-14 10:39:14 +11001062 ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
1063 if (ret < 0)
1064 goto error2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001065
1066 /* instantiate the key and link it into a keyring */
David Howells3e301482005-06-23 22:00:56 -07001067 ret = key_instantiate_and_link(rka->target_key, payload, plen,
David Howells8bbf49762008-11-14 10:39:14 +11001068 dest_keyring, instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001069
David Howells8bbf49762008-11-14 10:39:14 +11001070 key_put(dest_keyring);
David Howellsb5f545c2006-01-08 01:02:47 -08001071
1072 /* discard the assumed authority if it's just been disabled by
1073 * instantiation of the key */
David Howellsd84f4f92008-11-14 10:39:23 +11001074 if (ret == 0)
1075 keyctl_change_reqkey_auth(NULL);
David Howellsb5f545c2006-01-08 01:02:47 -08001076
1077error2:
David Howells38bbca62008-04-29 01:01:19 -07001078 if (!vm)
1079 kfree(payload);
1080 else
1081 vfree(payload);
David Howellsb5f545c2006-01-08 01:02:47 -08001082error:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001083 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +00001084}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001085
Linus Torvalds1da177e2005-04-16 15:20:36 -07001086/*
David Howellsee009e4a02011-03-07 15:06:20 +00001087 * Instantiate a key with the specified payload and link the key into the
1088 * destination keyring if one is given.
1089 *
1090 * The caller must have the appropriate instantiation permit set for this to
1091 * work (see keyctl_assume_authority). No other permissions are required.
1092 *
1093 * If successful, 0 will be returned.
1094 */
1095long keyctl_instantiate_key(key_serial_t id,
1096 const void __user *_payload,
1097 size_t plen,
1098 key_serial_t ringid)
1099{
1100 if (_payload && plen) {
1101 struct iovec iov[1] = {
1102 [0].iov_base = (void __user *)_payload,
1103 [0].iov_len = plen
1104 };
1105
1106 return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
1107 }
1108
1109 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
1110}
1111
1112/*
1113 * Instantiate a key with the specified multipart payload and link the key into
1114 * the destination keyring if one is given.
1115 *
1116 * The caller must have the appropriate instantiation permit set for this to
1117 * work (see keyctl_assume_authority). No other permissions are required.
1118 *
1119 * If successful, 0 will be returned.
1120 */
1121long keyctl_instantiate_key_iov(key_serial_t id,
1122 const struct iovec __user *_payload_iov,
1123 unsigned ioc,
1124 key_serial_t ringid)
1125{
1126 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1127 long ret;
1128
David Howells423b97882012-05-21 12:32:13 +01001129 if (!_payload_iov || !ioc)
David Howellsee009e4a02011-03-07 15:06:20 +00001130 goto no_payload;
1131
1132 ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
Christopher Yeohac34ebb2012-05-31 16:26:42 -07001133 ARRAY_SIZE(iovstack), iovstack, &iov);
David Howellsee009e4a02011-03-07 15:06:20 +00001134 if (ret < 0)
Alan Coxa84a9212012-09-28 12:20:02 +01001135 goto err;
David Howellsee009e4a02011-03-07 15:06:20 +00001136 if (ret == 0)
1137 goto no_payload_free;
1138
1139 ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
Alan Coxa84a9212012-09-28 12:20:02 +01001140err:
David Howellsee009e4a02011-03-07 15:06:20 +00001141 if (iov != iovstack)
1142 kfree(iov);
1143 return ret;
1144
1145no_payload_free:
1146 if (iov != iovstack)
1147 kfree(iov);
1148no_payload:
1149 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
1150}
1151
1152/*
David Howells973c9f42011-01-20 16:38:33 +00001153 * Negatively instantiate the key with the given timeout (in seconds) and link
1154 * the key into the destination keyring if one is given.
1155 *
1156 * The caller must have the appropriate instantiation permit set for this to
1157 * work (see keyctl_assume_authority). No other permissions are required.
1158 *
1159 * The key and any links to the key will be automatically garbage collected
1160 * after the timeout expires.
1161 *
1162 * Negative keys are used to rate limit repeated request_key() calls by causing
1163 * them to return -ENOKEY until the negative key expires.
1164 *
1165 * If successful, 0 will be returned.
Linus Torvalds1da177e2005-04-16 15:20:36 -07001166 */
1167long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1168{
David Howellsfdd1b942011-03-07 15:06:09 +00001169 return keyctl_reject_key(id, timeout, ENOKEY, ringid);
1170}
1171
1172/*
1173 * Negatively instantiate the key with the given timeout (in seconds) and error
1174 * code and link the key into the destination keyring if one is given.
1175 *
1176 * The caller must have the appropriate instantiation permit set for this to
1177 * work (see keyctl_assume_authority). No other permissions are required.
1178 *
1179 * The key and any links to the key will be automatically garbage collected
1180 * after the timeout expires.
1181 *
1182 * Negative keys are used to rate limit repeated request_key() calls by causing
1183 * them to return the specified error code until the negative key expires.
1184 *
1185 * If successful, 0 will be returned.
1186 */
1187long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
1188 key_serial_t ringid)
1189{
David Howellsd84f4f92008-11-14 10:39:23 +11001190 const struct cred *cred = current_cred();
David Howells3e301482005-06-23 22:00:56 -07001191 struct request_key_auth *rka;
David Howells8bbf49762008-11-14 10:39:14 +11001192 struct key *instkey, *dest_keyring;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001193 long ret;
1194
David Howellsfdd1b942011-03-07 15:06:09 +00001195 kenter("%d,%u,%u,%d", id, timeout, error, ringid);
1196
1197 /* must be a valid error code and mustn't be a kernel special */
1198 if (error <= 0 ||
1199 error >= MAX_ERRNO ||
1200 error == ERESTARTSYS ||
1201 error == ERESTARTNOINTR ||
1202 error == ERESTARTNOHAND ||
1203 error == ERESTART_RESTARTBLOCK)
1204 return -EINVAL;
David Howellsd84f4f92008-11-14 10:39:23 +11001205
David Howellsb5f545c2006-01-08 01:02:47 -08001206 /* the appropriate instantiation authorisation key must have been
1207 * assumed before calling this */
1208 ret = -EPERM;
David Howellsd84f4f92008-11-14 10:39:23 +11001209 instkey = cred->request_key_auth;
David Howellsb5f545c2006-01-08 01:02:47 -08001210 if (!instkey)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001211 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001212
David Howells3e301482005-06-23 22:00:56 -07001213 rka = instkey->payload.data;
David Howellsb5f545c2006-01-08 01:02:47 -08001214 if (rka->target_key->serial != id)
1215 goto error;
David Howells3e301482005-06-23 22:00:56 -07001216
Linus Torvalds1da177e2005-04-16 15:20:36 -07001217 /* find the destination keyring if present (which must also be
1218 * writable) */
David Howells8bbf49762008-11-14 10:39:14 +11001219 ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
1220 if (ret < 0)
1221 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001222
1223 /* instantiate the key and link it into a keyring */
David Howellsfdd1b942011-03-07 15:06:09 +00001224 ret = key_reject_and_link(rka->target_key, timeout, error,
David Howells8bbf49762008-11-14 10:39:14 +11001225 dest_keyring, instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001226
David Howells8bbf49762008-11-14 10:39:14 +11001227 key_put(dest_keyring);
David Howellsb5f545c2006-01-08 01:02:47 -08001228
1229 /* discard the assumed authority if it's just been disabled by
1230 * instantiation of the key */
David Howellsd84f4f92008-11-14 10:39:23 +11001231 if (ret == 0)
1232 keyctl_change_reqkey_auth(NULL);
David Howellsb5f545c2006-01-08 01:02:47 -08001233
1234error:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001235 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +00001236}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001237
Linus Torvalds1da177e2005-04-16 15:20:36 -07001238/*
David Howells973c9f42011-01-20 16:38:33 +00001239 * Read or set the default keyring in which request_key() will cache keys and
1240 * return the old setting.
1241 *
1242 * If a process keyring is specified then this will be created if it doesn't
1243 * yet exist. The old setting will be returned if successful.
David Howells3e301482005-06-23 22:00:56 -07001244 */
1245long keyctl_set_reqkey_keyring(int reqkey_defl)
1246{
David Howellsd84f4f92008-11-14 10:39:23 +11001247 struct cred *new;
1248 int ret, old_setting;
1249
1250 old_setting = current_cred_xxx(jit_keyring);
1251
1252 if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
1253 return old_setting;
1254
1255 new = prepare_creds();
1256 if (!new)
1257 return -ENOMEM;
David Howells3e301482005-06-23 22:00:56 -07001258
1259 switch (reqkey_defl) {
1260 case KEY_REQKEY_DEFL_THREAD_KEYRING:
David Howellsd84f4f92008-11-14 10:39:23 +11001261 ret = install_thread_keyring_to_cred(new);
David Howells3e301482005-06-23 22:00:56 -07001262 if (ret < 0)
David Howellsd84f4f92008-11-14 10:39:23 +11001263 goto error;
David Howells3e301482005-06-23 22:00:56 -07001264 goto set;
1265
1266 case KEY_REQKEY_DEFL_PROCESS_KEYRING:
David Howellsd84f4f92008-11-14 10:39:23 +11001267 ret = install_process_keyring_to_cred(new);
1268 if (ret < 0) {
1269 if (ret != -EEXIST)
1270 goto error;
1271 ret = 0;
1272 }
1273 goto set;
David Howells3e301482005-06-23 22:00:56 -07001274
1275 case KEY_REQKEY_DEFL_DEFAULT:
1276 case KEY_REQKEY_DEFL_SESSION_KEYRING:
1277 case KEY_REQKEY_DEFL_USER_KEYRING:
1278 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
David Howellsd84f4f92008-11-14 10:39:23 +11001279 case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
1280 goto set;
David Howells3e301482005-06-23 22:00:56 -07001281
1282 case KEY_REQKEY_DEFL_NO_CHANGE:
David Howells3e301482005-06-23 22:00:56 -07001283 case KEY_REQKEY_DEFL_GROUP_KEYRING:
1284 default:
David Howellsd84f4f92008-11-14 10:39:23 +11001285 ret = -EINVAL;
1286 goto error;
David Howells3e301482005-06-23 22:00:56 -07001287 }
1288
David Howellsd84f4f92008-11-14 10:39:23 +11001289set:
1290 new->jit_keyring = reqkey_defl;
1291 commit_creds(new);
1292 return old_setting;
1293error:
1294 abort_creds(new);
Dan Carpenter4303ef12010-06-11 17:30:05 +01001295 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +00001296}
David Howellsd84f4f92008-11-14 10:39:23 +11001297
David Howells3e301482005-06-23 22:00:56 -07001298/*
David Howells973c9f42011-01-20 16:38:33 +00001299 * Set or clear the timeout on a key.
1300 *
1301 * Either the key must grant the caller Setattr permission or else the caller
1302 * must hold an instantiation authorisation token for the key.
1303 *
1304 * The timeout is either 0 to clear the timeout, or a number of seconds from
1305 * the current time. The key and any links to the key will be automatically
1306 * garbage collected after the timeout expires.
1307 *
1308 * If successful, 0 is returned.
David Howells017679c2006-01-08 01:02:43 -08001309 */
1310long keyctl_set_timeout(key_serial_t id, unsigned timeout)
1311{
David Howells91562352010-06-11 17:31:05 +01001312 struct key *key, *instkey;
David Howells017679c2006-01-08 01:02:43 -08001313 key_ref_t key_ref;
David Howells017679c2006-01-08 01:02:43 -08001314 long ret;
1315
David Howells55931222009-09-02 09:13:45 +01001316 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
1317 KEY_SETATTR);
David Howells017679c2006-01-08 01:02:43 -08001318 if (IS_ERR(key_ref)) {
David Howells91562352010-06-11 17:31:05 +01001319 /* setting the timeout on a key under construction is permitted
1320 * if we have the authorisation token handy */
1321 if (PTR_ERR(key_ref) == -EACCES) {
1322 instkey = key_get_instantiation_authkey(id);
1323 if (!IS_ERR(instkey)) {
1324 key_put(instkey);
1325 key_ref = lookup_user_key(id,
1326 KEY_LOOKUP_PARTIAL,
1327 0);
1328 if (!IS_ERR(key_ref))
1329 goto okay;
1330 }
1331 }
1332
David Howells017679c2006-01-08 01:02:43 -08001333 ret = PTR_ERR(key_ref);
1334 goto error;
1335 }
1336
David Howells91562352010-06-11 17:31:05 +01001337okay:
David Howells017679c2006-01-08 01:02:43 -08001338 key = key_ref_to_ptr(key_ref);
Bryan Schumaker59e6b9c2012-02-24 14:14:50 -05001339 key_set_timeout(key, timeout);
David Howells017679c2006-01-08 01:02:43 -08001340 key_put(key);
1341
1342 ret = 0;
1343error:
1344 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +00001345}
David Howells017679c2006-01-08 01:02:43 -08001346
David Howells017679c2006-01-08 01:02:43 -08001347/*
David Howells973c9f42011-01-20 16:38:33 +00001348 * Assume (or clear) the authority to instantiate the specified key.
1349 *
1350 * This sets the authoritative token currently in force for key instantiation.
1351 * This must be done for a key to be instantiated. It has the effect of making
1352 * available all the keys from the caller of the request_key() that created a
1353 * key to request_key() calls made by the caller of this function.
1354 *
1355 * The caller must have the instantiation key in their process keyrings with a
1356 * Search permission grant available to the caller.
1357 *
1358 * If the ID given is 0, then the setting will be cleared and 0 returned.
1359 *
1360 * If the ID given has a matching an authorisation key, then that key will be
1361 * set and its ID will be returned. The authorisation key can be read to get
1362 * the callout information passed to request_key().
David Howellsb5f545c2006-01-08 01:02:47 -08001363 */
1364long keyctl_assume_authority(key_serial_t id)
1365{
1366 struct key *authkey;
1367 long ret;
1368
1369 /* special key IDs aren't permitted */
1370 ret = -EINVAL;
1371 if (id < 0)
1372 goto error;
1373
1374 /* we divest ourselves of authority if given an ID of 0 */
1375 if (id == 0) {
David Howellsd84f4f92008-11-14 10:39:23 +11001376 ret = keyctl_change_reqkey_auth(NULL);
David Howellsb5f545c2006-01-08 01:02:47 -08001377 goto error;
1378 }
1379
1380 /* attempt to assume the authority temporarily granted to us whilst we
1381 * instantiate the specified key
1382 * - the authorisation key must be in the current task's keyrings
1383 * somewhere
1384 */
1385 authkey = key_get_instantiation_authkey(id);
1386 if (IS_ERR(authkey)) {
1387 ret = PTR_ERR(authkey);
1388 goto error;
1389 }
1390
David Howellsd84f4f92008-11-14 10:39:23 +11001391 ret = keyctl_change_reqkey_auth(authkey);
1392 if (ret < 0)
1393 goto error;
1394 key_put(authkey);
David Howellsb5f545c2006-01-08 01:02:47 -08001395
David Howellsd84f4f92008-11-14 10:39:23 +11001396 ret = authkey->serial;
David Howellsb5f545c2006-01-08 01:02:47 -08001397error:
1398 return ret;
David Howellsa8b17ed2011-01-20 16:38:27 +00001399}
David Howellsb5f545c2006-01-08 01:02:47 -08001400
David Howells70a5bb72008-04-29 01:01:26 -07001401/*
David Howells973c9f42011-01-20 16:38:33 +00001402 * Get a key's the LSM security label.
1403 *
1404 * The key must grant the caller View permission for this to work.
1405 *
1406 * If there's a buffer, then up to buflen bytes of data will be placed into it.
1407 *
1408 * If successful, the amount of information available will be returned,
1409 * irrespective of how much was copied (including the terminal NUL).
David Howells70a5bb72008-04-29 01:01:26 -07001410 */
1411long keyctl_get_security(key_serial_t keyid,
1412 char __user *buffer,
1413 size_t buflen)
1414{
1415 struct key *key, *instkey;
1416 key_ref_t key_ref;
1417 char *context;
1418 long ret;
1419
David Howells55931222009-09-02 09:13:45 +01001420 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_VIEW);
David Howells70a5bb72008-04-29 01:01:26 -07001421 if (IS_ERR(key_ref)) {
1422 if (PTR_ERR(key_ref) != -EACCES)
1423 return PTR_ERR(key_ref);
1424
1425 /* viewing a key under construction is also permitted if we
1426 * have the authorisation token handy */
1427 instkey = key_get_instantiation_authkey(keyid);
1428 if (IS_ERR(instkey))
Roel Kluinfa1cc7b2009-12-15 15:05:12 -08001429 return PTR_ERR(instkey);
David Howells70a5bb72008-04-29 01:01:26 -07001430 key_put(instkey);
1431
David Howells55931222009-09-02 09:13:45 +01001432 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, 0);
David Howells70a5bb72008-04-29 01:01:26 -07001433 if (IS_ERR(key_ref))
1434 return PTR_ERR(key_ref);
1435 }
1436
1437 key = key_ref_to_ptr(key_ref);
1438 ret = security_key_getsecurity(key, &context);
1439 if (ret == 0) {
1440 /* if no information was returned, give userspace an empty
1441 * string */
1442 ret = 1;
1443 if (buffer && buflen > 0 &&
1444 copy_to_user(buffer, "", 1) != 0)
1445 ret = -EFAULT;
1446 } else if (ret > 0) {
1447 /* return as much data as there's room for */
1448 if (buffer && buflen > 0) {
1449 if (buflen > ret)
1450 buflen = ret;
1451
1452 if (copy_to_user(buffer, context, buflen) != 0)
1453 ret = -EFAULT;
1454 }
1455
1456 kfree(context);
1457 }
1458
1459 key_ref_put(key_ref);
1460 return ret;
1461}
1462
David Howellsee18d642009-09-02 09:14:21 +01001463/*
David Howells973c9f42011-01-20 16:38:33 +00001464 * Attempt to install the calling process's session keyring on the process's
1465 * parent process.
1466 *
1467 * The keyring must exist and must grant the caller LINK permission, and the
1468 * parent process must be single-threaded and must have the same effective
1469 * ownership as this process and mustn't be SUID/SGID.
1470 *
1471 * The keyring will be emplaced on the parent when it next resumes userspace.
1472 *
1473 * If successful, 0 will be returned.
David Howellsee18d642009-09-02 09:14:21 +01001474 */
1475long keyctl_session_to_parent(void)
1476{
1477 struct task_struct *me, *parent;
1478 const struct cred *mycred, *pcred;
Al Viro67d12142012-06-27 11:07:19 +04001479 struct callback_head *newwork, *oldwork;
David Howellsee18d642009-09-02 09:14:21 +01001480 key_ref_t keyring_r;
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001481 struct cred *cred;
David Howellsee18d642009-09-02 09:14:21 +01001482 int ret;
1483
1484 keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_LINK);
1485 if (IS_ERR(keyring_r))
1486 return PTR_ERR(keyring_r);
1487
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001488 ret = -ENOMEM;
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001489
David Howellsee18d642009-09-02 09:14:21 +01001490 /* our parent is going to need a new cred struct, a new tgcred struct
1491 * and new security data, so we allocate them here to prevent ENOMEM in
1492 * our parent */
David Howellsee18d642009-09-02 09:14:21 +01001493 cred = cred_alloc_blank();
1494 if (!cred)
Al Viro67d12142012-06-27 11:07:19 +04001495 goto error_keyring;
1496 newwork = &cred->rcu;
David Howellsee18d642009-09-02 09:14:21 +01001497
David Howells3a505972012-10-02 19:24:29 +01001498 cred->session_keyring = key_ref_to_ptr(keyring_r);
1499 keyring_r = NULL;
Al Viro67d12142012-06-27 11:07:19 +04001500 init_task_work(newwork, key_change_session_keyring);
David Howellsee18d642009-09-02 09:14:21 +01001501
1502 me = current;
David Howells9d1ac652010-09-10 09:59:46 +01001503 rcu_read_lock();
David Howellsee18d642009-09-02 09:14:21 +01001504 write_lock_irq(&tasklist_lock);
1505
David Howellsee18d642009-09-02 09:14:21 +01001506 ret = -EPERM;
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001507 oldwork = NULL;
1508 parent = me->real_parent;
David Howellsee18d642009-09-02 09:14:21 +01001509
1510 /* the parent mustn't be init and mustn't be a kernel thread */
1511 if (parent->pid <= 1 || !parent->mm)
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001512 goto unlock;
David Howellsee18d642009-09-02 09:14:21 +01001513
1514 /* the parent must be single threaded */
Oleg Nesterovdd98acf2010-05-26 14:43:23 -07001515 if (!thread_group_empty(parent))
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001516 goto unlock;
David Howellsee18d642009-09-02 09:14:21 +01001517
1518 /* the parent and the child must have different session keyrings or
1519 * there's no point */
1520 mycred = current_cred();
1521 pcred = __task_cred(parent);
1522 if (mycred == pcred ||
David Howells3a505972012-10-02 19:24:29 +01001523 mycred->session_keyring == pcred->session_keyring) {
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001524 ret = 0;
1525 goto unlock;
1526 }
David Howellsee18d642009-09-02 09:14:21 +01001527
1528 /* the parent must have the same effective ownership and mustn't be
1529 * SUID/SGID */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -08001530 if (!uid_eq(pcred->uid, mycred->euid) ||
1531 !uid_eq(pcred->euid, mycred->euid) ||
1532 !uid_eq(pcred->suid, mycred->euid) ||
1533 !gid_eq(pcred->gid, mycred->egid) ||
1534 !gid_eq(pcred->egid, mycred->egid) ||
1535 !gid_eq(pcred->sgid, mycred->egid))
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001536 goto unlock;
David Howellsee18d642009-09-02 09:14:21 +01001537
1538 /* the keyrings must have the same UID */
David Howells3a505972012-10-02 19:24:29 +01001539 if ((pcred->session_keyring &&
Linus Torvalds2a74dbb2012-12-16 15:40:50 -08001540 !uid_eq(pcred->session_keyring->uid, mycred->euid)) ||
1541 !uid_eq(mycred->session_keyring->uid, mycred->euid))
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001542 goto unlock;
David Howellsee18d642009-09-02 09:14:21 +01001543
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001544 /* cancel an already pending keyring replacement */
1545 oldwork = task_work_cancel(parent, key_change_session_keyring);
David Howellsee18d642009-09-02 09:14:21 +01001546
1547 /* the replacement session keyring is applied just prior to userspace
1548 * restarting */
Al Viro67d12142012-06-27 11:07:19 +04001549 ret = task_work_add(parent, newwork, true);
Oleg Nesterov413cd3d2012-05-11 10:59:08 +10001550 if (!ret)
1551 newwork = NULL;
1552unlock:
David Howellsee18d642009-09-02 09:14:21 +01001553 write_unlock_irq(&tasklist_lock);
David Howells9d1ac652010-09-10 09:59:46 +01001554 rcu_read_unlock();
Al Viro67d12142012-06-27 11:07:19 +04001555 if (oldwork)
1556 put_cred(container_of(oldwork, struct cred, rcu));
1557 if (newwork)
1558 put_cred(cred);
David Howellsee18d642009-09-02 09:14:21 +01001559 return ret;
1560
1561error_keyring:
1562 key_ref_put(keyring_r);
1563 return ret;
1564}
1565
David Howellsb5f545c2006-01-08 01:02:47 -08001566/*
David Howells973c9f42011-01-20 16:38:33 +00001567 * The key control system call
Linus Torvalds1da177e2005-04-16 15:20:36 -07001568 */
Heiko Carstens938bb9f2009-01-14 14:14:30 +01001569SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1570 unsigned long, arg4, unsigned long, arg5)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001571{
1572 switch (option) {
1573 case KEYCTL_GET_KEYRING_ID:
1574 return keyctl_get_keyring_ID((key_serial_t) arg2,
1575 (int) arg3);
1576
1577 case KEYCTL_JOIN_SESSION_KEYRING:
1578 return keyctl_join_session_keyring((const char __user *) arg2);
1579
1580 case KEYCTL_UPDATE:
1581 return keyctl_update_key((key_serial_t) arg2,
1582 (const void __user *) arg3,
1583 (size_t) arg4);
1584
1585 case KEYCTL_REVOKE:
1586 return keyctl_revoke_key((key_serial_t) arg2);
1587
1588 case KEYCTL_DESCRIBE:
1589 return keyctl_describe_key((key_serial_t) arg2,
1590 (char __user *) arg3,
1591 (unsigned) arg4);
1592
1593 case KEYCTL_CLEAR:
1594 return keyctl_keyring_clear((key_serial_t) arg2);
1595
1596 case KEYCTL_LINK:
1597 return keyctl_keyring_link((key_serial_t) arg2,
1598 (key_serial_t) arg3);
1599
1600 case KEYCTL_UNLINK:
1601 return keyctl_keyring_unlink((key_serial_t) arg2,
1602 (key_serial_t) arg3);
1603
1604 case KEYCTL_SEARCH:
1605 return keyctl_keyring_search((key_serial_t) arg2,
1606 (const char __user *) arg3,
1607 (const char __user *) arg4,
1608 (key_serial_t) arg5);
1609
1610 case KEYCTL_READ:
1611 return keyctl_read_key((key_serial_t) arg2,
1612 (char __user *) arg3,
1613 (size_t) arg4);
1614
1615 case KEYCTL_CHOWN:
1616 return keyctl_chown_key((key_serial_t) arg2,
1617 (uid_t) arg3,
1618 (gid_t) arg4);
1619
1620 case KEYCTL_SETPERM:
1621 return keyctl_setperm_key((key_serial_t) arg2,
1622 (key_perm_t) arg3);
1623
1624 case KEYCTL_INSTANTIATE:
1625 return keyctl_instantiate_key((key_serial_t) arg2,
1626 (const void __user *) arg3,
1627 (size_t) arg4,
1628 (key_serial_t) arg5);
1629
1630 case KEYCTL_NEGATE:
1631 return keyctl_negate_key((key_serial_t) arg2,
1632 (unsigned) arg3,
1633 (key_serial_t) arg4);
1634
David Howells3e301482005-06-23 22:00:56 -07001635 case KEYCTL_SET_REQKEY_KEYRING:
1636 return keyctl_set_reqkey_keyring(arg2);
1637
David Howells017679c2006-01-08 01:02:43 -08001638 case KEYCTL_SET_TIMEOUT:
1639 return keyctl_set_timeout((key_serial_t) arg2,
1640 (unsigned) arg3);
1641
David Howellsb5f545c2006-01-08 01:02:47 -08001642 case KEYCTL_ASSUME_AUTHORITY:
1643 return keyctl_assume_authority((key_serial_t) arg2);
1644
David Howells70a5bb72008-04-29 01:01:26 -07001645 case KEYCTL_GET_SECURITY:
1646 return keyctl_get_security((key_serial_t) arg2,
James Morris90bd49a2008-12-29 14:35:35 +11001647 (char __user *) arg3,
David Howells70a5bb72008-04-29 01:01:26 -07001648 (size_t) arg4);
1649
David Howellsee18d642009-09-02 09:14:21 +01001650 case KEYCTL_SESSION_TO_PARENT:
1651 return keyctl_session_to_parent();
1652
David Howellsfdd1b942011-03-07 15:06:09 +00001653 case KEYCTL_REJECT:
1654 return keyctl_reject_key((key_serial_t) arg2,
1655 (unsigned) arg3,
1656 (unsigned) arg4,
1657 (key_serial_t) arg5);
1658
David Howellsee009e4a02011-03-07 15:06:20 +00001659 case KEYCTL_INSTANTIATE_IOV:
1660 return keyctl_instantiate_key_iov(
1661 (key_serial_t) arg2,
1662 (const struct iovec __user *) arg3,
1663 (unsigned) arg4,
1664 (key_serial_t) arg5);
1665
David Howellsfd758152012-05-11 10:56:56 +01001666 case KEYCTL_INVALIDATE:
1667 return keyctl_invalidate_key((key_serial_t) arg2);
1668
Linus Torvalds1da177e2005-04-16 15:20:36 -07001669 default:
1670 return -EOPNOTSUPP;
1671 }
David Howellsa8b17ed2011-01-20 16:38:27 +00001672}