blob: efcc0c855a0db1284ee3debcb9be64823d9be3ed [file] [log] [blame]
David Howells973c9f42011-01-20 16:38:33 +00001/* Key permission checking
David Howells468ed2b2005-10-07 15:07:38 +01002 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
David Howells29db9192005-10-30 15:02:44 -080013#include <linux/security.h>
David Howells468ed2b2005-10-07 15:07:38 +010014#include "internal.h"
15
David Howellsd84f4f92008-11-14 10:39:23 +110016/**
17 * key_task_permission - Check a key can be used
David Howells973c9f42011-01-20 16:38:33 +000018 * @key_ref: The key to check.
19 * @cred: The credentials to use.
20 * @perm: The permissions to check for.
David Howellsd84f4f92008-11-14 10:39:23 +110021 *
22 * Check to see whether permission is granted to use a key in the desired way,
23 * but permit the security modules to override.
24 *
David Howells973c9f42011-01-20 16:38:33 +000025 * The caller must hold either a ref on cred or must hold the RCU readlock.
26 *
27 * Returns 0 if successful, -EACCES if access is denied based on the
28 * permissions bits or the LSM check.
David Howells468ed2b2005-10-07 15:07:38 +010029 */
David Howellsd84f4f92008-11-14 10:39:23 +110030int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
David Howells468ed2b2005-10-07 15:07:38 +010031 key_perm_t perm)
32{
33 struct key *key;
34 key_perm_t kperm;
35 int ret;
36
37 key = key_ref_to_ptr(key_ref);
38
David Howells468ed2b2005-10-07 15:07:38 +010039 /* use the second 8-bits of permissions for keys the caller owns */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080040 if (uid_eq(key->uid, cred->fsuid)) {
David Howells468ed2b2005-10-07 15:07:38 +010041 kperm = key->perm >> 16;
42 goto use_these_perms;
43 }
44
45 /* use the third 8-bits of permissions for keys the caller has a group
46 * membership in common with */
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080047 if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) {
48 if (gid_eq(key->gid, cred->fsgid)) {
David Howells468ed2b2005-10-07 15:07:38 +010049 kperm = key->perm >> 8;
50 goto use_these_perms;
51 }
52
Eric W. Biederman9a56c2d2012-02-08 07:53:04 -080053 ret = groups_search(cred->group_info, key->gid);
David Howells468ed2b2005-10-07 15:07:38 +010054 if (ret) {
55 kperm = key->perm >> 8;
56 goto use_these_perms;
57 }
58 }
59
60 /* otherwise use the least-significant 8-bits */
61 kperm = key->perm;
62
63use_these_perms:
David Howellsc69e8d92008-11-14 10:39:19 +110064
David Howells7ab501d2005-10-07 16:41:24 +010065 /* use the top 8-bits of permissions for keys the caller possesses
66 * - possessor permissions are additive with other permissions
67 */
68 if (is_key_possessed(key_ref))
69 kperm |= key->perm >> 24;
70
David Howells468ed2b2005-10-07 15:07:38 +010071 kperm = kperm & perm & KEY_ALL;
72
David Howells29db9192005-10-30 15:02:44 -080073 if (kperm != perm)
74 return -EACCES;
75
76 /* let LSM be the final arbiter */
David Howellsd84f4f92008-11-14 10:39:23 +110077 return security_key_permission(key_ref, cred, perm);
David Howellsa8b17ed2011-01-20 16:38:27 +000078}
David Howells468ed2b2005-10-07 15:07:38 +010079EXPORT_SYMBOL(key_task_permission);
David Howellsb5f545c2006-01-08 01:02:47 -080080
David Howells973c9f42011-01-20 16:38:33 +000081/**
82 * key_validate - Validate a key.
83 * @key: The key to be validated.
84 *
David Howellsfd758152012-05-11 10:56:56 +010085 * Check that a key is valid, returning 0 if the key is okay, -ENOKEY if the
86 * key is invalidated, -EKEYREVOKED if the key's type has been removed or if
87 * the key has been revoked or -EKEYEXPIRED if the key has expired.
David Howellsb5f545c2006-01-08 01:02:47 -080088 */
David Howellsb404aef2012-05-15 14:11:11 +010089int key_validate(const struct key *key)
David Howellsb5f545c2006-01-08 01:02:47 -080090{
David Howellsfd758152012-05-11 10:56:56 +010091 unsigned long flags = key->flags;
David Howellsb5f545c2006-01-08 01:02:47 -080092
David Howellsb404aef2012-05-15 14:11:11 +010093 if (flags & (1 << KEY_FLAG_INVALIDATED))
94 return -ENOKEY;
David Howellsfd758152012-05-11 10:56:56 +010095
David Howellsb404aef2012-05-15 14:11:11 +010096 /* check it's still accessible */
97 if (flags & ((1 << KEY_FLAG_REVOKED) |
98 (1 << KEY_FLAG_DEAD)))
99 return -EKEYREVOKED;
David Howellsb5f545c2006-01-08 01:02:47 -0800100
David Howellsb404aef2012-05-15 14:11:11 +0100101 /* check it hasn't expired */
102 if (key->expiry) {
103 struct timespec now = current_kernel_time();
104 if (now.tv_sec >= key->expiry)
105 return -EKEYEXPIRED;
David Howellsb5f545c2006-01-08 01:02:47 -0800106 }
107
David Howellsb404aef2012-05-15 14:11:11 +0100108 return 0;
David Howellsa8b17ed2011-01-20 16:38:27 +0000109}
David Howellsb5f545c2006-01-08 01:02:47 -0800110EXPORT_SYMBOL(key_validate);