blob: b7a468fabdf9a22e4ca1eecfc6da96f055512a58 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* keyctl.c: userspace keyctl operations
2 *
David Howells3e301482005-06-23 22:00:56 -07003 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
16#include <linux/syscalls.h>
17#include <linux/keyctl.h>
18#include <linux/fs.h>
19#include <linux/err.h>
20#include <asm/uaccess.h>
21#include "internal.h"
22
23/*****************************************************************************/
24/*
25 * extract the description of a new key from userspace and either add it as a
26 * new key to the specified keyring or update a matching key in that keyring
27 * - the keyring must be writable
28 * - returns the new key's serial number
29 * - implements add_key()
30 */
31asmlinkage long sys_add_key(const char __user *_type,
32 const char __user *_description,
33 const void __user *_payload,
34 size_t plen,
35 key_serial_t ringid)
36{
David Howells664cceb2005-09-28 17:03:15 +010037 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -070038 char type[32], *description;
39 void *payload;
40 long dlen, ret;
41
42 ret = -EINVAL;
43 if (plen > 32767)
44 goto error;
45
46 /* draw all the data into kernel space */
47 ret = strncpy_from_user(type, _type, sizeof(type) - 1);
48 if (ret < 0)
49 goto error;
50 type[31] = '\0';
51
David Howells3e301482005-06-23 22:00:56 -070052 ret = -EPERM;
53 if (type[0] == '.')
54 goto error;
55
Linus Torvalds1da177e2005-04-16 15:20:36 -070056 ret = -EFAULT;
57 dlen = strnlen_user(_description, PAGE_SIZE - 1);
58 if (dlen <= 0)
59 goto error;
60
61 ret = -EINVAL;
62 if (dlen > PAGE_SIZE - 1)
63 goto error;
64
65 ret = -ENOMEM;
66 description = kmalloc(dlen + 1, GFP_KERNEL);
67 if (!description)
68 goto error;
69
70 ret = -EFAULT;
71 if (copy_from_user(description, _description, dlen + 1) != 0)
72 goto error2;
73
74 /* pull the payload in if one was supplied */
75 payload = NULL;
76
77 if (_payload) {
78 ret = -ENOMEM;
79 payload = kmalloc(plen, GFP_KERNEL);
80 if (!payload)
81 goto error2;
82
83 ret = -EFAULT;
84 if (copy_from_user(payload, _payload, plen) != 0)
85 goto error3;
86 }
87
88 /* find the target keyring (which must be writable) */
David Howells664cceb2005-09-28 17:03:15 +010089 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
90 if (IS_ERR(keyring_ref)) {
91 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -070092 goto error3;
93 }
94
95 /* create or update the requested key and add it to the target
96 * keyring */
David Howells664cceb2005-09-28 17:03:15 +010097 key_ref = key_create_or_update(keyring_ref, type, description,
98 payload, plen, 0);
99 if (!IS_ERR(key_ref)) {
100 ret = key_ref_to_ptr(key_ref)->serial;
101 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102 }
103 else {
David Howells664cceb2005-09-28 17:03:15 +0100104 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700105 }
106
David Howells664cceb2005-09-28 17:03:15 +0100107 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108 error3:
109 kfree(payload);
110 error2:
111 kfree(description);
112 error:
113 return ret;
114
115} /* end sys_add_key() */
116
117/*****************************************************************************/
118/*
119 * search the process keyrings for a matching key
120 * - nested keyrings may also be searched if they have Search permission
121 * - if a key is found, it will be attached to the destination keyring if
122 * there's one specified
123 * - /sbin/request-key will be invoked if _callout_info is non-NULL
124 * - the _callout_info string will be passed to /sbin/request-key
125 * - if the _callout_info string is empty, it will be rendered as "-"
126 * - implements request_key()
127 */
128asmlinkage long sys_request_key(const char __user *_type,
129 const char __user *_description,
130 const char __user *_callout_info,
131 key_serial_t destringid)
132{
133 struct key_type *ktype;
David Howells664cceb2005-09-28 17:03:15 +0100134 struct key *key;
135 key_ref_t dest_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136 char type[32], *description, *callout_info;
137 long dlen, ret;
138
139 /* pull the type into kernel space */
140 ret = strncpy_from_user(type, _type, sizeof(type) - 1);
141 if (ret < 0)
142 goto error;
143 type[31] = '\0';
144
David Howells1260f802005-08-04 11:50:01 +0100145 ret = -EPERM;
146 if (type[0] == '.')
147 goto error;
148
Linus Torvalds1da177e2005-04-16 15:20:36 -0700149 /* pull the description into kernel space */
150 ret = -EFAULT;
151 dlen = strnlen_user(_description, PAGE_SIZE - 1);
152 if (dlen <= 0)
153 goto error;
154
155 ret = -EINVAL;
156 if (dlen > PAGE_SIZE - 1)
157 goto error;
158
159 ret = -ENOMEM;
160 description = kmalloc(dlen + 1, GFP_KERNEL);
161 if (!description)
162 goto error;
163
164 ret = -EFAULT;
165 if (copy_from_user(description, _description, dlen + 1) != 0)
166 goto error2;
167
168 /* pull the callout info into kernel space */
169 callout_info = NULL;
170 if (_callout_info) {
171 ret = -EFAULT;
172 dlen = strnlen_user(_callout_info, PAGE_SIZE - 1);
173 if (dlen <= 0)
174 goto error2;
175
176 ret = -EINVAL;
177 if (dlen > PAGE_SIZE - 1)
178 goto error2;
179
180 ret = -ENOMEM;
181 callout_info = kmalloc(dlen + 1, GFP_KERNEL);
182 if (!callout_info)
183 goto error2;
184
185 ret = -EFAULT;
186 if (copy_from_user(callout_info, _callout_info, dlen + 1) != 0)
187 goto error3;
188 }
189
190 /* get the destination keyring if specified */
David Howells664cceb2005-09-28 17:03:15 +0100191 dest_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700192 if (destringid) {
David Howells664cceb2005-09-28 17:03:15 +0100193 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
194 if (IS_ERR(dest_ref)) {
195 ret = PTR_ERR(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700196 goto error3;
197 }
198 }
199
200 /* find the key type */
201 ktype = key_type_lookup(type);
202 if (IS_ERR(ktype)) {
203 ret = PTR_ERR(ktype);
204 goto error4;
205 }
206
207 /* do the search */
David Howells664cceb2005-09-28 17:03:15 +0100208 key = request_key_and_link(ktype, description, callout_info,
209 key_ref_to_ptr(dest_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210 if (IS_ERR(key)) {
211 ret = PTR_ERR(key);
212 goto error5;
213 }
214
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 ret = key->serial;
216
David Howells3e301482005-06-23 22:00:56 -0700217 key_put(key);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 error5:
219 key_type_put(ktype);
220 error4:
David Howells664cceb2005-09-28 17:03:15 +0100221 key_ref_put(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 error3:
223 kfree(callout_info);
224 error2:
225 kfree(description);
226 error:
227 return ret;
228
229} /* end sys_request_key() */
230
231/*****************************************************************************/
232/*
233 * get the ID of the specified process keyring
234 * - the keyring must have search permission to be found
235 * - implements keyctl(KEYCTL_GET_KEYRING_ID)
236 */
237long keyctl_get_keyring_ID(key_serial_t id, int create)
238{
David Howells664cceb2005-09-28 17:03:15 +0100239 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700240 long ret;
241
David Howells664cceb2005-09-28 17:03:15 +0100242 key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
243 if (IS_ERR(key_ref)) {
244 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 goto error;
246 }
247
David Howells664cceb2005-09-28 17:03:15 +0100248 ret = key_ref_to_ptr(key_ref)->serial;
249 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250 error:
251 return ret;
252
253} /* end keyctl_get_keyring_ID() */
254
255/*****************************************************************************/
256/*
257 * join the session keyring
258 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
259 */
260long keyctl_join_session_keyring(const char __user *_name)
261{
262 char *name;
263 long nlen, ret;
264
265 /* fetch the name from userspace */
266 name = NULL;
267 if (_name) {
268 ret = -EFAULT;
269 nlen = strnlen_user(_name, PAGE_SIZE - 1);
270 if (nlen <= 0)
271 goto error;
272
273 ret = -EINVAL;
274 if (nlen > PAGE_SIZE - 1)
275 goto error;
276
277 ret = -ENOMEM;
278 name = kmalloc(nlen + 1, GFP_KERNEL);
279 if (!name)
280 goto error;
281
282 ret = -EFAULT;
283 if (copy_from_user(name, _name, nlen + 1) != 0)
284 goto error2;
285 }
286
287 /* join the session */
288 ret = join_session_keyring(name);
289
290 error2:
291 kfree(name);
292 error:
293 return ret;
294
295} /* end keyctl_join_session_keyring() */
296
297/*****************************************************************************/
298/*
299 * update a key's data payload
300 * - the key must be writable
301 * - implements keyctl(KEYCTL_UPDATE)
302 */
303long keyctl_update_key(key_serial_t id,
304 const void __user *_payload,
305 size_t plen)
306{
David Howells664cceb2005-09-28 17:03:15 +0100307 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700308 void *payload;
309 long ret;
310
311 ret = -EINVAL;
312 if (plen > PAGE_SIZE)
313 goto error;
314
315 /* pull the payload in if one was supplied */
316 payload = NULL;
317 if (_payload) {
318 ret = -ENOMEM;
319 payload = kmalloc(plen, GFP_KERNEL);
320 if (!payload)
321 goto error;
322
323 ret = -EFAULT;
324 if (copy_from_user(payload, _payload, plen) != 0)
325 goto error2;
326 }
327
328 /* find the target key (which must be writable) */
David Howells664cceb2005-09-28 17:03:15 +0100329 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
330 if (IS_ERR(key_ref)) {
331 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700332 goto error2;
333 }
334
335 /* update the key */
David Howells664cceb2005-09-28 17:03:15 +0100336 ret = key_update(key_ref, payload, plen);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700337
David Howells664cceb2005-09-28 17:03:15 +0100338 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700339 error2:
340 kfree(payload);
341 error:
342 return ret;
343
344} /* end keyctl_update_key() */
345
346/*****************************************************************************/
347/*
348 * revoke a key
349 * - the key must be writable
350 * - implements keyctl(KEYCTL_REVOKE)
351 */
352long keyctl_revoke_key(key_serial_t id)
353{
David Howells664cceb2005-09-28 17:03:15 +0100354 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700355 long ret;
356
David Howells664cceb2005-09-28 17:03:15 +0100357 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
358 if (IS_ERR(key_ref)) {
359 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700360 goto error;
361 }
362
David Howells664cceb2005-09-28 17:03:15 +0100363 key_revoke(key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364 ret = 0;
365
David Howells664cceb2005-09-28 17:03:15 +0100366 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700367 error:
David Howells1260f802005-08-04 11:50:01 +0100368 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369
370} /* end keyctl_revoke_key() */
371
372/*****************************************************************************/
373/*
374 * clear the specified process keyring
375 * - the keyring must be writable
376 * - implements keyctl(KEYCTL_CLEAR)
377 */
378long keyctl_keyring_clear(key_serial_t ringid)
379{
David Howells664cceb2005-09-28 17:03:15 +0100380 key_ref_t keyring_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700381 long ret;
382
David Howells664cceb2005-09-28 17:03:15 +0100383 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
384 if (IS_ERR(keyring_ref)) {
385 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700386 goto error;
387 }
388
David Howells664cceb2005-09-28 17:03:15 +0100389 ret = keyring_clear(key_ref_to_ptr(keyring_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
David Howells664cceb2005-09-28 17:03:15 +0100391 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 error:
393 return ret;
394
395} /* end keyctl_keyring_clear() */
396
397/*****************************************************************************/
398/*
399 * link a key into a keyring
400 * - the keyring must be writable
401 * - the key must be linkable
402 * - implements keyctl(KEYCTL_LINK)
403 */
404long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
405{
David Howells664cceb2005-09-28 17:03:15 +0100406 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407 long ret;
408
David Howells664cceb2005-09-28 17:03:15 +0100409 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
410 if (IS_ERR(keyring_ref)) {
411 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412 goto error;
413 }
414
David Howells664cceb2005-09-28 17:03:15 +0100415 key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
416 if (IS_ERR(key_ref)) {
417 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 goto error2;
419 }
420
David Howells664cceb2005-09-28 17:03:15 +0100421 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422
David Howells664cceb2005-09-28 17:03:15 +0100423 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 error2:
David Howells664cceb2005-09-28 17:03:15 +0100425 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700426 error:
427 return ret;
428
429} /* end keyctl_keyring_link() */
430
431/*****************************************************************************/
432/*
433 * unlink the first attachment of a key from a keyring
434 * - the keyring must be writable
435 * - we don't need any permissions on the key
436 * - implements keyctl(KEYCTL_UNLINK)
437 */
438long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
439{
David Howells664cceb2005-09-28 17:03:15 +0100440 key_ref_t keyring_ref, key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700441 long ret;
442
David Howells664cceb2005-09-28 17:03:15 +0100443 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
444 if (IS_ERR(keyring_ref)) {
445 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700446 goto error;
447 }
448
David Howells664cceb2005-09-28 17:03:15 +0100449 key_ref = lookup_user_key(NULL, id, 0, 0, 0);
450 if (IS_ERR(key_ref)) {
451 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700452 goto error2;
453 }
454
David Howells664cceb2005-09-28 17:03:15 +0100455 ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700456
David Howells664cceb2005-09-28 17:03:15 +0100457 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700458 error2:
David Howells664cceb2005-09-28 17:03:15 +0100459 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460 error:
461 return ret;
462
463} /* end keyctl_keyring_unlink() */
464
465/*****************************************************************************/
466/*
467 * describe a user key
468 * - the key must have view permission
469 * - if there's a buffer, we place up to buflen bytes of data into it
470 * - unless there's an error, we return the amount of description available,
471 * irrespective of how much we may have copied
472 * - the description is formatted thus:
473 * type;uid;gid;perm;description<NUL>
474 * - implements keyctl(KEYCTL_DESCRIBE)
475 */
476long keyctl_describe_key(key_serial_t keyid,
477 char __user *buffer,
478 size_t buflen)
479{
David Howells3e301482005-06-23 22:00:56 -0700480 struct key *key, *instkey;
David Howells664cceb2005-09-28 17:03:15 +0100481 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700482 char *tmpbuf;
483 long ret;
484
David Howells664cceb2005-09-28 17:03:15 +0100485 key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
486 if (IS_ERR(key_ref)) {
David Howells3e301482005-06-23 22:00:56 -0700487 /* viewing a key under construction is permitted if we have the
488 * authorisation token handy */
David Howells664cceb2005-09-28 17:03:15 +0100489 if (PTR_ERR(key_ref) == -EACCES) {
David Howells3e301482005-06-23 22:00:56 -0700490 instkey = key_get_instantiation_authkey(keyid);
491 if (!IS_ERR(instkey)) {
492 key_put(instkey);
David Howells664cceb2005-09-28 17:03:15 +0100493 key_ref = lookup_user_key(NULL, keyid,
494 0, 1, 0);
495 if (!IS_ERR(key_ref))
David Howells3e301482005-06-23 22:00:56 -0700496 goto okay;
497 }
498 }
499
David Howells664cceb2005-09-28 17:03:15 +0100500 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700501 goto error;
502 }
503
David Howells3e301482005-06-23 22:00:56 -0700504okay:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700505 /* calculate how much description we're going to return */
506 ret = -ENOMEM;
507 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
508 if (!tmpbuf)
509 goto error2;
510
David Howells664cceb2005-09-28 17:03:15 +0100511 key = key_ref_to_ptr(key_ref);
512
Linus Torvalds1da177e2005-04-16 15:20:36 -0700513 ret = snprintf(tmpbuf, PAGE_SIZE - 1,
David Howells664cceb2005-09-28 17:03:15 +0100514 "%s;%d;%d;%08x;%s",
515 key_ref_to_ptr(key_ref)->type->name,
516 key_ref_to_ptr(key_ref)->uid,
517 key_ref_to_ptr(key_ref)->gid,
518 key_ref_to_ptr(key_ref)->perm,
519 key_ref_to_ptr(key_ref)->description ?
520 key_ref_to_ptr(key_ref)->description : ""
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521 );
522
523 /* include a NUL char at the end of the data */
524 if (ret > PAGE_SIZE - 1)
525 ret = PAGE_SIZE - 1;
526 tmpbuf[ret] = 0;
527 ret++;
528
529 /* consider returning the data */
530 if (buffer && buflen > 0) {
531 if (buflen > ret)
532 buflen = ret;
533
534 if (copy_to_user(buffer, tmpbuf, buflen) != 0)
535 ret = -EFAULT;
536 }
537
538 kfree(tmpbuf);
539 error2:
David Howells664cceb2005-09-28 17:03:15 +0100540 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 error:
542 return ret;
543
544} /* end keyctl_describe_key() */
545
546/*****************************************************************************/
547/*
548 * search the specified keyring for a matching key
549 * - the start keyring must be searchable
550 * - nested keyrings may also be searched if they are searchable
551 * - only keys with search permission may be found
552 * - if a key is found, it will be attached to the destination keyring if
553 * there's one specified
554 * - implements keyctl(KEYCTL_SEARCH)
555 */
556long keyctl_keyring_search(key_serial_t ringid,
557 const char __user *_type,
558 const char __user *_description,
559 key_serial_t destringid)
560{
561 struct key_type *ktype;
David Howells664cceb2005-09-28 17:03:15 +0100562 key_ref_t keyring_ref, key_ref, dest_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700563 char type[32], *description;
564 long dlen, ret;
565
566 /* pull the type and description into kernel space */
567 ret = strncpy_from_user(type, _type, sizeof(type) - 1);
568 if (ret < 0)
569 goto error;
570 type[31] = '\0';
571
572 ret = -EFAULT;
573 dlen = strnlen_user(_description, PAGE_SIZE - 1);
574 if (dlen <= 0)
575 goto error;
576
577 ret = -EINVAL;
578 if (dlen > PAGE_SIZE - 1)
579 goto error;
580
581 ret = -ENOMEM;
582 description = kmalloc(dlen + 1, GFP_KERNEL);
583 if (!description)
584 goto error;
585
586 ret = -EFAULT;
587 if (copy_from_user(description, _description, dlen + 1) != 0)
588 goto error2;
589
590 /* get the keyring at which to begin the search */
David Howells664cceb2005-09-28 17:03:15 +0100591 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
592 if (IS_ERR(keyring_ref)) {
593 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700594 goto error2;
595 }
596
597 /* get the destination keyring if specified */
David Howells664cceb2005-09-28 17:03:15 +0100598 dest_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700599 if (destringid) {
David Howells664cceb2005-09-28 17:03:15 +0100600 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
601 if (IS_ERR(dest_ref)) {
602 ret = PTR_ERR(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700603 goto error3;
604 }
605 }
606
607 /* find the key type */
608 ktype = key_type_lookup(type);
609 if (IS_ERR(ktype)) {
610 ret = PTR_ERR(ktype);
611 goto error4;
612 }
613
614 /* do the search */
David Howells664cceb2005-09-28 17:03:15 +0100615 key_ref = keyring_search(keyring_ref, ktype, description);
616 if (IS_ERR(key_ref)) {
617 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700618
619 /* treat lack or presence of a negative key the same */
620 if (ret == -EAGAIN)
621 ret = -ENOKEY;
622 goto error5;
623 }
624
625 /* link the resulting key to the destination keyring if we can */
David Howells664cceb2005-09-28 17:03:15 +0100626 if (dest_ref) {
David Howells29db9192005-10-30 15:02:44 -0800627 ret = key_permission(key_ref, KEY_LINK);
628 if (ret < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700629 goto error6;
630
David Howells664cceb2005-09-28 17:03:15 +0100631 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700632 if (ret < 0)
633 goto error6;
634 }
635
David Howells664cceb2005-09-28 17:03:15 +0100636 ret = key_ref_to_ptr(key_ref)->serial;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700637
638 error6:
David Howells664cceb2005-09-28 17:03:15 +0100639 key_ref_put(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700640 error5:
641 key_type_put(ktype);
642 error4:
David Howells664cceb2005-09-28 17:03:15 +0100643 key_ref_put(dest_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700644 error3:
David Howells664cceb2005-09-28 17:03:15 +0100645 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700646 error2:
647 kfree(description);
648 error:
649 return ret;
650
651} /* end keyctl_keyring_search() */
652
653/*****************************************************************************/
654/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700655 * read a user key's payload
656 * - the keyring must be readable or the key must be searchable from the
657 * process's keyrings
658 * - if there's a buffer, we place up to buflen bytes of data into it
659 * - unless there's an error, we return the amount of data in the key,
660 * irrespective of how much we may have copied
661 * - implements keyctl(KEYCTL_READ)
662 */
663long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
664{
David Howells664cceb2005-09-28 17:03:15 +0100665 struct key *key;
666 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700667 long ret;
668
669 /* find the key first */
David Howells664cceb2005-09-28 17:03:15 +0100670 key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
671 if (IS_ERR(key_ref)) {
672 ret = -ENOKEY;
673 goto error;
674 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700675
David Howells664cceb2005-09-28 17:03:15 +0100676 key = key_ref_to_ptr(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700677
David Howells664cceb2005-09-28 17:03:15 +0100678 /* see if we can read it directly */
David Howells29db9192005-10-30 15:02:44 -0800679 ret = key_permission(key_ref, KEY_READ);
680 if (ret == 0)
David Howells664cceb2005-09-28 17:03:15 +0100681 goto can_read_key;
David Howells29db9192005-10-30 15:02:44 -0800682 if (ret != -EACCES)
683 goto error;
David Howells664cceb2005-09-28 17:03:15 +0100684
685 /* we can't; see if it's searchable from this process's keyrings
686 * - we automatically take account of the fact that it may be
687 * dangling off an instantiation key
688 */
689 if (!is_key_possessed(key_ref)) {
690 ret = -EACCES;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700691 goto error2;
692 }
693
Linus Torvalds1da177e2005-04-16 15:20:36 -0700694 /* the key is probably readable - now try to read it */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700695 can_read_key:
696 ret = key_validate(key);
697 if (ret == 0) {
698 ret = -EOPNOTSUPP;
699 if (key->type->read) {
700 /* read the data with the semaphore held (since we
701 * might sleep) */
702 down_read(&key->sem);
703 ret = key->type->read(key, buffer, buflen);
704 up_read(&key->sem);
705 }
706 }
707
708 error2:
709 key_put(key);
710 error:
711 return ret;
712
713} /* end keyctl_read_key() */
714
715/*****************************************************************************/
716/*
717 * change the ownership of a key
718 * - the keyring owned by the changer
719 * - if the uid or gid is -1, then that parameter is not changed
720 * - implements keyctl(KEYCTL_CHOWN)
721 */
722long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
723{
724 struct key *key;
David Howells664cceb2005-09-28 17:03:15 +0100725 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700726 long ret;
727
728 ret = 0;
729 if (uid == (uid_t) -1 && gid == (gid_t) -1)
730 goto error;
731
David Howells29db9192005-10-30 15:02:44 -0800732 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
David Howells664cceb2005-09-28 17:03:15 +0100733 if (IS_ERR(key_ref)) {
734 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700735 goto error;
736 }
737
David Howells664cceb2005-09-28 17:03:15 +0100738 key = key_ref_to_ptr(key_ref);
739
Linus Torvalds1da177e2005-04-16 15:20:36 -0700740 /* make the changes with the locks held to prevent chown/chown races */
741 ret = -EACCES;
742 down_write(&key->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700743
744 if (!capable(CAP_SYS_ADMIN)) {
745 /* only the sysadmin can chown a key to some other UID */
746 if (uid != (uid_t) -1 && key->uid != uid)
747 goto no_access;
748
749 /* only the sysadmin can set the key's GID to a group other
750 * than one of those that the current process subscribes to */
751 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
752 goto no_access;
753 }
754
755 /* change the UID (have to update the quotas) */
756 if (uid != (uid_t) -1 && uid != key->uid) {
757 /* don't support UID changing yet */
758 ret = -EOPNOTSUPP;
759 goto no_access;
760 }
761
762 /* change the GID */
763 if (gid != (gid_t) -1)
764 key->gid = gid;
765
766 ret = 0;
767
768 no_access:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700769 up_write(&key->sem);
770 key_put(key);
771 error:
772 return ret;
773
774} /* end keyctl_chown_key() */
775
776/*****************************************************************************/
777/*
778 * change the permission mask on a key
779 * - the keyring owned by the changer
780 * - implements keyctl(KEYCTL_SETPERM)
781 */
782long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
783{
784 struct key *key;
David Howells664cceb2005-09-28 17:03:15 +0100785 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700786 long ret;
787
788 ret = -EINVAL;
David Howells664cceb2005-09-28 17:03:15 +0100789 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 goto error;
791
David Howells29db9192005-10-30 15:02:44 -0800792 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
David Howells664cceb2005-09-28 17:03:15 +0100793 if (IS_ERR(key_ref)) {
794 ret = PTR_ERR(key_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700795 goto error;
796 }
797
David Howells664cceb2005-09-28 17:03:15 +0100798 key = key_ref_to_ptr(key_ref);
799
David Howells76d8aea2005-06-23 22:00:49 -0700800 /* make the changes with the locks held to prevent chown/chmod races */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700801 ret = -EACCES;
802 down_write(&key->sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700803
David Howells76d8aea2005-06-23 22:00:49 -0700804 /* if we're not the sysadmin, we can only change a key that we own */
805 if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
806 key->perm = perm;
807 ret = 0;
808 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700809
Linus Torvalds1da177e2005-04-16 15:20:36 -0700810 up_write(&key->sem);
811 key_put(key);
David Howells76d8aea2005-06-23 22:00:49 -0700812error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700813 return ret;
814
815} /* end keyctl_setperm_key() */
816
817/*****************************************************************************/
818/*
819 * instantiate the key with the specified payload, and, if one is given, link
820 * the key into the keyring
821 */
822long keyctl_instantiate_key(key_serial_t id,
823 const void __user *_payload,
824 size_t plen,
825 key_serial_t ringid)
826{
David Howells3e301482005-06-23 22:00:56 -0700827 struct request_key_auth *rka;
David Howells664cceb2005-09-28 17:03:15 +0100828 struct key *instkey;
829 key_ref_t keyring_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700830 void *payload;
831 long ret;
832
833 ret = -EINVAL;
834 if (plen > 32767)
835 goto error;
836
837 /* pull the payload in if one was supplied */
838 payload = NULL;
839
840 if (_payload) {
841 ret = -ENOMEM;
842 payload = kmalloc(plen, GFP_KERNEL);
843 if (!payload)
844 goto error;
845
846 ret = -EFAULT;
847 if (copy_from_user(payload, _payload, plen) != 0)
848 goto error2;
849 }
850
David Howells3e301482005-06-23 22:00:56 -0700851 /* find the instantiation authorisation key */
852 instkey = key_get_instantiation_authkey(id);
853 if (IS_ERR(instkey)) {
854 ret = PTR_ERR(instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700855 goto error2;
856 }
857
David Howells3e301482005-06-23 22:00:56 -0700858 rka = instkey->payload.data;
859
860 /* find the destination keyring amongst those belonging to the
861 * requesting task */
David Howells664cceb2005-09-28 17:03:15 +0100862 keyring_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700863 if (ringid) {
David Howells664cceb2005-09-28 17:03:15 +0100864 keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
865 KEY_WRITE);
866 if (IS_ERR(keyring_ref)) {
867 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868 goto error3;
869 }
870 }
871
872 /* instantiate the key and link it into a keyring */
David Howells3e301482005-06-23 22:00:56 -0700873 ret = key_instantiate_and_link(rka->target_key, payload, plen,
David Howells664cceb2005-09-28 17:03:15 +0100874 key_ref_to_ptr(keyring_ref), instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700875
David Howells664cceb2005-09-28 17:03:15 +0100876 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700877 error3:
David Howells3e301482005-06-23 22:00:56 -0700878 key_put(instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700879 error2:
880 kfree(payload);
881 error:
882 return ret;
883
884} /* end keyctl_instantiate_key() */
885
886/*****************************************************************************/
887/*
888 * negatively instantiate the key with the given timeout (in seconds), and, if
889 * one is given, link the key into the keyring
890 */
891long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
892{
David Howells3e301482005-06-23 22:00:56 -0700893 struct request_key_auth *rka;
David Howells664cceb2005-09-28 17:03:15 +0100894 struct key *instkey;
895 key_ref_t keyring_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700896 long ret;
897
David Howells3e301482005-06-23 22:00:56 -0700898 /* find the instantiation authorisation key */
899 instkey = key_get_instantiation_authkey(id);
900 if (IS_ERR(instkey)) {
901 ret = PTR_ERR(instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700902 goto error;
903 }
904
David Howells3e301482005-06-23 22:00:56 -0700905 rka = instkey->payload.data;
906
Linus Torvalds1da177e2005-04-16 15:20:36 -0700907 /* find the destination keyring if present (which must also be
908 * writable) */
David Howells664cceb2005-09-28 17:03:15 +0100909 keyring_ref = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700910 if (ringid) {
David Howells664cceb2005-09-28 17:03:15 +0100911 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
912 if (IS_ERR(keyring_ref)) {
913 ret = PTR_ERR(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700914 goto error2;
915 }
916 }
917
918 /* instantiate the key and link it into a keyring */
David Howells664cceb2005-09-28 17:03:15 +0100919 ret = key_negate_and_link(rka->target_key, timeout,
920 key_ref_to_ptr(keyring_ref), instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700921
David Howells664cceb2005-09-28 17:03:15 +0100922 key_ref_put(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700923 error2:
David Howells3e301482005-06-23 22:00:56 -0700924 key_put(instkey);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700925 error:
926 return ret;
927
928} /* end keyctl_negate_key() */
929
930/*****************************************************************************/
931/*
David Howells3e301482005-06-23 22:00:56 -0700932 * set the default keyring in which request_key() will cache keys
933 * - return the old setting
934 */
935long keyctl_set_reqkey_keyring(int reqkey_defl)
936{
937 int ret;
938
939 switch (reqkey_defl) {
940 case KEY_REQKEY_DEFL_THREAD_KEYRING:
941 ret = install_thread_keyring(current);
942 if (ret < 0)
943 return ret;
944 goto set;
945
946 case KEY_REQKEY_DEFL_PROCESS_KEYRING:
947 ret = install_process_keyring(current);
948 if (ret < 0)
949 return ret;
950
951 case KEY_REQKEY_DEFL_DEFAULT:
952 case KEY_REQKEY_DEFL_SESSION_KEYRING:
953 case KEY_REQKEY_DEFL_USER_KEYRING:
954 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
955 set:
956 current->jit_keyring = reqkey_defl;
957
958 case KEY_REQKEY_DEFL_NO_CHANGE:
959 return current->jit_keyring;
960
961 case KEY_REQKEY_DEFL_GROUP_KEYRING:
962 default:
963 return -EINVAL;
964 }
965
966} /* end keyctl_set_reqkey_keyring() */
967
968/*****************************************************************************/
969/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700970 * the key control system call
971 */
972asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
973 unsigned long arg4, unsigned long arg5)
974{
975 switch (option) {
976 case KEYCTL_GET_KEYRING_ID:
977 return keyctl_get_keyring_ID((key_serial_t) arg2,
978 (int) arg3);
979
980 case KEYCTL_JOIN_SESSION_KEYRING:
981 return keyctl_join_session_keyring((const char __user *) arg2);
982
983 case KEYCTL_UPDATE:
984 return keyctl_update_key((key_serial_t) arg2,
985 (const void __user *) arg3,
986 (size_t) arg4);
987
988 case KEYCTL_REVOKE:
989 return keyctl_revoke_key((key_serial_t) arg2);
990
991 case KEYCTL_DESCRIBE:
992 return keyctl_describe_key((key_serial_t) arg2,
993 (char __user *) arg3,
994 (unsigned) arg4);
995
996 case KEYCTL_CLEAR:
997 return keyctl_keyring_clear((key_serial_t) arg2);
998
999 case KEYCTL_LINK:
1000 return keyctl_keyring_link((key_serial_t) arg2,
1001 (key_serial_t) arg3);
1002
1003 case KEYCTL_UNLINK:
1004 return keyctl_keyring_unlink((key_serial_t) arg2,
1005 (key_serial_t) arg3);
1006
1007 case KEYCTL_SEARCH:
1008 return keyctl_keyring_search((key_serial_t) arg2,
1009 (const char __user *) arg3,
1010 (const char __user *) arg4,
1011 (key_serial_t) arg5);
1012
1013 case KEYCTL_READ:
1014 return keyctl_read_key((key_serial_t) arg2,
1015 (char __user *) arg3,
1016 (size_t) arg4);
1017
1018 case KEYCTL_CHOWN:
1019 return keyctl_chown_key((key_serial_t) arg2,
1020 (uid_t) arg3,
1021 (gid_t) arg4);
1022
1023 case KEYCTL_SETPERM:
1024 return keyctl_setperm_key((key_serial_t) arg2,
1025 (key_perm_t) arg3);
1026
1027 case KEYCTL_INSTANTIATE:
1028 return keyctl_instantiate_key((key_serial_t) arg2,
1029 (const void __user *) arg3,
1030 (size_t) arg4,
1031 (key_serial_t) arg5);
1032
1033 case KEYCTL_NEGATE:
1034 return keyctl_negate_key((key_serial_t) arg2,
1035 (unsigned) arg3,
1036 (key_serial_t) arg4);
1037
David Howells3e301482005-06-23 22:00:56 -07001038 case KEYCTL_SET_REQKEY_KEYRING:
1039 return keyctl_set_reqkey_keyring(arg2);
1040
Linus Torvalds1da177e2005-04-16 15:20:36 -07001041 default:
1042 return -EOPNOTSUPP;
1043 }
1044
1045} /* end sys_keyctl() */