blob: a1f6bac647a1c3a673bfbb2b4b03d0556cc9be88 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* keyring.c: keyring handling
2 *
David Howells3e301482005-06-23 22:00:56 -07003 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
16#include <linux/seq_file.h>
17#include <linux/err.h>
18#include <asm/uaccess.h>
19#include "internal.h"
20
21/*
22 * when plumbing the depths of the key tree, this sets a hard limit set on how
23 * deep we're willing to go
24 */
25#define KEYRING_SEARCH_MAX_DEPTH 6
26
27/*
28 * we keep all named keyrings in a hash to speed looking them up
29 */
30#define KEYRING_NAME_HASH_SIZE (1 << 5)
31
32static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
33static DEFINE_RWLOCK(keyring_name_lock);
34
35static inline unsigned keyring_hash(const char *desc)
36{
37 unsigned bucket = 0;
38
39 for (; *desc; desc++)
40 bucket += (unsigned char) *desc;
41
42 return bucket & (KEYRING_NAME_HASH_SIZE - 1);
43}
44
45/*
46 * the keyring type definition
47 */
48static int keyring_instantiate(struct key *keyring,
49 const void *data, size_t datalen);
50static int keyring_duplicate(struct key *keyring, const struct key *source);
51static int keyring_match(const struct key *keyring, const void *criterion);
52static void keyring_destroy(struct key *keyring);
53static void keyring_describe(const struct key *keyring, struct seq_file *m);
54static long keyring_read(const struct key *keyring,
55 char __user *buffer, size_t buflen);
56
57struct key_type key_type_keyring = {
58 .name = "keyring",
59 .def_datalen = sizeof(struct keyring_list),
60 .instantiate = keyring_instantiate,
61 .duplicate = keyring_duplicate,
62 .match = keyring_match,
63 .destroy = keyring_destroy,
64 .describe = keyring_describe,
65 .read = keyring_read,
66};
67
68/*
69 * semaphore to serialise link/link calls to prevent two link calls in parallel
70 * introducing a cycle
71 */
72DECLARE_RWSEM(keyring_serialise_link_sem);
73
74/*****************************************************************************/
75/*
76 * publish the name of a keyring so that it can be found by name (if it has
77 * one)
78 */
79void keyring_publish_name(struct key *keyring)
80{
81 int bucket;
82
83 if (keyring->description) {
84 bucket = keyring_hash(keyring->description);
85
86 write_lock(&keyring_name_lock);
87
88 if (!keyring_name_hash[bucket].next)
89 INIT_LIST_HEAD(&keyring_name_hash[bucket]);
90
91 list_add_tail(&keyring->type_data.link,
92 &keyring_name_hash[bucket]);
93
94 write_unlock(&keyring_name_lock);
95 }
96
97} /* end keyring_publish_name() */
98
99/*****************************************************************************/
100/*
101 * initialise a keyring
102 * - we object if we were given any data
103 */
104static int keyring_instantiate(struct key *keyring,
105 const void *data, size_t datalen)
106{
107 int ret;
108
109 ret = -EINVAL;
110 if (datalen == 0) {
111 /* make the keyring available by name if it has one */
112 keyring_publish_name(keyring);
113 ret = 0;
114 }
115
116 return ret;
117
118} /* end keyring_instantiate() */
119
120/*****************************************************************************/
121/*
122 * duplicate the list of subscribed keys from a source keyring into this one
123 */
124static int keyring_duplicate(struct key *keyring, const struct key *source)
125{
126 struct keyring_list *sklist, *klist;
127 unsigned max;
128 size_t size;
129 int loop, ret;
130
131 const unsigned limit =
David Howellsa4014d82005-07-07 17:57:03 -0700132 (PAGE_SIZE - sizeof(*klist)) / sizeof(struct key *);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700133
134 ret = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135
David Howells76d8aea2005-06-23 22:00:49 -0700136 /* find out how many keys are currently linked */
137 rcu_read_lock();
138 sklist = rcu_dereference(source->payload.subscriptions);
139 max = 0;
140 if (sklist)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700141 max = sklist->nkeys;
David Howells76d8aea2005-06-23 22:00:49 -0700142 rcu_read_unlock();
143
144 /* allocate a new payload and stuff load with key links */
145 if (max > 0) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146 BUG_ON(max > limit);
147
148 max = (max + 3) & ~3;
149 if (max > limit)
150 max = limit;
151
152 ret = -ENOMEM;
David Howellsa4014d82005-07-07 17:57:03 -0700153 size = sizeof(*klist) + sizeof(struct key *) * max;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700154 klist = kmalloc(size, GFP_KERNEL);
155 if (!klist)
156 goto error;
157
David Howells76d8aea2005-06-23 22:00:49 -0700158 /* set links */
159 rcu_read_lock();
160 sklist = rcu_dereference(source->payload.subscriptions);
161
Linus Torvalds1da177e2005-04-16 15:20:36 -0700162 klist->maxkeys = max;
163 klist->nkeys = sklist->nkeys;
164 memcpy(klist->keys,
165 sklist->keys,
David Howellsa4014d82005-07-07 17:57:03 -0700166 sklist->nkeys * sizeof(struct key *));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700167
168 for (loop = klist->nkeys - 1; loop >= 0; loop--)
169 atomic_inc(&klist->keys[loop]->usage);
170
David Howells76d8aea2005-06-23 22:00:49 -0700171 rcu_read_unlock();
172
173 rcu_assign_pointer(keyring->payload.subscriptions, klist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700174 ret = 0;
175 }
176
177 error:
178 return ret;
179
180} /* end keyring_duplicate() */
181
182/*****************************************************************************/
183/*
184 * match keyrings on their name
185 */
186static int keyring_match(const struct key *keyring, const void *description)
187{
188 return keyring->description &&
189 strcmp(keyring->description, description) == 0;
190
191} /* end keyring_match() */
192
193/*****************************************************************************/
194/*
195 * dispose of the data dangling from the corpse of a keyring
196 */
197static void keyring_destroy(struct key *keyring)
198{
199 struct keyring_list *klist;
200 int loop;
201
202 if (keyring->description) {
203 write_lock(&keyring_name_lock);
204 list_del(&keyring->type_data.link);
205 write_unlock(&keyring_name_lock);
206 }
207
David Howells76d8aea2005-06-23 22:00:49 -0700208 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700209 if (klist) {
210 for (loop = klist->nkeys - 1; loop >= 0; loop--)
211 key_put(klist->keys[loop]);
212 kfree(klist);
213 }
214
215} /* end keyring_destroy() */
216
217/*****************************************************************************/
218/*
219 * describe the keyring
220 */
221static void keyring_describe(const struct key *keyring, struct seq_file *m)
222{
223 struct keyring_list *klist;
224
225 if (keyring->description) {
226 seq_puts(m, keyring->description);
227 }
228 else {
229 seq_puts(m, "[anon]");
230 }
231
David Howells76d8aea2005-06-23 22:00:49 -0700232 rcu_read_lock();
233 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234 if (klist)
235 seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
236 else
237 seq_puts(m, ": empty");
David Howells76d8aea2005-06-23 22:00:49 -0700238 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239
240} /* end keyring_describe() */
241
242/*****************************************************************************/
243/*
244 * read a list of key IDs from the keyring's contents
David Howells76d8aea2005-06-23 22:00:49 -0700245 * - the keyring's semaphore is read-locked
Linus Torvalds1da177e2005-04-16 15:20:36 -0700246 */
247static long keyring_read(const struct key *keyring,
248 char __user *buffer, size_t buflen)
249{
250 struct keyring_list *klist;
251 struct key *key;
252 size_t qty, tmp;
253 int loop, ret;
254
255 ret = 0;
David Howells76d8aea2005-06-23 22:00:49 -0700256 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700257
258 if (klist) {
259 /* calculate how much data we could return */
260 qty = klist->nkeys * sizeof(key_serial_t);
261
262 if (buffer && buflen > 0) {
263 if (buflen > qty)
264 buflen = qty;
265
266 /* copy the IDs of the subscribed keys into the
267 * buffer */
268 ret = -EFAULT;
269
270 for (loop = 0; loop < klist->nkeys; loop++) {
271 key = klist->keys[loop];
272
273 tmp = sizeof(key_serial_t);
274 if (tmp > buflen)
275 tmp = buflen;
276
277 if (copy_to_user(buffer,
278 &key->serial,
279 tmp) != 0)
280 goto error;
281
282 buflen -= tmp;
283 if (buflen == 0)
284 break;
285 buffer += tmp;
286 }
287 }
288
289 ret = qty;
290 }
291
292 error:
293 return ret;
294
295} /* end keyring_read() */
296
297/*****************************************************************************/
298/*
299 * allocate a keyring and link into the destination keyring
300 */
301struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
302 int not_in_quota, struct key *dest)
303{
304 struct key *keyring;
305 int ret;
306
307 keyring = key_alloc(&key_type_keyring, description,
308 uid, gid, KEY_USR_ALL, not_in_quota);
309
310 if (!IS_ERR(keyring)) {
David Howells3e301482005-06-23 22:00:56 -0700311 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700312 if (ret < 0) {
313 key_put(keyring);
314 keyring = ERR_PTR(ret);
315 }
316 }
317
318 return keyring;
319
320} /* end keyring_alloc() */
321
322/*****************************************************************************/
323/*
324 * search the supplied keyring tree for a key that matches the criterion
325 * - perform a breadth-then-depth search up to the prescribed limit
326 * - we only find keys on which we have search permission
327 * - we use the supplied match function to see if the description (or other
328 * feature of interest) matches
David Howells3e301482005-06-23 22:00:56 -0700329 * - we rely on RCU to prevent the keyring lists from disappearing on us
Linus Torvalds1da177e2005-04-16 15:20:36 -0700330 * - we return -EAGAIN if we didn't find any matching key
331 * - we return -ENOKEY if we only found negative matching keys
332 */
333struct key *keyring_search_aux(struct key *keyring,
David Howells3e301482005-06-23 22:00:56 -0700334 struct task_struct *context,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700335 struct key_type *type,
336 const void *description,
337 key_match_func_t match)
338{
339 struct {
David Howells76d8aea2005-06-23 22:00:49 -0700340 struct keyring_list *keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700341 int kix;
342 } stack[KEYRING_SEARCH_MAX_DEPTH];
343
344 struct keyring_list *keylist;
345 struct timespec now;
346 struct key *key;
347 long err;
David Howells76d8aea2005-06-23 22:00:49 -0700348 int sp, kix;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349
350 key_check(keyring);
351
David Howells76d8aea2005-06-23 22:00:49 -0700352 rcu_read_lock();
353
Linus Torvalds1da177e2005-04-16 15:20:36 -0700354 /* top keyring must have search permission to begin the search */
355 key = ERR_PTR(-EACCES);
David Howells3e301482005-06-23 22:00:56 -0700356 if (!key_task_permission(keyring, context, KEY_SEARCH))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357 goto error;
358
359 key = ERR_PTR(-ENOTDIR);
360 if (keyring->type != &key_type_keyring)
361 goto error;
362
363 now = current_kernel_time();
364 err = -EAGAIN;
365 sp = 0;
366
367 /* start processing a new keyring */
368 descend:
David Howells76d8aea2005-06-23 22:00:49 -0700369 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 goto not_this_keyring;
371
David Howells76d8aea2005-06-23 22:00:49 -0700372 keylist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373 if (!keylist)
374 goto not_this_keyring;
375
376 /* iterate through the keys in this keyring first */
377 for (kix = 0; kix < keylist->nkeys; kix++) {
378 key = keylist->keys[kix];
379
380 /* ignore keys not of this type */
381 if (key->type != type)
382 continue;
383
384 /* skip revoked keys and expired keys */
David Howells76d8aea2005-06-23 22:00:49 -0700385 if (test_bit(KEY_FLAG_REVOKED, &key->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700386 continue;
387
388 if (key->expiry && now.tv_sec >= key->expiry)
389 continue;
390
391 /* keys that don't match */
392 if (!match(key, description))
393 continue;
394
395 /* key must have search permissions */
David Howells3e301482005-06-23 22:00:56 -0700396 if (!key_task_permission(key, context, KEY_SEARCH))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 continue;
398
399 /* we set a different error code if we find a negative key */
David Howells76d8aea2005-06-23 22:00:49 -0700400 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401 err = -ENOKEY;
402 continue;
403 }
404
405 goto found;
406 }
407
408 /* search through the keyrings nested in this one */
409 kix = 0;
410 ascend:
David Howells76d8aea2005-06-23 22:00:49 -0700411 for (; kix < keylist->nkeys; kix++) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412 key = keylist->keys[kix];
413 if (key->type != &key_type_keyring)
David Howells76d8aea2005-06-23 22:00:49 -0700414 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700415
416 /* recursively search nested keyrings
417 * - only search keyrings for which we have search permission
418 */
419 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
David Howells76d8aea2005-06-23 22:00:49 -0700420 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700421
David Howells3e301482005-06-23 22:00:56 -0700422 if (!key_task_permission(key, context, KEY_SEARCH))
David Howells76d8aea2005-06-23 22:00:49 -0700423 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424
425 /* stack the current position */
David Howells76d8aea2005-06-23 22:00:49 -0700426 stack[sp].keylist = keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700427 stack[sp].kix = kix;
428 sp++;
429
430 /* begin again with the new keyring */
431 keyring = key;
432 goto descend;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700433 }
434
435 /* the keyring we're looking at was disqualified or didn't contain a
436 * matching key */
437 not_this_keyring:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700438 if (sp > 0) {
439 /* resume the processing of a keyring higher up in the tree */
440 sp--;
David Howells76d8aea2005-06-23 22:00:49 -0700441 keylist = stack[sp].keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442 kix = stack[sp].kix + 1;
443 goto ascend;
444 }
445
446 key = ERR_PTR(err);
447 goto error;
448
449 /* we found a viable match */
450 found:
451 atomic_inc(&key->usage);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700452 key_check(key);
453 error:
David Howells76d8aea2005-06-23 22:00:49 -0700454 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700455 return key;
456
457} /* end keyring_search_aux() */
458
459/*****************************************************************************/
460/*
461 * search the supplied keyring tree for a key that matches the criterion
462 * - perform a breadth-then-depth search up to the prescribed limit
463 * - we only find keys on which we have search permission
464 * - we readlock the keyrings as we search down the tree
465 * - we return -EAGAIN if we didn't find any matching key
466 * - we return -ENOKEY if we only found negative matching keys
467 */
468struct key *keyring_search(struct key *keyring,
469 struct key_type *type,
470 const char *description)
471{
David Howells3e301482005-06-23 22:00:56 -0700472 if (!type->match)
473 return ERR_PTR(-ENOKEY);
474
475 return keyring_search_aux(keyring, current,
476 type, description, type->match);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477
478} /* end keyring_search() */
479
480EXPORT_SYMBOL(keyring_search);
481
482/*****************************************************************************/
483/*
484 * search the given keyring only (no recursion)
485 * - keyring must be locked by caller
486 */
487struct key *__keyring_search_one(struct key *keyring,
488 const struct key_type *ktype,
489 const char *description,
490 key_perm_t perm)
491{
492 struct keyring_list *klist;
493 struct key *key;
494 int loop;
495
David Howells76d8aea2005-06-23 22:00:49 -0700496 rcu_read_lock();
497
498 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700499 if (klist) {
500 for (loop = 0; loop < klist->nkeys; loop++) {
501 key = klist->keys[loop];
502
503 if (key->type == ktype &&
David Howells3e301482005-06-23 22:00:56 -0700504 (!key->type->match ||
505 key->type->match(key, description)) &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700506 key_permission(key, perm) &&
David Howells76d8aea2005-06-23 22:00:49 -0700507 !test_bit(KEY_FLAG_REVOKED, &key->flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700508 )
509 goto found;
510 }
511 }
512
513 key = ERR_PTR(-ENOKEY);
514 goto error;
515
516 found:
517 atomic_inc(&key->usage);
518 error:
David Howells76d8aea2005-06-23 22:00:49 -0700519 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700520 return key;
521
522} /* end __keyring_search_one() */
523
524/*****************************************************************************/
525/*
David Howells3e301482005-06-23 22:00:56 -0700526 * search for an instantiation authorisation key matching a target key
527 * - the RCU read lock must be held by the caller
528 * - a target_id of zero specifies any valid token
529 */
530struct key *keyring_search_instkey(struct key *keyring,
531 key_serial_t target_id)
532{
533 struct request_key_auth *rka;
534 struct keyring_list *klist;
535 struct key *instkey;
536 int loop;
537
538 klist = rcu_dereference(keyring->payload.subscriptions);
539 if (klist) {
540 for (loop = 0; loop < klist->nkeys; loop++) {
541 instkey = klist->keys[loop];
542
543 if (instkey->type != &key_type_request_key_auth)
544 continue;
545
546 rka = instkey->payload.data;
547 if (target_id && rka->target_key->serial != target_id)
548 continue;
549
550 /* the auth key is revoked during instantiation */
551 if (!test_bit(KEY_FLAG_REVOKED, &instkey->flags))
552 goto found;
553
554 instkey = ERR_PTR(-EKEYREVOKED);
555 goto error;
556 }
557 }
558
559 instkey = ERR_PTR(-EACCES);
560 goto error;
561
562found:
563 atomic_inc(&instkey->usage);
564error:
565 return instkey;
566
567} /* end keyring_search_instkey() */
568
569/*****************************************************************************/
570/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571 * find a keyring with the specified name
572 * - all named keyrings are searched
573 * - only find keyrings with search permission for the process
574 * - only find keyrings with a serial number greater than the one specified
575 */
576struct key *find_keyring_by_name(const char *name, key_serial_t bound)
577{
578 struct key *keyring;
579 int bucket;
580
581 keyring = ERR_PTR(-EINVAL);
582 if (!name)
583 goto error;
584
585 bucket = keyring_hash(name);
586
587 read_lock(&keyring_name_lock);
588
589 if (keyring_name_hash[bucket].next) {
590 /* search this hash bucket for a keyring with a matching name
591 * that's readable and that hasn't been revoked */
592 list_for_each_entry(keyring,
593 &keyring_name_hash[bucket],
594 type_data.link
595 ) {
David Howells76d8aea2005-06-23 22:00:49 -0700596 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700597 continue;
598
599 if (strcmp(keyring->description, name) != 0)
600 continue;
601
602 if (!key_permission(keyring, KEY_SEARCH))
603 continue;
604
605 /* found a potential candidate, but we still need to
606 * check the serial number */
607 if (keyring->serial <= bound)
608 continue;
609
610 /* we've got a match */
611 atomic_inc(&keyring->usage);
612 read_unlock(&keyring_name_lock);
613 goto error;
614 }
615 }
616
617 read_unlock(&keyring_name_lock);
618 keyring = ERR_PTR(-ENOKEY);
619
620 error:
621 return keyring;
622
623} /* end find_keyring_by_name() */
624
625/*****************************************************************************/
626/*
627 * see if a cycle will will be created by inserting acyclic tree B in acyclic
628 * tree A at the topmost level (ie: as a direct child of A)
629 * - since we are adding B to A at the top level, checking for cycles should
630 * just be a matter of seeing if node A is somewhere in tree B
631 */
632static int keyring_detect_cycle(struct key *A, struct key *B)
633{
634 struct {
David Howells76d8aea2005-06-23 22:00:49 -0700635 struct keyring_list *keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700636 int kix;
637 } stack[KEYRING_SEARCH_MAX_DEPTH];
638
639 struct keyring_list *keylist;
640 struct key *subtree, *key;
641 int sp, kix, ret;
642
David Howells76d8aea2005-06-23 22:00:49 -0700643 rcu_read_lock();
644
Linus Torvalds1da177e2005-04-16 15:20:36 -0700645 ret = -EDEADLK;
646 if (A == B)
David Howells76d8aea2005-06-23 22:00:49 -0700647 goto cycle_detected;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700648
649 subtree = B;
650 sp = 0;
651
652 /* start processing a new keyring */
653 descend:
David Howells76d8aea2005-06-23 22:00:49 -0700654 if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700655 goto not_this_keyring;
656
David Howells76d8aea2005-06-23 22:00:49 -0700657 keylist = rcu_dereference(subtree->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700658 if (!keylist)
659 goto not_this_keyring;
660 kix = 0;
661
662 ascend:
663 /* iterate through the remaining keys in this keyring */
664 for (; kix < keylist->nkeys; kix++) {
665 key = keylist->keys[kix];
666
667 if (key == A)
668 goto cycle_detected;
669
670 /* recursively check nested keyrings */
671 if (key->type == &key_type_keyring) {
672 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
673 goto too_deep;
674
675 /* stack the current position */
David Howells76d8aea2005-06-23 22:00:49 -0700676 stack[sp].keylist = keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700677 stack[sp].kix = kix;
678 sp++;
679
680 /* begin again with the new keyring */
681 subtree = key;
682 goto descend;
683 }
684 }
685
686 /* the keyring we're looking at was disqualified or didn't contain a
687 * matching key */
688 not_this_keyring:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700689 if (sp > 0) {
690 /* resume the checking of a keyring higher up in the tree */
691 sp--;
David Howells76d8aea2005-06-23 22:00:49 -0700692 keylist = stack[sp].keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700693 kix = stack[sp].kix + 1;
694 goto ascend;
695 }
696
697 ret = 0; /* no cycles detected */
698
699 error:
David Howells76d8aea2005-06-23 22:00:49 -0700700 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700701 return ret;
702
703 too_deep:
704 ret = -ELOOP;
David Howells76d8aea2005-06-23 22:00:49 -0700705 goto error;
706
Linus Torvalds1da177e2005-04-16 15:20:36 -0700707 cycle_detected:
708 ret = -EDEADLK;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700709 goto error;
710
711} /* end keyring_detect_cycle() */
712
713/*****************************************************************************/
714/*
David Howells76d8aea2005-06-23 22:00:49 -0700715 * dispose of a keyring list after the RCU grace period
716 */
717static void keyring_link_rcu_disposal(struct rcu_head *rcu)
718{
719 struct keyring_list *klist =
720 container_of(rcu, struct keyring_list, rcu);
721
722 kfree(klist);
723
724} /* end keyring_link_rcu_disposal() */
725
726/*****************************************************************************/
727/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700728 * link a key into to a keyring
David Howells76d8aea2005-06-23 22:00:49 -0700729 * - must be called with the keyring's semaphore write-locked
Linus Torvalds1da177e2005-04-16 15:20:36 -0700730 */
731int __key_link(struct key *keyring, struct key *key)
732{
733 struct keyring_list *klist, *nklist;
734 unsigned max;
735 size_t size;
736 int ret;
737
738 ret = -EKEYREVOKED;
David Howells76d8aea2005-06-23 22:00:49 -0700739 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700740 goto error;
741
742 ret = -ENOTDIR;
743 if (keyring->type != &key_type_keyring)
744 goto error;
745
746 /* serialise link/link calls to prevent parallel calls causing a
747 * cycle when applied to two keyring in opposite orders */
748 down_write(&keyring_serialise_link_sem);
749
750 /* check that we aren't going to create a cycle adding one keyring to
751 * another */
752 if (key->type == &key_type_keyring) {
753 ret = keyring_detect_cycle(keyring, key);
754 if (ret < 0)
755 goto error2;
756 }
757
758 /* check that we aren't going to overrun the user's quota */
759 ret = key_payload_reserve(keyring,
760 keyring->datalen + KEYQUOTA_LINK_BYTES);
761 if (ret < 0)
762 goto error2;
763
764 klist = keyring->payload.subscriptions;
765
766 if (klist && klist->nkeys < klist->maxkeys) {
767 /* there's sufficient slack space to add directly */
768 atomic_inc(&key->usage);
769
David Howells76d8aea2005-06-23 22:00:49 -0700770 klist->keys[klist->nkeys] = key;
771 smp_wmb();
772 klist->nkeys++;
773 smp_wmb();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700774
775 ret = 0;
776 }
777 else {
778 /* grow the key list */
779 max = 4;
780 if (klist)
781 max += klist->maxkeys;
782
783 ret = -ENFILE;
David Howells76d8aea2005-06-23 22:00:49 -0700784 if (max > 65535)
785 goto error3;
David Howellsa4014d82005-07-07 17:57:03 -0700786 size = sizeof(*klist) + sizeof(struct key *) * max;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700787 if (size > PAGE_SIZE)
788 goto error3;
789
790 ret = -ENOMEM;
791 nklist = kmalloc(size, GFP_KERNEL);
792 if (!nklist)
793 goto error3;
794 nklist->maxkeys = max;
795 nklist->nkeys = 0;
796
797 if (klist) {
798 nklist->nkeys = klist->nkeys;
799 memcpy(nklist->keys,
800 klist->keys,
801 sizeof(struct key *) * klist->nkeys);
802 }
803
804 /* add the key into the new space */
805 atomic_inc(&key->usage);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700806 nklist->keys[nklist->nkeys++] = key;
David Howells76d8aea2005-06-23 22:00:49 -0700807
808 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700809
810 /* dispose of the old keyring list */
David Howells76d8aea2005-06-23 22:00:49 -0700811 if (klist)
812 call_rcu(&klist->rcu, keyring_link_rcu_disposal);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700813
814 ret = 0;
815 }
816
817 error2:
818 up_write(&keyring_serialise_link_sem);
819 error:
820 return ret;
821
822 error3:
823 /* undo the quota changes */
824 key_payload_reserve(keyring,
825 keyring->datalen - KEYQUOTA_LINK_BYTES);
826 goto error2;
827
828} /* end __key_link() */
829
830/*****************************************************************************/
831/*
832 * link a key to a keyring
833 */
834int key_link(struct key *keyring, struct key *key)
835{
836 int ret;
837
838 key_check(keyring);
839 key_check(key);
840
841 down_write(&keyring->sem);
842 ret = __key_link(keyring, key);
843 up_write(&keyring->sem);
844
845 return ret;
846
847} /* end key_link() */
848
849EXPORT_SYMBOL(key_link);
850
851/*****************************************************************************/
852/*
David Howells76d8aea2005-06-23 22:00:49 -0700853 * dispose of a keyring list after the RCU grace period, freeing the unlinked
854 * key
855 */
856static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
857{
858 struct keyring_list *klist =
859 container_of(rcu, struct keyring_list, rcu);
860
861 key_put(klist->keys[klist->delkey]);
862 kfree(klist);
863
864} /* end keyring_unlink_rcu_disposal() */
865
866/*****************************************************************************/
867/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700868 * unlink the first link to a key from a keyring
869 */
870int key_unlink(struct key *keyring, struct key *key)
871{
David Howells76d8aea2005-06-23 22:00:49 -0700872 struct keyring_list *klist, *nklist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700873 int loop, ret;
874
875 key_check(keyring);
876 key_check(key);
877
878 ret = -ENOTDIR;
879 if (keyring->type != &key_type_keyring)
880 goto error;
881
882 down_write(&keyring->sem);
883
884 klist = keyring->payload.subscriptions;
885 if (klist) {
886 /* search the keyring for the key */
887 for (loop = 0; loop < klist->nkeys; loop++)
888 if (klist->keys[loop] == key)
889 goto key_is_present;
890 }
891
892 up_write(&keyring->sem);
893 ret = -ENOENT;
894 goto error;
895
David Howells76d8aea2005-06-23 22:00:49 -0700896key_is_present:
897 /* we need to copy the key list for RCU purposes */
David Howellsa4014d82005-07-07 17:57:03 -0700898 nklist = kmalloc(sizeof(*klist) +
899 sizeof(struct key *) * klist->maxkeys,
David Howells76d8aea2005-06-23 22:00:49 -0700900 GFP_KERNEL);
901 if (!nklist)
902 goto nomem;
903 nklist->maxkeys = klist->maxkeys;
904 nklist->nkeys = klist->nkeys - 1;
905
906 if (loop > 0)
907 memcpy(&nklist->keys[0],
908 &klist->keys[0],
David Howellsa4014d82005-07-07 17:57:03 -0700909 loop * sizeof(struct key *));
David Howells76d8aea2005-06-23 22:00:49 -0700910
911 if (loop < nklist->nkeys)
912 memcpy(&nklist->keys[loop],
913 &klist->keys[loop + 1],
David Howellsa4014d82005-07-07 17:57:03 -0700914 (nklist->nkeys - loop) * sizeof(struct key *));
David Howells76d8aea2005-06-23 22:00:49 -0700915
Linus Torvalds1da177e2005-04-16 15:20:36 -0700916 /* adjust the user's quota */
917 key_payload_reserve(keyring,
918 keyring->datalen - KEYQUOTA_LINK_BYTES);
919
David Howells76d8aea2005-06-23 22:00:49 -0700920 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700921
922 up_write(&keyring->sem);
David Howells76d8aea2005-06-23 22:00:49 -0700923
924 /* schedule for later cleanup */
925 klist->delkey = loop;
926 call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
927
Linus Torvalds1da177e2005-04-16 15:20:36 -0700928 ret = 0;
929
David Howells76d8aea2005-06-23 22:00:49 -0700930error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700931 return ret;
David Howells76d8aea2005-06-23 22:00:49 -0700932nomem:
933 ret = -ENOMEM;
934 up_write(&keyring->sem);
935 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700936
937} /* end key_unlink() */
938
939EXPORT_SYMBOL(key_unlink);
940
941/*****************************************************************************/
942/*
David Howells76d8aea2005-06-23 22:00:49 -0700943 * dispose of a keyring list after the RCU grace period, releasing the keys it
944 * links to
945 */
946static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
947{
948 struct keyring_list *klist;
949 int loop;
950
951 klist = container_of(rcu, struct keyring_list, rcu);
952
953 for (loop = klist->nkeys - 1; loop >= 0; loop--)
954 key_put(klist->keys[loop]);
955
956 kfree(klist);
957
958} /* end keyring_clear_rcu_disposal() */
959
960/*****************************************************************************/
961/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700962 * clear the specified process keyring
963 * - implements keyctl(KEYCTL_CLEAR)
964 */
965int keyring_clear(struct key *keyring)
966{
967 struct keyring_list *klist;
David Howells76d8aea2005-06-23 22:00:49 -0700968 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700969
970 ret = -ENOTDIR;
971 if (keyring->type == &key_type_keyring) {
972 /* detach the pointer block with the locks held */
973 down_write(&keyring->sem);
974
975 klist = keyring->payload.subscriptions;
976 if (klist) {
977 /* adjust the quota */
978 key_payload_reserve(keyring,
979 sizeof(struct keyring_list));
980
David Howells76d8aea2005-06-23 22:00:49 -0700981 rcu_assign_pointer(keyring->payload.subscriptions,
982 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700983 }
984
985 up_write(&keyring->sem);
986
987 /* free the keys after the locks have been dropped */
David Howells76d8aea2005-06-23 22:00:49 -0700988 if (klist)
989 call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700990
991 ret = 0;
992 }
993
994 return ret;
995
996} /* end keyring_clear() */
997
998EXPORT_SYMBOL(keyring_clear);