blob: 1357207fc9df8d55c783704d4e8f0a79c0465b32 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* keyring.c: keyring handling
2 *
David Howells3e301482005-06-23 22:00:56 -07003 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
David Howells29db9192005-10-30 15:02:44 -080016#include <linux/security.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017#include <linux/seq_file.h>
18#include <linux/err.h>
19#include <asm/uaccess.h>
20#include "internal.h"
21
22/*
23 * when plumbing the depths of the key tree, this sets a hard limit set on how
24 * deep we're willing to go
25 */
26#define KEYRING_SEARCH_MAX_DEPTH 6
27
28/*
29 * we keep all named keyrings in a hash to speed looking them up
30 */
31#define KEYRING_NAME_HASH_SIZE (1 << 5)
32
33static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
34static DEFINE_RWLOCK(keyring_name_lock);
35
36static inline unsigned keyring_hash(const char *desc)
37{
38 unsigned bucket = 0;
39
40 for (; *desc; desc++)
41 bucket += (unsigned char) *desc;
42
43 return bucket & (KEYRING_NAME_HASH_SIZE - 1);
44}
45
46/*
47 * the keyring type definition
48 */
49static int keyring_instantiate(struct key *keyring,
50 const void *data, size_t datalen);
Linus Torvalds1da177e2005-04-16 15:20:36 -070051static int keyring_match(const struct key *keyring, const void *criterion);
52static void keyring_destroy(struct key *keyring);
53static void keyring_describe(const struct key *keyring, struct seq_file *m);
54static long keyring_read(const struct key *keyring,
55 char __user *buffer, size_t buflen);
56
57struct key_type key_type_keyring = {
58 .name = "keyring",
59 .def_datalen = sizeof(struct keyring_list),
60 .instantiate = keyring_instantiate,
Linus Torvalds1da177e2005-04-16 15:20:36 -070061 .match = keyring_match,
62 .destroy = keyring_destroy,
63 .describe = keyring_describe,
64 .read = keyring_read,
65};
66
67/*
68 * semaphore to serialise link/link calls to prevent two link calls in parallel
69 * introducing a cycle
70 */
Adrian Bunk1ae8f402006-01-06 00:11:25 -080071static DECLARE_RWSEM(keyring_serialise_link_sem);
Linus Torvalds1da177e2005-04-16 15:20:36 -070072
73/*****************************************************************************/
74/*
75 * publish the name of a keyring so that it can be found by name (if it has
76 * one)
77 */
78void keyring_publish_name(struct key *keyring)
79{
80 int bucket;
81
82 if (keyring->description) {
83 bucket = keyring_hash(keyring->description);
84
85 write_lock(&keyring_name_lock);
86
87 if (!keyring_name_hash[bucket].next)
88 INIT_LIST_HEAD(&keyring_name_hash[bucket]);
89
90 list_add_tail(&keyring->type_data.link,
91 &keyring_name_hash[bucket]);
92
93 write_unlock(&keyring_name_lock);
94 }
95
96} /* end keyring_publish_name() */
97
98/*****************************************************************************/
99/*
100 * initialise a keyring
101 * - we object if we were given any data
102 */
103static int keyring_instantiate(struct key *keyring,
104 const void *data, size_t datalen)
105{
106 int ret;
107
108 ret = -EINVAL;
109 if (datalen == 0) {
110 /* make the keyring available by name if it has one */
111 keyring_publish_name(keyring);
112 ret = 0;
113 }
114
115 return ret;
116
117} /* end keyring_instantiate() */
118
119/*****************************************************************************/
120/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121 * match keyrings on their name
122 */
123static int keyring_match(const struct key *keyring, const void *description)
124{
125 return keyring->description &&
126 strcmp(keyring->description, description) == 0;
127
128} /* end keyring_match() */
129
130/*****************************************************************************/
131/*
132 * dispose of the data dangling from the corpse of a keyring
133 */
134static void keyring_destroy(struct key *keyring)
135{
136 struct keyring_list *klist;
137 int loop;
138
139 if (keyring->description) {
140 write_lock(&keyring_name_lock);
David Howells94efe722005-08-04 13:07:07 -0700141
142 if (keyring->type_data.link.next != NULL &&
143 !list_empty(&keyring->type_data.link))
144 list_del(&keyring->type_data.link);
145
Linus Torvalds1da177e2005-04-16 15:20:36 -0700146 write_unlock(&keyring_name_lock);
147 }
148
David Howells76d8aea2005-06-23 22:00:49 -0700149 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700150 if (klist) {
151 for (loop = klist->nkeys - 1; loop >= 0; loop--)
152 key_put(klist->keys[loop]);
153 kfree(klist);
154 }
155
156} /* end keyring_destroy() */
157
158/*****************************************************************************/
159/*
160 * describe the keyring
161 */
162static void keyring_describe(const struct key *keyring, struct seq_file *m)
163{
164 struct keyring_list *klist;
165
166 if (keyring->description) {
167 seq_puts(m, keyring->description);
168 }
169 else {
170 seq_puts(m, "[anon]");
171 }
172
David Howells76d8aea2005-06-23 22:00:49 -0700173 rcu_read_lock();
174 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700175 if (klist)
176 seq_printf(m, ": %u/%u", klist->nkeys, klist->maxkeys);
177 else
178 seq_puts(m, ": empty");
David Howells76d8aea2005-06-23 22:00:49 -0700179 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180
181} /* end keyring_describe() */
182
183/*****************************************************************************/
184/*
185 * read a list of key IDs from the keyring's contents
David Howells76d8aea2005-06-23 22:00:49 -0700186 * - the keyring's semaphore is read-locked
Linus Torvalds1da177e2005-04-16 15:20:36 -0700187 */
188static long keyring_read(const struct key *keyring,
189 char __user *buffer, size_t buflen)
190{
191 struct keyring_list *klist;
192 struct key *key;
193 size_t qty, tmp;
194 int loop, ret;
195
196 ret = 0;
David Howells76d8aea2005-06-23 22:00:49 -0700197 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700198
199 if (klist) {
200 /* calculate how much data we could return */
201 qty = klist->nkeys * sizeof(key_serial_t);
202
203 if (buffer && buflen > 0) {
204 if (buflen > qty)
205 buflen = qty;
206
207 /* copy the IDs of the subscribed keys into the
208 * buffer */
209 ret = -EFAULT;
210
211 for (loop = 0; loop < klist->nkeys; loop++) {
212 key = klist->keys[loop];
213
214 tmp = sizeof(key_serial_t);
215 if (tmp > buflen)
216 tmp = buflen;
217
218 if (copy_to_user(buffer,
219 &key->serial,
220 tmp) != 0)
221 goto error;
222
223 buflen -= tmp;
224 if (buflen == 0)
225 break;
226 buffer += tmp;
227 }
228 }
229
230 ret = qty;
231 }
232
233 error:
234 return ret;
235
236} /* end keyring_read() */
237
238/*****************************************************************************/
239/*
240 * allocate a keyring and link into the destination keyring
241 */
242struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
Michael LeMayd7200242006-06-22 14:47:17 -0700243 struct task_struct *ctx, int not_in_quota,
244 struct key *dest)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245{
246 struct key *keyring;
247 int ret;
248
249 keyring = key_alloc(&key_type_keyring, description,
Michael LeMayd7200242006-06-22 14:47:17 -0700250 uid, gid, ctx,
David Howells29db9192005-10-30 15:02:44 -0800251 (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
252 not_in_quota);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253
254 if (!IS_ERR(keyring)) {
David Howells3e301482005-06-23 22:00:56 -0700255 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 if (ret < 0) {
257 key_put(keyring);
258 keyring = ERR_PTR(ret);
259 }
260 }
261
262 return keyring;
263
264} /* end keyring_alloc() */
265
266/*****************************************************************************/
267/*
268 * search the supplied keyring tree for a key that matches the criterion
269 * - perform a breadth-then-depth search up to the prescribed limit
270 * - we only find keys on which we have search permission
271 * - we use the supplied match function to see if the description (or other
272 * feature of interest) matches
David Howells3e301482005-06-23 22:00:56 -0700273 * - we rely on RCU to prevent the keyring lists from disappearing on us
Linus Torvalds1da177e2005-04-16 15:20:36 -0700274 * - we return -EAGAIN if we didn't find any matching key
275 * - we return -ENOKEY if we only found negative matching keys
David Howells664cceb2005-09-28 17:03:15 +0100276 * - we propagate the possession attribute from the keyring ref to the key ref
Linus Torvalds1da177e2005-04-16 15:20:36 -0700277 */
David Howells664cceb2005-09-28 17:03:15 +0100278key_ref_t keyring_search_aux(key_ref_t keyring_ref,
279 struct task_struct *context,
280 struct key_type *type,
281 const void *description,
282 key_match_func_t match)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283{
284 struct {
David Howells76d8aea2005-06-23 22:00:49 -0700285 struct keyring_list *keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700286 int kix;
287 } stack[KEYRING_SEARCH_MAX_DEPTH];
288
289 struct keyring_list *keylist;
290 struct timespec now;
David Howells664cceb2005-09-28 17:03:15 +0100291 unsigned long possessed;
292 struct key *keyring, *key;
293 key_ref_t key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700294 long err;
David Howells76d8aea2005-06-23 22:00:49 -0700295 int sp, kix;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700296
David Howells664cceb2005-09-28 17:03:15 +0100297 keyring = key_ref_to_ptr(keyring_ref);
298 possessed = is_key_possessed(keyring_ref);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700299 key_check(keyring);
300
301 /* top keyring must have search permission to begin the search */
David Howells29db9192005-10-30 15:02:44 -0800302 err = key_task_permission(keyring_ref, context, KEY_SEARCH);
303 if (err < 0) {
304 key_ref = ERR_PTR(err);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700305 goto error;
David Howells29db9192005-10-30 15:02:44 -0800306 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700307
David Howells664cceb2005-09-28 17:03:15 +0100308 key_ref = ERR_PTR(-ENOTDIR);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700309 if (keyring->type != &key_type_keyring)
310 goto error;
311
David Howells664cceb2005-09-28 17:03:15 +0100312 rcu_read_lock();
313
Linus Torvalds1da177e2005-04-16 15:20:36 -0700314 now = current_kernel_time();
315 err = -EAGAIN;
316 sp = 0;
317
318 /* start processing a new keyring */
David Howells664cceb2005-09-28 17:03:15 +0100319descend:
David Howells76d8aea2005-06-23 22:00:49 -0700320 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700321 goto not_this_keyring;
322
David Howells76d8aea2005-06-23 22:00:49 -0700323 keylist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324 if (!keylist)
325 goto not_this_keyring;
326
327 /* iterate through the keys in this keyring first */
328 for (kix = 0; kix < keylist->nkeys; kix++) {
329 key = keylist->keys[kix];
330
331 /* ignore keys not of this type */
332 if (key->type != type)
333 continue;
334
335 /* skip revoked keys and expired keys */
David Howells76d8aea2005-06-23 22:00:49 -0700336 if (test_bit(KEY_FLAG_REVOKED, &key->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700337 continue;
338
339 if (key->expiry && now.tv_sec >= key->expiry)
340 continue;
341
342 /* keys that don't match */
343 if (!match(key, description))
344 continue;
345
346 /* key must have search permissions */
David Howells29db9192005-10-30 15:02:44 -0800347 if (key_task_permission(make_key_ref(key, possessed),
348 context, KEY_SEARCH) < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349 continue;
350
351 /* we set a different error code if we find a negative key */
David Howells76d8aea2005-06-23 22:00:49 -0700352 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 err = -ENOKEY;
354 continue;
355 }
356
357 goto found;
358 }
359
360 /* search through the keyrings nested in this one */
361 kix = 0;
David Howells664cceb2005-09-28 17:03:15 +0100362ascend:
David Howells76d8aea2005-06-23 22:00:49 -0700363 for (; kix < keylist->nkeys; kix++) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364 key = keylist->keys[kix];
365 if (key->type != &key_type_keyring)
David Howells76d8aea2005-06-23 22:00:49 -0700366 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700367
368 /* recursively search nested keyrings
369 * - only search keyrings for which we have search permission
370 */
371 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
David Howells76d8aea2005-06-23 22:00:49 -0700372 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
David Howells0f6ed7c2005-11-07 00:59:30 -0800374 if (key_task_permission(make_key_ref(key, possessed),
375 context, KEY_SEARCH) < 0)
David Howells76d8aea2005-06-23 22:00:49 -0700376 continue;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377
378 /* stack the current position */
David Howells76d8aea2005-06-23 22:00:49 -0700379 stack[sp].keylist = keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380 stack[sp].kix = kix;
381 sp++;
382
383 /* begin again with the new keyring */
384 keyring = key;
385 goto descend;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700386 }
387
388 /* the keyring we're looking at was disqualified or didn't contain a
389 * matching key */
David Howells664cceb2005-09-28 17:03:15 +0100390not_this_keyring:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700391 if (sp > 0) {
392 /* resume the processing of a keyring higher up in the tree */
393 sp--;
David Howells76d8aea2005-06-23 22:00:49 -0700394 keylist = stack[sp].keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700395 kix = stack[sp].kix + 1;
396 goto ascend;
397 }
398
David Howells664cceb2005-09-28 17:03:15 +0100399 key_ref = ERR_PTR(err);
400 goto error_2;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401
402 /* we found a viable match */
David Howells664cceb2005-09-28 17:03:15 +0100403found:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 atomic_inc(&key->usage);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 key_check(key);
David Howells664cceb2005-09-28 17:03:15 +0100406 key_ref = make_key_ref(key, possessed);
407error_2:
David Howells76d8aea2005-06-23 22:00:49 -0700408 rcu_read_unlock();
David Howells664cceb2005-09-28 17:03:15 +0100409error:
410 return key_ref;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700411
412} /* end keyring_search_aux() */
413
414/*****************************************************************************/
415/*
416 * search the supplied keyring tree for a key that matches the criterion
417 * - perform a breadth-then-depth search up to the prescribed limit
418 * - we only find keys on which we have search permission
419 * - we readlock the keyrings as we search down the tree
420 * - we return -EAGAIN if we didn't find any matching key
421 * - we return -ENOKEY if we only found negative matching keys
422 */
David Howells664cceb2005-09-28 17:03:15 +0100423key_ref_t keyring_search(key_ref_t keyring,
424 struct key_type *type,
425 const char *description)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700426{
David Howells3e301482005-06-23 22:00:56 -0700427 if (!type->match)
428 return ERR_PTR(-ENOKEY);
429
430 return keyring_search_aux(keyring, current,
431 type, description, type->match);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432
433} /* end keyring_search() */
434
435EXPORT_SYMBOL(keyring_search);
436
437/*****************************************************************************/
438/*
439 * search the given keyring only (no recursion)
440 * - keyring must be locked by caller
David Howellsc3a9d652006-04-10 15:15:21 +0100441 * - caller must guarantee that the keyring is a keyring
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442 */
David Howells664cceb2005-09-28 17:03:15 +0100443key_ref_t __keyring_search_one(key_ref_t keyring_ref,
444 const struct key_type *ktype,
445 const char *description,
446 key_perm_t perm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700447{
448 struct keyring_list *klist;
David Howells664cceb2005-09-28 17:03:15 +0100449 unsigned long possessed;
450 struct key *keyring, *key;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700451 int loop;
452
David Howells664cceb2005-09-28 17:03:15 +0100453 keyring = key_ref_to_ptr(keyring_ref);
454 possessed = is_key_possessed(keyring_ref);
455
David Howells76d8aea2005-06-23 22:00:49 -0700456 rcu_read_lock();
457
458 klist = rcu_dereference(keyring->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700459 if (klist) {
460 for (loop = 0; loop < klist->nkeys; loop++) {
461 key = klist->keys[loop];
462
463 if (key->type == ktype &&
David Howells3e301482005-06-23 22:00:56 -0700464 (!key->type->match ||
465 key->type->match(key, description)) &&
David Howells664cceb2005-09-28 17:03:15 +0100466 key_permission(make_key_ref(key, possessed),
David Howellsdb1d1d52005-12-01 00:51:18 -0800467 perm) == 0 &&
David Howells76d8aea2005-06-23 22:00:49 -0700468 !test_bit(KEY_FLAG_REVOKED, &key->flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700469 )
470 goto found;
471 }
472 }
473
David Howells664cceb2005-09-28 17:03:15 +0100474 rcu_read_unlock();
475 return ERR_PTR(-ENOKEY);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700476
477 found:
478 atomic_inc(&key->usage);
David Howells76d8aea2005-06-23 22:00:49 -0700479 rcu_read_unlock();
David Howells664cceb2005-09-28 17:03:15 +0100480 return make_key_ref(key, possessed);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700481
482} /* end __keyring_search_one() */
483
484/*****************************************************************************/
485/*
486 * find a keyring with the specified name
487 * - all named keyrings are searched
488 * - only find keyrings with search permission for the process
489 * - only find keyrings with a serial number greater than the one specified
490 */
491struct key *find_keyring_by_name(const char *name, key_serial_t bound)
492{
493 struct key *keyring;
494 int bucket;
495
496 keyring = ERR_PTR(-EINVAL);
497 if (!name)
498 goto error;
499
500 bucket = keyring_hash(name);
501
502 read_lock(&keyring_name_lock);
503
504 if (keyring_name_hash[bucket].next) {
505 /* search this hash bucket for a keyring with a matching name
506 * that's readable and that hasn't been revoked */
507 list_for_each_entry(keyring,
508 &keyring_name_hash[bucket],
509 type_data.link
510 ) {
David Howells76d8aea2005-06-23 22:00:49 -0700511 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700512 continue;
513
514 if (strcmp(keyring->description, name) != 0)
515 continue;
516
David Howells0f6ed7c2005-11-07 00:59:30 -0800517 if (key_permission(make_key_ref(keyring, 0),
518 KEY_SEARCH) < 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700519 continue;
520
521 /* found a potential candidate, but we still need to
522 * check the serial number */
523 if (keyring->serial <= bound)
524 continue;
525
526 /* we've got a match */
527 atomic_inc(&keyring->usage);
528 read_unlock(&keyring_name_lock);
529 goto error;
530 }
531 }
532
533 read_unlock(&keyring_name_lock);
534 keyring = ERR_PTR(-ENOKEY);
535
536 error:
537 return keyring;
538
539} /* end find_keyring_by_name() */
540
541/*****************************************************************************/
542/*
543 * see if a cycle will will be created by inserting acyclic tree B in acyclic
544 * tree A at the topmost level (ie: as a direct child of A)
545 * - since we are adding B to A at the top level, checking for cycles should
546 * just be a matter of seeing if node A is somewhere in tree B
547 */
548static int keyring_detect_cycle(struct key *A, struct key *B)
549{
550 struct {
David Howells76d8aea2005-06-23 22:00:49 -0700551 struct keyring_list *keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552 int kix;
553 } stack[KEYRING_SEARCH_MAX_DEPTH];
554
555 struct keyring_list *keylist;
556 struct key *subtree, *key;
557 int sp, kix, ret;
558
David Howells76d8aea2005-06-23 22:00:49 -0700559 rcu_read_lock();
560
Linus Torvalds1da177e2005-04-16 15:20:36 -0700561 ret = -EDEADLK;
562 if (A == B)
David Howells76d8aea2005-06-23 22:00:49 -0700563 goto cycle_detected;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564
565 subtree = B;
566 sp = 0;
567
568 /* start processing a new keyring */
569 descend:
David Howells76d8aea2005-06-23 22:00:49 -0700570 if (test_bit(KEY_FLAG_REVOKED, &subtree->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571 goto not_this_keyring;
572
David Howells76d8aea2005-06-23 22:00:49 -0700573 keylist = rcu_dereference(subtree->payload.subscriptions);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700574 if (!keylist)
575 goto not_this_keyring;
576 kix = 0;
577
578 ascend:
579 /* iterate through the remaining keys in this keyring */
580 for (; kix < keylist->nkeys; kix++) {
581 key = keylist->keys[kix];
582
583 if (key == A)
584 goto cycle_detected;
585
586 /* recursively check nested keyrings */
587 if (key->type == &key_type_keyring) {
588 if (sp >= KEYRING_SEARCH_MAX_DEPTH)
589 goto too_deep;
590
591 /* stack the current position */
David Howells76d8aea2005-06-23 22:00:49 -0700592 stack[sp].keylist = keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 stack[sp].kix = kix;
594 sp++;
595
596 /* begin again with the new keyring */
597 subtree = key;
598 goto descend;
599 }
600 }
601
602 /* the keyring we're looking at was disqualified or didn't contain a
603 * matching key */
604 not_this_keyring:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700605 if (sp > 0) {
606 /* resume the checking of a keyring higher up in the tree */
607 sp--;
David Howells76d8aea2005-06-23 22:00:49 -0700608 keylist = stack[sp].keylist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700609 kix = stack[sp].kix + 1;
610 goto ascend;
611 }
612
613 ret = 0; /* no cycles detected */
614
615 error:
David Howells76d8aea2005-06-23 22:00:49 -0700616 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700617 return ret;
618
619 too_deep:
620 ret = -ELOOP;
David Howells76d8aea2005-06-23 22:00:49 -0700621 goto error;
622
Linus Torvalds1da177e2005-04-16 15:20:36 -0700623 cycle_detected:
624 ret = -EDEADLK;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700625 goto error;
626
627} /* end keyring_detect_cycle() */
628
629/*****************************************************************************/
630/*
David Howells76d8aea2005-06-23 22:00:49 -0700631 * dispose of a keyring list after the RCU grace period
632 */
633static void keyring_link_rcu_disposal(struct rcu_head *rcu)
634{
635 struct keyring_list *klist =
636 container_of(rcu, struct keyring_list, rcu);
637
638 kfree(klist);
639
640} /* end keyring_link_rcu_disposal() */
641
642/*****************************************************************************/
643/*
David Howellscab8eb52006-01-08 01:02:45 -0800644 * dispose of a keyring list after the RCU grace period, freeing the unlinked
645 * key
646 */
647static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
648{
649 struct keyring_list *klist =
650 container_of(rcu, struct keyring_list, rcu);
651
652 key_put(klist->keys[klist->delkey]);
653 kfree(klist);
654
655} /* end keyring_unlink_rcu_disposal() */
656
657/*****************************************************************************/
658/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700659 * link a key into to a keyring
David Howells76d8aea2005-06-23 22:00:49 -0700660 * - must be called with the keyring's semaphore write-locked
David Howellscab8eb52006-01-08 01:02:45 -0800661 * - discard already extant link to matching key if there is one
Linus Torvalds1da177e2005-04-16 15:20:36 -0700662 */
663int __key_link(struct key *keyring, struct key *key)
664{
665 struct keyring_list *klist, *nklist;
666 unsigned max;
667 size_t size;
David Howellscab8eb52006-01-08 01:02:45 -0800668 int loop, ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700669
670 ret = -EKEYREVOKED;
David Howells76d8aea2005-06-23 22:00:49 -0700671 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700672 goto error;
673
674 ret = -ENOTDIR;
675 if (keyring->type != &key_type_keyring)
676 goto error;
677
678 /* serialise link/link calls to prevent parallel calls causing a
679 * cycle when applied to two keyring in opposite orders */
680 down_write(&keyring_serialise_link_sem);
681
682 /* check that we aren't going to create a cycle adding one keyring to
683 * another */
684 if (key->type == &key_type_keyring) {
685 ret = keyring_detect_cycle(keyring, key);
686 if (ret < 0)
687 goto error2;
688 }
689
David Howellscab8eb52006-01-08 01:02:45 -0800690 /* see if there's a matching key we can displace */
691 klist = keyring->payload.subscriptions;
692
693 if (klist && klist->nkeys > 0) {
694 struct key_type *type = key->type;
695
696 for (loop = klist->nkeys - 1; loop >= 0; loop--) {
697 if (klist->keys[loop]->type == type &&
698 strcmp(klist->keys[loop]->description,
699 key->description) == 0
700 ) {
701 /* found a match - replace with new key */
702 size = sizeof(struct key *) * klist->maxkeys;
703 size += sizeof(*klist);
704 BUG_ON(size > PAGE_SIZE);
705
706 ret = -ENOMEM;
707 nklist = kmalloc(size, GFP_KERNEL);
708 if (!nklist)
709 goto error2;
710
711 memcpy(nklist, klist, size);
712
713 /* replace matched key */
714 atomic_inc(&key->usage);
715 nklist->keys[loop] = key;
716
717 rcu_assign_pointer(
718 keyring->payload.subscriptions,
719 nklist);
720
721 /* dispose of the old keyring list and the
722 * displaced key */
723 klist->delkey = loop;
724 call_rcu(&klist->rcu,
725 keyring_unlink_rcu_disposal);
726
727 goto done;
728 }
729 }
730 }
731
Linus Torvalds1da177e2005-04-16 15:20:36 -0700732 /* check that we aren't going to overrun the user's quota */
733 ret = key_payload_reserve(keyring,
734 keyring->datalen + KEYQUOTA_LINK_BYTES);
735 if (ret < 0)
736 goto error2;
737
738 klist = keyring->payload.subscriptions;
739
740 if (klist && klist->nkeys < klist->maxkeys) {
741 /* there's sufficient slack space to add directly */
742 atomic_inc(&key->usage);
743
David Howells76d8aea2005-06-23 22:00:49 -0700744 klist->keys[klist->nkeys] = key;
745 smp_wmb();
746 klist->nkeys++;
747 smp_wmb();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700748 }
749 else {
750 /* grow the key list */
751 max = 4;
752 if (klist)
753 max += klist->maxkeys;
754
755 ret = -ENFILE;
David Howells76d8aea2005-06-23 22:00:49 -0700756 if (max > 65535)
757 goto error3;
David Howellsa4014d82005-07-07 17:57:03 -0700758 size = sizeof(*klist) + sizeof(struct key *) * max;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700759 if (size > PAGE_SIZE)
760 goto error3;
761
762 ret = -ENOMEM;
763 nklist = kmalloc(size, GFP_KERNEL);
764 if (!nklist)
765 goto error3;
766 nklist->maxkeys = max;
767 nklist->nkeys = 0;
768
769 if (klist) {
770 nklist->nkeys = klist->nkeys;
771 memcpy(nklist->keys,
772 klist->keys,
773 sizeof(struct key *) * klist->nkeys);
774 }
775
776 /* add the key into the new space */
777 atomic_inc(&key->usage);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700778 nklist->keys[nklist->nkeys++] = key;
David Howells76d8aea2005-06-23 22:00:49 -0700779
780 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700781
782 /* dispose of the old keyring list */
David Howells76d8aea2005-06-23 22:00:49 -0700783 if (klist)
784 call_rcu(&klist->rcu, keyring_link_rcu_disposal);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700785 }
786
David Howellscab8eb52006-01-08 01:02:45 -0800787done:
788 ret = 0;
789error2:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700790 up_write(&keyring_serialise_link_sem);
David Howellscab8eb52006-01-08 01:02:45 -0800791error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700792 return ret;
793
David Howellscab8eb52006-01-08 01:02:45 -0800794error3:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700795 /* undo the quota changes */
796 key_payload_reserve(keyring,
797 keyring->datalen - KEYQUOTA_LINK_BYTES);
798 goto error2;
799
800} /* end __key_link() */
801
802/*****************************************************************************/
803/*
804 * link a key to a keyring
805 */
806int key_link(struct key *keyring, struct key *key)
807{
808 int ret;
809
810 key_check(keyring);
811 key_check(key);
812
813 down_write(&keyring->sem);
814 ret = __key_link(keyring, key);
815 up_write(&keyring->sem);
816
817 return ret;
818
819} /* end key_link() */
820
821EXPORT_SYMBOL(key_link);
822
823/*****************************************************************************/
824/*
825 * unlink the first link to a key from a keyring
826 */
827int key_unlink(struct key *keyring, struct key *key)
828{
David Howells76d8aea2005-06-23 22:00:49 -0700829 struct keyring_list *klist, *nklist;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700830 int loop, ret;
831
832 key_check(keyring);
833 key_check(key);
834
835 ret = -ENOTDIR;
836 if (keyring->type != &key_type_keyring)
837 goto error;
838
839 down_write(&keyring->sem);
840
841 klist = keyring->payload.subscriptions;
842 if (klist) {
843 /* search the keyring for the key */
844 for (loop = 0; loop < klist->nkeys; loop++)
845 if (klist->keys[loop] == key)
846 goto key_is_present;
847 }
848
849 up_write(&keyring->sem);
850 ret = -ENOENT;
851 goto error;
852
David Howells76d8aea2005-06-23 22:00:49 -0700853key_is_present:
854 /* we need to copy the key list for RCU purposes */
David Howellsa4014d82005-07-07 17:57:03 -0700855 nklist = kmalloc(sizeof(*klist) +
856 sizeof(struct key *) * klist->maxkeys,
David Howells76d8aea2005-06-23 22:00:49 -0700857 GFP_KERNEL);
858 if (!nklist)
859 goto nomem;
860 nklist->maxkeys = klist->maxkeys;
861 nklist->nkeys = klist->nkeys - 1;
862
863 if (loop > 0)
864 memcpy(&nklist->keys[0],
865 &klist->keys[0],
David Howellsa4014d82005-07-07 17:57:03 -0700866 loop * sizeof(struct key *));
David Howells76d8aea2005-06-23 22:00:49 -0700867
868 if (loop < nklist->nkeys)
869 memcpy(&nklist->keys[loop],
870 &klist->keys[loop + 1],
David Howellsa4014d82005-07-07 17:57:03 -0700871 (nklist->nkeys - loop) * sizeof(struct key *));
David Howells76d8aea2005-06-23 22:00:49 -0700872
Linus Torvalds1da177e2005-04-16 15:20:36 -0700873 /* adjust the user's quota */
874 key_payload_reserve(keyring,
875 keyring->datalen - KEYQUOTA_LINK_BYTES);
876
David Howells76d8aea2005-06-23 22:00:49 -0700877 rcu_assign_pointer(keyring->payload.subscriptions, nklist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700878
879 up_write(&keyring->sem);
David Howells76d8aea2005-06-23 22:00:49 -0700880
881 /* schedule for later cleanup */
882 klist->delkey = loop;
883 call_rcu(&klist->rcu, keyring_unlink_rcu_disposal);
884
Linus Torvalds1da177e2005-04-16 15:20:36 -0700885 ret = 0;
886
David Howells76d8aea2005-06-23 22:00:49 -0700887error:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700888 return ret;
David Howells76d8aea2005-06-23 22:00:49 -0700889nomem:
890 ret = -ENOMEM;
891 up_write(&keyring->sem);
892 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700893
894} /* end key_unlink() */
895
896EXPORT_SYMBOL(key_unlink);
897
898/*****************************************************************************/
899/*
David Howells76d8aea2005-06-23 22:00:49 -0700900 * dispose of a keyring list after the RCU grace period, releasing the keys it
901 * links to
902 */
903static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
904{
905 struct keyring_list *klist;
906 int loop;
907
908 klist = container_of(rcu, struct keyring_list, rcu);
909
910 for (loop = klist->nkeys - 1; loop >= 0; loop--)
911 key_put(klist->keys[loop]);
912
913 kfree(klist);
914
915} /* end keyring_clear_rcu_disposal() */
916
917/*****************************************************************************/
918/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700919 * clear the specified process keyring
920 * - implements keyctl(KEYCTL_CLEAR)
921 */
922int keyring_clear(struct key *keyring)
923{
924 struct keyring_list *klist;
David Howells76d8aea2005-06-23 22:00:49 -0700925 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700926
927 ret = -ENOTDIR;
928 if (keyring->type == &key_type_keyring) {
929 /* detach the pointer block with the locks held */
930 down_write(&keyring->sem);
931
932 klist = keyring->payload.subscriptions;
933 if (klist) {
934 /* adjust the quota */
935 key_payload_reserve(keyring,
936 sizeof(struct keyring_list));
937
David Howells76d8aea2005-06-23 22:00:49 -0700938 rcu_assign_pointer(keyring->payload.subscriptions,
939 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700940 }
941
942 up_write(&keyring->sem);
943
944 /* free the keys after the locks have been dropped */
David Howells76d8aea2005-06-23 22:00:49 -0700945 if (klist)
946 call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700947
948 ret = 0;
949 }
950
951 return ret;
952
953} /* end keyring_clear() */
954
955EXPORT_SYMBOL(keyring_clear);