David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 1 | /* Authentication token and access key management internal defs |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2 | * |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 3 | * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | * Written by David Howells (dhowells@redhat.com) |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #ifndef _INTERNAL_H |
| 13 | #define _INTERNAL_H |
| 14 | |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 15 | #include <linux/sched.h> |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 16 | #include <linux/key-type.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 18 | #ifdef __KDEBUG |
| 19 | #define kenter(FMT, ...) \ |
Harvey Harrison | dd6f953 | 2008-03-06 10:03:59 +1100 | [diff] [blame] | 20 | printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__) |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 21 | #define kleave(FMT, ...) \ |
Harvey Harrison | dd6f953 | 2008-03-06 10:03:59 +1100 | [diff] [blame] | 22 | printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__) |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 23 | #define kdebug(FMT, ...) \ |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 24 | printk(KERN_DEBUG " "FMT"\n", ##__VA_ARGS__) |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 25 | #else |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 26 | #define kenter(FMT, ...) \ |
Harvey Harrison | dd6f953 | 2008-03-06 10:03:59 +1100 | [diff] [blame] | 27 | no_printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__) |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 28 | #define kleave(FMT, ...) \ |
Harvey Harrison | dd6f953 | 2008-03-06 10:03:59 +1100 | [diff] [blame] | 29 | no_printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__) |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 30 | #define kdebug(FMT, ...) \ |
| 31 | no_printk(KERN_DEBUG FMT"\n", ##__VA_ARGS__) |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 32 | #endif |
| 33 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | extern struct key_type key_type_user; |
| 35 | |
| 36 | /*****************************************************************************/ |
| 37 | /* |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 38 | * Keep track of keys for a user. |
| 39 | * |
| 40 | * This needs to be separate to user_struct to avoid a refcount-loop |
| 41 | * (user_struct pins some keyrings which pin this struct). |
| 42 | * |
| 43 | * We also keep track of keys under request from userspace for this UID here. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 44 | */ |
| 45 | struct key_user { |
| 46 | struct rb_node node; |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 47 | struct mutex cons_lock; /* construction initiation lock */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 48 | spinlock_t lock; |
| 49 | atomic_t usage; /* for accessing qnkeys & qnbytes */ |
| 50 | atomic_t nkeys; /* number of keys */ |
| 51 | atomic_t nikeys; /* number of instantiated keys */ |
| 52 | uid_t uid; |
Serge E. Hallyn | 1d1e975 | 2009-02-26 18:27:38 -0600 | [diff] [blame] | 53 | struct user_namespace *user_ns; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 54 | int qnkeys; /* number of keys allocated to this user */ |
| 55 | int qnbytes; /* number of bytes allocated to this user */ |
| 56 | }; |
| 57 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | extern struct rb_root key_user_tree; |
| 59 | extern spinlock_t key_user_lock; |
| 60 | extern struct key_user root_key_user; |
| 61 | |
Serge E. Hallyn | 1d1e975 | 2009-02-26 18:27:38 -0600 | [diff] [blame] | 62 | extern struct key_user *key_user_lookup(uid_t uid, |
| 63 | struct user_namespace *user_ns); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | extern void key_user_put(struct key_user *user); |
| 65 | |
David Howells | 0b77f5b | 2008-04-29 01:01:32 -0700 | [diff] [blame] | 66 | /* |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 67 | * Key quota limits. |
David Howells | 0b77f5b | 2008-04-29 01:01:32 -0700 | [diff] [blame] | 68 | * - root has its own separate limits to everyone else |
| 69 | */ |
| 70 | extern unsigned key_quota_root_maxkeys; |
| 71 | extern unsigned key_quota_root_maxbytes; |
| 72 | extern unsigned key_quota_maxkeys; |
| 73 | extern unsigned key_quota_maxbytes; |
| 74 | |
| 75 | #define KEYQUOTA_LINK_BYTES 4 /* a link in a keyring is worth 4 bytes */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | |
| 77 | |
| 78 | extern struct rb_root key_serial_tree; |
| 79 | extern spinlock_t key_serial_lock; |
David Howells | 76181c1 | 2007-10-16 23:29:46 -0700 | [diff] [blame] | 80 | extern struct mutex key_construction_mutex; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 81 | extern wait_queue_head_t request_key_conswq; |
| 82 | |
| 83 | |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 84 | extern struct key_type *key_type_lookup(const char *type); |
| 85 | extern void key_type_put(struct key_type *ktype); |
| 86 | |
David Howells | f70e2e0 | 2010-04-30 14:32:39 +0100 | [diff] [blame] | 87 | extern int __key_link_begin(struct key *keyring, |
| 88 | const struct key_type *type, |
| 89 | const char *description, |
David Howells | ceb73c1 | 2011-01-25 16:34:28 +0000 | [diff] [blame] | 90 | unsigned long *_prealloc); |
David Howells | f70e2e0 | 2010-04-30 14:32:39 +0100 | [diff] [blame] | 91 | extern int __key_link_check_live_key(struct key *keyring, struct key *key); |
| 92 | extern void __key_link(struct key *keyring, struct key *key, |
David Howells | ceb73c1 | 2011-01-25 16:34:28 +0000 | [diff] [blame] | 93 | unsigned long *_prealloc); |
David Howells | f70e2e0 | 2010-04-30 14:32:39 +0100 | [diff] [blame] | 94 | extern void __key_link_end(struct key *keyring, |
| 95 | struct key_type *type, |
David Howells | ceb73c1 | 2011-01-25 16:34:28 +0000 | [diff] [blame] | 96 | unsigned long prealloc); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 97 | |
David Howells | 664cceb | 2005-09-28 17:03:15 +0100 | [diff] [blame] | 98 | extern key_ref_t __keyring_search_one(key_ref_t keyring_ref, |
| 99 | const struct key_type *type, |
| 100 | const char *description, |
| 101 | key_perm_t perm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 102 | |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 103 | extern struct key *keyring_search_instkey(struct key *keyring, |
| 104 | key_serial_t target_id); |
| 105 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 106 | typedef int (*key_match_func_t)(const struct key *, const void *); |
| 107 | |
David Howells | 664cceb | 2005-09-28 17:03:15 +0100 | [diff] [blame] | 108 | extern key_ref_t keyring_search_aux(key_ref_t keyring_ref, |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 109 | const struct cred *cred, |
David Howells | 664cceb | 2005-09-28 17:03:15 +0100 | [diff] [blame] | 110 | struct key_type *type, |
| 111 | const void *description, |
| 112 | key_match_func_t match); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | |
David Howells | 927942a | 2010-06-11 17:31:10 +0100 | [diff] [blame] | 114 | extern key_ref_t search_my_process_keyrings(struct key_type *type, |
| 115 | const void *description, |
| 116 | key_match_func_t match, |
| 117 | const struct cred *cred); |
David Howells | 664cceb | 2005-09-28 17:03:15 +0100 | [diff] [blame] | 118 | extern key_ref_t search_process_keyrings(struct key_type *type, |
| 119 | const void *description, |
| 120 | key_match_func_t match, |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 121 | const struct cred *cred); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 122 | |
David Howells | 69664cf | 2008-04-29 01:01:31 -0700 | [diff] [blame] | 123 | extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 124 | |
David Howells | 8bbf4976 | 2008-11-14 10:39:14 +1100 | [diff] [blame] | 125 | extern int install_user_keyrings(void); |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 126 | extern int install_thread_keyring_to_cred(struct cred *); |
| 127 | extern int install_process_keyring_to_cred(struct cred *); |
Oleg Nesterov | 685bfd2 | 2010-05-26 14:43:00 -0700 | [diff] [blame] | 128 | extern int install_session_keyring_to_cred(struct cred *, struct key *); |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 129 | |
| 130 | extern struct key *request_key_and_link(struct key_type *type, |
| 131 | const char *description, |
David Howells | 4a38e12 | 2008-04-29 01:01:24 -0700 | [diff] [blame] | 132 | const void *callout_info, |
| 133 | size_t callout_len, |
David Howells | 4e54f08 | 2006-06-29 02:24:28 -0700 | [diff] [blame] | 134 | void *aux, |
David Howells | 7e047ef | 2006-06-26 00:24:50 -0700 | [diff] [blame] | 135 | struct key *dest_keyring, |
| 136 | unsigned long flags); |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 137 | |
David Howells | 927942a | 2010-06-11 17:31:10 +0100 | [diff] [blame] | 138 | extern int lookup_user_key_possessed(const struct key *key, const void *target); |
David Howells | 5593122 | 2009-09-02 09:13:45 +0100 | [diff] [blame] | 139 | extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 140 | key_perm_t perm); |
David Howells | 5593122 | 2009-09-02 09:13:45 +0100 | [diff] [blame] | 141 | #define KEY_LOOKUP_CREATE 0x01 |
| 142 | #define KEY_LOOKUP_PARTIAL 0x02 |
| 143 | #define KEY_LOOKUP_FOR_UNLINK 0x04 |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 144 | |
| 145 | extern long join_session_keyring(const char *name); |
| 146 | |
David Howells | 5d13544 | 2009-09-02 09:14:00 +0100 | [diff] [blame] | 147 | extern unsigned key_gc_delay; |
| 148 | extern void keyring_gc(struct key *keyring, time_t limit); |
| 149 | extern void key_schedule_gc(time_t expiry_at); |
| 150 | |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 151 | extern int key_task_permission(const key_ref_t key_ref, |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 152 | const struct cred *cred, |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 153 | key_perm_t perm); |
| 154 | |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 155 | /* |
| 156 | * Check to see whether permission is granted to use a key in the desired way. |
| 157 | */ |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 158 | static inline int key_permission(const key_ref_t key_ref, key_perm_t perm) |
| 159 | { |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 160 | return key_task_permission(key_ref, current_cred(), perm); |
David Howells | e9e349b | 2008-11-14 10:39:13 +1100 | [diff] [blame] | 161 | } |
| 162 | |
| 163 | /* required permissions */ |
| 164 | #define KEY_VIEW 0x01 /* require permission to view attributes */ |
| 165 | #define KEY_READ 0x02 /* require permission to read content */ |
| 166 | #define KEY_WRITE 0x04 /* require permission to update / modify */ |
| 167 | #define KEY_SEARCH 0x08 /* require permission to search (keyring) or find (key) */ |
| 168 | #define KEY_LINK 0x10 /* require permission to link */ |
| 169 | #define KEY_SETATTR 0x20 /* require permission to change attributes */ |
| 170 | #define KEY_ALL 0x3f /* all the above permissions */ |
| 171 | |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 172 | /* |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 173 | * Authorisation record for request_key(). |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 174 | */ |
| 175 | struct request_key_auth { |
| 176 | struct key *target_key; |
David Howells | 8bbf4976 | 2008-11-14 10:39:14 +1100 | [diff] [blame] | 177 | struct key *dest_keyring; |
David Howells | d84f4f9 | 2008-11-14 10:39:23 +1100 | [diff] [blame] | 178 | const struct cred *cred; |
David Howells | 4a38e12 | 2008-04-29 01:01:24 -0700 | [diff] [blame] | 179 | void *callout_info; |
| 180 | size_t callout_len; |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 181 | pid_t pid; |
| 182 | }; |
| 183 | |
| 184 | extern struct key_type key_type_request_key_auth; |
| 185 | extern struct key *request_key_auth_new(struct key *target, |
David Howells | 4a38e12 | 2008-04-29 01:01:24 -0700 | [diff] [blame] | 186 | const void *callout_info, |
David Howells | 8bbf4976 | 2008-11-14 10:39:14 +1100 | [diff] [blame] | 187 | size_t callout_len, |
| 188 | struct key *dest_keyring); |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 189 | |
| 190 | extern struct key *key_get_instantiation_authkey(key_serial_t target_id); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 191 | |
| 192 | /* |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 193 | * keyctl() functions |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 194 | */ |
| 195 | extern long keyctl_get_keyring_ID(key_serial_t, int); |
| 196 | extern long keyctl_join_session_keyring(const char __user *); |
| 197 | extern long keyctl_update_key(key_serial_t, const void __user *, size_t); |
| 198 | extern long keyctl_revoke_key(key_serial_t); |
| 199 | extern long keyctl_keyring_clear(key_serial_t); |
| 200 | extern long keyctl_keyring_link(key_serial_t, key_serial_t); |
| 201 | extern long keyctl_keyring_unlink(key_serial_t, key_serial_t); |
| 202 | extern long keyctl_describe_key(key_serial_t, char __user *, size_t); |
| 203 | extern long keyctl_keyring_search(key_serial_t, const char __user *, |
| 204 | const char __user *, key_serial_t); |
| 205 | extern long keyctl_read_key(key_serial_t, char __user *, size_t); |
| 206 | extern long keyctl_chown_key(key_serial_t, uid_t, gid_t); |
| 207 | extern long keyctl_setperm_key(key_serial_t, key_perm_t); |
| 208 | extern long keyctl_instantiate_key(key_serial_t, const void __user *, |
| 209 | size_t, key_serial_t); |
| 210 | extern long keyctl_negate_key(key_serial_t, unsigned, key_serial_t); |
David Howells | 3e30148 | 2005-06-23 22:00:56 -0700 | [diff] [blame] | 211 | extern long keyctl_set_reqkey_keyring(int); |
David Howells | 017679c | 2006-01-08 01:02:43 -0800 | [diff] [blame] | 212 | extern long keyctl_set_timeout(key_serial_t, unsigned); |
David Howells | b5f545c | 2006-01-08 01:02:47 -0800 | [diff] [blame] | 213 | extern long keyctl_assume_authority(key_serial_t); |
David Howells | 70a5bb7 | 2008-04-29 01:01:26 -0700 | [diff] [blame] | 214 | extern long keyctl_get_security(key_serial_t keyid, char __user *buffer, |
| 215 | size_t buflen); |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 216 | extern long keyctl_session_to_parent(void); |
David Howells | fdd1b94 | 2011-03-07 15:06:09 +0000 | [diff] [blame] | 217 | extern long keyctl_reject_key(key_serial_t, unsigned, unsigned, key_serial_t); |
David Howells | ee009e4 | 2011-03-07 15:06:20 +0000 | [diff] [blame] | 218 | extern long keyctl_instantiate_key_iov(key_serial_t, |
| 219 | const struct iovec __user *, |
| 220 | unsigned, key_serial_t); |
| 221 | |
| 222 | extern long keyctl_instantiate_key_common(key_serial_t, |
| 223 | const struct iovec __user *, |
| 224 | unsigned, size_t, key_serial_t); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 225 | |
| 226 | /* |
David Howells | 973c9f4 | 2011-01-20 16:38:33 +0000 | [diff] [blame] | 227 | * Debugging key validation |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 228 | */ |
| 229 | #ifdef KEY_DEBUGGING |
| 230 | extern void __key_check(const struct key *); |
| 231 | |
| 232 | static inline void key_check(const struct key *key) |
| 233 | { |
| 234 | if (key && (IS_ERR(key) || key->magic != KEY_DEBUG_MAGIC)) |
| 235 | __key_check(key); |
| 236 | } |
| 237 | |
| 238 | #else |
| 239 | |
| 240 | #define key_check(key) do {} while(0) |
| 241 | |
| 242 | #endif |
| 243 | |
| 244 | #endif /* _INTERNAL_H */ |