request_key_auth.c 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276
  1. /* Request key authorisation token key definition.
  2. *
  3. * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
  4. * Written by David Howells (dhowells@redhat.com)
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. *
  11. * See Documentation/security/keys-request-key.txt
  12. */
  13. #include <linux/module.h>
  14. #include <linux/sched.h>
  15. #include <linux/err.h>
  16. #include <linux/seq_file.h>
  17. #include <linux/slab.h>
  18. #include <asm/uaccess.h>
  19. #include "internal.h"
  20. #include <keys/user-type.h>
  21. static int request_key_auth_preparse(struct key_preparsed_payload *);
  22. static void request_key_auth_free_preparse(struct key_preparsed_payload *);
  23. static int request_key_auth_instantiate(struct key *,
  24. struct key_preparsed_payload *);
  25. static void request_key_auth_describe(const struct key *, struct seq_file *);
  26. static void request_key_auth_revoke(struct key *);
  27. static void request_key_auth_destroy(struct key *);
  28. static long request_key_auth_read(const struct key *, char __user *, size_t);
  29. /*
  30. * The request-key authorisation key type definition.
  31. */
  32. struct key_type key_type_request_key_auth = {
  33. .name = ".request_key_auth",
  34. .def_datalen = sizeof(struct request_key_auth),
  35. .preparse = request_key_auth_preparse,
  36. .free_preparse = request_key_auth_free_preparse,
  37. .instantiate = request_key_auth_instantiate,
  38. .describe = request_key_auth_describe,
  39. .revoke = request_key_auth_revoke,
  40. .destroy = request_key_auth_destroy,
  41. .read = request_key_auth_read,
  42. };
  43. static int request_key_auth_preparse(struct key_preparsed_payload *prep)
  44. {
  45. return 0;
  46. }
  47. static void request_key_auth_free_preparse(struct key_preparsed_payload *prep)
  48. {
  49. }
  50. /*
  51. * Instantiate a request-key authorisation key.
  52. */
  53. static int request_key_auth_instantiate(struct key *key,
  54. struct key_preparsed_payload *prep)
  55. {
  56. key->payload.data[0] = (struct request_key_auth *)prep->data;
  57. return 0;
  58. }
  59. /*
  60. * Describe an authorisation token.
  61. */
  62. static void request_key_auth_describe(const struct key *key,
  63. struct seq_file *m)
  64. {
  65. struct request_key_auth *rka = key->payload.data[0];
  66. seq_puts(m, "key:");
  67. seq_puts(m, key->description);
  68. if (key_is_positive(key))
  69. seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
  70. }
  71. /*
  72. * Read the callout_info data (retrieves the callout information).
  73. * - the key's semaphore is read-locked
  74. */
  75. static long request_key_auth_read(const struct key *key,
  76. char __user *buffer, size_t buflen)
  77. {
  78. struct request_key_auth *rka = key->payload.data[0];
  79. size_t datalen;
  80. long ret;
  81. datalen = rka->callout_len;
  82. ret = datalen;
  83. /* we can return the data as is */
  84. if (buffer && buflen > 0) {
  85. if (buflen > datalen)
  86. buflen = datalen;
  87. if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
  88. ret = -EFAULT;
  89. }
  90. return ret;
  91. }
  92. /*
  93. * Handle revocation of an authorisation token key.
  94. *
  95. * Called with the key sem write-locked.
  96. */
  97. static void request_key_auth_revoke(struct key *key)
  98. {
  99. struct request_key_auth *rka = key->payload.data[0];
  100. kenter("{%d}", key->serial);
  101. if (rka->cred) {
  102. put_cred(rka->cred);
  103. rka->cred = NULL;
  104. }
  105. }
  106. /*
  107. * Destroy an instantiation authorisation token key.
  108. */
  109. static void request_key_auth_destroy(struct key *key)
  110. {
  111. struct request_key_auth *rka = key->payload.data[0];
  112. kenter("{%d}", key->serial);
  113. if (rka->cred) {
  114. put_cred(rka->cred);
  115. rka->cred = NULL;
  116. }
  117. key_put(rka->target_key);
  118. key_put(rka->dest_keyring);
  119. kfree(rka->callout_info);
  120. kfree(rka);
  121. }
  122. /*
  123. * Create an authorisation token for /sbin/request-key or whoever to gain
  124. * access to the caller's security data.
  125. */
  126. struct key *request_key_auth_new(struct key *target, const void *callout_info,
  127. size_t callout_len, struct key *dest_keyring)
  128. {
  129. struct request_key_auth *rka, *irka;
  130. const struct cred *cred = current->cred;
  131. struct key *authkey = NULL;
  132. char desc[20];
  133. int ret;
  134. kenter("%d,", target->serial);
  135. /* allocate a auth record */
  136. rka = kmalloc(sizeof(*rka), GFP_KERNEL);
  137. if (!rka) {
  138. kleave(" = -ENOMEM");
  139. return ERR_PTR(-ENOMEM);
  140. }
  141. rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
  142. if (!rka->callout_info) {
  143. kleave(" = -ENOMEM");
  144. kfree(rka);
  145. return ERR_PTR(-ENOMEM);
  146. }
  147. /* see if the calling process is already servicing the key request of
  148. * another process */
  149. if (cred->request_key_auth) {
  150. /* it is - use that instantiation context here too */
  151. down_read(&cred->request_key_auth->sem);
  152. /* if the auth key has been revoked, then the key we're
  153. * servicing is already instantiated */
  154. if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
  155. goto auth_key_revoked;
  156. irka = cred->request_key_auth->payload.data[0];
  157. rka->cred = get_cred(irka->cred);
  158. rka->pid = irka->pid;
  159. up_read(&cred->request_key_auth->sem);
  160. }
  161. else {
  162. /* it isn't - use this process as the context */
  163. rka->cred = get_cred(cred);
  164. rka->pid = current->pid;
  165. }
  166. rka->target_key = key_get(target);
  167. rka->dest_keyring = key_get(dest_keyring);
  168. memcpy(rka->callout_info, callout_info, callout_len);
  169. rka->callout_len = callout_len;
  170. /* allocate the auth key */
  171. sprintf(desc, "%x", target->serial);
  172. authkey = key_alloc(&key_type_request_key_auth, desc,
  173. cred->fsuid, cred->fsgid, cred,
  174. KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
  175. KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
  176. if (IS_ERR(authkey)) {
  177. ret = PTR_ERR(authkey);
  178. goto error_alloc;
  179. }
  180. /* construct the auth key */
  181. ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
  182. if (ret < 0)
  183. goto error_inst;
  184. kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
  185. return authkey;
  186. auth_key_revoked:
  187. up_read(&cred->request_key_auth->sem);
  188. kfree(rka->callout_info);
  189. kfree(rka);
  190. kleave("= -EKEYREVOKED");
  191. return ERR_PTR(-EKEYREVOKED);
  192. error_inst:
  193. key_revoke(authkey);
  194. key_put(authkey);
  195. error_alloc:
  196. key_put(rka->target_key);
  197. key_put(rka->dest_keyring);
  198. kfree(rka->callout_info);
  199. kfree(rka);
  200. kleave("= %d", ret);
  201. return ERR_PTR(ret);
  202. }
  203. /*
  204. * Search the current process's keyrings for the authorisation key for
  205. * instantiation of a key.
  206. */
  207. struct key *key_get_instantiation_authkey(key_serial_t target_id)
  208. {
  209. char description[16];
  210. struct keyring_search_context ctx = {
  211. .index_key.type = &key_type_request_key_auth,
  212. .index_key.description = description,
  213. .cred = current_cred(),
  214. .match_data.cmp = key_default_cmp,
  215. .match_data.raw_data = description,
  216. .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
  217. .flags = KEYRING_SEARCH_DO_STATE_CHECK,
  218. };
  219. struct key *authkey;
  220. key_ref_t authkey_ref;
  221. ctx.index_key.desc_len = sprintf(description, "%x", target_id);
  222. authkey_ref = search_process_keyrings(&ctx);
  223. if (IS_ERR(authkey_ref)) {
  224. authkey = ERR_CAST(authkey_ref);
  225. if (authkey == ERR_PTR(-EAGAIN))
  226. authkey = ERR_PTR(-ENOKEY);
  227. goto error;
  228. }
  229. authkey = key_ref_to_ptr(authkey_ref);
  230. if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
  231. key_put(authkey);
  232. authkey = ERR_PTR(-EKEYREVOKED);
  233. }
  234. error:
  235. return authkey;
  236. }