1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Request a key from userspace
4  * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
7  * See Documentation/security/keys/request-key.rst
18 #include <keys/request_key_auth-type.h>
20 #define key_negative_timeout	60	/* default timeout on a negative key's existence */
22 static struct key *check_cached_key(struct keyring_search_context *ctx)  in check_cached_key()
25 	struct key *key = current->cached_requested_key;  in check_cached_key()  local
27 	if (key &&  in check_cached_key()
28 	    ctx->match_data.cmp(key, &ctx->match_data) &&  in check_cached_key()
29 	    !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |  in check_cached_key()
31 		return key_get(key);  in check_cached_key()
36 static void cache_requested_key(struct key *key)  in cache_requested_key()  argument
41 	/* Do not cache key if it is a kernel thread */  in cache_requested_key()
42 	if (!(t->flags & PF_KTHREAD)) {  in cache_requested_key()
43 		key_put(t->cached_requested_key);  in cache_requested_key()
44 		t->cached_requested_key = key_get(key);  in cache_requested_key()
51  * complete_request_key - Complete the construction of a key.
52  * @authkey: The authorisation key.
55  * Complete the attempt to construct a key.  The key will be negated
56  * if an error is indicated.  The authorisation key will be revoked
59 void complete_request_key(struct key *authkey, int error)  in complete_request_key()
62 	struct key *key = rka->target_key;  in complete_request_key()  local
64 	kenter("%d{%d},%d", authkey->serial, key->serial, error);  in complete_request_key()
67 		key_negate_and_link(key, key_negative_timeout, NULL, authkey);  in complete_request_key()
82 	struct key *keyring = info->data;  in umh_keys_init()
92 	struct key *keyring = info->data;  in umh_keys_cleanup()
100 					struct key *session_keyring, int wait)  in call_usermodehelper_keys()
108 		return -ENOMEM;  in call_usermodehelper_keys()
115  * Request userspace finish the construction of a key
116  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
118 static int call_sbin_request_key(struct key *authkey, void *aux)  in call_sbin_request_key()
120 	static char const request_key[] = "/sbin/request-key";  in call_sbin_request_key()
124 	struct key *key = rka->target_key, *keyring, *session, *user_session;  in call_sbin_request_key()  local
130 	kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);  in call_sbin_request_key()
137 	sprintf(desc, "_req.%u", key->serial);  in call_sbin_request_key()
140 	keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,  in call_sbin_request_key()
149 	/* attach the auth key to the session keyring */  in call_sbin_request_key()
155 	sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->fsuid));  in call_sbin_request_key()
156 	sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->fsgid));  in call_sbin_request_key()
158 	/* we say which key is under construction */  in call_sbin_request_key()
159 	sprintf(key_str, "%d", key->serial);  in call_sbin_request_key()
163 		cred->thread_keyring ? cred->thread_keyring->serial : 0);  in call_sbin_request_key()
166 	if (cred->process_keyring)  in call_sbin_request_key()
167 		prkey = cred->process_keyring->serial;  in call_sbin_request_key()
170 	session = cred->session_keyring;  in call_sbin_request_key()
173 	sskey = session->serial;  in call_sbin_request_key()
186 	argv[i++] = (char *)rka->op;  in call_sbin_request_key()
198 	kdebug("usermode -> 0x%x", ret);  in call_sbin_request_key()
201 		if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) ||  in call_sbin_request_key()
202 		    key_validate(key) < 0)  in call_sbin_request_key()
203 			ret = -ENOKEY;  in call_sbin_request_key()
205 			/* ignore any errors from userspace if the key was  in call_sbin_request_key()
222  * Call out to userspace for key construction.
224  * Program failure is ignored in favour of key status.
226 static int construct_key(struct key *key, const void *callout_info,  in construct_key()  argument
228 			 struct key *dest_keyring)  in construct_key()
231 	struct key *authkey;  in construct_key()
234 	kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);  in construct_key()
236 	/* allocate an authorisation key */  in construct_key()
237 	authkey = request_key_auth_new(key, "create", callout_info, callout_len,  in construct_key()
244 	if (key->type->request_key)  in construct_key()
245 		actor = key->type->request_key;  in construct_key()
252 		!test_bit(KEY_FLAG_INVALIDATED, &authkey->flags));  in construct_key()
265 static int construct_get_dest_keyring(struct key **_dest_keyring)  in construct_get_dest_keyring()
269 	struct key *dest_keyring = *_dest_keyring, *authkey;  in construct_get_dest_keyring()
283 		switch (cred->jit_keyring) {  in construct_get_dest_keyring()
286 			if (cred->request_key_auth) {  in construct_get_dest_keyring()
287 				authkey = cred->request_key_auth;  in construct_get_dest_keyring()
288 				down_read(&authkey->sem);  in construct_get_dest_keyring()
291 					      &authkey->flags))  in construct_get_dest_keyring()
293 						key_get(rka->dest_keyring);  in construct_get_dest_keyring()
294 				up_read(&authkey->sem);  in construct_get_dest_keyring()
303 			dest_keyring = key_get(cred->thread_keyring);  in construct_get_dest_keyring()
309 			dest_keyring = key_get(cred->process_keyring);  in construct_get_dest_keyring()
315 			dest_keyring = key_get(cred->session_keyring);  in construct_get_dest_keyring()
344 		 * that /sbin/request-key can itself use request_key() to add  in construct_get_dest_keyring()
363  * Allocate a new key in under-construction state and attempt to link it in to
366  * May return a key that's already under construction instead if there was a
370 			       struct key *dest_keyring,  in construct_alloc_key()
373 			       struct key **_key)  in construct_alloc_key()
376 	struct key *key;  in construct_alloc_key()  local
382 	       ctx->index_key.type->name, ctx->index_key.description);  in construct_alloc_key()
385 	mutex_lock(&user->cons_lock);  in construct_alloc_key()
389 	if (ctx->index_key.type->read)  in construct_alloc_key()
391 	if (ctx->index_key.type == &key_type_keyring ||  in construct_alloc_key()
392 	    ctx->index_key.type->update)  in construct_alloc_key()
395 	key = key_alloc(ctx->index_key.type, ctx->index_key.description,  in construct_alloc_key()
396 			ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,  in construct_alloc_key()
398 	if (IS_ERR(key))  in construct_alloc_key()
401 	set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);  in construct_alloc_key()
404 		ret = __key_link_lock(dest_keyring, &key->index_key);  in construct_alloc_key()
410 	 * Attach the key to the destination keyring under lock, but we do need  in construct_alloc_key()
417 	 * an actual key is determined.  in construct_alloc_key()
428 		ret = __key_link_begin(dest_keyring, &key->index_key, &edit);  in construct_alloc_key()
431 		__key_link(dest_keyring, key, &edit);  in construct_alloc_key()
436 		__key_link_end(dest_keyring, &key->index_key, edit);  in construct_alloc_key()
437 	mutex_unlock(&user->cons_lock);  in construct_alloc_key()
438 	*_key = key;  in construct_alloc_key()
439 	kleave(" = 0 [%d]", key_serial(key));  in construct_alloc_key()
442 	/* the key is now present - we tell the caller that we found it by  in construct_alloc_key()
443 	 * returning -EINPROGRESS  */  in construct_alloc_key()
445 	key_put(key);  in construct_alloc_key()
447 	key = key_ref_to_ptr(key_ref);  in construct_alloc_key()
449 		ret = __key_link_begin(dest_keyring, &key->index_key, &edit);  in construct_alloc_key()
452 		ret = __key_link_check_live_key(dest_keyring, key);  in construct_alloc_key()
454 			__key_link(dest_keyring, key, &edit);  in construct_alloc_key()
455 		__key_link_end(dest_keyring, &key->index_key, edit);  in construct_alloc_key()
459 	mutex_unlock(&user->cons_lock);  in construct_alloc_key()
460 	*_key = key;  in construct_alloc_key()
461 	kleave(" = -EINPROGRESS [%d]", key_serial(key));  in construct_alloc_key()
462 	return -EINPROGRESS;  in construct_alloc_key()
465 	mutex_unlock(&user->cons_lock);  in construct_alloc_key()
466 	key_put(key);  in construct_alloc_key()
473 	__key_link_end(dest_keyring, &key->index_key, edit);  in construct_alloc_key()
475 	mutex_unlock(&user->cons_lock);  in construct_alloc_key()
476 	key_put(key);  in construct_alloc_key()
481 	mutex_unlock(&user->cons_lock);  in construct_alloc_key()
482 	kleave(" = %ld", PTR_ERR(key));  in construct_alloc_key()
483 	return PTR_ERR(key);  in construct_alloc_key()
487  * Commence key construction.
489 static struct key *construct_key_and_link(struct keyring_search_context *ctx,  in construct_key_and_link()
493 					  struct key *dest_keyring,  in construct_key_and_link()
497 	struct key *key;  in construct_key_and_link()  local
502 	if (ctx->index_key.type == &key_type_keyring)  in construct_key_and_link()
503 		return ERR_PTR(-EPERM);  in construct_key_and_link()
511 		ret = -ENOMEM;  in construct_key_and_link()
515 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);  in construct_key_and_link()
519 		ret = construct_key(key, callout_info, callout_len, aux,  in construct_key_and_link()
525 	} else if (ret == -EINPROGRESS) {  in construct_key_and_link()
532 	kleave(" = key %d", key_serial(key));  in construct_key_and_link()
533 	return key;  in construct_key_and_link()
536 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);  in construct_key_and_link()
537 	key_put(key);  in construct_key_and_link()
546  * request_key_and_link - Request a key and cache it in a keyring.
547  * @type: The type of key we want.
548  * @description: The searchable description of the key.
549  * @domain_tag: The domain in which the key operates.
553  * @dest_keyring: Where to cache the key.
556  * A key matching the specified criteria (type, description, domain_tag) is
558  * incremented if found.  Otherwise, if callout_info is not NULL, a key will be
562  * If successfully found or created, the key will be linked to the destination
565  * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
566  * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
567  * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
568  * if insufficient key quota was available to create a new key; or -ENOMEM if
571  * If the returned key was created, then it may still be under construction,
574 struct key *request_key_and_link(struct key_type *type,  in request_key_and_link()
580 				 struct key *dest_keyring,  in request_key_and_link()
596 	struct key *key;  in request_key_and_link()  local
601 	       ctx.index_key.type->name, ctx.index_key.description,  in request_key_and_link()
604 	if (type->match_preparse) {  in request_key_and_link()
605 		ret = type->match_preparse(&ctx.match_data);  in request_key_and_link()
607 			key = ERR_PTR(ret);  in request_key_and_link()
612 	key = check_cached_key(&ctx);  in request_key_and_link()
613 	if (key)  in request_key_and_link()
616 	/* search all the process keyrings for a key */  in request_key_and_link()
627 				key = ERR_PTR(ret);  in request_key_and_link()
632 		key = key_ref_to_ptr(key_ref);  in request_key_and_link()
634 			ret = key_link(dest_keyring, key);  in request_key_and_link()
636 				key_put(key);  in request_key_and_link()
637 				key = ERR_PTR(ret);  in request_key_and_link()
642 		/* Only cache the key on immediate success */  in request_key_and_link()
643 		cache_requested_key(key);  in request_key_and_link()
644 	} else if (PTR_ERR(key_ref) != -EAGAIN) {  in request_key_and_link()
645 		key = ERR_CAST(key_ref);  in request_key_and_link()
649 		key = ERR_PTR(-ENOKEY);  in request_key_and_link()
653 		key = construct_key_and_link(&ctx, callout_info, callout_len,  in request_key_and_link()
658 	if (type->match_free)  in request_key_and_link()
659 		type->match_free(&ctx.match_data);  in request_key_and_link()
661 	kleave(" = %p", key);  in request_key_and_link()
662 	return key;  in request_key_and_link()
666  * wait_for_key_construction - Wait for construction of a key to complete
667  * @key: The key being waited for.
670  * Wait for a key to finish being constructed.
672  * Returns 0 if successful; -ERESTARTSYS if the wait was interrupted; -ENOKEY
673  * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
676 int wait_for_key_construction(struct key *key, bool intr)  in wait_for_key_construction()  argument
680 	ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,  in wait_for_key_construction()
683 		return -ERESTARTSYS;  in wait_for_key_construction()
684 	ret = key_read_state(key);  in wait_for_key_construction()
687 	return key_validate(key);  in wait_for_key_construction()
692  * request_key_tag - Request a key and wait for construction
693  * @type: Type of key.
694  * @description: The searchable description of the key.
695  * @domain_tag: The domain in which the key operates.
698  * As for request_key_and_link() except that it does not add the returned key
700  * the callout_info must be a NUL-terminated string and no auxiliary data can
704  * completion of keys undergoing construction with a non-interruptible wait.
706 struct key *request_key_tag(struct key_type *type,  in request_key_tag()
711 	struct key *key;  in request_key_tag()  local
717 	key = request_key_and_link(type, description, domain_tag,  in request_key_tag()
720 	if (!IS_ERR(key)) {  in request_key_tag()
721 		ret = wait_for_key_construction(key, false);  in request_key_tag()
723 			key_put(key);  in request_key_tag()
727 	return key;  in request_key_tag()
732  * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
733  * @type: The type of key we want.
734  * @description: The searchable description of the key.
735  * @domain_tag: The domain in which the key operates.
740  * As for request_key_and_link() except that it does not add the returned key
744  * completion of keys undergoing construction with a non-interruptible wait.
746 struct key *request_key_with_auxdata(struct key_type *type,  in request_key_with_auxdata()
753 	struct key *key;  in request_key_with_auxdata()  local
756 	key = request_key_and_link(type, description, domain_tag,  in request_key_with_auxdata()
759 	if (!IS_ERR(key)) {  in request_key_with_auxdata()
760 		ret = wait_for_key_construction(key, false);  in request_key_with_auxdata()
762 			key_put(key);  in request_key_with_auxdata()
766 	return key;  in request_key_with_auxdata()
771  * request_key_rcu - Request key from RCU-read-locked context
772  * @type: The type of key we want.
773  * @description: The name of the key we want.
774  * @domain_tag: The domain in which the key operates.
776  * Request a key from a context that we may not sleep in (such as RCU-mode
779  * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
780  * a key or some other error if the key found was unsuitable or inaccessible.
782 struct key *request_key_rcu(struct key_type *type,  in request_key_rcu()
798 	struct key *key;  in request_key_rcu()  local
801 	kenter("%s,%s", type->name, description);  in request_key_rcu()
803 	key = check_cached_key(&ctx);  in request_key_rcu()
804 	if (key)  in request_key_rcu()
805 		return key;  in request_key_rcu()
807 	/* search all the process keyrings for a key */  in request_key_rcu()
810 		key = ERR_CAST(key_ref);  in request_key_rcu()
811 		if (PTR_ERR(key_ref) == -EAGAIN)  in request_key_rcu()
812 			key = ERR_PTR(-ENOKEY);  in request_key_rcu()
814 		key = key_ref_to_ptr(key_ref);  in request_key_rcu()
815 		cache_requested_key(key);  in request_key_rcu()
818 	kleave(" = %p", key);  in request_key_rcu()
819 	return key;  in request_key_rcu()