Lines Matching full:key
2 /* Request a key from userspace
7 * See Documentation/security/keys/request-key.rst
20 #define key_negative_timeout 60 /* default timeout on a negative key's existence */
22 static struct key *check_cached_key(struct keyring_search_context *ctx) in check_cached_key()
25 struct key *key = current->cached_requested_key; in check_cached_key() local
27 if (key && in check_cached_key()
28 ctx->match_data.cmp(key, &ctx->match_data) && in check_cached_key()
29 !(key->flags & ((1 << KEY_FLAG_INVALIDATED) | in check_cached_key()
31 return key_get(key); in check_cached_key()
36 static void cache_requested_key(struct key *key) in cache_requested_key() argument
41 /* Do not cache key if it is a kernel thread */ in cache_requested_key()
44 t->cached_requested_key = key_get(key); in cache_requested_key()
51 * complete_request_key - Complete the construction of a key.
52 * @authkey: The authorisation key.
55 * Complete the attempt to construct a key. The key will be negated
56 * if an error is indicated. The authorisation key will be revoked
59 void complete_request_key(struct key *authkey, int error) in complete_request_key()
62 struct key *key = rka->target_key; in complete_request_key() local
64 kenter("%d{%d},%d", authkey->serial, key->serial, error); in complete_request_key()
67 key_negate_and_link(key, key_negative_timeout, NULL, authkey); in complete_request_key()
82 struct key *keyring = info->data; in umh_keys_init()
92 struct key *keyring = info->data; in umh_keys_cleanup()
100 struct key *session_keyring, int wait) in call_usermodehelper_keys()
115 * Request userspace finish the construction of a key
116 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
118 static int call_sbin_request_key(struct key *authkey, void *aux) in call_sbin_request_key()
120 static char const request_key[] = "/sbin/request-key"; in call_sbin_request_key()
124 struct key *key = rka->target_key, *keyring, *session, *user_session; in call_sbin_request_key() local
130 kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op); in call_sbin_request_key()
137 sprintf(desc, "_req.%u", key->serial); in call_sbin_request_key()
149 /* attach the auth key to the session keyring */ in call_sbin_request_key()
158 /* we say which key is under construction */ in call_sbin_request_key()
159 sprintf(key_str, "%d", key->serial); in call_sbin_request_key()
201 if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) || in call_sbin_request_key()
202 key_validate(key) < 0) in call_sbin_request_key()
205 /* ignore any errors from userspace if the key was in call_sbin_request_key()
222 * Call out to userspace for key construction.
224 * Program failure is ignored in favour of key status.
226 static int construct_key(struct key *key, const void *callout_info, in construct_key() argument
228 struct key *dest_keyring) in construct_key()
231 struct key *authkey; in construct_key()
234 kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux); in construct_key()
236 /* allocate an authorisation key */ in construct_key()
237 authkey = request_key_auth_new(key, "create", callout_info, callout_len, in construct_key()
244 if (key->type->request_key) in construct_key()
245 actor = key->type->request_key; in construct_key()
265 static int construct_get_dest_keyring(struct key **_dest_keyring) in construct_get_dest_keyring()
269 struct key *dest_keyring = *_dest_keyring, *authkey; in construct_get_dest_keyring()
344 * that /sbin/request-key can itself use request_key() to add in construct_get_dest_keyring()
363 * Allocate a new key in under-construction state and attempt to link it in to
366 * May return a key that's already under construction instead if there was a
370 struct key *dest_keyring, in construct_alloc_key()
373 struct key **_key) in construct_alloc_key()
376 struct key *key; in construct_alloc_key() local
395 key = key_alloc(ctx->index_key.type, ctx->index_key.description, in construct_alloc_key()
398 if (IS_ERR(key)) in construct_alloc_key()
401 set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags); in construct_alloc_key()
404 ret = __key_link_lock(dest_keyring, &key->index_key); in construct_alloc_key()
410 * Attach the key to the destination keyring under lock, but we do need in construct_alloc_key()
417 * an actual key is determined. in construct_alloc_key()
428 ret = __key_link_begin(dest_keyring, &key->index_key, &edit); in construct_alloc_key()
431 __key_link(dest_keyring, key, &edit); in construct_alloc_key()
436 __key_link_end(dest_keyring, &key->index_key, edit); in construct_alloc_key()
438 *_key = key; in construct_alloc_key()
439 kleave(" = 0 [%d]", key_serial(key)); in construct_alloc_key()
442 /* the key is now present - we tell the caller that we found it by in construct_alloc_key()
445 key_put(key); in construct_alloc_key()
447 key = key_ref_to_ptr(key_ref); in construct_alloc_key()
449 ret = __key_link_begin(dest_keyring, &key->index_key, &edit); in construct_alloc_key()
452 ret = __key_link_check_live_key(dest_keyring, key); in construct_alloc_key()
454 __key_link(dest_keyring, key, &edit); in construct_alloc_key()
455 __key_link_end(dest_keyring, &key->index_key, edit); in construct_alloc_key()
460 *_key = key; in construct_alloc_key()
461 kleave(" = -EINPROGRESS [%d]", key_serial(key)); in construct_alloc_key()
466 key_put(key); in construct_alloc_key()
473 __key_link_end(dest_keyring, &key->index_key, edit); in construct_alloc_key()
476 key_put(key); in construct_alloc_key()
482 kleave(" = %ld", PTR_ERR(key)); in construct_alloc_key()
483 return PTR_ERR(key); in construct_alloc_key()
487 * Commence key construction.
489 static struct key *construct_key_and_link(struct keyring_search_context *ctx, in construct_key_and_link()
493 struct key *dest_keyring, in construct_key_and_link()
497 struct key *key; in construct_key_and_link() local
515 ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); in construct_key_and_link()
519 ret = construct_key(key, callout_info, callout_len, aux, in construct_key_and_link()
532 kleave(" = key %d", key_serial(key)); in construct_key_and_link()
533 return key; in construct_key_and_link()
536 key_negate_and_link(key, key_negative_timeout, NULL, NULL); in construct_key_and_link()
537 key_put(key); in construct_key_and_link()
546 * request_key_and_link - Request a key and cache it in a keyring.
547 * @type: The type of key we want.
548 * @description: The searchable description of the key.
549 * @domain_tag: The domain in which the key operates.
553 * @dest_keyring: Where to cache the key.
556 * A key matching the specified criteria (type, description, domain_tag) is
558 * incremented if found. Otherwise, if callout_info is not NULL, a key will be
562 * If successfully found or created, the key will be linked to the destination
565 * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
566 * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
567 * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
568 * if insufficient key quota was available to create a new key; or -ENOMEM if
571 * If the returned key was created, then it may still be under construction,
574 struct key *request_key_and_link(struct key_type *type, in request_key_and_link()
580 struct key *dest_keyring, in request_key_and_link()
596 struct key *key; in request_key_and_link() local
607 key = ERR_PTR(ret); in request_key_and_link()
612 key = check_cached_key(&ctx); in request_key_and_link()
613 if (key) in request_key_and_link()
616 /* search all the process keyrings for a key */ in request_key_and_link()
627 key = ERR_PTR(ret); in request_key_and_link()
632 key = key_ref_to_ptr(key_ref); in request_key_and_link()
634 ret = key_link(dest_keyring, key); in request_key_and_link()
636 key_put(key); in request_key_and_link()
637 key = ERR_PTR(ret); in request_key_and_link()
642 /* Only cache the key on immediate success */ in request_key_and_link()
643 cache_requested_key(key); in request_key_and_link()
645 key = ERR_CAST(key_ref); in request_key_and_link()
649 key = ERR_PTR(-ENOKEY); in request_key_and_link()
653 key = construct_key_and_link(&ctx, callout_info, callout_len, in request_key_and_link()
661 kleave(" = %p", key); in request_key_and_link()
662 return key; in request_key_and_link()
666 * wait_for_key_construction - Wait for construction of a key to complete
667 * @key: The key being waited for.
670 * Wait for a key to finish being constructed.
673 * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
676 int wait_for_key_construction(struct key *key, bool intr) in wait_for_key_construction() argument
680 ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT, in wait_for_key_construction()
684 ret = key_read_state(key); in wait_for_key_construction()
687 return key_validate(key); in wait_for_key_construction()
692 * request_key_tag - Request a key and wait for construction
693 * @type: Type of key.
694 * @description: The searchable description of the key.
695 * @domain_tag: The domain in which the key operates.
698 * As for request_key_and_link() except that it does not add the returned key
706 struct key *request_key_tag(struct key_type *type, in request_key_tag()
711 struct key *key; in request_key_tag() local
717 key = request_key_and_link(type, description, domain_tag, in request_key_tag()
720 if (!IS_ERR(key)) { in request_key_tag()
721 ret = wait_for_key_construction(key, false); in request_key_tag()
723 key_put(key); in request_key_tag()
727 return key; in request_key_tag()
732 * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
733 * @type: The type of key we want.
734 * @description: The searchable description of the key.
735 * @domain_tag: The domain in which the key operates.
740 * As for request_key_and_link() except that it does not add the returned key
746 struct key *request_key_with_auxdata(struct key_type *type, in request_key_with_auxdata()
753 struct key *key; in request_key_with_auxdata() local
756 key = request_key_and_link(type, description, domain_tag, in request_key_with_auxdata()
759 if (!IS_ERR(key)) { in request_key_with_auxdata()
760 ret = wait_for_key_construction(key, false); in request_key_with_auxdata()
762 key_put(key); in request_key_with_auxdata()
766 return key; in request_key_with_auxdata()
771 * request_key_rcu - Request key from RCU-read-locked context
772 * @type: The type of key we want.
773 * @description: The name of the key we want.
774 * @domain_tag: The domain in which the key operates.
776 * Request a key from a context that we may not sleep in (such as RCU-mode
779 * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
780 * a key or some other error if the key found was unsuitable or inaccessible.
782 struct key *request_key_rcu(struct key_type *type, in request_key_rcu()
798 struct key *key; in request_key_rcu() local
803 key = check_cached_key(&ctx); in request_key_rcu()
804 if (key) in request_key_rcu()
805 return key; in request_key_rcu()
807 /* search all the process keyrings for a key */ in request_key_rcu()
810 key = ERR_CAST(key_ref); in request_key_rcu()
812 key = ERR_PTR(-ENOKEY); in request_key_rcu()
814 key = key_ref_to_ptr(key_ref); in request_key_rcu()
815 cache_requested_key(key); in request_key_rcu()
818 kleave(" = %p", key); in request_key_rcu()
819 return key; in request_key_rcu()