1 /* keyctl.c: userspace keyctl operations 2 * 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/init.h> 14 #include <linux/sched.h> 15 #include <linux/slab.h> 16 #include <linux/syscalls.h> 17 #include <linux/keyctl.h> 18 #include <linux/fs.h> 19 #include <linux/capability.h> 20 #include <linux/string.h> 21 #include <linux/err.h> 22 #include <linux/vmalloc.h> 23 #include <linux/security.h> 24 #include <asm/uaccess.h> 25 #include "internal.h" 26 27 static int key_get_type_from_user(char *type, 28 const char __user *_type, 29 unsigned len) 30 { 31 int ret; 32 33 ret = strncpy_from_user(type, _type, len); 34 35 if (ret < 0) 36 return -EFAULT; 37 38 if (ret == 0 || ret >= len) 39 return -EINVAL; 40 41 if (type[0] == '.') 42 return -EPERM; 43 44 type[len - 1] = '\0'; 45 46 return 0; 47 } 48 49 /*****************************************************************************/ 50 /* 51 * extract the description of a new key from userspace and either add it as a 52 * new key to the specified keyring or update a matching key in that keyring 53 * - the keyring must be writable 54 * - returns the new key's serial number 55 * - implements add_key() 56 */ 57 asmlinkage long sys_add_key(const char __user *_type, 58 const char __user *_description, 59 const void __user *_payload, 60 size_t plen, 61 key_serial_t ringid) 62 { 63 key_ref_t keyring_ref, key_ref; 64 char type[32], *description; 65 void *payload; 66 long ret; 67 bool vm; 68 69 ret = -EINVAL; 70 if (plen > 1024 * 1024 - 1) 71 goto error; 72 73 /* draw all the data into kernel space */ 74 ret = key_get_type_from_user(type, _type, sizeof(type)); 75 if (ret < 0) 76 goto error; 77 78 description = strndup_user(_description, PAGE_SIZE); 79 if (IS_ERR(description)) { 80 ret = PTR_ERR(description); 81 goto error; 82 } 83 84 /* pull the payload in if one was supplied */ 85 payload = NULL; 86 87 vm = false; 88 if (_payload) { 89 ret = -ENOMEM; 90 payload = kmalloc(plen, GFP_KERNEL); 91 if (!payload) { 92 if (plen <= PAGE_SIZE) 93 goto error2; 94 vm = true; 95 payload = vmalloc(plen); 96 if (!payload) 97 goto error2; 98 } 99 100 ret = -EFAULT; 101 if (copy_from_user(payload, _payload, plen) != 0) 102 goto error3; 103 } 104 105 /* find the target keyring (which must be writable) */ 106 keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE); 107 if (IS_ERR(keyring_ref)) { 108 ret = PTR_ERR(keyring_ref); 109 goto error3; 110 } 111 112 /* create or update the requested key and add it to the target 113 * keyring */ 114 key_ref = key_create_or_update(keyring_ref, type, description, 115 payload, plen, KEY_PERM_UNDEF, 116 KEY_ALLOC_IN_QUOTA); 117 if (!IS_ERR(key_ref)) { 118 ret = key_ref_to_ptr(key_ref)->serial; 119 key_ref_put(key_ref); 120 } 121 else { 122 ret = PTR_ERR(key_ref); 123 } 124 125 key_ref_put(keyring_ref); 126 error3: 127 if (!vm) 128 kfree(payload); 129 else 130 vfree(payload); 131 error2: 132 kfree(description); 133 error: 134 return ret; 135 136 } /* end sys_add_key() */ 137 138 /*****************************************************************************/ 139 /* 140 * search the process keyrings for a matching key 141 * - nested keyrings may also be searched if they have Search permission 142 * - if a key is found, it will be attached to the destination keyring if 143 * there's one specified 144 * - /sbin/request-key will be invoked if _callout_info is non-NULL 145 * - the _callout_info string will be passed to /sbin/request-key 146 * - if the _callout_info string is empty, it will be rendered as "-" 147 * - implements request_key() 148 */ 149 asmlinkage long sys_request_key(const char __user *_type, 150 const char __user *_description, 151 const char __user *_callout_info, 152 key_serial_t destringid) 153 { 154 struct key_type *ktype; 155 struct key *key; 156 key_ref_t dest_ref; 157 size_t callout_len; 158 char type[32], *description, *callout_info; 159 long ret; 160 161 /* pull the type into kernel space */ 162 ret = key_get_type_from_user(type, _type, sizeof(type)); 163 if (ret < 0) 164 goto error; 165 166 /* pull the description into kernel space */ 167 description = strndup_user(_description, PAGE_SIZE); 168 if (IS_ERR(description)) { 169 ret = PTR_ERR(description); 170 goto error; 171 } 172 173 /* pull the callout info into kernel space */ 174 callout_info = NULL; 175 callout_len = 0; 176 if (_callout_info) { 177 callout_info = strndup_user(_callout_info, PAGE_SIZE); 178 if (IS_ERR(callout_info)) { 179 ret = PTR_ERR(callout_info); 180 goto error2; 181 } 182 callout_len = strlen(callout_info); 183 } 184 185 /* get the destination keyring if specified */ 186 dest_ref = NULL; 187 if (destringid) { 188 dest_ref = lookup_user_key(destringid, 1, 0, KEY_WRITE); 189 if (IS_ERR(dest_ref)) { 190 ret = PTR_ERR(dest_ref); 191 goto error3; 192 } 193 } 194 195 /* find the key type */ 196 ktype = key_type_lookup(type); 197 if (IS_ERR(ktype)) { 198 ret = PTR_ERR(ktype); 199 goto error4; 200 } 201 202 /* do the search */ 203 key = request_key_and_link(ktype, description, callout_info, 204 callout_len, NULL, key_ref_to_ptr(dest_ref), 205 KEY_ALLOC_IN_QUOTA); 206 if (IS_ERR(key)) { 207 ret = PTR_ERR(key); 208 goto error5; 209 } 210 211 ret = key->serial; 212 213 key_put(key); 214 error5: 215 key_type_put(ktype); 216 error4: 217 key_ref_put(dest_ref); 218 error3: 219 kfree(callout_info); 220 error2: 221 kfree(description); 222 error: 223 return ret; 224 225 } /* end sys_request_key() */ 226 227 /*****************************************************************************/ 228 /* 229 * get the ID of the specified process keyring 230 * - the keyring must have search permission to be found 231 * - implements keyctl(KEYCTL_GET_KEYRING_ID) 232 */ 233 long keyctl_get_keyring_ID(key_serial_t id, int create) 234 { 235 key_ref_t key_ref; 236 long ret; 237 238 key_ref = lookup_user_key(id, create, 0, KEY_SEARCH); 239 if (IS_ERR(key_ref)) { 240 ret = PTR_ERR(key_ref); 241 goto error; 242 } 243 244 ret = key_ref_to_ptr(key_ref)->serial; 245 key_ref_put(key_ref); 246 error: 247 return ret; 248 249 } /* end keyctl_get_keyring_ID() */ 250 251 /*****************************************************************************/ 252 /* 253 * join the session keyring 254 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING) 255 */ 256 long keyctl_join_session_keyring(const char __user *_name) 257 { 258 char *name; 259 long ret; 260 261 /* fetch the name from userspace */ 262 name = NULL; 263 if (_name) { 264 name = strndup_user(_name, PAGE_SIZE); 265 if (IS_ERR(name)) { 266 ret = PTR_ERR(name); 267 goto error; 268 } 269 } 270 271 /* join the session */ 272 ret = join_session_keyring(name); 273 274 error: 275 return ret; 276 277 } /* end keyctl_join_session_keyring() */ 278 279 /*****************************************************************************/ 280 /* 281 * update a key's data payload 282 * - the key must be writable 283 * - implements keyctl(KEYCTL_UPDATE) 284 */ 285 long keyctl_update_key(key_serial_t id, 286 const void __user *_payload, 287 size_t plen) 288 { 289 key_ref_t key_ref; 290 void *payload; 291 long ret; 292 293 ret = -EINVAL; 294 if (plen > PAGE_SIZE) 295 goto error; 296 297 /* pull the payload in if one was supplied */ 298 payload = NULL; 299 if (_payload) { 300 ret = -ENOMEM; 301 payload = kmalloc(plen, GFP_KERNEL); 302 if (!payload) 303 goto error; 304 305 ret = -EFAULT; 306 if (copy_from_user(payload, _payload, plen) != 0) 307 goto error2; 308 } 309 310 /* find the target key (which must be writable) */ 311 key_ref = lookup_user_key(id, 0, 0, KEY_WRITE); 312 if (IS_ERR(key_ref)) { 313 ret = PTR_ERR(key_ref); 314 goto error2; 315 } 316 317 /* update the key */ 318 ret = key_update(key_ref, payload, plen); 319 320 key_ref_put(key_ref); 321 error2: 322 kfree(payload); 323 error: 324 return ret; 325 326 } /* end keyctl_update_key() */ 327 328 /*****************************************************************************/ 329 /* 330 * revoke a key 331 * - the key must be writable 332 * - implements keyctl(KEYCTL_REVOKE) 333 */ 334 long keyctl_revoke_key(key_serial_t id) 335 { 336 key_ref_t key_ref; 337 long ret; 338 339 key_ref = lookup_user_key(id, 0, 0, KEY_WRITE); 340 if (IS_ERR(key_ref)) { 341 ret = PTR_ERR(key_ref); 342 goto error; 343 } 344 345 key_revoke(key_ref_to_ptr(key_ref)); 346 ret = 0; 347 348 key_ref_put(key_ref); 349 error: 350 return ret; 351 352 } /* end keyctl_revoke_key() */ 353 354 /*****************************************************************************/ 355 /* 356 * clear the specified process keyring 357 * - the keyring must be writable 358 * - implements keyctl(KEYCTL_CLEAR) 359 */ 360 long keyctl_keyring_clear(key_serial_t ringid) 361 { 362 key_ref_t keyring_ref; 363 long ret; 364 365 keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE); 366 if (IS_ERR(keyring_ref)) { 367 ret = PTR_ERR(keyring_ref); 368 goto error; 369 } 370 371 ret = keyring_clear(key_ref_to_ptr(keyring_ref)); 372 373 key_ref_put(keyring_ref); 374 error: 375 return ret; 376 377 } /* end keyctl_keyring_clear() */ 378 379 /*****************************************************************************/ 380 /* 381 * link a key into a keyring 382 * - the keyring must be writable 383 * - the key must be linkable 384 * - implements keyctl(KEYCTL_LINK) 385 */ 386 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid) 387 { 388 key_ref_t keyring_ref, key_ref; 389 long ret; 390 391 keyring_ref = lookup_user_key(ringid, 1, 0, KEY_WRITE); 392 if (IS_ERR(keyring_ref)) { 393 ret = PTR_ERR(keyring_ref); 394 goto error; 395 } 396 397 key_ref = lookup_user_key(id, 1, 0, KEY_LINK); 398 if (IS_ERR(key_ref)) { 399 ret = PTR_ERR(key_ref); 400 goto error2; 401 } 402 403 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 404 405 key_ref_put(key_ref); 406 error2: 407 key_ref_put(keyring_ref); 408 error: 409 return ret; 410 411 } /* end keyctl_keyring_link() */ 412 413 /*****************************************************************************/ 414 /* 415 * unlink the first attachment of a key from a keyring 416 * - the keyring must be writable 417 * - we don't need any permissions on the key 418 * - implements keyctl(KEYCTL_UNLINK) 419 */ 420 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid) 421 { 422 key_ref_t keyring_ref, key_ref; 423 long ret; 424 425 keyring_ref = lookup_user_key(ringid, 0, 0, KEY_WRITE); 426 if (IS_ERR(keyring_ref)) { 427 ret = PTR_ERR(keyring_ref); 428 goto error; 429 } 430 431 key_ref = lookup_user_key(id, 0, 0, 0); 432 if (IS_ERR(key_ref)) { 433 ret = PTR_ERR(key_ref); 434 goto error2; 435 } 436 437 ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 438 439 key_ref_put(key_ref); 440 error2: 441 key_ref_put(keyring_ref); 442 error: 443 return ret; 444 445 } /* end keyctl_keyring_unlink() */ 446 447 /*****************************************************************************/ 448 /* 449 * describe a user key 450 * - the key must have view permission 451 * - if there's a buffer, we place up to buflen bytes of data into it 452 * - unless there's an error, we return the amount of description available, 453 * irrespective of how much we may have copied 454 * - the description is formatted thus: 455 * type;uid;gid;perm;description<NUL> 456 * - implements keyctl(KEYCTL_DESCRIBE) 457 */ 458 long keyctl_describe_key(key_serial_t keyid, 459 char __user *buffer, 460 size_t buflen) 461 { 462 struct key *key, *instkey; 463 key_ref_t key_ref; 464 char *tmpbuf; 465 long ret; 466 467 key_ref = lookup_user_key(keyid, 0, 1, KEY_VIEW); 468 if (IS_ERR(key_ref)) { 469 /* viewing a key under construction is permitted if we have the 470 * authorisation token handy */ 471 if (PTR_ERR(key_ref) == -EACCES) { 472 instkey = key_get_instantiation_authkey(keyid); 473 if (!IS_ERR(instkey)) { 474 key_put(instkey); 475 key_ref = lookup_user_key(keyid, 476 0, 1, 0); 477 if (!IS_ERR(key_ref)) 478 goto okay; 479 } 480 } 481 482 ret = PTR_ERR(key_ref); 483 goto error; 484 } 485 486 okay: 487 /* calculate how much description we're going to return */ 488 ret = -ENOMEM; 489 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL); 490 if (!tmpbuf) 491 goto error2; 492 493 key = key_ref_to_ptr(key_ref); 494 495 ret = snprintf(tmpbuf, PAGE_SIZE - 1, 496 "%s;%d;%d;%08x;%s", 497 key_ref_to_ptr(key_ref)->type->name, 498 key_ref_to_ptr(key_ref)->uid, 499 key_ref_to_ptr(key_ref)->gid, 500 key_ref_to_ptr(key_ref)->perm, 501 key_ref_to_ptr(key_ref)->description ? 502 key_ref_to_ptr(key_ref)->description : "" 503 ); 504 505 /* include a NUL char at the end of the data */ 506 if (ret > PAGE_SIZE - 1) 507 ret = PAGE_SIZE - 1; 508 tmpbuf[ret] = 0; 509 ret++; 510 511 /* consider returning the data */ 512 if (buffer && buflen > 0) { 513 if (buflen > ret) 514 buflen = ret; 515 516 if (copy_to_user(buffer, tmpbuf, buflen) != 0) 517 ret = -EFAULT; 518 } 519 520 kfree(tmpbuf); 521 error2: 522 key_ref_put(key_ref); 523 error: 524 return ret; 525 526 } /* end keyctl_describe_key() */ 527 528 /*****************************************************************************/ 529 /* 530 * search the specified keyring for a matching key 531 * - the start keyring must be searchable 532 * - nested keyrings may also be searched if they are searchable 533 * - only keys with search permission may be found 534 * - if a key is found, it will be attached to the destination keyring if 535 * there's one specified 536 * - implements keyctl(KEYCTL_SEARCH) 537 */ 538 long keyctl_keyring_search(key_serial_t ringid, 539 const char __user *_type, 540 const char __user *_description, 541 key_serial_t destringid) 542 { 543 struct key_type *ktype; 544 key_ref_t keyring_ref, key_ref, dest_ref; 545 char type[32], *description; 546 long ret; 547 548 /* pull the type and description into kernel space */ 549 ret = key_get_type_from_user(type, _type, sizeof(type)); 550 if (ret < 0) 551 goto error; 552 553 description = strndup_user(_description, PAGE_SIZE); 554 if (IS_ERR(description)) { 555 ret = PTR_ERR(description); 556 goto error; 557 } 558 559 /* get the keyring at which to begin the search */ 560 keyring_ref = lookup_user_key(ringid, 0, 0, KEY_SEARCH); 561 if (IS_ERR(keyring_ref)) { 562 ret = PTR_ERR(keyring_ref); 563 goto error2; 564 } 565 566 /* get the destination keyring if specified */ 567 dest_ref = NULL; 568 if (destringid) { 569 dest_ref = lookup_user_key(destringid, 1, 0, KEY_WRITE); 570 if (IS_ERR(dest_ref)) { 571 ret = PTR_ERR(dest_ref); 572 goto error3; 573 } 574 } 575 576 /* find the key type */ 577 ktype = key_type_lookup(type); 578 if (IS_ERR(ktype)) { 579 ret = PTR_ERR(ktype); 580 goto error4; 581 } 582 583 /* do the search */ 584 key_ref = keyring_search(keyring_ref, ktype, description); 585 if (IS_ERR(key_ref)) { 586 ret = PTR_ERR(key_ref); 587 588 /* treat lack or presence of a negative key the same */ 589 if (ret == -EAGAIN) 590 ret = -ENOKEY; 591 goto error5; 592 } 593 594 /* link the resulting key to the destination keyring if we can */ 595 if (dest_ref) { 596 ret = key_permission(key_ref, KEY_LINK); 597 if (ret < 0) 598 goto error6; 599 600 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref)); 601 if (ret < 0) 602 goto error6; 603 } 604 605 ret = key_ref_to_ptr(key_ref)->serial; 606 607 error6: 608 key_ref_put(key_ref); 609 error5: 610 key_type_put(ktype); 611 error4: 612 key_ref_put(dest_ref); 613 error3: 614 key_ref_put(keyring_ref); 615 error2: 616 kfree(description); 617 error: 618 return ret; 619 620 } /* end keyctl_keyring_search() */ 621 622 /*****************************************************************************/ 623 /* 624 * read a user key's payload 625 * - the keyring must be readable or the key must be searchable from the 626 * process's keyrings 627 * - if there's a buffer, we place up to buflen bytes of data into it 628 * - unless there's an error, we return the amount of data in the key, 629 * irrespective of how much we may have copied 630 * - implements keyctl(KEYCTL_READ) 631 */ 632 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) 633 { 634 struct key *key; 635 key_ref_t key_ref; 636 long ret; 637 638 /* find the key first */ 639 key_ref = lookup_user_key(keyid, 0, 0, 0); 640 if (IS_ERR(key_ref)) { 641 ret = -ENOKEY; 642 goto error; 643 } 644 645 key = key_ref_to_ptr(key_ref); 646 647 /* see if we can read it directly */ 648 ret = key_permission(key_ref, KEY_READ); 649 if (ret == 0) 650 goto can_read_key; 651 if (ret != -EACCES) 652 goto error; 653 654 /* we can't; see if it's searchable from this process's keyrings 655 * - we automatically take account of the fact that it may be 656 * dangling off an instantiation key 657 */ 658 if (!is_key_possessed(key_ref)) { 659 ret = -EACCES; 660 goto error2; 661 } 662 663 /* the key is probably readable - now try to read it */ 664 can_read_key: 665 ret = key_validate(key); 666 if (ret == 0) { 667 ret = -EOPNOTSUPP; 668 if (key->type->read) { 669 /* read the data with the semaphore held (since we 670 * might sleep) */ 671 down_read(&key->sem); 672 ret = key->type->read(key, buffer, buflen); 673 up_read(&key->sem); 674 } 675 } 676 677 error2: 678 key_put(key); 679 error: 680 return ret; 681 682 } /* end keyctl_read_key() */ 683 684 /*****************************************************************************/ 685 /* 686 * change the ownership of a key 687 * - the keyring owned by the changer 688 * - if the uid or gid is -1, then that parameter is not changed 689 * - implements keyctl(KEYCTL_CHOWN) 690 */ 691 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid) 692 { 693 struct key_user *newowner, *zapowner = NULL; 694 struct key *key; 695 key_ref_t key_ref; 696 long ret; 697 698 ret = 0; 699 if (uid == (uid_t) -1 && gid == (gid_t) -1) 700 goto error; 701 702 key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR); 703 if (IS_ERR(key_ref)) { 704 ret = PTR_ERR(key_ref); 705 goto error; 706 } 707 708 key = key_ref_to_ptr(key_ref); 709 710 /* make the changes with the locks held to prevent chown/chown races */ 711 ret = -EACCES; 712 down_write(&key->sem); 713 714 if (!capable(CAP_SYS_ADMIN)) { 715 /* only the sysadmin can chown a key to some other UID */ 716 if (uid != (uid_t) -1 && key->uid != uid) 717 goto error_put; 718 719 /* only the sysadmin can set the key's GID to a group other 720 * than one of those that the current process subscribes to */ 721 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid)) 722 goto error_put; 723 } 724 725 /* change the UID */ 726 if (uid != (uid_t) -1 && uid != key->uid) { 727 ret = -ENOMEM; 728 newowner = key_user_lookup(uid); 729 if (!newowner) 730 goto error_put; 731 732 /* transfer the quota burden to the new user */ 733 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 734 unsigned maxkeys = (uid == 0) ? 735 key_quota_root_maxkeys : key_quota_maxkeys; 736 unsigned maxbytes = (uid == 0) ? 737 key_quota_root_maxbytes : key_quota_maxbytes; 738 739 spin_lock(&newowner->lock); 740 if (newowner->qnkeys + 1 >= maxkeys || 741 newowner->qnbytes + key->quotalen >= maxbytes || 742 newowner->qnbytes + key->quotalen < 743 newowner->qnbytes) 744 goto quota_overrun; 745 746 newowner->qnkeys++; 747 newowner->qnbytes += key->quotalen; 748 spin_unlock(&newowner->lock); 749 750 spin_lock(&key->user->lock); 751 key->user->qnkeys--; 752 key->user->qnbytes -= key->quotalen; 753 spin_unlock(&key->user->lock); 754 } 755 756 atomic_dec(&key->user->nkeys); 757 atomic_inc(&newowner->nkeys); 758 759 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) { 760 atomic_dec(&key->user->nikeys); 761 atomic_inc(&newowner->nikeys); 762 } 763 764 zapowner = key->user; 765 key->user = newowner; 766 key->uid = uid; 767 } 768 769 /* change the GID */ 770 if (gid != (gid_t) -1) 771 key->gid = gid; 772 773 ret = 0; 774 775 error_put: 776 up_write(&key->sem); 777 key_put(key); 778 if (zapowner) 779 key_user_put(zapowner); 780 error: 781 return ret; 782 783 quota_overrun: 784 spin_unlock(&newowner->lock); 785 zapowner = newowner; 786 ret = -EDQUOT; 787 goto error_put; 788 789 } /* end keyctl_chown_key() */ 790 791 /*****************************************************************************/ 792 /* 793 * change the permission mask on a key 794 * - the keyring owned by the changer 795 * - implements keyctl(KEYCTL_SETPERM) 796 */ 797 long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 798 { 799 struct key *key; 800 key_ref_t key_ref; 801 long ret; 802 803 ret = -EINVAL; 804 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL)) 805 goto error; 806 807 key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR); 808 if (IS_ERR(key_ref)) { 809 ret = PTR_ERR(key_ref); 810 goto error; 811 } 812 813 key = key_ref_to_ptr(key_ref); 814 815 /* make the changes with the locks held to prevent chown/chmod races */ 816 ret = -EACCES; 817 down_write(&key->sem); 818 819 /* if we're not the sysadmin, we can only change a key that we own */ 820 if (capable(CAP_SYS_ADMIN) || key->uid == current_fsuid()) { 821 key->perm = perm; 822 ret = 0; 823 } 824 825 up_write(&key->sem); 826 key_put(key); 827 error: 828 return ret; 829 830 } /* end keyctl_setperm_key() */ 831 832 /* 833 * get the destination keyring for instantiation 834 */ 835 static long get_instantiation_keyring(key_serial_t ringid, 836 struct request_key_auth *rka, 837 struct key **_dest_keyring) 838 { 839 key_ref_t dkref; 840 841 /* just return a NULL pointer if we weren't asked to make a link */ 842 if (ringid == 0) { 843 *_dest_keyring = NULL; 844 return 0; 845 } 846 847 /* if a specific keyring is nominated by ID, then use that */ 848 if (ringid > 0) { 849 dkref = lookup_user_key(ringid, 1, 0, KEY_WRITE); 850 if (IS_ERR(dkref)) 851 return PTR_ERR(dkref); 852 *_dest_keyring = key_ref_to_ptr(dkref); 853 return 0; 854 } 855 856 if (ringid == KEY_SPEC_REQKEY_AUTH_KEY) 857 return -EINVAL; 858 859 /* otherwise specify the destination keyring recorded in the 860 * authorisation key (any KEY_SPEC_*_KEYRING) */ 861 if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) { 862 *_dest_keyring = rka->dest_keyring; 863 return 0; 864 } 865 866 return -ENOKEY; 867 } 868 869 /*****************************************************************************/ 870 /* 871 * instantiate the key with the specified payload, and, if one is given, link 872 * the key into the keyring 873 */ 874 long keyctl_instantiate_key(key_serial_t id, 875 const void __user *_payload, 876 size_t plen, 877 key_serial_t ringid) 878 { 879 struct request_key_auth *rka; 880 struct key *instkey, *dest_keyring; 881 void *payload; 882 long ret; 883 bool vm = false; 884 885 ret = -EINVAL; 886 if (plen > 1024 * 1024 - 1) 887 goto error; 888 889 /* the appropriate instantiation authorisation key must have been 890 * assumed before calling this */ 891 ret = -EPERM; 892 instkey = current->cred->request_key_auth; 893 if (!instkey) 894 goto error; 895 896 rka = instkey->payload.data; 897 if (rka->target_key->serial != id) 898 goto error; 899 900 /* pull the payload in if one was supplied */ 901 payload = NULL; 902 903 if (_payload) { 904 ret = -ENOMEM; 905 payload = kmalloc(plen, GFP_KERNEL); 906 if (!payload) { 907 if (plen <= PAGE_SIZE) 908 goto error; 909 vm = true; 910 payload = vmalloc(plen); 911 if (!payload) 912 goto error; 913 } 914 915 ret = -EFAULT; 916 if (copy_from_user(payload, _payload, plen) != 0) 917 goto error2; 918 } 919 920 /* find the destination keyring amongst those belonging to the 921 * requesting task */ 922 ret = get_instantiation_keyring(ringid, rka, &dest_keyring); 923 if (ret < 0) 924 goto error2; 925 926 /* instantiate the key and link it into a keyring */ 927 ret = key_instantiate_and_link(rka->target_key, payload, plen, 928 dest_keyring, instkey); 929 930 key_put(dest_keyring); 931 932 /* discard the assumed authority if it's just been disabled by 933 * instantiation of the key */ 934 if (ret == 0) { 935 key_put(current->cred->request_key_auth); 936 current->cred->request_key_auth = NULL; 937 } 938 939 error2: 940 if (!vm) 941 kfree(payload); 942 else 943 vfree(payload); 944 error: 945 return ret; 946 947 } /* end keyctl_instantiate_key() */ 948 949 /*****************************************************************************/ 950 /* 951 * negatively instantiate the key with the given timeout (in seconds), and, if 952 * one is given, link the key into the keyring 953 */ 954 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid) 955 { 956 struct request_key_auth *rka; 957 struct key *instkey, *dest_keyring; 958 long ret; 959 960 /* the appropriate instantiation authorisation key must have been 961 * assumed before calling this */ 962 ret = -EPERM; 963 instkey = current->cred->request_key_auth; 964 if (!instkey) 965 goto error; 966 967 rka = instkey->payload.data; 968 if (rka->target_key->serial != id) 969 goto error; 970 971 /* find the destination keyring if present (which must also be 972 * writable) */ 973 ret = get_instantiation_keyring(ringid, rka, &dest_keyring); 974 if (ret < 0) 975 goto error; 976 977 /* instantiate the key and link it into a keyring */ 978 ret = key_negate_and_link(rka->target_key, timeout, 979 dest_keyring, instkey); 980 981 key_put(dest_keyring); 982 983 /* discard the assumed authority if it's just been disabled by 984 * instantiation of the key */ 985 if (ret == 0) { 986 key_put(current->cred->request_key_auth); 987 current->cred->request_key_auth = NULL; 988 } 989 990 error: 991 return ret; 992 993 } /* end keyctl_negate_key() */ 994 995 /*****************************************************************************/ 996 /* 997 * set the default keyring in which request_key() will cache keys 998 * - return the old setting 999 */ 1000 long keyctl_set_reqkey_keyring(int reqkey_defl) 1001 { 1002 struct cred *cred = current->cred; 1003 int ret; 1004 1005 switch (reqkey_defl) { 1006 case KEY_REQKEY_DEFL_THREAD_KEYRING: 1007 ret = install_thread_keyring(); 1008 if (ret < 0) 1009 return ret; 1010 goto set; 1011 1012 case KEY_REQKEY_DEFL_PROCESS_KEYRING: 1013 ret = install_process_keyring(); 1014 if (ret < 0) 1015 return ret; 1016 1017 case KEY_REQKEY_DEFL_DEFAULT: 1018 case KEY_REQKEY_DEFL_SESSION_KEYRING: 1019 case KEY_REQKEY_DEFL_USER_KEYRING: 1020 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING: 1021 set: 1022 cred->jit_keyring = reqkey_defl; 1023 1024 case KEY_REQKEY_DEFL_NO_CHANGE: 1025 return cred->jit_keyring; 1026 1027 case KEY_REQKEY_DEFL_GROUP_KEYRING: 1028 default: 1029 return -EINVAL; 1030 } 1031 1032 } /* end keyctl_set_reqkey_keyring() */ 1033 1034 /*****************************************************************************/ 1035 /* 1036 * set or clear the timeout for a key 1037 */ 1038 long keyctl_set_timeout(key_serial_t id, unsigned timeout) 1039 { 1040 struct timespec now; 1041 struct key *key; 1042 key_ref_t key_ref; 1043 time_t expiry; 1044 long ret; 1045 1046 key_ref = lookup_user_key(id, 1, 1, KEY_SETATTR); 1047 if (IS_ERR(key_ref)) { 1048 ret = PTR_ERR(key_ref); 1049 goto error; 1050 } 1051 1052 key = key_ref_to_ptr(key_ref); 1053 1054 /* make the changes with the locks held to prevent races */ 1055 down_write(&key->sem); 1056 1057 expiry = 0; 1058 if (timeout > 0) { 1059 now = current_kernel_time(); 1060 expiry = now.tv_sec + timeout; 1061 } 1062 1063 key->expiry = expiry; 1064 1065 up_write(&key->sem); 1066 key_put(key); 1067 1068 ret = 0; 1069 error: 1070 return ret; 1071 1072 } /* end keyctl_set_timeout() */ 1073 1074 /*****************************************************************************/ 1075 /* 1076 * assume the authority to instantiate the specified key 1077 */ 1078 long keyctl_assume_authority(key_serial_t id) 1079 { 1080 struct key *authkey; 1081 long ret; 1082 1083 /* special key IDs aren't permitted */ 1084 ret = -EINVAL; 1085 if (id < 0) 1086 goto error; 1087 1088 /* we divest ourselves of authority if given an ID of 0 */ 1089 if (id == 0) { 1090 key_put(current->cred->request_key_auth); 1091 current->cred->request_key_auth = NULL; 1092 ret = 0; 1093 goto error; 1094 } 1095 1096 /* attempt to assume the authority temporarily granted to us whilst we 1097 * instantiate the specified key 1098 * - the authorisation key must be in the current task's keyrings 1099 * somewhere 1100 */ 1101 authkey = key_get_instantiation_authkey(id); 1102 if (IS_ERR(authkey)) { 1103 ret = PTR_ERR(authkey); 1104 goto error; 1105 } 1106 1107 key_put(current->cred->request_key_auth); 1108 current->cred->request_key_auth = authkey; 1109 ret = authkey->serial; 1110 1111 error: 1112 return ret; 1113 1114 } /* end keyctl_assume_authority() */ 1115 1116 /* 1117 * get the security label of a key 1118 * - the key must grant us view permission 1119 * - if there's a buffer, we place up to buflen bytes of data into it 1120 * - unless there's an error, we return the amount of information available, 1121 * irrespective of how much we may have copied (including the terminal NUL) 1122 * - implements keyctl(KEYCTL_GET_SECURITY) 1123 */ 1124 long keyctl_get_security(key_serial_t keyid, 1125 char __user *buffer, 1126 size_t buflen) 1127 { 1128 struct key *key, *instkey; 1129 key_ref_t key_ref; 1130 char *context; 1131 long ret; 1132 1133 key_ref = lookup_user_key(keyid, 0, 1, KEY_VIEW); 1134 if (IS_ERR(key_ref)) { 1135 if (PTR_ERR(key_ref) != -EACCES) 1136 return PTR_ERR(key_ref); 1137 1138 /* viewing a key under construction is also permitted if we 1139 * have the authorisation token handy */ 1140 instkey = key_get_instantiation_authkey(keyid); 1141 if (IS_ERR(instkey)) 1142 return PTR_ERR(key_ref); 1143 key_put(instkey); 1144 1145 key_ref = lookup_user_key(keyid, 0, 1, 0); 1146 if (IS_ERR(key_ref)) 1147 return PTR_ERR(key_ref); 1148 } 1149 1150 key = key_ref_to_ptr(key_ref); 1151 ret = security_key_getsecurity(key, &context); 1152 if (ret == 0) { 1153 /* if no information was returned, give userspace an empty 1154 * string */ 1155 ret = 1; 1156 if (buffer && buflen > 0 && 1157 copy_to_user(buffer, "", 1) != 0) 1158 ret = -EFAULT; 1159 } else if (ret > 0) { 1160 /* return as much data as there's room for */ 1161 if (buffer && buflen > 0) { 1162 if (buflen > ret) 1163 buflen = ret; 1164 1165 if (copy_to_user(buffer, context, buflen) != 0) 1166 ret = -EFAULT; 1167 } 1168 1169 kfree(context); 1170 } 1171 1172 key_ref_put(key_ref); 1173 return ret; 1174 } 1175 1176 /*****************************************************************************/ 1177 /* 1178 * the key control system call 1179 */ 1180 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3, 1181 unsigned long arg4, unsigned long arg5) 1182 { 1183 switch (option) { 1184 case KEYCTL_GET_KEYRING_ID: 1185 return keyctl_get_keyring_ID((key_serial_t) arg2, 1186 (int) arg3); 1187 1188 case KEYCTL_JOIN_SESSION_KEYRING: 1189 return keyctl_join_session_keyring((const char __user *) arg2); 1190 1191 case KEYCTL_UPDATE: 1192 return keyctl_update_key((key_serial_t) arg2, 1193 (const void __user *) arg3, 1194 (size_t) arg4); 1195 1196 case KEYCTL_REVOKE: 1197 return keyctl_revoke_key((key_serial_t) arg2); 1198 1199 case KEYCTL_DESCRIBE: 1200 return keyctl_describe_key((key_serial_t) arg2, 1201 (char __user *) arg3, 1202 (unsigned) arg4); 1203 1204 case KEYCTL_CLEAR: 1205 return keyctl_keyring_clear((key_serial_t) arg2); 1206 1207 case KEYCTL_LINK: 1208 return keyctl_keyring_link((key_serial_t) arg2, 1209 (key_serial_t) arg3); 1210 1211 case KEYCTL_UNLINK: 1212 return keyctl_keyring_unlink((key_serial_t) arg2, 1213 (key_serial_t) arg3); 1214 1215 case KEYCTL_SEARCH: 1216 return keyctl_keyring_search((key_serial_t) arg2, 1217 (const char __user *) arg3, 1218 (const char __user *) arg4, 1219 (key_serial_t) arg5); 1220 1221 case KEYCTL_READ: 1222 return keyctl_read_key((key_serial_t) arg2, 1223 (char __user *) arg3, 1224 (size_t) arg4); 1225 1226 case KEYCTL_CHOWN: 1227 return keyctl_chown_key((key_serial_t) arg2, 1228 (uid_t) arg3, 1229 (gid_t) arg4); 1230 1231 case KEYCTL_SETPERM: 1232 return keyctl_setperm_key((key_serial_t) arg2, 1233 (key_perm_t) arg3); 1234 1235 case KEYCTL_INSTANTIATE: 1236 return keyctl_instantiate_key((key_serial_t) arg2, 1237 (const void __user *) arg3, 1238 (size_t) arg4, 1239 (key_serial_t) arg5); 1240 1241 case KEYCTL_NEGATE: 1242 return keyctl_negate_key((key_serial_t) arg2, 1243 (unsigned) arg3, 1244 (key_serial_t) arg4); 1245 1246 case KEYCTL_SET_REQKEY_KEYRING: 1247 return keyctl_set_reqkey_keyring(arg2); 1248 1249 case KEYCTL_SET_TIMEOUT: 1250 return keyctl_set_timeout((key_serial_t) arg2, 1251 (unsigned) arg3); 1252 1253 case KEYCTL_ASSUME_AUTHORITY: 1254 return keyctl_assume_authority((key_serial_t) arg2); 1255 1256 case KEYCTL_GET_SECURITY: 1257 return keyctl_get_security((key_serial_t) arg2, 1258 (char *) arg3, 1259 (size_t) arg4); 1260 1261 default: 1262 return -EOPNOTSUPP; 1263 } 1264 1265 } /* end sys_keyctl() */ 1266