1 /* Userspace key control operations 2 * 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/init.h> 13 #include <linux/sched.h> 14 #include <linux/sched/task.h> 15 #include <linux/slab.h> 16 #include <linux/syscalls.h> 17 #include <linux/key.h> 18 #include <linux/keyctl.h> 19 #include <linux/fs.h> 20 #include <linux/capability.h> 21 #include <linux/cred.h> 22 #include <linux/string.h> 23 #include <linux/err.h> 24 #include <linux/vmalloc.h> 25 #include <linux/security.h> 26 #include <linux/uio.h> 27 #include <linux/uaccess.h> 28 #include <keys/request_key_auth-type.h> 29 #include "internal.h" 30 31 #define KEY_MAX_DESC_SIZE 4096 32 33 static int key_get_type_from_user(char *type, 34 const char __user *_type, 35 unsigned len) 36 { 37 int ret; 38 39 ret = strncpy_from_user(type, _type, len); 40 if (ret < 0) 41 return ret; 42 if (ret == 0 || ret >= len) 43 return -EINVAL; 44 if (type[0] == '.') 45 return -EPERM; 46 type[len - 1] = '\0'; 47 return 0; 48 } 49 50 /* 51 * Extract the description of a new key from userspace and either add it as a 52 * new key to the specified keyring or update a matching key in that keyring. 53 * 54 * If the description is NULL or an empty string, the key type is asked to 55 * generate one from the payload. 56 * 57 * The keyring must be writable so that we can attach the key to it. 58 * 59 * If successful, the new key's serial number is returned, otherwise an error 60 * code is returned. 61 */ 62 SYSCALL_DEFINE5(add_key, const char __user *, _type, 63 const char __user *, _description, 64 const void __user *, _payload, 65 size_t, plen, 66 key_serial_t, ringid) 67 { 68 key_ref_t keyring_ref, key_ref; 69 char type[32], *description; 70 void *payload; 71 long ret; 72 73 ret = -EINVAL; 74 if (plen > 1024 * 1024 - 1) 75 goto error; 76 77 /* draw all the data into kernel space */ 78 ret = key_get_type_from_user(type, _type, sizeof(type)); 79 if (ret < 0) 80 goto error; 81 82 description = NULL; 83 if (_description) { 84 description = strndup_user(_description, KEY_MAX_DESC_SIZE); 85 if (IS_ERR(description)) { 86 ret = PTR_ERR(description); 87 goto error; 88 } 89 if (!*description) { 90 kfree(description); 91 description = NULL; 92 } else if ((description[0] == '.') && 93 (strncmp(type, "keyring", 7) == 0)) { 94 ret = -EPERM; 95 goto error2; 96 } 97 } 98 99 /* pull the payload in if one was supplied */ 100 payload = NULL; 101 102 if (plen) { 103 ret = -ENOMEM; 104 payload = kvmalloc(plen, GFP_KERNEL); 105 if (!payload) 106 goto error2; 107 108 ret = -EFAULT; 109 if (copy_from_user(payload, _payload, plen) != 0) 110 goto error3; 111 } 112 113 /* find the target keyring (which must be writable) */ 114 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE); 115 if (IS_ERR(keyring_ref)) { 116 ret = PTR_ERR(keyring_ref); 117 goto error3; 118 } 119 120 /* create or update the requested key and add it to the target 121 * keyring */ 122 key_ref = key_create_or_update(keyring_ref, type, description, 123 payload, plen, KEY_PERM_UNDEF, 124 KEY_ALLOC_IN_QUOTA); 125 if (!IS_ERR(key_ref)) { 126 ret = key_ref_to_ptr(key_ref)->serial; 127 key_ref_put(key_ref); 128 } 129 else { 130 ret = PTR_ERR(key_ref); 131 } 132 133 key_ref_put(keyring_ref); 134 error3: 135 if (payload) { 136 memzero_explicit(payload, plen); 137 kvfree(payload); 138 } 139 error2: 140 kfree(description); 141 error: 142 return ret; 143 } 144 145 /* 146 * Search the process keyrings and keyring trees linked from those for a 147 * matching key. Keyrings must have appropriate Search permission to be 148 * searched. 149 * 150 * If a key is found, it will be attached to the destination keyring if there's 151 * one specified and the serial number of the key will be returned. 152 * 153 * If no key is found, /sbin/request-key will be invoked if _callout_info is 154 * non-NULL in an attempt to create a key. The _callout_info string will be 155 * passed to /sbin/request-key to aid with completing the request. If the 156 * _callout_info string is "" then it will be changed to "-". 157 */ 158 SYSCALL_DEFINE4(request_key, const char __user *, _type, 159 const char __user *, _description, 160 const char __user *, _callout_info, 161 key_serial_t, destringid) 162 { 163 struct key_type *ktype; 164 struct key *key; 165 key_ref_t dest_ref; 166 size_t callout_len; 167 char type[32], *description, *callout_info; 168 long ret; 169 170 /* pull the type into kernel space */ 171 ret = key_get_type_from_user(type, _type, sizeof(type)); 172 if (ret < 0) 173 goto error; 174 175 /* pull the description into kernel space */ 176 description = strndup_user(_description, KEY_MAX_DESC_SIZE); 177 if (IS_ERR(description)) { 178 ret = PTR_ERR(description); 179 goto error; 180 } 181 182 /* pull the callout info into kernel space */ 183 callout_info = NULL; 184 callout_len = 0; 185 if (_callout_info) { 186 callout_info = strndup_user(_callout_info, PAGE_SIZE); 187 if (IS_ERR(callout_info)) { 188 ret = PTR_ERR(callout_info); 189 goto error2; 190 } 191 callout_len = strlen(callout_info); 192 } 193 194 /* get the destination keyring if specified */ 195 dest_ref = NULL; 196 if (destringid) { 197 dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE, 198 KEY_NEED_WRITE); 199 if (IS_ERR(dest_ref)) { 200 ret = PTR_ERR(dest_ref); 201 goto error3; 202 } 203 } 204 205 /* find the key type */ 206 ktype = key_type_lookup(type); 207 if (IS_ERR(ktype)) { 208 ret = PTR_ERR(ktype); 209 goto error4; 210 } 211 212 /* do the search */ 213 key = request_key_and_link(ktype, description, callout_info, 214 callout_len, NULL, key_ref_to_ptr(dest_ref), 215 KEY_ALLOC_IN_QUOTA); 216 if (IS_ERR(key)) { 217 ret = PTR_ERR(key); 218 goto error5; 219 } 220 221 /* wait for the key to finish being constructed */ 222 ret = wait_for_key_construction(key, 1); 223 if (ret < 0) 224 goto error6; 225 226 ret = key->serial; 227 228 error6: 229 key_put(key); 230 error5: 231 key_type_put(ktype); 232 error4: 233 key_ref_put(dest_ref); 234 error3: 235 kfree(callout_info); 236 error2: 237 kfree(description); 238 error: 239 return ret; 240 } 241 242 /* 243 * Get the ID of the specified process keyring. 244 * 245 * The requested keyring must have search permission to be found. 246 * 247 * If successful, the ID of the requested keyring will be returned. 248 */ 249 long keyctl_get_keyring_ID(key_serial_t id, int create) 250 { 251 key_ref_t key_ref; 252 unsigned long lflags; 253 long ret; 254 255 lflags = create ? KEY_LOOKUP_CREATE : 0; 256 key_ref = lookup_user_key(id, lflags, KEY_NEED_SEARCH); 257 if (IS_ERR(key_ref)) { 258 ret = PTR_ERR(key_ref); 259 goto error; 260 } 261 262 ret = key_ref_to_ptr(key_ref)->serial; 263 key_ref_put(key_ref); 264 error: 265 return ret; 266 } 267 268 /* 269 * Join a (named) session keyring. 270 * 271 * Create and join an anonymous session keyring or join a named session 272 * keyring, creating it if necessary. A named session keyring must have Search 273 * permission for it to be joined. Session keyrings without this permit will 274 * be skipped over. It is not permitted for userspace to create or join 275 * keyrings whose name begin with a dot. 276 * 277 * If successful, the ID of the joined session keyring will be returned. 278 */ 279 long keyctl_join_session_keyring(const char __user *_name) 280 { 281 char *name; 282 long ret; 283 284 /* fetch the name from userspace */ 285 name = NULL; 286 if (_name) { 287 name = strndup_user(_name, KEY_MAX_DESC_SIZE); 288 if (IS_ERR(name)) { 289 ret = PTR_ERR(name); 290 goto error; 291 } 292 293 ret = -EPERM; 294 if (name[0] == '.') 295 goto error_name; 296 } 297 298 /* join the session */ 299 ret = join_session_keyring(name); 300 error_name: 301 kfree(name); 302 error: 303 return ret; 304 } 305 306 /* 307 * Update a key's data payload from the given data. 308 * 309 * The key must grant the caller Write permission and the key type must support 310 * updating for this to work. A negative key can be positively instantiated 311 * with this call. 312 * 313 * If successful, 0 will be returned. If the key type does not support 314 * updating, then -EOPNOTSUPP will be returned. 315 */ 316 long keyctl_update_key(key_serial_t id, 317 const void __user *_payload, 318 size_t plen) 319 { 320 key_ref_t key_ref; 321 void *payload; 322 long ret; 323 324 ret = -EINVAL; 325 if (plen > PAGE_SIZE) 326 goto error; 327 328 /* pull the payload in if one was supplied */ 329 payload = NULL; 330 if (plen) { 331 ret = -ENOMEM; 332 payload = kmalloc(plen, GFP_KERNEL); 333 if (!payload) 334 goto error; 335 336 ret = -EFAULT; 337 if (copy_from_user(payload, _payload, plen) != 0) 338 goto error2; 339 } 340 341 /* find the target key (which must be writable) */ 342 key_ref = lookup_user_key(id, 0, KEY_NEED_WRITE); 343 if (IS_ERR(key_ref)) { 344 ret = PTR_ERR(key_ref); 345 goto error2; 346 } 347 348 /* update the key */ 349 ret = key_update(key_ref, payload, plen); 350 351 key_ref_put(key_ref); 352 error2: 353 kzfree(payload); 354 error: 355 return ret; 356 } 357 358 /* 359 * Revoke a key. 360 * 361 * The key must be grant the caller Write or Setattr permission for this to 362 * work. The key type should give up its quota claim when revoked. The key 363 * and any links to the key will be automatically garbage collected after a 364 * certain amount of time (/proc/sys/kernel/keys/gc_delay). 365 * 366 * Keys with KEY_FLAG_KEEP set should not be revoked. 367 * 368 * If successful, 0 is returned. 369 */ 370 long keyctl_revoke_key(key_serial_t id) 371 { 372 key_ref_t key_ref; 373 struct key *key; 374 long ret; 375 376 key_ref = lookup_user_key(id, 0, KEY_NEED_WRITE); 377 if (IS_ERR(key_ref)) { 378 ret = PTR_ERR(key_ref); 379 if (ret != -EACCES) 380 goto error; 381 key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR); 382 if (IS_ERR(key_ref)) { 383 ret = PTR_ERR(key_ref); 384 goto error; 385 } 386 } 387 388 key = key_ref_to_ptr(key_ref); 389 ret = 0; 390 if (test_bit(KEY_FLAG_KEEP, &key->flags)) 391 ret = -EPERM; 392 else 393 key_revoke(key); 394 395 key_ref_put(key_ref); 396 error: 397 return ret; 398 } 399 400 /* 401 * Invalidate a key. 402 * 403 * The key must be grant the caller Invalidate permission for this to work. 404 * The key and any links to the key will be automatically garbage collected 405 * immediately. 406 * 407 * Keys with KEY_FLAG_KEEP set should not be invalidated. 408 * 409 * If successful, 0 is returned. 410 */ 411 long keyctl_invalidate_key(key_serial_t id) 412 { 413 key_ref_t key_ref; 414 struct key *key; 415 long ret; 416 417 kenter("%d", id); 418 419 key_ref = lookup_user_key(id, 0, KEY_NEED_SEARCH); 420 if (IS_ERR(key_ref)) { 421 ret = PTR_ERR(key_ref); 422 423 /* Root is permitted to invalidate certain special keys */ 424 if (capable(CAP_SYS_ADMIN)) { 425 key_ref = lookup_user_key(id, 0, 0); 426 if (IS_ERR(key_ref)) 427 goto error; 428 if (test_bit(KEY_FLAG_ROOT_CAN_INVAL, 429 &key_ref_to_ptr(key_ref)->flags)) 430 goto invalidate; 431 goto error_put; 432 } 433 434 goto error; 435 } 436 437 invalidate: 438 key = key_ref_to_ptr(key_ref); 439 ret = 0; 440 if (test_bit(KEY_FLAG_KEEP, &key->flags)) 441 ret = -EPERM; 442 else 443 key_invalidate(key); 444 error_put: 445 key_ref_put(key_ref); 446 error: 447 kleave(" = %ld", ret); 448 return ret; 449 } 450 451 /* 452 * Clear the specified keyring, creating an empty process keyring if one of the 453 * special keyring IDs is used. 454 * 455 * The keyring must grant the caller Write permission and not have 456 * KEY_FLAG_KEEP set for this to work. If successful, 0 will be returned. 457 */ 458 long keyctl_keyring_clear(key_serial_t ringid) 459 { 460 key_ref_t keyring_ref; 461 struct key *keyring; 462 long ret; 463 464 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE); 465 if (IS_ERR(keyring_ref)) { 466 ret = PTR_ERR(keyring_ref); 467 468 /* Root is permitted to invalidate certain special keyrings */ 469 if (capable(CAP_SYS_ADMIN)) { 470 keyring_ref = lookup_user_key(ringid, 0, 0); 471 if (IS_ERR(keyring_ref)) 472 goto error; 473 if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR, 474 &key_ref_to_ptr(keyring_ref)->flags)) 475 goto clear; 476 goto error_put; 477 } 478 479 goto error; 480 } 481 482 clear: 483 keyring = key_ref_to_ptr(keyring_ref); 484 if (test_bit(KEY_FLAG_KEEP, &keyring->flags)) 485 ret = -EPERM; 486 else 487 ret = keyring_clear(keyring); 488 error_put: 489 key_ref_put(keyring_ref); 490 error: 491 return ret; 492 } 493 494 /* 495 * Create a link from a keyring to a key if there's no matching key in the 496 * keyring, otherwise replace the link to the matching key with a link to the 497 * new key. 498 * 499 * The key must grant the caller Link permission and the the keyring must grant 500 * the caller Write permission. Furthermore, if an additional link is created, 501 * the keyring's quota will be extended. 502 * 503 * If successful, 0 will be returned. 504 */ 505 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid) 506 { 507 key_ref_t keyring_ref, key_ref; 508 long ret; 509 510 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE); 511 if (IS_ERR(keyring_ref)) { 512 ret = PTR_ERR(keyring_ref); 513 goto error; 514 } 515 516 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_NEED_LINK); 517 if (IS_ERR(key_ref)) { 518 ret = PTR_ERR(key_ref); 519 goto error2; 520 } 521 522 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 523 524 key_ref_put(key_ref); 525 error2: 526 key_ref_put(keyring_ref); 527 error: 528 return ret; 529 } 530 531 /* 532 * Unlink a key from a keyring. 533 * 534 * The keyring must grant the caller Write permission for this to work; the key 535 * itself need not grant the caller anything. If the last link to a key is 536 * removed then that key will be scheduled for destruction. 537 * 538 * Keys or keyrings with KEY_FLAG_KEEP set should not be unlinked. 539 * 540 * If successful, 0 will be returned. 541 */ 542 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid) 543 { 544 key_ref_t keyring_ref, key_ref; 545 struct key *keyring, *key; 546 long ret; 547 548 keyring_ref = lookup_user_key(ringid, 0, KEY_NEED_WRITE); 549 if (IS_ERR(keyring_ref)) { 550 ret = PTR_ERR(keyring_ref); 551 goto error; 552 } 553 554 key_ref = lookup_user_key(id, KEY_LOOKUP_FOR_UNLINK, 0); 555 if (IS_ERR(key_ref)) { 556 ret = PTR_ERR(key_ref); 557 goto error2; 558 } 559 560 keyring = key_ref_to_ptr(keyring_ref); 561 key = key_ref_to_ptr(key_ref); 562 if (test_bit(KEY_FLAG_KEEP, &keyring->flags) && 563 test_bit(KEY_FLAG_KEEP, &key->flags)) 564 ret = -EPERM; 565 else 566 ret = key_unlink(keyring, key); 567 568 key_ref_put(key_ref); 569 error2: 570 key_ref_put(keyring_ref); 571 error: 572 return ret; 573 } 574 575 /* 576 * Return a description of a key to userspace. 577 * 578 * The key must grant the caller View permission for this to work. 579 * 580 * If there's a buffer, we place up to buflen bytes of data into it formatted 581 * in the following way: 582 * 583 * type;uid;gid;perm;description<NUL> 584 * 585 * If successful, we return the amount of description available, irrespective 586 * of how much we may have copied into the buffer. 587 */ 588 long keyctl_describe_key(key_serial_t keyid, 589 char __user *buffer, 590 size_t buflen) 591 { 592 struct key *key, *instkey; 593 key_ref_t key_ref; 594 char *infobuf; 595 long ret; 596 int desclen, infolen; 597 598 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW); 599 if (IS_ERR(key_ref)) { 600 /* viewing a key under construction is permitted if we have the 601 * authorisation token handy */ 602 if (PTR_ERR(key_ref) == -EACCES) { 603 instkey = key_get_instantiation_authkey(keyid); 604 if (!IS_ERR(instkey)) { 605 key_put(instkey); 606 key_ref = lookup_user_key(keyid, 607 KEY_LOOKUP_PARTIAL, 608 0); 609 if (!IS_ERR(key_ref)) 610 goto okay; 611 } 612 } 613 614 ret = PTR_ERR(key_ref); 615 goto error; 616 } 617 618 okay: 619 key = key_ref_to_ptr(key_ref); 620 desclen = strlen(key->description); 621 622 /* calculate how much information we're going to return */ 623 ret = -ENOMEM; 624 infobuf = kasprintf(GFP_KERNEL, 625 "%s;%d;%d;%08x;", 626 key->type->name, 627 from_kuid_munged(current_user_ns(), key->uid), 628 from_kgid_munged(current_user_ns(), key->gid), 629 key->perm); 630 if (!infobuf) 631 goto error2; 632 infolen = strlen(infobuf); 633 ret = infolen + desclen + 1; 634 635 /* consider returning the data */ 636 if (buffer && buflen >= ret) { 637 if (copy_to_user(buffer, infobuf, infolen) != 0 || 638 copy_to_user(buffer + infolen, key->description, 639 desclen + 1) != 0) 640 ret = -EFAULT; 641 } 642 643 kfree(infobuf); 644 error2: 645 key_ref_put(key_ref); 646 error: 647 return ret; 648 } 649 650 /* 651 * Search the specified keyring and any keyrings it links to for a matching 652 * key. Only keyrings that grant the caller Search permission will be searched 653 * (this includes the starting keyring). Only keys with Search permission can 654 * be found. 655 * 656 * If successful, the found key will be linked to the destination keyring if 657 * supplied and the key has Link permission, and the found key ID will be 658 * returned. 659 */ 660 long keyctl_keyring_search(key_serial_t ringid, 661 const char __user *_type, 662 const char __user *_description, 663 key_serial_t destringid) 664 { 665 struct key_type *ktype; 666 key_ref_t keyring_ref, key_ref, dest_ref; 667 char type[32], *description; 668 long ret; 669 670 /* pull the type and description into kernel space */ 671 ret = key_get_type_from_user(type, _type, sizeof(type)); 672 if (ret < 0) 673 goto error; 674 675 description = strndup_user(_description, KEY_MAX_DESC_SIZE); 676 if (IS_ERR(description)) { 677 ret = PTR_ERR(description); 678 goto error; 679 } 680 681 /* get the keyring at which to begin the search */ 682 keyring_ref = lookup_user_key(ringid, 0, KEY_NEED_SEARCH); 683 if (IS_ERR(keyring_ref)) { 684 ret = PTR_ERR(keyring_ref); 685 goto error2; 686 } 687 688 /* get the destination keyring if specified */ 689 dest_ref = NULL; 690 if (destringid) { 691 dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE, 692 KEY_NEED_WRITE); 693 if (IS_ERR(dest_ref)) { 694 ret = PTR_ERR(dest_ref); 695 goto error3; 696 } 697 } 698 699 /* find the key type */ 700 ktype = key_type_lookup(type); 701 if (IS_ERR(ktype)) { 702 ret = PTR_ERR(ktype); 703 goto error4; 704 } 705 706 /* do the search */ 707 key_ref = keyring_search(keyring_ref, ktype, description); 708 if (IS_ERR(key_ref)) { 709 ret = PTR_ERR(key_ref); 710 711 /* treat lack or presence of a negative key the same */ 712 if (ret == -EAGAIN) 713 ret = -ENOKEY; 714 goto error5; 715 } 716 717 /* link the resulting key to the destination keyring if we can */ 718 if (dest_ref) { 719 ret = key_permission(key_ref, KEY_NEED_LINK); 720 if (ret < 0) 721 goto error6; 722 723 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref)); 724 if (ret < 0) 725 goto error6; 726 } 727 728 ret = key_ref_to_ptr(key_ref)->serial; 729 730 error6: 731 key_ref_put(key_ref); 732 error5: 733 key_type_put(ktype); 734 error4: 735 key_ref_put(dest_ref); 736 error3: 737 key_ref_put(keyring_ref); 738 error2: 739 kfree(description); 740 error: 741 return ret; 742 } 743 744 /* 745 * Read a key's payload. 746 * 747 * The key must either grant the caller Read permission, or it must grant the 748 * caller Search permission when searched for from the process keyrings. 749 * 750 * If successful, we place up to buflen bytes of data into the buffer, if one 751 * is provided, and return the amount of data that is available in the key, 752 * irrespective of how much we copied into the buffer. 753 */ 754 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) 755 { 756 struct key *key; 757 key_ref_t key_ref; 758 long ret; 759 760 /* find the key first */ 761 key_ref = lookup_user_key(keyid, 0, 0); 762 if (IS_ERR(key_ref)) { 763 ret = -ENOKEY; 764 goto error; 765 } 766 767 key = key_ref_to_ptr(key_ref); 768 769 ret = key_read_state(key); 770 if (ret < 0) 771 goto error2; /* Negatively instantiated */ 772 773 /* see if we can read it directly */ 774 ret = key_permission(key_ref, KEY_NEED_READ); 775 if (ret == 0) 776 goto can_read_key; 777 if (ret != -EACCES) 778 goto error2; 779 780 /* we can't; see if it's searchable from this process's keyrings 781 * - we automatically take account of the fact that it may be 782 * dangling off an instantiation key 783 */ 784 if (!is_key_possessed(key_ref)) { 785 ret = -EACCES; 786 goto error2; 787 } 788 789 /* the key is probably readable - now try to read it */ 790 can_read_key: 791 ret = -EOPNOTSUPP; 792 if (key->type->read) { 793 /* Read the data with the semaphore held (since we might sleep) 794 * to protect against the key being updated or revoked. 795 */ 796 down_read(&key->sem); 797 ret = key_validate(key); 798 if (ret == 0) 799 ret = key->type->read(key, buffer, buflen); 800 up_read(&key->sem); 801 } 802 803 error2: 804 key_put(key); 805 error: 806 return ret; 807 } 808 809 /* 810 * Change the ownership of a key 811 * 812 * The key must grant the caller Setattr permission for this to work, though 813 * the key need not be fully instantiated yet. For the UID to be changed, or 814 * for the GID to be changed to a group the caller is not a member of, the 815 * caller must have sysadmin capability. If either uid or gid is -1 then that 816 * attribute is not changed. 817 * 818 * If the UID is to be changed, the new user must have sufficient quota to 819 * accept the key. The quota deduction will be removed from the old user to 820 * the new user should the attribute be changed. 821 * 822 * If successful, 0 will be returned. 823 */ 824 long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) 825 { 826 struct key_user *newowner, *zapowner = NULL; 827 struct key *key; 828 key_ref_t key_ref; 829 long ret; 830 kuid_t uid; 831 kgid_t gid; 832 833 uid = make_kuid(current_user_ns(), user); 834 gid = make_kgid(current_user_ns(), group); 835 ret = -EINVAL; 836 if ((user != (uid_t) -1) && !uid_valid(uid)) 837 goto error; 838 if ((group != (gid_t) -1) && !gid_valid(gid)) 839 goto error; 840 841 ret = 0; 842 if (user == (uid_t) -1 && group == (gid_t) -1) 843 goto error; 844 845 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 846 KEY_NEED_SETATTR); 847 if (IS_ERR(key_ref)) { 848 ret = PTR_ERR(key_ref); 849 goto error; 850 } 851 852 key = key_ref_to_ptr(key_ref); 853 854 /* make the changes with the locks held to prevent chown/chown races */ 855 ret = -EACCES; 856 down_write(&key->sem); 857 858 if (!capable(CAP_SYS_ADMIN)) { 859 /* only the sysadmin can chown a key to some other UID */ 860 if (user != (uid_t) -1 && !uid_eq(key->uid, uid)) 861 goto error_put; 862 863 /* only the sysadmin can set the key's GID to a group other 864 * than one of those that the current process subscribes to */ 865 if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid)) 866 goto error_put; 867 } 868 869 /* change the UID */ 870 if (user != (uid_t) -1 && !uid_eq(uid, key->uid)) { 871 ret = -ENOMEM; 872 newowner = key_user_lookup(uid); 873 if (!newowner) 874 goto error_put; 875 876 /* transfer the quota burden to the new user */ 877 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 878 unsigned maxkeys = uid_eq(uid, GLOBAL_ROOT_UID) ? 879 key_quota_root_maxkeys : key_quota_maxkeys; 880 unsigned maxbytes = uid_eq(uid, GLOBAL_ROOT_UID) ? 881 key_quota_root_maxbytes : key_quota_maxbytes; 882 883 spin_lock(&newowner->lock); 884 if (newowner->qnkeys + 1 >= maxkeys || 885 newowner->qnbytes + key->quotalen >= maxbytes || 886 newowner->qnbytes + key->quotalen < 887 newowner->qnbytes) 888 goto quota_overrun; 889 890 newowner->qnkeys++; 891 newowner->qnbytes += key->quotalen; 892 spin_unlock(&newowner->lock); 893 894 spin_lock(&key->user->lock); 895 key->user->qnkeys--; 896 key->user->qnbytes -= key->quotalen; 897 spin_unlock(&key->user->lock); 898 } 899 900 atomic_dec(&key->user->nkeys); 901 atomic_inc(&newowner->nkeys); 902 903 if (key->state != KEY_IS_UNINSTANTIATED) { 904 atomic_dec(&key->user->nikeys); 905 atomic_inc(&newowner->nikeys); 906 } 907 908 zapowner = key->user; 909 key->user = newowner; 910 key->uid = uid; 911 } 912 913 /* change the GID */ 914 if (group != (gid_t) -1) 915 key->gid = gid; 916 917 ret = 0; 918 919 error_put: 920 up_write(&key->sem); 921 key_put(key); 922 if (zapowner) 923 key_user_put(zapowner); 924 error: 925 return ret; 926 927 quota_overrun: 928 spin_unlock(&newowner->lock); 929 zapowner = newowner; 930 ret = -EDQUOT; 931 goto error_put; 932 } 933 934 /* 935 * Change the permission mask on a key. 936 * 937 * The key must grant the caller Setattr permission for this to work, though 938 * the key need not be fully instantiated yet. If the caller does not have 939 * sysadmin capability, it may only change the permission on keys that it owns. 940 */ 941 long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 942 { 943 struct key *key; 944 key_ref_t key_ref; 945 long ret; 946 947 ret = -EINVAL; 948 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL)) 949 goto error; 950 951 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 952 KEY_NEED_SETATTR); 953 if (IS_ERR(key_ref)) { 954 ret = PTR_ERR(key_ref); 955 goto error; 956 } 957 958 key = key_ref_to_ptr(key_ref); 959 960 /* make the changes with the locks held to prevent chown/chmod races */ 961 ret = -EACCES; 962 down_write(&key->sem); 963 964 /* if we're not the sysadmin, we can only change a key that we own */ 965 if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { 966 key->perm = perm; 967 ret = 0; 968 } 969 970 up_write(&key->sem); 971 key_put(key); 972 error: 973 return ret; 974 } 975 976 /* 977 * Get the destination keyring for instantiation and check that the caller has 978 * Write permission on it. 979 */ 980 static long get_instantiation_keyring(key_serial_t ringid, 981 struct request_key_auth *rka, 982 struct key **_dest_keyring) 983 { 984 key_ref_t dkref; 985 986 *_dest_keyring = NULL; 987 988 /* just return a NULL pointer if we weren't asked to make a link */ 989 if (ringid == 0) 990 return 0; 991 992 /* if a specific keyring is nominated by ID, then use that */ 993 if (ringid > 0) { 994 dkref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE); 995 if (IS_ERR(dkref)) 996 return PTR_ERR(dkref); 997 *_dest_keyring = key_ref_to_ptr(dkref); 998 return 0; 999 } 1000 1001 if (ringid == KEY_SPEC_REQKEY_AUTH_KEY) 1002 return -EINVAL; 1003 1004 /* otherwise specify the destination keyring recorded in the 1005 * authorisation key (any KEY_SPEC_*_KEYRING) */ 1006 if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) { 1007 *_dest_keyring = key_get(rka->dest_keyring); 1008 return 0; 1009 } 1010 1011 return -ENOKEY; 1012 } 1013 1014 /* 1015 * Change the request_key authorisation key on the current process. 1016 */ 1017 static int keyctl_change_reqkey_auth(struct key *key) 1018 { 1019 struct cred *new; 1020 1021 new = prepare_creds(); 1022 if (!new) 1023 return -ENOMEM; 1024 1025 key_put(new->request_key_auth); 1026 new->request_key_auth = key_get(key); 1027 1028 return commit_creds(new); 1029 } 1030 1031 /* 1032 * Instantiate a key with the specified payload and link the key into the 1033 * destination keyring if one is given. 1034 * 1035 * The caller must have the appropriate instantiation permit set for this to 1036 * work (see keyctl_assume_authority). No other permissions are required. 1037 * 1038 * If successful, 0 will be returned. 1039 */ 1040 long keyctl_instantiate_key_common(key_serial_t id, 1041 struct iov_iter *from, 1042 key_serial_t ringid) 1043 { 1044 const struct cred *cred = current_cred(); 1045 struct request_key_auth *rka; 1046 struct key *instkey, *dest_keyring; 1047 size_t plen = from ? iov_iter_count(from) : 0; 1048 void *payload; 1049 long ret; 1050 1051 kenter("%d,,%zu,%d", id, plen, ringid); 1052 1053 if (!plen) 1054 from = NULL; 1055 1056 ret = -EINVAL; 1057 if (plen > 1024 * 1024 - 1) 1058 goto error; 1059 1060 /* the appropriate instantiation authorisation key must have been 1061 * assumed before calling this */ 1062 ret = -EPERM; 1063 instkey = cred->request_key_auth; 1064 if (!instkey) 1065 goto error; 1066 1067 rka = instkey->payload.data[0]; 1068 if (rka->target_key->serial != id) 1069 goto error; 1070 1071 /* pull the payload in if one was supplied */ 1072 payload = NULL; 1073 1074 if (from) { 1075 ret = -ENOMEM; 1076 payload = kvmalloc(plen, GFP_KERNEL); 1077 if (!payload) 1078 goto error; 1079 1080 ret = -EFAULT; 1081 if (!copy_from_iter_full(payload, plen, from)) 1082 goto error2; 1083 } 1084 1085 /* find the destination keyring amongst those belonging to the 1086 * requesting task */ 1087 ret = get_instantiation_keyring(ringid, rka, &dest_keyring); 1088 if (ret < 0) 1089 goto error2; 1090 1091 /* instantiate the key and link it into a keyring */ 1092 ret = key_instantiate_and_link(rka->target_key, payload, plen, 1093 dest_keyring, instkey); 1094 1095 key_put(dest_keyring); 1096 1097 /* discard the assumed authority if it's just been disabled by 1098 * instantiation of the key */ 1099 if (ret == 0) 1100 keyctl_change_reqkey_auth(NULL); 1101 1102 error2: 1103 if (payload) { 1104 memzero_explicit(payload, plen); 1105 kvfree(payload); 1106 } 1107 error: 1108 return ret; 1109 } 1110 1111 /* 1112 * Instantiate a key with the specified payload and link the key into the 1113 * destination keyring if one is given. 1114 * 1115 * The caller must have the appropriate instantiation permit set for this to 1116 * work (see keyctl_assume_authority). No other permissions are required. 1117 * 1118 * If successful, 0 will be returned. 1119 */ 1120 long keyctl_instantiate_key(key_serial_t id, 1121 const void __user *_payload, 1122 size_t plen, 1123 key_serial_t ringid) 1124 { 1125 if (_payload && plen) { 1126 struct iovec iov; 1127 struct iov_iter from; 1128 int ret; 1129 1130 ret = import_single_range(WRITE, (void __user *)_payload, plen, 1131 &iov, &from); 1132 if (unlikely(ret)) 1133 return ret; 1134 1135 return keyctl_instantiate_key_common(id, &from, ringid); 1136 } 1137 1138 return keyctl_instantiate_key_common(id, NULL, ringid); 1139 } 1140 1141 /* 1142 * Instantiate a key with the specified multipart payload and link the key into 1143 * the destination keyring if one is given. 1144 * 1145 * The caller must have the appropriate instantiation permit set for this to 1146 * work (see keyctl_assume_authority). No other permissions are required. 1147 * 1148 * If successful, 0 will be returned. 1149 */ 1150 long keyctl_instantiate_key_iov(key_serial_t id, 1151 const struct iovec __user *_payload_iov, 1152 unsigned ioc, 1153 key_serial_t ringid) 1154 { 1155 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack; 1156 struct iov_iter from; 1157 long ret; 1158 1159 if (!_payload_iov) 1160 ioc = 0; 1161 1162 ret = import_iovec(WRITE, _payload_iov, ioc, 1163 ARRAY_SIZE(iovstack), &iov, &from); 1164 if (ret < 0) 1165 return ret; 1166 ret = keyctl_instantiate_key_common(id, &from, ringid); 1167 kfree(iov); 1168 return ret; 1169 } 1170 1171 /* 1172 * Negatively instantiate the key with the given timeout (in seconds) and link 1173 * the key into the destination keyring if one is given. 1174 * 1175 * The caller must have the appropriate instantiation permit set for this to 1176 * work (see keyctl_assume_authority). No other permissions are required. 1177 * 1178 * The key and any links to the key will be automatically garbage collected 1179 * after the timeout expires. 1180 * 1181 * Negative keys are used to rate limit repeated request_key() calls by causing 1182 * them to return -ENOKEY until the negative key expires. 1183 * 1184 * If successful, 0 will be returned. 1185 */ 1186 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid) 1187 { 1188 return keyctl_reject_key(id, timeout, ENOKEY, ringid); 1189 } 1190 1191 /* 1192 * Negatively instantiate the key with the given timeout (in seconds) and error 1193 * code and link the key into the destination keyring if one is given. 1194 * 1195 * The caller must have the appropriate instantiation permit set for this to 1196 * work (see keyctl_assume_authority). No other permissions are required. 1197 * 1198 * The key and any links to the key will be automatically garbage collected 1199 * after the timeout expires. 1200 * 1201 * Negative keys are used to rate limit repeated request_key() calls by causing 1202 * them to return the specified error code until the negative key expires. 1203 * 1204 * If successful, 0 will be returned. 1205 */ 1206 long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error, 1207 key_serial_t ringid) 1208 { 1209 const struct cred *cred = current_cred(); 1210 struct request_key_auth *rka; 1211 struct key *instkey, *dest_keyring; 1212 long ret; 1213 1214 kenter("%d,%u,%u,%d", id, timeout, error, ringid); 1215 1216 /* must be a valid error code and mustn't be a kernel special */ 1217 if (error <= 0 || 1218 error >= MAX_ERRNO || 1219 error == ERESTARTSYS || 1220 error == ERESTARTNOINTR || 1221 error == ERESTARTNOHAND || 1222 error == ERESTART_RESTARTBLOCK) 1223 return -EINVAL; 1224 1225 /* the appropriate instantiation authorisation key must have been 1226 * assumed before calling this */ 1227 ret = -EPERM; 1228 instkey = cred->request_key_auth; 1229 if (!instkey) 1230 goto error; 1231 1232 rka = instkey->payload.data[0]; 1233 if (rka->target_key->serial != id) 1234 goto error; 1235 1236 /* find the destination keyring if present (which must also be 1237 * writable) */ 1238 ret = get_instantiation_keyring(ringid, rka, &dest_keyring); 1239 if (ret < 0) 1240 goto error; 1241 1242 /* instantiate the key and link it into a keyring */ 1243 ret = key_reject_and_link(rka->target_key, timeout, error, 1244 dest_keyring, instkey); 1245 1246 key_put(dest_keyring); 1247 1248 /* discard the assumed authority if it's just been disabled by 1249 * instantiation of the key */ 1250 if (ret == 0) 1251 keyctl_change_reqkey_auth(NULL); 1252 1253 error: 1254 return ret; 1255 } 1256 1257 /* 1258 * Read or set the default keyring in which request_key() will cache keys and 1259 * return the old setting. 1260 * 1261 * If a thread or process keyring is specified then it will be created if it 1262 * doesn't yet exist. The old setting will be returned if successful. 1263 */ 1264 long keyctl_set_reqkey_keyring(int reqkey_defl) 1265 { 1266 struct cred *new; 1267 int ret, old_setting; 1268 1269 old_setting = current_cred_xxx(jit_keyring); 1270 1271 if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE) 1272 return old_setting; 1273 1274 new = prepare_creds(); 1275 if (!new) 1276 return -ENOMEM; 1277 1278 switch (reqkey_defl) { 1279 case KEY_REQKEY_DEFL_THREAD_KEYRING: 1280 ret = install_thread_keyring_to_cred(new); 1281 if (ret < 0) 1282 goto error; 1283 goto set; 1284 1285 case KEY_REQKEY_DEFL_PROCESS_KEYRING: 1286 ret = install_process_keyring_to_cred(new); 1287 if (ret < 0) 1288 goto error; 1289 goto set; 1290 1291 case KEY_REQKEY_DEFL_DEFAULT: 1292 case KEY_REQKEY_DEFL_SESSION_KEYRING: 1293 case KEY_REQKEY_DEFL_USER_KEYRING: 1294 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING: 1295 case KEY_REQKEY_DEFL_REQUESTOR_KEYRING: 1296 goto set; 1297 1298 case KEY_REQKEY_DEFL_NO_CHANGE: 1299 case KEY_REQKEY_DEFL_GROUP_KEYRING: 1300 default: 1301 ret = -EINVAL; 1302 goto error; 1303 } 1304 1305 set: 1306 new->jit_keyring = reqkey_defl; 1307 commit_creds(new); 1308 return old_setting; 1309 error: 1310 abort_creds(new); 1311 return ret; 1312 } 1313 1314 /* 1315 * Set or clear the timeout on a key. 1316 * 1317 * Either the key must grant the caller Setattr permission or else the caller 1318 * must hold an instantiation authorisation token for the key. 1319 * 1320 * The timeout is either 0 to clear the timeout, or a number of seconds from 1321 * the current time. The key and any links to the key will be automatically 1322 * garbage collected after the timeout expires. 1323 * 1324 * Keys with KEY_FLAG_KEEP set should not be timed out. 1325 * 1326 * If successful, 0 is returned. 1327 */ 1328 long keyctl_set_timeout(key_serial_t id, unsigned timeout) 1329 { 1330 struct key *key, *instkey; 1331 key_ref_t key_ref; 1332 long ret; 1333 1334 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 1335 KEY_NEED_SETATTR); 1336 if (IS_ERR(key_ref)) { 1337 /* setting the timeout on a key under construction is permitted 1338 * if we have the authorisation token handy */ 1339 if (PTR_ERR(key_ref) == -EACCES) { 1340 instkey = key_get_instantiation_authkey(id); 1341 if (!IS_ERR(instkey)) { 1342 key_put(instkey); 1343 key_ref = lookup_user_key(id, 1344 KEY_LOOKUP_PARTIAL, 1345 0); 1346 if (!IS_ERR(key_ref)) 1347 goto okay; 1348 } 1349 } 1350 1351 ret = PTR_ERR(key_ref); 1352 goto error; 1353 } 1354 1355 okay: 1356 key = key_ref_to_ptr(key_ref); 1357 ret = 0; 1358 if (test_bit(KEY_FLAG_KEEP, &key->flags)) 1359 ret = -EPERM; 1360 else 1361 key_set_timeout(key, timeout); 1362 key_put(key); 1363 1364 error: 1365 return ret; 1366 } 1367 1368 /* 1369 * Assume (or clear) the authority to instantiate the specified key. 1370 * 1371 * This sets the authoritative token currently in force for key instantiation. 1372 * This must be done for a key to be instantiated. It has the effect of making 1373 * available all the keys from the caller of the request_key() that created a 1374 * key to request_key() calls made by the caller of this function. 1375 * 1376 * The caller must have the instantiation key in their process keyrings with a 1377 * Search permission grant available to the caller. 1378 * 1379 * If the ID given is 0, then the setting will be cleared and 0 returned. 1380 * 1381 * If the ID given has a matching an authorisation key, then that key will be 1382 * set and its ID will be returned. The authorisation key can be read to get 1383 * the callout information passed to request_key(). 1384 */ 1385 long keyctl_assume_authority(key_serial_t id) 1386 { 1387 struct key *authkey; 1388 long ret; 1389 1390 /* special key IDs aren't permitted */ 1391 ret = -EINVAL; 1392 if (id < 0) 1393 goto error; 1394 1395 /* we divest ourselves of authority if given an ID of 0 */ 1396 if (id == 0) { 1397 ret = keyctl_change_reqkey_auth(NULL); 1398 goto error; 1399 } 1400 1401 /* attempt to assume the authority temporarily granted to us whilst we 1402 * instantiate the specified key 1403 * - the authorisation key must be in the current task's keyrings 1404 * somewhere 1405 */ 1406 authkey = key_get_instantiation_authkey(id); 1407 if (IS_ERR(authkey)) { 1408 ret = PTR_ERR(authkey); 1409 goto error; 1410 } 1411 1412 ret = keyctl_change_reqkey_auth(authkey); 1413 if (ret == 0) 1414 ret = authkey->serial; 1415 key_put(authkey); 1416 error: 1417 return ret; 1418 } 1419 1420 /* 1421 * Get a key's the LSM security label. 1422 * 1423 * The key must grant the caller View permission for this to work. 1424 * 1425 * If there's a buffer, then up to buflen bytes of data will be placed into it. 1426 * 1427 * If successful, the amount of information available will be returned, 1428 * irrespective of how much was copied (including the terminal NUL). 1429 */ 1430 long keyctl_get_security(key_serial_t keyid, 1431 char __user *buffer, 1432 size_t buflen) 1433 { 1434 struct key *key, *instkey; 1435 key_ref_t key_ref; 1436 char *context; 1437 long ret; 1438 1439 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW); 1440 if (IS_ERR(key_ref)) { 1441 if (PTR_ERR(key_ref) != -EACCES) 1442 return PTR_ERR(key_ref); 1443 1444 /* viewing a key under construction is also permitted if we 1445 * have the authorisation token handy */ 1446 instkey = key_get_instantiation_authkey(keyid); 1447 if (IS_ERR(instkey)) 1448 return PTR_ERR(instkey); 1449 key_put(instkey); 1450 1451 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, 0); 1452 if (IS_ERR(key_ref)) 1453 return PTR_ERR(key_ref); 1454 } 1455 1456 key = key_ref_to_ptr(key_ref); 1457 ret = security_key_getsecurity(key, &context); 1458 if (ret == 0) { 1459 /* if no information was returned, give userspace an empty 1460 * string */ 1461 ret = 1; 1462 if (buffer && buflen > 0 && 1463 copy_to_user(buffer, "", 1) != 0) 1464 ret = -EFAULT; 1465 } else if (ret > 0) { 1466 /* return as much data as there's room for */ 1467 if (buffer && buflen > 0) { 1468 if (buflen > ret) 1469 buflen = ret; 1470 1471 if (copy_to_user(buffer, context, buflen) != 0) 1472 ret = -EFAULT; 1473 } 1474 1475 kfree(context); 1476 } 1477 1478 key_ref_put(key_ref); 1479 return ret; 1480 } 1481 1482 /* 1483 * Attempt to install the calling process's session keyring on the process's 1484 * parent process. 1485 * 1486 * The keyring must exist and must grant the caller LINK permission, and the 1487 * parent process must be single-threaded and must have the same effective 1488 * ownership as this process and mustn't be SUID/SGID. 1489 * 1490 * The keyring will be emplaced on the parent when it next resumes userspace. 1491 * 1492 * If successful, 0 will be returned. 1493 */ 1494 long keyctl_session_to_parent(void) 1495 { 1496 struct task_struct *me, *parent; 1497 const struct cred *mycred, *pcred; 1498 struct callback_head *newwork, *oldwork; 1499 key_ref_t keyring_r; 1500 struct cred *cred; 1501 int ret; 1502 1503 keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_NEED_LINK); 1504 if (IS_ERR(keyring_r)) 1505 return PTR_ERR(keyring_r); 1506 1507 ret = -ENOMEM; 1508 1509 /* our parent is going to need a new cred struct, a new tgcred struct 1510 * and new security data, so we allocate them here to prevent ENOMEM in 1511 * our parent */ 1512 cred = cred_alloc_blank(); 1513 if (!cred) 1514 goto error_keyring; 1515 newwork = &cred->rcu; 1516 1517 cred->session_keyring = key_ref_to_ptr(keyring_r); 1518 keyring_r = NULL; 1519 init_task_work(newwork, key_change_session_keyring); 1520 1521 me = current; 1522 rcu_read_lock(); 1523 write_lock_irq(&tasklist_lock); 1524 1525 ret = -EPERM; 1526 oldwork = NULL; 1527 parent = me->real_parent; 1528 1529 /* the parent mustn't be init and mustn't be a kernel thread */ 1530 if (parent->pid <= 1 || !parent->mm) 1531 goto unlock; 1532 1533 /* the parent must be single threaded */ 1534 if (!thread_group_empty(parent)) 1535 goto unlock; 1536 1537 /* the parent and the child must have different session keyrings or 1538 * there's no point */ 1539 mycred = current_cred(); 1540 pcred = __task_cred(parent); 1541 if (mycred == pcred || 1542 mycred->session_keyring == pcred->session_keyring) { 1543 ret = 0; 1544 goto unlock; 1545 } 1546 1547 /* the parent must have the same effective ownership and mustn't be 1548 * SUID/SGID */ 1549 if (!uid_eq(pcred->uid, mycred->euid) || 1550 !uid_eq(pcred->euid, mycred->euid) || 1551 !uid_eq(pcred->suid, mycred->euid) || 1552 !gid_eq(pcred->gid, mycred->egid) || 1553 !gid_eq(pcred->egid, mycred->egid) || 1554 !gid_eq(pcred->sgid, mycred->egid)) 1555 goto unlock; 1556 1557 /* the keyrings must have the same UID */ 1558 if ((pcred->session_keyring && 1559 !uid_eq(pcred->session_keyring->uid, mycred->euid)) || 1560 !uid_eq(mycred->session_keyring->uid, mycred->euid)) 1561 goto unlock; 1562 1563 /* cancel an already pending keyring replacement */ 1564 oldwork = task_work_cancel(parent, key_change_session_keyring); 1565 1566 /* the replacement session keyring is applied just prior to userspace 1567 * restarting */ 1568 ret = task_work_add(parent, newwork, true); 1569 if (!ret) 1570 newwork = NULL; 1571 unlock: 1572 write_unlock_irq(&tasklist_lock); 1573 rcu_read_unlock(); 1574 if (oldwork) 1575 put_cred(container_of(oldwork, struct cred, rcu)); 1576 if (newwork) 1577 put_cred(cred); 1578 return ret; 1579 1580 error_keyring: 1581 key_ref_put(keyring_r); 1582 return ret; 1583 } 1584 1585 /* 1586 * Apply a restriction to a given keyring. 1587 * 1588 * The caller must have Setattr permission to change keyring restrictions. 1589 * 1590 * The requested type name may be a NULL pointer to reject all attempts 1591 * to link to the keyring. In this case, _restriction must also be NULL. 1592 * Otherwise, both _type and _restriction must be non-NULL. 1593 * 1594 * Returns 0 if successful. 1595 */ 1596 long keyctl_restrict_keyring(key_serial_t id, const char __user *_type, 1597 const char __user *_restriction) 1598 { 1599 key_ref_t key_ref; 1600 char type[32]; 1601 char *restriction = NULL; 1602 long ret; 1603 1604 key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR); 1605 if (IS_ERR(key_ref)) 1606 return PTR_ERR(key_ref); 1607 1608 ret = -EINVAL; 1609 if (_type) { 1610 if (!_restriction) 1611 goto error; 1612 1613 ret = key_get_type_from_user(type, _type, sizeof(type)); 1614 if (ret < 0) 1615 goto error; 1616 1617 restriction = strndup_user(_restriction, PAGE_SIZE); 1618 if (IS_ERR(restriction)) { 1619 ret = PTR_ERR(restriction); 1620 goto error; 1621 } 1622 } else { 1623 if (_restriction) 1624 goto error; 1625 } 1626 1627 ret = keyring_restrict(key_ref, _type ? type : NULL, restriction); 1628 kfree(restriction); 1629 error: 1630 key_ref_put(key_ref); 1631 return ret; 1632 } 1633 1634 /* 1635 * The key control system call 1636 */ 1637 SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3, 1638 unsigned long, arg4, unsigned long, arg5) 1639 { 1640 switch (option) { 1641 case KEYCTL_GET_KEYRING_ID: 1642 return keyctl_get_keyring_ID((key_serial_t) arg2, 1643 (int) arg3); 1644 1645 case KEYCTL_JOIN_SESSION_KEYRING: 1646 return keyctl_join_session_keyring((const char __user *) arg2); 1647 1648 case KEYCTL_UPDATE: 1649 return keyctl_update_key((key_serial_t) arg2, 1650 (const void __user *) arg3, 1651 (size_t) arg4); 1652 1653 case KEYCTL_REVOKE: 1654 return keyctl_revoke_key((key_serial_t) arg2); 1655 1656 case KEYCTL_DESCRIBE: 1657 return keyctl_describe_key((key_serial_t) arg2, 1658 (char __user *) arg3, 1659 (unsigned) arg4); 1660 1661 case KEYCTL_CLEAR: 1662 return keyctl_keyring_clear((key_serial_t) arg2); 1663 1664 case KEYCTL_LINK: 1665 return keyctl_keyring_link((key_serial_t) arg2, 1666 (key_serial_t) arg3); 1667 1668 case KEYCTL_UNLINK: 1669 return keyctl_keyring_unlink((key_serial_t) arg2, 1670 (key_serial_t) arg3); 1671 1672 case KEYCTL_SEARCH: 1673 return keyctl_keyring_search((key_serial_t) arg2, 1674 (const char __user *) arg3, 1675 (const char __user *) arg4, 1676 (key_serial_t) arg5); 1677 1678 case KEYCTL_READ: 1679 return keyctl_read_key((key_serial_t) arg2, 1680 (char __user *) arg3, 1681 (size_t) arg4); 1682 1683 case KEYCTL_CHOWN: 1684 return keyctl_chown_key((key_serial_t) arg2, 1685 (uid_t) arg3, 1686 (gid_t) arg4); 1687 1688 case KEYCTL_SETPERM: 1689 return keyctl_setperm_key((key_serial_t) arg2, 1690 (key_perm_t) arg3); 1691 1692 case KEYCTL_INSTANTIATE: 1693 return keyctl_instantiate_key((key_serial_t) arg2, 1694 (const void __user *) arg3, 1695 (size_t) arg4, 1696 (key_serial_t) arg5); 1697 1698 case KEYCTL_NEGATE: 1699 return keyctl_negate_key((key_serial_t) arg2, 1700 (unsigned) arg3, 1701 (key_serial_t) arg4); 1702 1703 case KEYCTL_SET_REQKEY_KEYRING: 1704 return keyctl_set_reqkey_keyring(arg2); 1705 1706 case KEYCTL_SET_TIMEOUT: 1707 return keyctl_set_timeout((key_serial_t) arg2, 1708 (unsigned) arg3); 1709 1710 case KEYCTL_ASSUME_AUTHORITY: 1711 return keyctl_assume_authority((key_serial_t) arg2); 1712 1713 case KEYCTL_GET_SECURITY: 1714 return keyctl_get_security((key_serial_t) arg2, 1715 (char __user *) arg3, 1716 (size_t) arg4); 1717 1718 case KEYCTL_SESSION_TO_PARENT: 1719 return keyctl_session_to_parent(); 1720 1721 case KEYCTL_REJECT: 1722 return keyctl_reject_key((key_serial_t) arg2, 1723 (unsigned) arg3, 1724 (unsigned) arg4, 1725 (key_serial_t) arg5); 1726 1727 case KEYCTL_INSTANTIATE_IOV: 1728 return keyctl_instantiate_key_iov( 1729 (key_serial_t) arg2, 1730 (const struct iovec __user *) arg3, 1731 (unsigned) arg4, 1732 (key_serial_t) arg5); 1733 1734 case KEYCTL_INVALIDATE: 1735 return keyctl_invalidate_key((key_serial_t) arg2); 1736 1737 case KEYCTL_GET_PERSISTENT: 1738 return keyctl_get_persistent((uid_t)arg2, (key_serial_t)arg3); 1739 1740 case KEYCTL_DH_COMPUTE: 1741 return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2, 1742 (char __user *) arg3, (size_t) arg4, 1743 (struct keyctl_kdf_params __user *) arg5); 1744 1745 case KEYCTL_RESTRICT_KEYRING: 1746 return keyctl_restrict_keyring((key_serial_t) arg2, 1747 (const char __user *) arg3, 1748 (const char __user *) arg4); 1749 1750 case KEYCTL_PKEY_QUERY: 1751 if (arg3 != 0) 1752 return -EINVAL; 1753 return keyctl_pkey_query((key_serial_t)arg2, 1754 (const char __user *)arg4, 1755 (struct keyctl_pkey_query __user *)arg5); 1756 1757 case KEYCTL_PKEY_ENCRYPT: 1758 case KEYCTL_PKEY_DECRYPT: 1759 case KEYCTL_PKEY_SIGN: 1760 return keyctl_pkey_e_d_s( 1761 option, 1762 (const struct keyctl_pkey_params __user *)arg2, 1763 (const char __user *)arg3, 1764 (const void __user *)arg4, 1765 (void __user *)arg5); 1766 1767 case KEYCTL_PKEY_VERIFY: 1768 return keyctl_pkey_verify( 1769 (const struct keyctl_pkey_params __user *)arg2, 1770 (const char __user *)arg3, 1771 (const void __user *)arg4, 1772 (const void __user *)arg5); 1773 1774 default: 1775 return -EOPNOTSUPP; 1776 } 1777 } 1778