1 /* procfs files for key database enumeration 2 * 3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/init.h> 13 #include <linux/sched.h> 14 #include <linux/fs.h> 15 #include <linux/proc_fs.h> 16 #include <linux/seq_file.h> 17 #include <asm/errno.h> 18 #include "internal.h" 19 20 static void *proc_keys_start(struct seq_file *p, loff_t *_pos); 21 static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos); 22 static void proc_keys_stop(struct seq_file *p, void *v); 23 static int proc_keys_show(struct seq_file *m, void *v); 24 25 static const struct seq_operations proc_keys_ops = { 26 .start = proc_keys_start, 27 .next = proc_keys_next, 28 .stop = proc_keys_stop, 29 .show = proc_keys_show, 30 }; 31 32 static void *proc_key_users_start(struct seq_file *p, loff_t *_pos); 33 static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos); 34 static void proc_key_users_stop(struct seq_file *p, void *v); 35 static int proc_key_users_show(struct seq_file *m, void *v); 36 37 static const struct seq_operations proc_key_users_ops = { 38 .start = proc_key_users_start, 39 .next = proc_key_users_next, 40 .stop = proc_key_users_stop, 41 .show = proc_key_users_show, 42 }; 43 44 /* 45 * Declare the /proc files. 46 */ 47 static int __init key_proc_init(void) 48 { 49 struct proc_dir_entry *p; 50 51 p = proc_create_seq("keys", 0, NULL, &proc_keys_ops); 52 if (!p) 53 panic("Cannot create /proc/keys\n"); 54 55 p = proc_create_seq("key-users", 0, NULL, &proc_key_users_ops); 56 if (!p) 57 panic("Cannot create /proc/key-users\n"); 58 59 return 0; 60 } 61 62 __initcall(key_proc_init); 63 64 /* 65 * Implement "/proc/keys" to provide a list of the keys on the system that 66 * grant View permission to the caller. 67 */ 68 static struct rb_node *key_serial_next(struct seq_file *p, struct rb_node *n) 69 { 70 struct user_namespace *user_ns = seq_user_ns(p); 71 72 n = rb_next(n); 73 while (n) { 74 struct key *key = rb_entry(n, struct key, serial_node); 75 if (kuid_has_mapping(user_ns, key->user->uid)) 76 break; 77 n = rb_next(n); 78 } 79 return n; 80 } 81 82 static struct key *find_ge_key(struct seq_file *p, key_serial_t id) 83 { 84 struct user_namespace *user_ns = seq_user_ns(p); 85 struct rb_node *n = key_serial_tree.rb_node; 86 struct key *minkey = NULL; 87 88 while (n) { 89 struct key *key = rb_entry(n, struct key, serial_node); 90 if (id < key->serial) { 91 if (!minkey || minkey->serial > key->serial) 92 minkey = key; 93 n = n->rb_left; 94 } else if (id > key->serial) { 95 n = n->rb_right; 96 } else { 97 minkey = key; 98 break; 99 } 100 key = NULL; 101 } 102 103 if (!minkey) 104 return NULL; 105 106 for (;;) { 107 if (kuid_has_mapping(user_ns, minkey->user->uid)) 108 return minkey; 109 n = rb_next(&minkey->serial_node); 110 if (!n) 111 return NULL; 112 minkey = rb_entry(n, struct key, serial_node); 113 } 114 } 115 116 static void *proc_keys_start(struct seq_file *p, loff_t *_pos) 117 __acquires(key_serial_lock) 118 { 119 key_serial_t pos = *_pos; 120 struct key *key; 121 122 spin_lock(&key_serial_lock); 123 124 if (*_pos > INT_MAX) 125 return NULL; 126 key = find_ge_key(p, pos); 127 if (!key) 128 return NULL; 129 *_pos = key->serial; 130 return &key->serial_node; 131 } 132 133 static inline key_serial_t key_node_serial(struct rb_node *n) 134 { 135 struct key *key = rb_entry(n, struct key, serial_node); 136 return key->serial; 137 } 138 139 static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos) 140 { 141 struct rb_node *n; 142 143 n = key_serial_next(p, v); 144 if (n) 145 *_pos = key_node_serial(n); 146 return n; 147 } 148 149 static void proc_keys_stop(struct seq_file *p, void *v) 150 __releases(key_serial_lock) 151 { 152 spin_unlock(&key_serial_lock); 153 } 154 155 static int proc_keys_show(struct seq_file *m, void *v) 156 { 157 struct rb_node *_p = v; 158 struct key *key = rb_entry(_p, struct key, serial_node); 159 unsigned long flags; 160 key_ref_t key_ref, skey_ref; 161 time64_t now, expiry; 162 char xbuf[16]; 163 short state; 164 u64 timo; 165 int rc; 166 167 struct keyring_search_context ctx = { 168 .index_key = key->index_key, 169 .cred = m->file->f_cred, 170 .match_data.cmp = lookup_user_key_possessed, 171 .match_data.raw_data = key, 172 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT, 173 .flags = (KEYRING_SEARCH_NO_STATE_CHECK | 174 KEYRING_SEARCH_RECURSE), 175 }; 176 177 key_ref = make_key_ref(key, 0); 178 179 /* determine if the key is possessed by this process (a test we can 180 * skip if the key does not indicate the possessor can view it 181 */ 182 if (key->perm & KEY_POS_VIEW) { 183 rcu_read_lock(); 184 skey_ref = search_cred_keyrings_rcu(&ctx); 185 rcu_read_unlock(); 186 if (!IS_ERR(skey_ref)) { 187 key_ref_put(skey_ref); 188 key_ref = make_key_ref(key, 1); 189 } 190 } 191 192 /* check whether the current task is allowed to view the key */ 193 rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW); 194 if (rc < 0) 195 return 0; 196 197 now = ktime_get_real_seconds(); 198 199 rcu_read_lock(); 200 201 /* come up with a suitable timeout value */ 202 expiry = READ_ONCE(key->expiry); 203 if (expiry == 0) { 204 memcpy(xbuf, "perm", 5); 205 } else if (now >= expiry) { 206 memcpy(xbuf, "expd", 5); 207 } else { 208 timo = expiry - now; 209 210 if (timo < 60) 211 sprintf(xbuf, "%llus", timo); 212 else if (timo < 60*60) 213 sprintf(xbuf, "%llum", div_u64(timo, 60)); 214 else if (timo < 60*60*24) 215 sprintf(xbuf, "%lluh", div_u64(timo, 60 * 60)); 216 else if (timo < 60*60*24*7) 217 sprintf(xbuf, "%llud", div_u64(timo, 60 * 60 * 24)); 218 else 219 sprintf(xbuf, "%lluw", div_u64(timo, 60 * 60 * 24 * 7)); 220 } 221 222 state = key_read_state(key); 223 224 #define showflag(FLAGS, LETTER, FLAG) \ 225 ((FLAGS & (1 << FLAG)) ? LETTER : '-') 226 227 flags = READ_ONCE(key->flags); 228 seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ", 229 key->serial, 230 state != KEY_IS_UNINSTANTIATED ? 'I' : '-', 231 showflag(flags, 'R', KEY_FLAG_REVOKED), 232 showflag(flags, 'D', KEY_FLAG_DEAD), 233 showflag(flags, 'Q', KEY_FLAG_IN_QUOTA), 234 showflag(flags, 'U', KEY_FLAG_USER_CONSTRUCT), 235 state < 0 ? 'N' : '-', 236 showflag(flags, 'i', KEY_FLAG_INVALIDATED), 237 refcount_read(&key->usage), 238 xbuf, 239 key->perm, 240 from_kuid_munged(seq_user_ns(m), key->uid), 241 from_kgid_munged(seq_user_ns(m), key->gid), 242 key->type->name); 243 244 #undef showflag 245 246 if (key->type->describe) 247 key->type->describe(key, m); 248 seq_putc(m, '\n'); 249 250 rcu_read_unlock(); 251 return 0; 252 } 253 254 static struct rb_node *__key_user_next(struct user_namespace *user_ns, struct rb_node *n) 255 { 256 while (n) { 257 struct key_user *user = rb_entry(n, struct key_user, node); 258 if (kuid_has_mapping(user_ns, user->uid)) 259 break; 260 n = rb_next(n); 261 } 262 return n; 263 } 264 265 static struct rb_node *key_user_next(struct user_namespace *user_ns, struct rb_node *n) 266 { 267 return __key_user_next(user_ns, rb_next(n)); 268 } 269 270 static struct rb_node *key_user_first(struct user_namespace *user_ns, struct rb_root *r) 271 { 272 struct rb_node *n = rb_first(r); 273 return __key_user_next(user_ns, n); 274 } 275 276 static void *proc_key_users_start(struct seq_file *p, loff_t *_pos) 277 __acquires(key_user_lock) 278 { 279 struct rb_node *_p; 280 loff_t pos = *_pos; 281 282 spin_lock(&key_user_lock); 283 284 _p = key_user_first(seq_user_ns(p), &key_user_tree); 285 while (pos > 0 && _p) { 286 pos--; 287 _p = key_user_next(seq_user_ns(p), _p); 288 } 289 290 return _p; 291 } 292 293 static void *proc_key_users_next(struct seq_file *p, void *v, loff_t *_pos) 294 { 295 (*_pos)++; 296 return key_user_next(seq_user_ns(p), (struct rb_node *)v); 297 } 298 299 static void proc_key_users_stop(struct seq_file *p, void *v) 300 __releases(key_user_lock) 301 { 302 spin_unlock(&key_user_lock); 303 } 304 305 static int proc_key_users_show(struct seq_file *m, void *v) 306 { 307 struct rb_node *_p = v; 308 struct key_user *user = rb_entry(_p, struct key_user, node); 309 unsigned maxkeys = uid_eq(user->uid, GLOBAL_ROOT_UID) ? 310 key_quota_root_maxkeys : key_quota_maxkeys; 311 unsigned maxbytes = uid_eq(user->uid, GLOBAL_ROOT_UID) ? 312 key_quota_root_maxbytes : key_quota_maxbytes; 313 314 seq_printf(m, "%5u: %5d %d/%d %d/%d %d/%d\n", 315 from_kuid_munged(seq_user_ns(m), user->uid), 316 refcount_read(&user->usage), 317 atomic_read(&user->nkeys), 318 atomic_read(&user->nikeys), 319 user->qnkeys, 320 maxkeys, 321 user->qnbytes, 322 maxbytes); 323 324 return 0; 325 } 326