1 /* Manage a process's keyrings 2 * 3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/init.h> 14 #include <linux/sched.h> 15 #include <linux/keyctl.h> 16 #include <linux/fs.h> 17 #include <linux/err.h> 18 #include <linux/mutex.h> 19 #include <linux/security.h> 20 #include <linux/user_namespace.h> 21 #include <asm/uaccess.h> 22 #include "internal.h" 23 24 /* Session keyring create vs join semaphore */ 25 static DEFINE_MUTEX(key_session_mutex); 26 27 /* User keyring creation semaphore */ 28 static DEFINE_MUTEX(key_user_keyring_mutex); 29 30 /* The root user's tracking struct */ 31 struct key_user root_key_user = { 32 .usage = ATOMIC_INIT(3), 33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock), 34 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock), 35 .nkeys = ATOMIC_INIT(2), 36 .nikeys = ATOMIC_INIT(2), 37 .uid = GLOBAL_ROOT_UID, 38 }; 39 40 /* 41 * Install the user and user session keyrings for the current process's UID. 42 */ 43 int install_user_keyrings(void) 44 { 45 struct user_struct *user; 46 const struct cred *cred; 47 struct key *uid_keyring, *session_keyring; 48 key_perm_t user_keyring_perm; 49 char buf[20]; 50 int ret; 51 uid_t uid; 52 53 user_keyring_perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL; 54 cred = current_cred(); 55 user = cred->user; 56 uid = from_kuid(cred->user_ns, user->uid); 57 58 kenter("%p{%u}", user, uid); 59 60 if (user->uid_keyring && user->session_keyring) { 61 kleave(" = 0 [exist]"); 62 return 0; 63 } 64 65 mutex_lock(&key_user_keyring_mutex); 66 ret = 0; 67 68 if (!user->uid_keyring) { 69 /* get the UID-specific keyring 70 * - there may be one in existence already as it may have been 71 * pinned by a session, but the user_struct pointing to it 72 * may have been destroyed by setuid */ 73 sprintf(buf, "_uid.%u", uid); 74 75 uid_keyring = find_keyring_by_name(buf, true); 76 if (IS_ERR(uid_keyring)) { 77 uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID, 78 cred, user_keyring_perm, 79 KEY_ALLOC_IN_QUOTA, NULL); 80 if (IS_ERR(uid_keyring)) { 81 ret = PTR_ERR(uid_keyring); 82 goto error; 83 } 84 } 85 86 /* get a default session keyring (which might also exist 87 * already) */ 88 sprintf(buf, "_uid_ses.%u", uid); 89 90 session_keyring = find_keyring_by_name(buf, true); 91 if (IS_ERR(session_keyring)) { 92 session_keyring = 93 keyring_alloc(buf, user->uid, INVALID_GID, 94 cred, user_keyring_perm, 95 KEY_ALLOC_IN_QUOTA, NULL); 96 if (IS_ERR(session_keyring)) { 97 ret = PTR_ERR(session_keyring); 98 goto error_release; 99 } 100 101 /* we install a link from the user session keyring to 102 * the user keyring */ 103 ret = key_link(session_keyring, uid_keyring); 104 if (ret < 0) 105 goto error_release_both; 106 } 107 108 /* install the keyrings */ 109 user->uid_keyring = uid_keyring; 110 user->session_keyring = session_keyring; 111 } 112 113 mutex_unlock(&key_user_keyring_mutex); 114 kleave(" = 0"); 115 return 0; 116 117 error_release_both: 118 key_put(session_keyring); 119 error_release: 120 key_put(uid_keyring); 121 error: 122 mutex_unlock(&key_user_keyring_mutex); 123 kleave(" = %d", ret); 124 return ret; 125 } 126 127 /* 128 * Install a fresh thread keyring directly to new credentials. This keyring is 129 * allowed to overrun the quota. 130 */ 131 int install_thread_keyring_to_cred(struct cred *new) 132 { 133 struct key *keyring; 134 135 keyring = keyring_alloc("_tid", new->uid, new->gid, new, 136 KEY_POS_ALL | KEY_USR_VIEW, 137 KEY_ALLOC_QUOTA_OVERRUN, NULL); 138 if (IS_ERR(keyring)) 139 return PTR_ERR(keyring); 140 141 new->thread_keyring = keyring; 142 return 0; 143 } 144 145 /* 146 * Install a fresh thread keyring, discarding the old one. 147 */ 148 static int install_thread_keyring(void) 149 { 150 struct cred *new; 151 int ret; 152 153 new = prepare_creds(); 154 if (!new) 155 return -ENOMEM; 156 157 BUG_ON(new->thread_keyring); 158 159 ret = install_thread_keyring_to_cred(new); 160 if (ret < 0) { 161 abort_creds(new); 162 return ret; 163 } 164 165 return commit_creds(new); 166 } 167 168 /* 169 * Install a process keyring directly to a credentials struct. 170 * 171 * Returns -EEXIST if there was already a process keyring, 0 if one installed, 172 * and other value on any other error 173 */ 174 int install_process_keyring_to_cred(struct cred *new) 175 { 176 struct key *keyring; 177 178 if (new->process_keyring) 179 return -EEXIST; 180 181 keyring = keyring_alloc("_pid", new->uid, new->gid, new, 182 KEY_POS_ALL | KEY_USR_VIEW, 183 KEY_ALLOC_QUOTA_OVERRUN, NULL); 184 if (IS_ERR(keyring)) 185 return PTR_ERR(keyring); 186 187 new->process_keyring = keyring; 188 return 0; 189 } 190 191 /* 192 * Make sure a process keyring is installed for the current process. The 193 * existing process keyring is not replaced. 194 * 195 * Returns 0 if there is a process keyring by the end of this function, some 196 * error otherwise. 197 */ 198 static int install_process_keyring(void) 199 { 200 struct cred *new; 201 int ret; 202 203 new = prepare_creds(); 204 if (!new) 205 return -ENOMEM; 206 207 ret = install_process_keyring_to_cred(new); 208 if (ret < 0) { 209 abort_creds(new); 210 return ret != -EEXIST ? ret : 0; 211 } 212 213 return commit_creds(new); 214 } 215 216 /* 217 * Install a session keyring directly to a credentials struct. 218 */ 219 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) 220 { 221 unsigned long flags; 222 struct key *old; 223 224 might_sleep(); 225 226 /* create an empty session keyring */ 227 if (!keyring) { 228 flags = KEY_ALLOC_QUOTA_OVERRUN; 229 if (cred->session_keyring) 230 flags = KEY_ALLOC_IN_QUOTA; 231 232 keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred, 233 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ, 234 flags, NULL); 235 if (IS_ERR(keyring)) 236 return PTR_ERR(keyring); 237 } else { 238 __key_get(keyring); 239 } 240 241 /* install the keyring */ 242 old = cred->session_keyring; 243 rcu_assign_pointer(cred->session_keyring, keyring); 244 245 if (old) 246 key_put(old); 247 248 return 0; 249 } 250 251 /* 252 * Install a session keyring, discarding the old one. If a keyring is not 253 * supplied, an empty one is invented. 254 */ 255 static int install_session_keyring(struct key *keyring) 256 { 257 struct cred *new; 258 int ret; 259 260 new = prepare_creds(); 261 if (!new) 262 return -ENOMEM; 263 264 ret = install_session_keyring_to_cred(new, keyring); 265 if (ret < 0) { 266 abort_creds(new); 267 return ret; 268 } 269 270 return commit_creds(new); 271 } 272 273 /* 274 * Handle the fsuid changing. 275 */ 276 void key_fsuid_changed(struct task_struct *tsk) 277 { 278 /* update the ownership of the thread keyring */ 279 BUG_ON(!tsk->cred); 280 if (tsk->cred->thread_keyring) { 281 down_write(&tsk->cred->thread_keyring->sem); 282 tsk->cred->thread_keyring->uid = tsk->cred->fsuid; 283 up_write(&tsk->cred->thread_keyring->sem); 284 } 285 } 286 287 /* 288 * Handle the fsgid changing. 289 */ 290 void key_fsgid_changed(struct task_struct *tsk) 291 { 292 /* update the ownership of the thread keyring */ 293 BUG_ON(!tsk->cred); 294 if (tsk->cred->thread_keyring) { 295 down_write(&tsk->cred->thread_keyring->sem); 296 tsk->cred->thread_keyring->gid = tsk->cred->fsgid; 297 up_write(&tsk->cred->thread_keyring->sem); 298 } 299 } 300 301 /* 302 * Search the process keyrings attached to the supplied cred for the first 303 * matching key. 304 * 305 * The search criteria are the type and the match function. The description is 306 * given to the match function as a parameter, but doesn't otherwise influence 307 * the search. Typically the match function will compare the description 308 * parameter to the key's description. 309 * 310 * This can only search keyrings that grant Search permission to the supplied 311 * credentials. Keyrings linked to searched keyrings will also be searched if 312 * they grant Search permission too. Keys can only be found if they grant 313 * Search permission to the credentials. 314 * 315 * Returns a pointer to the key with the key usage count incremented if 316 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only 317 * matched negative keys. 318 * 319 * In the case of a successful return, the possession attribute is set on the 320 * returned key reference. 321 */ 322 key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx) 323 { 324 key_ref_t key_ref, ret, err; 325 326 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were 327 * searchable, but we failed to find a key or we found a negative key; 328 * otherwise we want to return a sample error (probably -EACCES) if 329 * none of the keyrings were searchable 330 * 331 * in terms of priority: success > -ENOKEY > -EAGAIN > other error 332 */ 333 key_ref = NULL; 334 ret = NULL; 335 err = ERR_PTR(-EAGAIN); 336 337 /* search the thread keyring first */ 338 if (ctx->cred->thread_keyring) { 339 key_ref = keyring_search_aux( 340 make_key_ref(ctx->cred->thread_keyring, 1), ctx); 341 if (!IS_ERR(key_ref)) 342 goto found; 343 344 switch (PTR_ERR(key_ref)) { 345 case -EAGAIN: /* no key */ 346 case -ENOKEY: /* negative key */ 347 ret = key_ref; 348 break; 349 default: 350 err = key_ref; 351 break; 352 } 353 } 354 355 /* search the process keyring second */ 356 if (ctx->cred->process_keyring) { 357 key_ref = keyring_search_aux( 358 make_key_ref(ctx->cred->process_keyring, 1), ctx); 359 if (!IS_ERR(key_ref)) 360 goto found; 361 362 switch (PTR_ERR(key_ref)) { 363 case -EAGAIN: /* no key */ 364 if (ret) 365 break; 366 case -ENOKEY: /* negative key */ 367 ret = key_ref; 368 break; 369 default: 370 err = key_ref; 371 break; 372 } 373 } 374 375 /* search the session keyring */ 376 if (ctx->cred->session_keyring) { 377 rcu_read_lock(); 378 key_ref = keyring_search_aux( 379 make_key_ref(rcu_dereference(ctx->cred->session_keyring), 1), 380 ctx); 381 rcu_read_unlock(); 382 383 if (!IS_ERR(key_ref)) 384 goto found; 385 386 switch (PTR_ERR(key_ref)) { 387 case -EAGAIN: /* no key */ 388 if (ret) 389 break; 390 case -ENOKEY: /* negative key */ 391 ret = key_ref; 392 break; 393 default: 394 err = key_ref; 395 break; 396 } 397 } 398 /* or search the user-session keyring */ 399 else if (ctx->cred->user->session_keyring) { 400 key_ref = keyring_search_aux( 401 make_key_ref(ctx->cred->user->session_keyring, 1), 402 ctx); 403 if (!IS_ERR(key_ref)) 404 goto found; 405 406 switch (PTR_ERR(key_ref)) { 407 case -EAGAIN: /* no key */ 408 if (ret) 409 break; 410 case -ENOKEY: /* negative key */ 411 ret = key_ref; 412 break; 413 default: 414 err = key_ref; 415 break; 416 } 417 } 418 419 /* no key - decide on the error we're going to go for */ 420 key_ref = ret ? ret : err; 421 422 found: 423 return key_ref; 424 } 425 426 /* 427 * Search the process keyrings attached to the supplied cred for the first 428 * matching key in the manner of search_my_process_keyrings(), but also search 429 * the keys attached to the assumed authorisation key using its credentials if 430 * one is available. 431 * 432 * Return same as search_my_process_keyrings(). 433 */ 434 key_ref_t search_process_keyrings(struct keyring_search_context *ctx) 435 { 436 struct request_key_auth *rka; 437 key_ref_t key_ref, ret = ERR_PTR(-EACCES), err; 438 439 might_sleep(); 440 441 key_ref = search_my_process_keyrings(ctx); 442 if (!IS_ERR(key_ref)) 443 goto found; 444 err = key_ref; 445 446 /* if this process has an instantiation authorisation key, then we also 447 * search the keyrings of the process mentioned there 448 * - we don't permit access to request_key auth keys via this method 449 */ 450 if (ctx->cred->request_key_auth && 451 ctx->cred == current_cred() && 452 ctx->index_key.type != &key_type_request_key_auth 453 ) { 454 const struct cred *cred = ctx->cred; 455 456 /* defend against the auth key being revoked */ 457 down_read(&cred->request_key_auth->sem); 458 459 if (key_validate(ctx->cred->request_key_auth) == 0) { 460 rka = ctx->cred->request_key_auth->payload.data; 461 462 ctx->cred = rka->cred; 463 key_ref = search_process_keyrings(ctx); 464 ctx->cred = cred; 465 466 up_read(&cred->request_key_auth->sem); 467 468 if (!IS_ERR(key_ref)) 469 goto found; 470 471 ret = key_ref; 472 } else { 473 up_read(&cred->request_key_auth->sem); 474 } 475 } 476 477 /* no key - decide on the error we're going to go for */ 478 if (err == ERR_PTR(-ENOKEY) || ret == ERR_PTR(-ENOKEY)) 479 key_ref = ERR_PTR(-ENOKEY); 480 else if (err == ERR_PTR(-EACCES)) 481 key_ref = ret; 482 else 483 key_ref = err; 484 485 found: 486 return key_ref; 487 } 488 489 /* 490 * See if the key we're looking at is the target key. 491 */ 492 int lookup_user_key_possessed(const struct key *key, const void *target) 493 { 494 return key == target; 495 } 496 497 /* 498 * Look up a key ID given us by userspace with a given permissions mask to get 499 * the key it refers to. 500 * 501 * Flags can be passed to request that special keyrings be created if referred 502 * to directly, to permit partially constructed keys to be found and to skip 503 * validity and permission checks on the found key. 504 * 505 * Returns a pointer to the key with an incremented usage count if successful; 506 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond 507 * to a key or the best found key was a negative key; -EKEYREVOKED or 508 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the 509 * found key doesn't grant the requested permit or the LSM denied access to it; 510 * or -ENOMEM if a special keyring couldn't be created. 511 * 512 * In the case of a successful return, the possession attribute is set on the 513 * returned key reference. 514 */ 515 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, 516 key_perm_t perm) 517 { 518 struct keyring_search_context ctx = { 519 .match = lookup_user_key_possessed, 520 .flags = (KEYRING_SEARCH_NO_STATE_CHECK | 521 KEYRING_SEARCH_LOOKUP_DIRECT), 522 }; 523 struct request_key_auth *rka; 524 struct key *key; 525 key_ref_t key_ref, skey_ref; 526 int ret; 527 528 try_again: 529 ctx.cred = get_current_cred(); 530 key_ref = ERR_PTR(-ENOKEY); 531 532 switch (id) { 533 case KEY_SPEC_THREAD_KEYRING: 534 if (!ctx.cred->thread_keyring) { 535 if (!(lflags & KEY_LOOKUP_CREATE)) 536 goto error; 537 538 ret = install_thread_keyring(); 539 if (ret < 0) { 540 key_ref = ERR_PTR(ret); 541 goto error; 542 } 543 goto reget_creds; 544 } 545 546 key = ctx.cred->thread_keyring; 547 __key_get(key); 548 key_ref = make_key_ref(key, 1); 549 break; 550 551 case KEY_SPEC_PROCESS_KEYRING: 552 if (!ctx.cred->process_keyring) { 553 if (!(lflags & KEY_LOOKUP_CREATE)) 554 goto error; 555 556 ret = install_process_keyring(); 557 if (ret < 0) { 558 key_ref = ERR_PTR(ret); 559 goto error; 560 } 561 goto reget_creds; 562 } 563 564 key = ctx.cred->process_keyring; 565 __key_get(key); 566 key_ref = make_key_ref(key, 1); 567 break; 568 569 case KEY_SPEC_SESSION_KEYRING: 570 if (!ctx.cred->session_keyring) { 571 /* always install a session keyring upon access if one 572 * doesn't exist yet */ 573 ret = install_user_keyrings(); 574 if (ret < 0) 575 goto error; 576 if (lflags & KEY_LOOKUP_CREATE) 577 ret = join_session_keyring(NULL); 578 else 579 ret = install_session_keyring( 580 ctx.cred->user->session_keyring); 581 582 if (ret < 0) 583 goto error; 584 goto reget_creds; 585 } else if (ctx.cred->session_keyring == 586 ctx.cred->user->session_keyring && 587 lflags & KEY_LOOKUP_CREATE) { 588 ret = join_session_keyring(NULL); 589 if (ret < 0) 590 goto error; 591 goto reget_creds; 592 } 593 594 rcu_read_lock(); 595 key = rcu_dereference(ctx.cred->session_keyring); 596 __key_get(key); 597 rcu_read_unlock(); 598 key_ref = make_key_ref(key, 1); 599 break; 600 601 case KEY_SPEC_USER_KEYRING: 602 if (!ctx.cred->user->uid_keyring) { 603 ret = install_user_keyrings(); 604 if (ret < 0) 605 goto error; 606 } 607 608 key = ctx.cred->user->uid_keyring; 609 __key_get(key); 610 key_ref = make_key_ref(key, 1); 611 break; 612 613 case KEY_SPEC_USER_SESSION_KEYRING: 614 if (!ctx.cred->user->session_keyring) { 615 ret = install_user_keyrings(); 616 if (ret < 0) 617 goto error; 618 } 619 620 key = ctx.cred->user->session_keyring; 621 __key_get(key); 622 key_ref = make_key_ref(key, 1); 623 break; 624 625 case KEY_SPEC_GROUP_KEYRING: 626 /* group keyrings are not yet supported */ 627 key_ref = ERR_PTR(-EINVAL); 628 goto error; 629 630 case KEY_SPEC_REQKEY_AUTH_KEY: 631 key = ctx.cred->request_key_auth; 632 if (!key) 633 goto error; 634 635 __key_get(key); 636 key_ref = make_key_ref(key, 1); 637 break; 638 639 case KEY_SPEC_REQUESTOR_KEYRING: 640 if (!ctx.cred->request_key_auth) 641 goto error; 642 643 down_read(&ctx.cred->request_key_auth->sem); 644 if (test_bit(KEY_FLAG_REVOKED, 645 &ctx.cred->request_key_auth->flags)) { 646 key_ref = ERR_PTR(-EKEYREVOKED); 647 key = NULL; 648 } else { 649 rka = ctx.cred->request_key_auth->payload.data; 650 key = rka->dest_keyring; 651 __key_get(key); 652 } 653 up_read(&ctx.cred->request_key_auth->sem); 654 if (!key) 655 goto error; 656 key_ref = make_key_ref(key, 1); 657 break; 658 659 default: 660 key_ref = ERR_PTR(-EINVAL); 661 if (id < 1) 662 goto error; 663 664 key = key_lookup(id); 665 if (IS_ERR(key)) { 666 key_ref = ERR_CAST(key); 667 goto error; 668 } 669 670 key_ref = make_key_ref(key, 0); 671 672 /* check to see if we possess the key */ 673 ctx.index_key.type = key->type; 674 ctx.index_key.description = key->description; 675 ctx.index_key.desc_len = strlen(key->description); 676 ctx.match_data = key; 677 kdebug("check possessed"); 678 skey_ref = search_process_keyrings(&ctx); 679 kdebug("possessed=%p", skey_ref); 680 681 if (!IS_ERR(skey_ref)) { 682 key_put(key); 683 key_ref = skey_ref; 684 } 685 686 break; 687 } 688 689 /* unlink does not use the nominated key in any way, so can skip all 690 * the permission checks as it is only concerned with the keyring */ 691 if (lflags & KEY_LOOKUP_FOR_UNLINK) { 692 ret = 0; 693 goto error; 694 } 695 696 if (!(lflags & KEY_LOOKUP_PARTIAL)) { 697 ret = wait_for_key_construction(key, true); 698 switch (ret) { 699 case -ERESTARTSYS: 700 goto invalid_key; 701 default: 702 if (perm) 703 goto invalid_key; 704 case 0: 705 break; 706 } 707 } else if (perm) { 708 ret = key_validate(key); 709 if (ret < 0) 710 goto invalid_key; 711 } 712 713 ret = -EIO; 714 if (!(lflags & KEY_LOOKUP_PARTIAL) && 715 !test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) 716 goto invalid_key; 717 718 /* check the permissions */ 719 ret = key_task_permission(key_ref, ctx.cred, perm); 720 if (ret < 0) 721 goto invalid_key; 722 723 key->last_used_at = current_kernel_time().tv_sec; 724 725 error: 726 put_cred(ctx.cred); 727 return key_ref; 728 729 invalid_key: 730 key_ref_put(key_ref); 731 key_ref = ERR_PTR(ret); 732 goto error; 733 734 /* if we attempted to install a keyring, then it may have caused new 735 * creds to be installed */ 736 reget_creds: 737 put_cred(ctx.cred); 738 goto try_again; 739 } 740 741 /* 742 * Join the named keyring as the session keyring if possible else attempt to 743 * create a new one of that name and join that. 744 * 745 * If the name is NULL, an empty anonymous keyring will be installed as the 746 * session keyring. 747 * 748 * Named session keyrings are joined with a semaphore held to prevent the 749 * keyrings from going away whilst the attempt is made to going them and also 750 * to prevent a race in creating compatible session keyrings. 751 */ 752 long join_session_keyring(const char *name) 753 { 754 const struct cred *old; 755 struct cred *new; 756 struct key *keyring; 757 long ret, serial; 758 759 new = prepare_creds(); 760 if (!new) 761 return -ENOMEM; 762 old = current_cred(); 763 764 /* if no name is provided, install an anonymous keyring */ 765 if (!name) { 766 ret = install_session_keyring_to_cred(new, NULL); 767 if (ret < 0) 768 goto error; 769 770 serial = new->session_keyring->serial; 771 ret = commit_creds(new); 772 if (ret == 0) 773 ret = serial; 774 goto okay; 775 } 776 777 /* allow the user to join or create a named keyring */ 778 mutex_lock(&key_session_mutex); 779 780 /* look for an existing keyring of this name */ 781 keyring = find_keyring_by_name(name, false); 782 if (PTR_ERR(keyring) == -ENOKEY) { 783 /* not found - try and create a new one */ 784 keyring = keyring_alloc( 785 name, old->uid, old->gid, old, 786 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK, 787 KEY_ALLOC_IN_QUOTA, NULL); 788 if (IS_ERR(keyring)) { 789 ret = PTR_ERR(keyring); 790 goto error2; 791 } 792 } else if (IS_ERR(keyring)) { 793 ret = PTR_ERR(keyring); 794 goto error2; 795 } else if (keyring == new->session_keyring) { 796 ret = 0; 797 goto error2; 798 } 799 800 /* we've got a keyring - now to install it */ 801 ret = install_session_keyring_to_cred(new, keyring); 802 if (ret < 0) 803 goto error2; 804 805 commit_creds(new); 806 mutex_unlock(&key_session_mutex); 807 808 ret = keyring->serial; 809 key_put(keyring); 810 okay: 811 return ret; 812 813 error2: 814 mutex_unlock(&key_session_mutex); 815 error: 816 abort_creds(new); 817 return ret; 818 } 819 820 /* 821 * Replace a process's session keyring on behalf of one of its children when 822 * the target process is about to resume userspace execution. 823 */ 824 void key_change_session_keyring(struct callback_head *twork) 825 { 826 const struct cred *old = current_cred(); 827 struct cred *new = container_of(twork, struct cred, rcu); 828 829 if (unlikely(current->flags & PF_EXITING)) { 830 put_cred(new); 831 return; 832 } 833 834 new-> uid = old-> uid; 835 new-> euid = old-> euid; 836 new-> suid = old-> suid; 837 new->fsuid = old->fsuid; 838 new-> gid = old-> gid; 839 new-> egid = old-> egid; 840 new-> sgid = old-> sgid; 841 new->fsgid = old->fsgid; 842 new->user = get_uid(old->user); 843 new->user_ns = get_user_ns(old->user_ns); 844 new->group_info = get_group_info(old->group_info); 845 846 new->securebits = old->securebits; 847 new->cap_inheritable = old->cap_inheritable; 848 new->cap_permitted = old->cap_permitted; 849 new->cap_effective = old->cap_effective; 850 new->cap_bset = old->cap_bset; 851 852 new->jit_keyring = old->jit_keyring; 853 new->thread_keyring = key_get(old->thread_keyring); 854 new->process_keyring = key_get(old->process_keyring); 855 856 security_transfer_creds(new, old); 857 858 commit_creds(new); 859 } 860 861 /* 862 * Make sure that root's user and user-session keyrings exist. 863 */ 864 static int __init init_root_keyring(void) 865 { 866 return install_user_keyrings(); 867 } 868 869 late_initcall(init_root_keyring); 870