1 /* Request key authorisation token key definition.
2  *
3  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  *
11  * See Documentation/security/keys/request-key.rst
12  */
13 
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/err.h>
17 #include <linux/seq_file.h>
18 #include <linux/slab.h>
19 #include <linux/uaccess.h>
20 #include "internal.h"
21 #include <keys/user-type.h>
22 
23 static int request_key_auth_preparse(struct key_preparsed_payload *);
24 static void request_key_auth_free_preparse(struct key_preparsed_payload *);
25 static int request_key_auth_instantiate(struct key *,
26 					struct key_preparsed_payload *);
27 static void request_key_auth_describe(const struct key *, struct seq_file *);
28 static void request_key_auth_revoke(struct key *);
29 static void request_key_auth_destroy(struct key *);
30 static long request_key_auth_read(const struct key *, char __user *, size_t);
31 
32 /*
33  * The request-key authorisation key type definition.
34  */
35 struct key_type key_type_request_key_auth = {
36 	.name		= ".request_key_auth",
37 	.def_datalen	= sizeof(struct request_key_auth),
38 	.preparse	= request_key_auth_preparse,
39 	.free_preparse	= request_key_auth_free_preparse,
40 	.instantiate	= request_key_auth_instantiate,
41 	.describe	= request_key_auth_describe,
42 	.revoke		= request_key_auth_revoke,
43 	.destroy	= request_key_auth_destroy,
44 	.read		= request_key_auth_read,
45 };
46 
47 static int request_key_auth_preparse(struct key_preparsed_payload *prep)
48 {
49 	return 0;
50 }
51 
52 static void request_key_auth_free_preparse(struct key_preparsed_payload *prep)
53 {
54 }
55 
56 /*
57  * Instantiate a request-key authorisation key.
58  */
59 static int request_key_auth_instantiate(struct key *key,
60 					struct key_preparsed_payload *prep)
61 {
62 	key->payload.data[0] = (struct request_key_auth *)prep->data;
63 	return 0;
64 }
65 
66 /*
67  * Describe an authorisation token.
68  */
69 static void request_key_auth_describe(const struct key *key,
70 				      struct seq_file *m)
71 {
72 	struct request_key_auth *rka = key->payload.data[0];
73 
74 	seq_puts(m, "key:");
75 	seq_puts(m, key->description);
76 	if (key_is_positive(key))
77 		seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
78 }
79 
80 /*
81  * Read the callout_info data (retrieves the callout information).
82  * - the key's semaphore is read-locked
83  */
84 static long request_key_auth_read(const struct key *key,
85 				  char __user *buffer, size_t buflen)
86 {
87 	struct request_key_auth *rka = key->payload.data[0];
88 	size_t datalen;
89 	long ret;
90 
91 	datalen = rka->callout_len;
92 	ret = datalen;
93 
94 	/* we can return the data as is */
95 	if (buffer && buflen > 0) {
96 		if (buflen > datalen)
97 			buflen = datalen;
98 
99 		if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
100 			ret = -EFAULT;
101 	}
102 
103 	return ret;
104 }
105 
106 /*
107  * Handle revocation of an authorisation token key.
108  *
109  * Called with the key sem write-locked.
110  */
111 static void request_key_auth_revoke(struct key *key)
112 {
113 	struct request_key_auth *rka = key->payload.data[0];
114 
115 	kenter("{%d}", key->serial);
116 
117 	if (rka->cred) {
118 		put_cred(rka->cred);
119 		rka->cred = NULL;
120 	}
121 }
122 
123 static void free_request_key_auth(struct request_key_auth *rka)
124 {
125 	if (!rka)
126 		return;
127 	key_put(rka->target_key);
128 	key_put(rka->dest_keyring);
129 	if (rka->cred)
130 		put_cred(rka->cred);
131 	kfree(rka->callout_info);
132 	kfree(rka);
133 }
134 
135 /*
136  * Destroy an instantiation authorisation token key.
137  */
138 static void request_key_auth_destroy(struct key *key)
139 {
140 	struct request_key_auth *rka = key->payload.data[0];
141 
142 	kenter("{%d}", key->serial);
143 
144 	free_request_key_auth(rka);
145 }
146 
147 /*
148  * Create an authorisation token for /sbin/request-key or whoever to gain
149  * access to the caller's security data.
150  */
151 struct key *request_key_auth_new(struct key *target, const void *callout_info,
152 				 size_t callout_len, struct key *dest_keyring)
153 {
154 	struct request_key_auth *rka, *irka;
155 	const struct cred *cred = current->cred;
156 	struct key *authkey = NULL;
157 	char desc[20];
158 	int ret = -ENOMEM;
159 
160 	kenter("%d,", target->serial);
161 
162 	/* allocate a auth record */
163 	rka = kzalloc(sizeof(*rka), GFP_KERNEL);
164 	if (!rka)
165 		goto error;
166 	rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
167 	if (!rka->callout_info)
168 		goto error_free_rka;
169 	rka->callout_len = callout_len;
170 
171 	/* see if the calling process is already servicing the key request of
172 	 * another process */
173 	if (cred->request_key_auth) {
174 		/* it is - use that instantiation context here too */
175 		down_read(&cred->request_key_auth->sem);
176 
177 		/* if the auth key has been revoked, then the key we're
178 		 * servicing is already instantiated */
179 		if (test_bit(KEY_FLAG_REVOKED,
180 			     &cred->request_key_auth->flags)) {
181 			up_read(&cred->request_key_auth->sem);
182 			ret = -EKEYREVOKED;
183 			goto error_free_rka;
184 		}
185 
186 		irka = cred->request_key_auth->payload.data[0];
187 		rka->cred = get_cred(irka->cred);
188 		rka->pid = irka->pid;
189 
190 		up_read(&cred->request_key_auth->sem);
191 	}
192 	else {
193 		/* it isn't - use this process as the context */
194 		rka->cred = get_cred(cred);
195 		rka->pid = current->pid;
196 	}
197 
198 	rka->target_key = key_get(target);
199 	rka->dest_keyring = key_get(dest_keyring);
200 
201 	/* allocate the auth key */
202 	sprintf(desc, "%x", target->serial);
203 
204 	authkey = key_alloc(&key_type_request_key_auth, desc,
205 			    cred->fsuid, cred->fsgid, cred,
206 			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
207 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
208 	if (IS_ERR(authkey)) {
209 		ret = PTR_ERR(authkey);
210 		goto error_free_rka;
211 	}
212 
213 	/* construct the auth key */
214 	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
215 	if (ret < 0)
216 		goto error_put_authkey;
217 
218 	kleave(" = {%d,%d}", authkey->serial, refcount_read(&authkey->usage));
219 	return authkey;
220 
221 error_put_authkey:
222 	key_put(authkey);
223 error_free_rka:
224 	free_request_key_auth(rka);
225 error:
226 	kleave("= %d", ret);
227 	return ERR_PTR(ret);
228 }
229 
230 /*
231  * Search the current process's keyrings for the authorisation key for
232  * instantiation of a key.
233  */
234 struct key *key_get_instantiation_authkey(key_serial_t target_id)
235 {
236 	char description[16];
237 	struct keyring_search_context ctx = {
238 		.index_key.type		= &key_type_request_key_auth,
239 		.index_key.description	= description,
240 		.cred			= current_cred(),
241 		.match_data.cmp		= key_default_cmp,
242 		.match_data.raw_data	= description,
243 		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
244 		.flags			= KEYRING_SEARCH_DO_STATE_CHECK,
245 	};
246 	struct key *authkey;
247 	key_ref_t authkey_ref;
248 
249 	sprintf(description, "%x", target_id);
250 
251 	authkey_ref = search_process_keyrings(&ctx);
252 
253 	if (IS_ERR(authkey_ref)) {
254 		authkey = ERR_CAST(authkey_ref);
255 		if (authkey == ERR_PTR(-EAGAIN))
256 			authkey = ERR_PTR(-ENOKEY);
257 		goto error;
258 	}
259 
260 	authkey = key_ref_to_ptr(authkey_ref);
261 	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
262 		key_put(authkey);
263 		authkey = ERR_PTR(-EKEYREVOKED);
264 	}
265 
266 error:
267 	return authkey;
268 }
269