1 /* Request key authorisation token key definition. 2 * 3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 * 11 * See Documentation/keys-request-key.txt 12 */ 13 14 #include <linux/module.h> 15 #include <linux/sched.h> 16 #include <linux/err.h> 17 #include <linux/seq_file.h> 18 #include <linux/slab.h> 19 #include <asm/uaccess.h> 20 #include "internal.h" 21 22 static int request_key_auth_instantiate(struct key *, const void *, size_t); 23 static void request_key_auth_describe(const struct key *, struct seq_file *); 24 static void request_key_auth_revoke(struct key *); 25 static void request_key_auth_destroy(struct key *); 26 static long request_key_auth_read(const struct key *, char __user *, size_t); 27 28 /* 29 * The request-key authorisation key type definition. 30 */ 31 struct key_type key_type_request_key_auth = { 32 .name = ".request_key_auth", 33 .def_datalen = sizeof(struct request_key_auth), 34 .instantiate = request_key_auth_instantiate, 35 .describe = request_key_auth_describe, 36 .revoke = request_key_auth_revoke, 37 .destroy = request_key_auth_destroy, 38 .read = request_key_auth_read, 39 }; 40 41 /* 42 * Instantiate a request-key authorisation key. 43 */ 44 static int request_key_auth_instantiate(struct key *key, 45 const void *data, 46 size_t datalen) 47 { 48 key->payload.data = (struct request_key_auth *) data; 49 return 0; 50 } 51 52 /* 53 * Describe an authorisation token. 54 */ 55 static void request_key_auth_describe(const struct key *key, 56 struct seq_file *m) 57 { 58 struct request_key_auth *rka = key->payload.data; 59 60 seq_puts(m, "key:"); 61 seq_puts(m, key->description); 62 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); 63 } 64 65 /* 66 * Read the callout_info data (retrieves the callout information). 67 * - the key's semaphore is read-locked 68 */ 69 static long request_key_auth_read(const struct key *key, 70 char __user *buffer, size_t buflen) 71 { 72 struct request_key_auth *rka = key->payload.data; 73 size_t datalen; 74 long ret; 75 76 datalen = rka->callout_len; 77 ret = datalen; 78 79 /* we can return the data as is */ 80 if (buffer && buflen > 0) { 81 if (buflen > datalen) 82 buflen = datalen; 83 84 if (copy_to_user(buffer, rka->callout_info, buflen) != 0) 85 ret = -EFAULT; 86 } 87 88 return ret; 89 } 90 91 /* 92 * Handle revocation of an authorisation token key. 93 * 94 * Called with the key sem write-locked. 95 */ 96 static void request_key_auth_revoke(struct key *key) 97 { 98 struct request_key_auth *rka = key->payload.data; 99 100 kenter("{%d}", key->serial); 101 102 if (rka->cred) { 103 put_cred(rka->cred); 104 rka->cred = NULL; 105 } 106 } 107 108 /* 109 * Destroy an instantiation authorisation token key. 110 */ 111 static void request_key_auth_destroy(struct key *key) 112 { 113 struct request_key_auth *rka = key->payload.data; 114 115 kenter("{%d}", key->serial); 116 117 if (rka->cred) { 118 put_cred(rka->cred); 119 rka->cred = NULL; 120 } 121 122 key_put(rka->target_key); 123 key_put(rka->dest_keyring); 124 kfree(rka->callout_info); 125 kfree(rka); 126 } 127 128 /* 129 * Create an authorisation token for /sbin/request-key or whoever to gain 130 * access to the caller's security data. 131 */ 132 struct key *request_key_auth_new(struct key *target, const void *callout_info, 133 size_t callout_len, struct key *dest_keyring) 134 { 135 struct request_key_auth *rka, *irka; 136 const struct cred *cred = current->cred; 137 struct key *authkey = NULL; 138 char desc[20]; 139 int ret; 140 141 kenter("%d,", target->serial); 142 143 /* allocate a auth record */ 144 rka = kmalloc(sizeof(*rka), GFP_KERNEL); 145 if (!rka) { 146 kleave(" = -ENOMEM"); 147 return ERR_PTR(-ENOMEM); 148 } 149 rka->callout_info = kmalloc(callout_len, GFP_KERNEL); 150 if (!rka->callout_info) { 151 kleave(" = -ENOMEM"); 152 kfree(rka); 153 return ERR_PTR(-ENOMEM); 154 } 155 156 /* see if the calling process is already servicing the key request of 157 * another process */ 158 if (cred->request_key_auth) { 159 /* it is - use that instantiation context here too */ 160 down_read(&cred->request_key_auth->sem); 161 162 /* if the auth key has been revoked, then the key we're 163 * servicing is already instantiated */ 164 if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags)) 165 goto auth_key_revoked; 166 167 irka = cred->request_key_auth->payload.data; 168 rka->cred = get_cred(irka->cred); 169 rka->pid = irka->pid; 170 171 up_read(&cred->request_key_auth->sem); 172 } 173 else { 174 /* it isn't - use this process as the context */ 175 rka->cred = get_cred(cred); 176 rka->pid = current->pid; 177 } 178 179 rka->target_key = key_get(target); 180 rka->dest_keyring = key_get(dest_keyring); 181 memcpy(rka->callout_info, callout_info, callout_len); 182 rka->callout_len = callout_len; 183 184 /* allocate the auth key */ 185 sprintf(desc, "%x", target->serial); 186 187 authkey = key_alloc(&key_type_request_key_auth, desc, 188 cred->fsuid, cred->fsgid, cred, 189 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | 190 KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA); 191 if (IS_ERR(authkey)) { 192 ret = PTR_ERR(authkey); 193 goto error_alloc; 194 } 195 196 /* construct the auth key */ 197 ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL); 198 if (ret < 0) 199 goto error_inst; 200 201 kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage)); 202 return authkey; 203 204 auth_key_revoked: 205 up_read(&cred->request_key_auth->sem); 206 kfree(rka->callout_info); 207 kfree(rka); 208 kleave("= -EKEYREVOKED"); 209 return ERR_PTR(-EKEYREVOKED); 210 211 error_inst: 212 key_revoke(authkey); 213 key_put(authkey); 214 error_alloc: 215 key_put(rka->target_key); 216 key_put(rka->dest_keyring); 217 kfree(rka->callout_info); 218 kfree(rka); 219 kleave("= %d", ret); 220 return ERR_PTR(ret); 221 } 222 223 /* 224 * See if an authorisation key is associated with a particular key. 225 */ 226 static int key_get_instantiation_authkey_match(const struct key *key, 227 const void *_id) 228 { 229 struct request_key_auth *rka = key->payload.data; 230 key_serial_t id = (key_serial_t)(unsigned long) _id; 231 232 return rka->target_key->serial == id; 233 } 234 235 /* 236 * Search the current process's keyrings for the authorisation key for 237 * instantiation of a key. 238 */ 239 struct key *key_get_instantiation_authkey(key_serial_t target_id) 240 { 241 const struct cred *cred = current_cred(); 242 struct key *authkey; 243 key_ref_t authkey_ref; 244 245 authkey_ref = search_process_keyrings( 246 &key_type_request_key_auth, 247 (void *) (unsigned long) target_id, 248 key_get_instantiation_authkey_match, 249 cred); 250 251 if (IS_ERR(authkey_ref)) { 252 authkey = ERR_CAST(authkey_ref); 253 goto error; 254 } 255 256 authkey = key_ref_to_ptr(authkey_ref); 257 if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) { 258 key_put(authkey); 259 authkey = ERR_PTR(-EKEYREVOKED); 260 } 261 262 error: 263 return authkey; 264 } 265