xref: /openbmc/linux/security/keys/request_key_auth.c (revision df2634f43f5106947f3735a0b61a6527a4b278cd)
1 /* Request key authorisation token key definition.
2  *
3  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  *
11  * See Documentation/keys-request-key.txt
12  */
13 
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/err.h>
17 #include <linux/seq_file.h>
18 #include <linux/slab.h>
19 #include <asm/uaccess.h>
20 #include "internal.h"
21 
22 static int request_key_auth_instantiate(struct key *, const void *, size_t);
23 static void request_key_auth_describe(const struct key *, struct seq_file *);
24 static void request_key_auth_revoke(struct key *);
25 static void request_key_auth_destroy(struct key *);
26 static long request_key_auth_read(const struct key *, char __user *, size_t);
27 
28 /*
29  * The request-key authorisation key type definition.
30  */
31 struct key_type key_type_request_key_auth = {
32 	.name		= ".request_key_auth",
33 	.def_datalen	= sizeof(struct request_key_auth),
34 	.instantiate	= request_key_auth_instantiate,
35 	.describe	= request_key_auth_describe,
36 	.revoke		= request_key_auth_revoke,
37 	.destroy	= request_key_auth_destroy,
38 	.read		= request_key_auth_read,
39 };
40 
41 /*
42  * Instantiate a request-key authorisation key.
43  */
44 static int request_key_auth_instantiate(struct key *key,
45 					const void *data,
46 					size_t datalen)
47 {
48 	key->payload.data = (struct request_key_auth *) data;
49 	return 0;
50 }
51 
52 /*
53  * Describe an authorisation token.
54  */
55 static void request_key_auth_describe(const struct key *key,
56 				      struct seq_file *m)
57 {
58 	struct request_key_auth *rka = key->payload.data;
59 
60 	seq_puts(m, "key:");
61 	seq_puts(m, key->description);
62 	seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
63 }
64 
65 /*
66  * Read the callout_info data (retrieves the callout information).
67  * - the key's semaphore is read-locked
68  */
69 static long request_key_auth_read(const struct key *key,
70 				  char __user *buffer, size_t buflen)
71 {
72 	struct request_key_auth *rka = key->payload.data;
73 	size_t datalen;
74 	long ret;
75 
76 	datalen = rka->callout_len;
77 	ret = datalen;
78 
79 	/* we can return the data as is */
80 	if (buffer && buflen > 0) {
81 		if (buflen > datalen)
82 			buflen = datalen;
83 
84 		if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
85 			ret = -EFAULT;
86 	}
87 
88 	return ret;
89 }
90 
91 /*
92  * Handle revocation of an authorisation token key.
93  *
94  * Called with the key sem write-locked.
95  */
96 static void request_key_auth_revoke(struct key *key)
97 {
98 	struct request_key_auth *rka = key->payload.data;
99 
100 	kenter("{%d}", key->serial);
101 
102 	if (rka->cred) {
103 		put_cred(rka->cred);
104 		rka->cred = NULL;
105 	}
106 }
107 
108 /*
109  * Destroy an instantiation authorisation token key.
110  */
111 static void request_key_auth_destroy(struct key *key)
112 {
113 	struct request_key_auth *rka = key->payload.data;
114 
115 	kenter("{%d}", key->serial);
116 
117 	if (rka->cred) {
118 		put_cred(rka->cred);
119 		rka->cred = NULL;
120 	}
121 
122 	key_put(rka->target_key);
123 	key_put(rka->dest_keyring);
124 	kfree(rka->callout_info);
125 	kfree(rka);
126 }
127 
128 /*
129  * Create an authorisation token for /sbin/request-key or whoever to gain
130  * access to the caller's security data.
131  */
132 struct key *request_key_auth_new(struct key *target, const void *callout_info,
133 				 size_t callout_len, struct key *dest_keyring)
134 {
135 	struct request_key_auth *rka, *irka;
136 	const struct cred *cred = current->cred;
137 	struct key *authkey = NULL;
138 	char desc[20];
139 	int ret;
140 
141 	kenter("%d,", target->serial);
142 
143 	/* allocate a auth record */
144 	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
145 	if (!rka) {
146 		kleave(" = -ENOMEM");
147 		return ERR_PTR(-ENOMEM);
148 	}
149 	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
150 	if (!rka->callout_info) {
151 		kleave(" = -ENOMEM");
152 		kfree(rka);
153 		return ERR_PTR(-ENOMEM);
154 	}
155 
156 	/* see if the calling process is already servicing the key request of
157 	 * another process */
158 	if (cred->request_key_auth) {
159 		/* it is - use that instantiation context here too */
160 		down_read(&cred->request_key_auth->sem);
161 
162 		/* if the auth key has been revoked, then the key we're
163 		 * servicing is already instantiated */
164 		if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
165 			goto auth_key_revoked;
166 
167 		irka = cred->request_key_auth->payload.data;
168 		rka->cred = get_cred(irka->cred);
169 		rka->pid = irka->pid;
170 
171 		up_read(&cred->request_key_auth->sem);
172 	}
173 	else {
174 		/* it isn't - use this process as the context */
175 		rka->cred = get_cred(cred);
176 		rka->pid = current->pid;
177 	}
178 
179 	rka->target_key = key_get(target);
180 	rka->dest_keyring = key_get(dest_keyring);
181 	memcpy(rka->callout_info, callout_info, callout_len);
182 	rka->callout_len = callout_len;
183 
184 	/* allocate the auth key */
185 	sprintf(desc, "%x", target->serial);
186 
187 	authkey = key_alloc(&key_type_request_key_auth, desc,
188 			    cred->fsuid, cred->fsgid, cred,
189 			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
190 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
191 	if (IS_ERR(authkey)) {
192 		ret = PTR_ERR(authkey);
193 		goto error_alloc;
194 	}
195 
196 	/* construct the auth key */
197 	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
198 	if (ret < 0)
199 		goto error_inst;
200 
201 	kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
202 	return authkey;
203 
204 auth_key_revoked:
205 	up_read(&cred->request_key_auth->sem);
206 	kfree(rka->callout_info);
207 	kfree(rka);
208 	kleave("= -EKEYREVOKED");
209 	return ERR_PTR(-EKEYREVOKED);
210 
211 error_inst:
212 	key_revoke(authkey);
213 	key_put(authkey);
214 error_alloc:
215 	key_put(rka->target_key);
216 	key_put(rka->dest_keyring);
217 	kfree(rka->callout_info);
218 	kfree(rka);
219 	kleave("= %d", ret);
220 	return ERR_PTR(ret);
221 }
222 
223 /*
224  * See if an authorisation key is associated with a particular key.
225  */
226 static int key_get_instantiation_authkey_match(const struct key *key,
227 					       const void *_id)
228 {
229 	struct request_key_auth *rka = key->payload.data;
230 	key_serial_t id = (key_serial_t)(unsigned long) _id;
231 
232 	return rka->target_key->serial == id;
233 }
234 
235 /*
236  * Search the current process's keyrings for the authorisation key for
237  * instantiation of a key.
238  */
239 struct key *key_get_instantiation_authkey(key_serial_t target_id)
240 {
241 	const struct cred *cred = current_cred();
242 	struct key *authkey;
243 	key_ref_t authkey_ref;
244 
245 	authkey_ref = search_process_keyrings(
246 		&key_type_request_key_auth,
247 		(void *) (unsigned long) target_id,
248 		key_get_instantiation_authkey_match,
249 		cred);
250 
251 	if (IS_ERR(authkey_ref)) {
252 		authkey = ERR_CAST(authkey_ref);
253 		goto error;
254 	}
255 
256 	authkey = key_ref_to_ptr(authkey_ref);
257 	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
258 		key_put(authkey);
259 		authkey = ERR_PTR(-EKEYREVOKED);
260 	}
261 
262 error:
263 	return authkey;
264 }
265