xref: /openbmc/linux/security/keys/request_key_auth.c (revision f677b30b487ca3763c3de3f1b4d8c976c2961cd1)
1 /* Request key authorisation token key definition.
2  *
3  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4  * Written by David Howells (dhowells@redhat.com)
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  *
11  * See Documentation/security/keys-request-key.txt
12  */
13 
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/err.h>
17 #include <linux/seq_file.h>
18 #include <linux/slab.h>
19 #include <asm/uaccess.h>
20 #include "internal.h"
21 #include <keys/user-type.h>
22 
23 static int request_key_auth_instantiate(struct key *,
24 					struct key_preparsed_payload *);
25 static void request_key_auth_describe(const struct key *, struct seq_file *);
26 static void request_key_auth_revoke(struct key *);
27 static void request_key_auth_destroy(struct key *);
28 static long request_key_auth_read(const struct key *, char __user *, size_t);
29 
30 /*
31  * The request-key authorisation key type definition.
32  */
33 struct key_type key_type_request_key_auth = {
34 	.name		= ".request_key_auth",
35 	.def_datalen	= sizeof(struct request_key_auth),
36 	.instantiate	= request_key_auth_instantiate,
37 	.describe	= request_key_auth_describe,
38 	.revoke		= request_key_auth_revoke,
39 	.destroy	= request_key_auth_destroy,
40 	.read		= request_key_auth_read,
41 };
42 
43 /*
44  * Instantiate a request-key authorisation key.
45  */
46 static int request_key_auth_instantiate(struct key *key,
47 					struct key_preparsed_payload *prep)
48 {
49 	key->payload.data = (struct request_key_auth *)prep->data;
50 	return 0;
51 }
52 
53 /*
54  * Describe an authorisation token.
55  */
56 static void request_key_auth_describe(const struct key *key,
57 				      struct seq_file *m)
58 {
59 	struct request_key_auth *rka = key->payload.data;
60 
61 	seq_puts(m, "key:");
62 	seq_puts(m, key->description);
63 	if (key_is_instantiated(key))
64 		seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
65 }
66 
67 /*
68  * Read the callout_info data (retrieves the callout information).
69  * - the key's semaphore is read-locked
70  */
71 static long request_key_auth_read(const struct key *key,
72 				  char __user *buffer, size_t buflen)
73 {
74 	struct request_key_auth *rka = key->payload.data;
75 	size_t datalen;
76 	long ret;
77 
78 	datalen = rka->callout_len;
79 	ret = datalen;
80 
81 	/* we can return the data as is */
82 	if (buffer && buflen > 0) {
83 		if (buflen > datalen)
84 			buflen = datalen;
85 
86 		if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
87 			ret = -EFAULT;
88 	}
89 
90 	return ret;
91 }
92 
93 /*
94  * Handle revocation of an authorisation token key.
95  *
96  * Called with the key sem write-locked.
97  */
98 static void request_key_auth_revoke(struct key *key)
99 {
100 	struct request_key_auth *rka = key->payload.data;
101 
102 	kenter("{%d}", key->serial);
103 
104 	if (rka->cred) {
105 		put_cred(rka->cred);
106 		rka->cred = NULL;
107 	}
108 }
109 
110 /*
111  * Destroy an instantiation authorisation token key.
112  */
113 static void request_key_auth_destroy(struct key *key)
114 {
115 	struct request_key_auth *rka = key->payload.data;
116 
117 	kenter("{%d}", key->serial);
118 
119 	if (rka->cred) {
120 		put_cred(rka->cred);
121 		rka->cred = NULL;
122 	}
123 
124 	key_put(rka->target_key);
125 	key_put(rka->dest_keyring);
126 	kfree(rka->callout_info);
127 	kfree(rka);
128 }
129 
130 /*
131  * Create an authorisation token for /sbin/request-key or whoever to gain
132  * access to the caller's security data.
133  */
134 struct key *request_key_auth_new(struct key *target, const void *callout_info,
135 				 size_t callout_len, struct key *dest_keyring)
136 {
137 	struct request_key_auth *rka, *irka;
138 	const struct cred *cred = current->cred;
139 	struct key *authkey = NULL;
140 	char desc[20];
141 	int ret;
142 
143 	kenter("%d,", target->serial);
144 
145 	/* allocate a auth record */
146 	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
147 	if (!rka) {
148 		kleave(" = -ENOMEM");
149 		return ERR_PTR(-ENOMEM);
150 	}
151 	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
152 	if (!rka->callout_info) {
153 		kleave(" = -ENOMEM");
154 		kfree(rka);
155 		return ERR_PTR(-ENOMEM);
156 	}
157 
158 	/* see if the calling process is already servicing the key request of
159 	 * another process */
160 	if (cred->request_key_auth) {
161 		/* it is - use that instantiation context here too */
162 		down_read(&cred->request_key_auth->sem);
163 
164 		/* if the auth key has been revoked, then the key we're
165 		 * servicing is already instantiated */
166 		if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
167 			goto auth_key_revoked;
168 
169 		irka = cred->request_key_auth->payload.data;
170 		rka->cred = get_cred(irka->cred);
171 		rka->pid = irka->pid;
172 
173 		up_read(&cred->request_key_auth->sem);
174 	}
175 	else {
176 		/* it isn't - use this process as the context */
177 		rka->cred = get_cred(cred);
178 		rka->pid = current->pid;
179 	}
180 
181 	rka->target_key = key_get(target);
182 	rka->dest_keyring = key_get(dest_keyring);
183 	memcpy(rka->callout_info, callout_info, callout_len);
184 	rka->callout_len = callout_len;
185 
186 	/* allocate the auth key */
187 	sprintf(desc, "%x", target->serial);
188 
189 	authkey = key_alloc(&key_type_request_key_auth, desc,
190 			    cred->fsuid, cred->fsgid, cred,
191 			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
192 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
193 	if (IS_ERR(authkey)) {
194 		ret = PTR_ERR(authkey);
195 		goto error_alloc;
196 	}
197 
198 	/* construct the auth key */
199 	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
200 	if (ret < 0)
201 		goto error_inst;
202 
203 	kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
204 	return authkey;
205 
206 auth_key_revoked:
207 	up_read(&cred->request_key_auth->sem);
208 	kfree(rka->callout_info);
209 	kfree(rka);
210 	kleave("= -EKEYREVOKED");
211 	return ERR_PTR(-EKEYREVOKED);
212 
213 error_inst:
214 	key_revoke(authkey);
215 	key_put(authkey);
216 error_alloc:
217 	key_put(rka->target_key);
218 	key_put(rka->dest_keyring);
219 	kfree(rka->callout_info);
220 	kfree(rka);
221 	kleave("= %d", ret);
222 	return ERR_PTR(ret);
223 }
224 
225 /*
226  * Search the current process's keyrings for the authorisation key for
227  * instantiation of a key.
228  */
229 struct key *key_get_instantiation_authkey(key_serial_t target_id)
230 {
231 	char description[16];
232 	struct keyring_search_context ctx = {
233 		.index_key.type		= &key_type_request_key_auth,
234 		.index_key.description	= description,
235 		.cred			= current_cred(),
236 		.match			= user_match,
237 		.match_data		= description,
238 		.flags			= KEYRING_SEARCH_LOOKUP_DIRECT,
239 	};
240 	struct key *authkey;
241 	key_ref_t authkey_ref;
242 
243 	sprintf(description, "%x", target_id);
244 
245 	authkey_ref = search_process_keyrings(&ctx);
246 
247 	if (IS_ERR(authkey_ref)) {
248 		authkey = ERR_CAST(authkey_ref);
249 		if (authkey == ERR_PTR(-EAGAIN))
250 			authkey = ERR_PTR(-ENOKEY);
251 		goto error;
252 	}
253 
254 	authkey = key_ref_to_ptr(authkey_ref);
255 	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
256 		key_put(authkey);
257 		authkey = ERR_PTR(-EKEYREVOKED);
258 	}
259 
260 error:
261 	return authkey;
262 }
263