1 /* Management of a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/keyctl.h>
17 #include <linux/err.h>
18 #include <linux/mutex.h>
19 #include <linux/security.h>
20 #include <linux/user_namespace.h>
21 #include <asm/uaccess.h>
24 /* session keyring create vs join semaphore */
25 static DEFINE_MUTEX(key_session_mutex);
27 /* user keyring creation semaphore */
28 static DEFINE_MUTEX(key_user_keyring_mutex);
30 /* the root user's tracking struct */
31 struct key_user root_key_user = {
32 .usage = ATOMIC_INIT(3),
33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
34 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
35 .nkeys = ATOMIC_INIT(2),
36 .nikeys = ATOMIC_INIT(2),
38 .user_ns = &init_user_ns,
41 /*****************************************************************************/
43 * install user and user session keyrings for a particular UID
45 int install_user_keyrings(void)
47 struct user_struct *user;
48 const struct cred *cred;
49 struct key *uid_keyring, *session_keyring;
53 cred = current_cred();
56 kenter("%p{%u}", user, user->uid);
58 if (user->uid_keyring) {
59 kleave(" = 0 [exist]");
63 mutex_lock(&key_user_keyring_mutex);
66 if (!user->uid_keyring) {
67 /* get the UID-specific keyring
68 * - there may be one in existence already as it may have been
69 * pinned by a session, but the user_struct pointing to it
70 * may have been destroyed by setuid */
71 sprintf(buf, "_uid.%u", user->uid);
73 uid_keyring = find_keyring_by_name(buf, true);
74 if (IS_ERR(uid_keyring)) {
75 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
76 cred, KEY_ALLOC_IN_QUOTA,
78 if (IS_ERR(uid_keyring)) {
79 ret = PTR_ERR(uid_keyring);
84 /* get a default session keyring (which might also exist
86 sprintf(buf, "_uid_ses.%u", user->uid);
88 session_keyring = find_keyring_by_name(buf, true);
89 if (IS_ERR(session_keyring)) {
91 keyring_alloc(buf, user->uid, (gid_t) -1,
92 cred, KEY_ALLOC_IN_QUOTA, NULL);
93 if (IS_ERR(session_keyring)) {
94 ret = PTR_ERR(session_keyring);
98 /* we install a link from the user session keyring to
100 ret = key_link(session_keyring, uid_keyring);
102 goto error_release_both;
105 /* install the keyrings */
106 user->uid_keyring = uid_keyring;
107 user->session_keyring = session_keyring;
110 mutex_unlock(&key_user_keyring_mutex);
115 key_put(session_keyring);
117 key_put(uid_keyring);
119 mutex_unlock(&key_user_keyring_mutex);
120 kleave(" = %d", ret);
125 * install a fresh thread keyring directly to new credentials
127 int install_thread_keyring_to_cred(struct cred *new)
131 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
132 KEY_ALLOC_QUOTA_OVERRUN, NULL);
134 return PTR_ERR(keyring);
136 new->thread_keyring = keyring;
141 * install a fresh thread keyring, discarding the old one
143 static int install_thread_keyring(void)
148 new = prepare_creds();
152 BUG_ON(new->thread_keyring);
154 ret = install_thread_keyring_to_cred(new);
160 return commit_creds(new);
164 * install a process keyring directly to a credentials struct
165 * - returns -EEXIST if there was already a process keyring, 0 if one installed,
166 * and other -ve on any other error
168 int install_process_keyring_to_cred(struct cred *new)
173 if (new->tgcred->process_keyring)
176 keyring = keyring_alloc("_pid", new->uid, new->gid,
177 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
179 return PTR_ERR(keyring);
181 spin_lock_irq(&new->tgcred->lock);
182 if (!new->tgcred->process_keyring) {
183 new->tgcred->process_keyring = keyring;
189 spin_unlock_irq(&new->tgcred->lock);
195 * make sure a process keyring is installed
198 static int install_process_keyring(void)
203 new = prepare_creds();
207 ret = install_process_keyring_to_cred(new);
210 return ret != -EEXIST ?: 0;
213 return commit_creds(new);
217 * install a session keyring directly to a credentials struct
219 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
226 /* create an empty session keyring */
228 flags = KEY_ALLOC_QUOTA_OVERRUN;
229 if (cred->tgcred->session_keyring)
230 flags = KEY_ALLOC_IN_QUOTA;
232 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
235 return PTR_ERR(keyring);
237 atomic_inc(&keyring->usage);
240 /* install the keyring */
241 spin_lock_irq(&cred->tgcred->lock);
242 old = cred->tgcred->session_keyring;
243 rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
244 spin_unlock_irq(&cred->tgcred->lock);
246 /* we're using RCU on the pointer, but there's no point synchronising
247 * on it if it didn't previously point to anything */
257 * install a session keyring, discarding the old one
258 * - if a keyring is not supplied, an empty one is invented
260 static int install_session_keyring(struct key *keyring)
265 new = prepare_creds();
269 ret = install_session_keyring_to_cred(new, NULL);
275 return commit_creds(new);
278 /*****************************************************************************/
280 * the filesystem user ID changed
282 void key_fsuid_changed(struct task_struct *tsk)
284 /* update the ownership of the thread keyring */
286 if (tsk->cred->thread_keyring) {
287 down_write(&tsk->cred->thread_keyring->sem);
288 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
289 up_write(&tsk->cred->thread_keyring->sem);
292 } /* end key_fsuid_changed() */
294 /*****************************************************************************/
296 * the filesystem group ID changed
298 void key_fsgid_changed(struct task_struct *tsk)
300 /* update the ownership of the thread keyring */
302 if (tsk->cred->thread_keyring) {
303 down_write(&tsk->cred->thread_keyring->sem);
304 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
305 up_write(&tsk->cred->thread_keyring->sem);
308 } /* end key_fsgid_changed() */
310 /*****************************************************************************/
312 * search only my process keyrings for the first matching key
313 * - we use the supplied match function to see if the description (or other
314 * feature of interest) matches
315 * - we return -EAGAIN if we didn't find any matching key
316 * - we return -ENOKEY if we found only negative matching keys
318 key_ref_t search_my_process_keyrings(struct key_type *type,
319 const void *description,
320 key_match_func_t match,
321 const struct cred *cred)
323 key_ref_t key_ref, ret, err;
325 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
326 * searchable, but we failed to find a key or we found a negative key;
327 * otherwise we want to return a sample error (probably -EACCES) if
328 * none of the keyrings were searchable
330 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
334 err = ERR_PTR(-EAGAIN);
336 /* search the thread keyring first */
337 if (cred->thread_keyring) {
338 key_ref = keyring_search_aux(
339 make_key_ref(cred->thread_keyring, 1),
340 cred, type, description, match);
341 if (!IS_ERR(key_ref))
344 switch (PTR_ERR(key_ref)) {
345 case -EAGAIN: /* no key */
348 case -ENOKEY: /* negative key */
357 /* search the process keyring second */
358 if (cred->tgcred->process_keyring) {
359 key_ref = keyring_search_aux(
360 make_key_ref(cred->tgcred->process_keyring, 1),
361 cred, type, description, match);
362 if (!IS_ERR(key_ref))
365 switch (PTR_ERR(key_ref)) {
366 case -EAGAIN: /* no key */
369 case -ENOKEY: /* negative key */
378 /* search the session keyring */
379 if (cred->tgcred->session_keyring) {
381 key_ref = keyring_search_aux(
382 make_key_ref(rcu_dereference(
383 cred->tgcred->session_keyring),
385 cred, type, description, match);
388 if (!IS_ERR(key_ref))
391 switch (PTR_ERR(key_ref)) {
392 case -EAGAIN: /* no key */
395 case -ENOKEY: /* negative key */
403 /* or search the user-session keyring */
404 else if (cred->user->session_keyring) {
405 key_ref = keyring_search_aux(
406 make_key_ref(cred->user->session_keyring, 1),
407 cred, type, description, match);
408 if (!IS_ERR(key_ref))
411 switch (PTR_ERR(key_ref)) {
412 case -EAGAIN: /* no key */
415 case -ENOKEY: /* negative key */
424 /* no key - decide on the error we're going to go for */
425 key_ref = ret ? ret : err;
431 /*****************************************************************************/
433 * search the process keyrings for the first matching key
434 * - we use the supplied match function to see if the description (or other
435 * feature of interest) matches
436 * - we return -EAGAIN if we didn't find any matching key
437 * - we return -ENOKEY if we found only negative matching keys
439 key_ref_t search_process_keyrings(struct key_type *type,
440 const void *description,
441 key_match_func_t match,
442 const struct cred *cred)
444 struct request_key_auth *rka;
445 key_ref_t key_ref, ret = ERR_PTR(-EACCES), err;
449 key_ref = search_my_process_keyrings(type, description, match, cred);
450 if (!IS_ERR(key_ref))
454 /* if this process has an instantiation authorisation key, then we also
455 * search the keyrings of the process mentioned there
456 * - we don't permit access to request_key auth keys via this method
458 if (cred->request_key_auth &&
459 cred == current_cred() &&
460 type != &key_type_request_key_auth
462 /* defend against the auth key being revoked */
463 down_read(&cred->request_key_auth->sem);
465 if (key_validate(cred->request_key_auth) == 0) {
466 rka = cred->request_key_auth->payload.data;
468 key_ref = search_process_keyrings(type, description,
471 up_read(&cred->request_key_auth->sem);
473 if (!IS_ERR(key_ref))
478 up_read(&cred->request_key_auth->sem);
482 /* no key - decide on the error we're going to go for */
483 if (err == ERR_PTR(-ENOKEY) || ret == ERR_PTR(-ENOKEY))
484 key_ref = ERR_PTR(-ENOKEY);
485 else if (err == ERR_PTR(-EACCES))
493 } /* end search_process_keyrings() */
495 /*****************************************************************************/
497 * see if the key we're looking at is the target key
499 int lookup_user_key_possessed(const struct key *key, const void *target)
501 return key == target;
503 } /* end lookup_user_key_possessed() */
505 /*****************************************************************************/
507 * lookup a key given a key ID from userspace with a given permissions mask
508 * - don't create special keyrings unless so requested
509 * - partially constructed keys aren't found unless requested
511 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
514 struct request_key_auth *rka;
515 const struct cred *cred;
517 key_ref_t key_ref, skey_ref;
521 cred = get_current_cred();
522 key_ref = ERR_PTR(-ENOKEY);
525 case KEY_SPEC_THREAD_KEYRING:
526 if (!cred->thread_keyring) {
527 if (!(lflags & KEY_LOOKUP_CREATE))
530 ret = install_thread_keyring();
532 key_ref = ERR_PTR(ret);
538 key = cred->thread_keyring;
539 atomic_inc(&key->usage);
540 key_ref = make_key_ref(key, 1);
543 case KEY_SPEC_PROCESS_KEYRING:
544 if (!cred->tgcred->process_keyring) {
545 if (!(lflags & KEY_LOOKUP_CREATE))
548 ret = install_process_keyring();
550 key_ref = ERR_PTR(ret);
556 key = cred->tgcred->process_keyring;
557 atomic_inc(&key->usage);
558 key_ref = make_key_ref(key, 1);
561 case KEY_SPEC_SESSION_KEYRING:
562 if (!cred->tgcred->session_keyring) {
563 /* always install a session keyring upon access if one
564 * doesn't exist yet */
565 ret = install_user_keyrings();
568 ret = install_session_keyring(
569 cred->user->session_keyring);
577 key = rcu_dereference(cred->tgcred->session_keyring);
578 atomic_inc(&key->usage);
580 key_ref = make_key_ref(key, 1);
583 case KEY_SPEC_USER_KEYRING:
584 if (!cred->user->uid_keyring) {
585 ret = install_user_keyrings();
590 key = cred->user->uid_keyring;
591 atomic_inc(&key->usage);
592 key_ref = make_key_ref(key, 1);
595 case KEY_SPEC_USER_SESSION_KEYRING:
596 if (!cred->user->session_keyring) {
597 ret = install_user_keyrings();
602 key = cred->user->session_keyring;
603 atomic_inc(&key->usage);
604 key_ref = make_key_ref(key, 1);
607 case KEY_SPEC_GROUP_KEYRING:
608 /* group keyrings are not yet supported */
609 key_ref = ERR_PTR(-EINVAL);
612 case KEY_SPEC_REQKEY_AUTH_KEY:
613 key = cred->request_key_auth;
617 atomic_inc(&key->usage);
618 key_ref = make_key_ref(key, 1);
621 case KEY_SPEC_REQUESTOR_KEYRING:
622 if (!cred->request_key_auth)
625 down_read(&cred->request_key_auth->sem);
626 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
627 key_ref = ERR_PTR(-EKEYREVOKED);
630 rka = cred->request_key_auth->payload.data;
631 key = rka->dest_keyring;
632 atomic_inc(&key->usage);
634 up_read(&cred->request_key_auth->sem);
637 key_ref = make_key_ref(key, 1);
641 key_ref = ERR_PTR(-EINVAL);
645 key = key_lookup(id);
647 key_ref = ERR_CAST(key);
651 key_ref = make_key_ref(key, 0);
653 /* check to see if we possess the key */
654 skey_ref = search_process_keyrings(key->type, key,
655 lookup_user_key_possessed,
658 if (!IS_ERR(skey_ref)) {
666 /* unlink does not use the nominated key in any way, so can skip all
667 * the permission checks as it is only concerned with the keyring */
668 if (lflags & KEY_LOOKUP_FOR_UNLINK) {
673 if (!(lflags & KEY_LOOKUP_PARTIAL)) {
674 ret = wait_for_key_construction(key, true);
685 ret = key_validate(key);
691 if (!(lflags & KEY_LOOKUP_PARTIAL) &&
692 !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
695 /* check the permissions */
696 ret = key_task_permission(key_ref, cred, perm);
705 key_ref_put(key_ref);
706 key_ref = ERR_PTR(ret);
709 /* if we attempted to install a keyring, then it may have caused new
710 * creds to be installed */
715 } /* end lookup_user_key() */
717 /*****************************************************************************/
719 * join the named keyring as the session keyring if possible, or attempt to
720 * create a new one of that name if not
721 * - if the name is NULL, an empty anonymous keyring is installed instead
722 * - named session keyring joining is done with a semaphore held
724 long join_session_keyring(const char *name)
726 const struct cred *old;
731 /* only permit this if there's a single thread in the thread group -
732 * this avoids us having to adjust the creds on all threads and risking
734 if (!current_is_single_threaded())
737 new = prepare_creds();
740 old = current_cred();
742 /* if no name is provided, install an anonymous keyring */
744 ret = install_session_keyring_to_cred(new, NULL);
748 serial = new->tgcred->session_keyring->serial;
749 ret = commit_creds(new);
755 /* allow the user to join or create a named keyring */
756 mutex_lock(&key_session_mutex);
758 /* look for an existing keyring of this name */
759 keyring = find_keyring_by_name(name, false);
760 if (PTR_ERR(keyring) == -ENOKEY) {
761 /* not found - try and create a new one */
762 keyring = keyring_alloc(name, old->uid, old->gid, old,
763 KEY_ALLOC_IN_QUOTA, NULL);
764 if (IS_ERR(keyring)) {
765 ret = PTR_ERR(keyring);
768 } else if (IS_ERR(keyring)) {
769 ret = PTR_ERR(keyring);
773 /* we've got a keyring - now to install it */
774 ret = install_session_keyring_to_cred(new, keyring);
779 mutex_unlock(&key_session_mutex);
781 ret = keyring->serial;
787 mutex_unlock(&key_session_mutex);
794 * Replace a process's session keyring when that process resumes userspace on
795 * behalf of one of its children
797 void key_replace_session_keyring(void)
799 const struct cred *old;
802 if (!current->replacement_session_keyring)
805 write_lock_irq(&tasklist_lock);
806 new = current->replacement_session_keyring;
807 current->replacement_session_keyring = NULL;
808 write_unlock_irq(&tasklist_lock);
813 old = current_cred();
814 new-> uid = old-> uid;
815 new-> euid = old-> euid;
816 new-> suid = old-> suid;
817 new->fsuid = old->fsuid;
818 new-> gid = old-> gid;
819 new-> egid = old-> egid;
820 new-> sgid = old-> sgid;
821 new->fsgid = old->fsgid;
822 new->user = get_uid(old->user);
823 new->group_info = get_group_info(old->group_info);
825 new->securebits = old->securebits;
826 new->cap_inheritable = old->cap_inheritable;
827 new->cap_permitted = old->cap_permitted;
828 new->cap_effective = old->cap_effective;
829 new->cap_bset = old->cap_bset;
831 new->jit_keyring = old->jit_keyring;
832 new->thread_keyring = key_get(old->thread_keyring);
833 new->tgcred->tgid = old->tgcred->tgid;
834 new->tgcred->process_keyring = key_get(old->tgcred->process_keyring);
836 security_transfer_creds(new, old);