1 /* Request a key from userspace
3 * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * See Documentation/keys-request-key.txt
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/kmod.h>
17 #include <linux/err.h>
18 #include <linux/keyctl.h>
19 #include <linux/slab.h>
22 #define key_negative_timeout 60 /* default timeout on a negative key's existence */
25 * wait_on_bit() sleep function for uninterruptible waiting
27 static int key_wait_bit(void *flags)
34 * wait_on_bit() sleep function for interruptible waiting
36 static int key_wait_bit_intr(void *flags)
39 return signal_pending(current) ? -ERESTARTSYS : 0;
43 * call to complete the construction of a key
45 void complete_request_key(struct key_construction *cons, int error)
47 kenter("{%d,%d},%d", cons->key->serial, cons->authkey->serial, error);
50 key_negate_and_link(cons->key, key_negative_timeout, NULL,
53 key_revoke(cons->authkey);
56 key_put(cons->authkey);
59 EXPORT_SYMBOL(complete_request_key);
62 * request userspace finish the construction of a key
63 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
65 static int call_sbin_request_key(struct key_construction *cons,
69 const struct cred *cred = current_cred();
70 key_serial_t prkey, sskey;
71 struct key *key = cons->key, *authkey = cons->authkey, *keyring,
73 char *argv[9], *envp[3], uid_str[12], gid_str[12];
74 char key_str[12], keyring_str[3][12];
78 kenter("{%d},{%d},%s", key->serial, authkey->serial, op);
80 ret = install_user_keyrings();
84 /* allocate a new session keyring */
85 sprintf(desc, "_req.%u", key->serial);
87 cred = get_current_cred();
88 keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
89 KEY_ALLOC_QUOTA_OVERRUN, NULL);
91 if (IS_ERR(keyring)) {
92 ret = PTR_ERR(keyring);
96 /* attach the auth key to the session keyring */
97 ret = key_link(keyring, authkey);
101 /* record the UID and GID */
102 sprintf(uid_str, "%d", cred->fsuid);
103 sprintf(gid_str, "%d", cred->fsgid);
105 /* we say which key is under construction */
106 sprintf(key_str, "%d", key->serial);
108 /* we specify the process's default keyrings */
109 sprintf(keyring_str[0], "%d",
110 cred->thread_keyring ? cred->thread_keyring->serial : 0);
113 if (cred->tgcred->process_keyring)
114 prkey = cred->tgcred->process_keyring->serial;
117 session = rcu_dereference(cred->tgcred->session_keyring);
119 session = cred->user->session_keyring;
120 sskey = session->serial;
123 sprintf(keyring_str[2], "%d", sskey);
125 /* set up a minimal environment */
127 envp[i++] = "HOME=/";
128 envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
131 /* set up the argument list */
133 argv[i++] = "/sbin/request-key";
134 argv[i++] = (char *) op;
138 argv[i++] = keyring_str[0];
139 argv[i++] = keyring_str[1];
140 argv[i++] = keyring_str[2];
144 ret = call_usermodehelper_keys(argv[0], argv, envp, keyring,
146 kdebug("usermode -> 0x%x", ret);
148 /* ret is the exit/wait code */
149 if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) ||
150 key_validate(key) < 0)
153 /* ignore any errors from userspace if the key was
162 complete_request_key(cons, ret);
163 kleave(" = %d", ret);
168 * call out to userspace for key construction
169 * - we ignore program failure and go on key status instead
171 static int construct_key(struct key *key, const void *callout_info,
172 size_t callout_len, void *aux,
173 struct key *dest_keyring)
175 struct key_construction *cons;
176 request_key_actor_t actor;
180 kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
182 cons = kmalloc(sizeof(*cons), GFP_KERNEL);
186 /* allocate an authorisation key */
187 authkey = request_key_auth_new(key, callout_info, callout_len,
189 if (IS_ERR(authkey)) {
191 ret = PTR_ERR(authkey);
194 cons->authkey = key_get(authkey);
195 cons->key = key_get(key);
198 actor = call_sbin_request_key;
199 if (key->type->request_key)
200 actor = key->type->request_key;
202 ret = actor(cons, "create", aux);
204 /* check that the actor called complete_request_key() prior to
205 * returning an error */
207 !test_bit(KEY_FLAG_REVOKED, &authkey->flags));
211 kleave(" = %d", ret);
216 * get the appropriate destination keyring for the request
217 * - we return whatever keyring we select with an extra reference upon it which
218 * the caller must release
220 static void construct_get_dest_keyring(struct key **_dest_keyring)
222 struct request_key_auth *rka;
223 const struct cred *cred = current_cred();
224 struct key *dest_keyring = *_dest_keyring, *authkey;
226 kenter("%p", dest_keyring);
228 /* find the appropriate keyring */
230 /* the caller supplied one */
231 key_get(dest_keyring);
233 /* use a default keyring; falling through the cases until we
234 * find one that we actually have */
235 switch (cred->jit_keyring) {
236 case KEY_REQKEY_DEFL_DEFAULT:
237 case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
238 if (cred->request_key_auth) {
239 authkey = cred->request_key_auth;
240 down_read(&authkey->sem);
241 rka = authkey->payload.data;
242 if (!test_bit(KEY_FLAG_REVOKED,
245 key_get(rka->dest_keyring);
246 up_read(&authkey->sem);
251 case KEY_REQKEY_DEFL_THREAD_KEYRING:
252 dest_keyring = key_get(cred->thread_keyring);
256 case KEY_REQKEY_DEFL_PROCESS_KEYRING:
257 dest_keyring = key_get(cred->tgcred->process_keyring);
261 case KEY_REQKEY_DEFL_SESSION_KEYRING:
263 dest_keyring = key_get(
264 rcu_dereference(cred->tgcred->session_keyring));
270 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
272 key_get(cred->user->session_keyring);
275 case KEY_REQKEY_DEFL_USER_KEYRING:
276 dest_keyring = key_get(cred->user->uid_keyring);
279 case KEY_REQKEY_DEFL_GROUP_KEYRING:
285 *_dest_keyring = dest_keyring;
286 kleave(" [dk %d]", key_serial(dest_keyring));
291 * allocate a new key in under-construction state and attempt to link it in to
292 * the requested place
293 * - may return a key that's already under construction instead
295 static int construct_alloc_key(struct key_type *type,
296 const char *description,
297 struct key *dest_keyring,
299 struct key_user *user,
302 struct keyring_list *prealloc;
303 const struct cred *cred = current_cred();
308 kenter("%s,%s,,,", type->name, description);
311 mutex_lock(&user->cons_lock);
313 key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
318 set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
321 ret = __key_link_begin(dest_keyring, type, description,
324 goto link_prealloc_failed;
327 /* attach the key to the destination keyring under lock, but we do need
328 * to do another check just in case someone beat us to it whilst we
329 * waited for locks */
330 mutex_lock(&key_construction_mutex);
332 key_ref = search_process_keyrings(type, description, type->match, cred);
333 if (!IS_ERR(key_ref))
334 goto key_already_present;
337 __key_link(dest_keyring, key, &prealloc);
339 mutex_unlock(&key_construction_mutex);
341 __key_link_end(dest_keyring, type, prealloc);
342 mutex_unlock(&user->cons_lock);
344 kleave(" = 0 [%d]", key_serial(key));
347 /* the key is now present - we tell the caller that we found it by
348 * returning -EINPROGRESS */
351 mutex_unlock(&key_construction_mutex);
352 key = key_ref_to_ptr(key_ref);
354 ret = __key_link_check_live_key(dest_keyring, key);
356 __key_link(dest_keyring, key, &prealloc);
357 __key_link_end(dest_keyring, type, prealloc);
359 goto link_check_failed;
361 mutex_unlock(&user->cons_lock);
363 kleave(" = -EINPROGRESS [%d]", key_serial(key));
367 mutex_unlock(&user->cons_lock);
369 kleave(" = %d [linkcheck]", ret);
372 link_prealloc_failed:
373 up_write(&dest_keyring->sem);
374 mutex_unlock(&user->cons_lock);
375 kleave(" = %d [prelink]", ret);
379 mutex_unlock(&user->cons_lock);
380 kleave(" = %ld", PTR_ERR(key));
385 * commence key construction
387 static struct key *construct_key_and_link(struct key_type *type,
388 const char *description,
389 const char *callout_info,
392 struct key *dest_keyring,
395 struct key_user *user;
401 user = key_user_lookup(current_fsuid(), current_user_ns());
403 return ERR_PTR(-ENOMEM);
405 construct_get_dest_keyring(&dest_keyring);
407 ret = construct_alloc_key(type, description, dest_keyring, flags, user,
412 ret = construct_key(key, callout_info, callout_len, aux,
415 kdebug("cons failed");
416 goto construction_failed;
418 } else if (ret == -EINPROGRESS) {
424 key_put(dest_keyring);
425 kleave(" = key %d", key_serial(key));
429 key_negate_and_link(key, key_negative_timeout, NULL, NULL);
431 key_put(dest_keyring);
432 kleave(" = %d", ret);
438 * - search the process's keyrings
439 * - check the list of keys being created or updated
440 * - call out to userspace for a key if supplementary info was provided
441 * - cache the key in an appropriate keyring
443 struct key *request_key_and_link(struct key_type *type,
444 const char *description,
445 const void *callout_info,
448 struct key *dest_keyring,
451 const struct cred *cred = current_cred();
456 kenter("%s,%s,%p,%zu,%p,%p,%lx",
457 type->name, description, callout_info, callout_len, aux,
458 dest_keyring, flags);
460 /* search all the process keyrings for a key */
461 key_ref = search_process_keyrings(type, description, type->match,
464 if (!IS_ERR(key_ref)) {
465 key = key_ref_to_ptr(key_ref);
467 construct_get_dest_keyring(&dest_keyring);
468 ret = key_link(dest_keyring, key);
469 key_put(dest_keyring);
476 } else if (PTR_ERR(key_ref) != -EAGAIN) {
477 key = ERR_CAST(key_ref);
479 /* the search failed, but the keyrings were searchable, so we
480 * should consult userspace if we can */
481 key = ERR_PTR(-ENOKEY);
485 key = construct_key_and_link(type, description, callout_info,
486 callout_len, aux, dest_keyring,
491 kleave(" = %p", key);
496 * wait for construction of a key to complete
498 int wait_for_key_construction(struct key *key, bool intr)
502 ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,
503 intr ? key_wait_bit_intr : key_wait_bit,
504 intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
507 return key_validate(key);
509 EXPORT_SYMBOL(wait_for_key_construction);
513 * - search the process's keyrings
514 * - check the list of keys being created or updated
515 * - call out to userspace for a key if supplementary info was provided
516 * - waits uninterruptible for creation to complete
518 struct key *request_key(struct key_type *type,
519 const char *description,
520 const char *callout_info)
523 size_t callout_len = 0;
527 callout_len = strlen(callout_info);
528 key = request_key_and_link(type, description, callout_info, callout_len,
529 NULL, NULL, KEY_ALLOC_IN_QUOTA);
531 ret = wait_for_key_construction(key, false);
539 EXPORT_SYMBOL(request_key);
542 * request a key with auxiliary data for the upcaller
543 * - search the process's keyrings
544 * - check the list of keys being created or updated
545 * - call out to userspace for a key if supplementary info was provided
546 * - waits uninterruptible for creation to complete
548 struct key *request_key_with_auxdata(struct key_type *type,
549 const char *description,
550 const void *callout_info,
557 key = request_key_and_link(type, description, callout_info, callout_len,
558 aux, NULL, KEY_ALLOC_IN_QUOTA);
560 ret = wait_for_key_construction(key, false);
568 EXPORT_SYMBOL(request_key_with_auxdata);
571 * request a key (allow async construction)
572 * - search the process's keyrings
573 * - check the list of keys being created or updated
574 * - call out to userspace for a key if supplementary info was provided
576 struct key *request_key_async(struct key_type *type,
577 const char *description,
578 const void *callout_info,
581 return request_key_and_link(type, description, callout_info,
582 callout_len, NULL, NULL,
585 EXPORT_SYMBOL(request_key_async);
588 * request a key with auxiliary data for the upcaller (allow async construction)
589 * - search the process's keyrings
590 * - check the list of keys being created or updated
591 * - call out to userspace for a key if supplementary info was provided
593 struct key *request_key_async_with_auxdata(struct key_type *type,
594 const char *description,
595 const void *callout_info,
599 return request_key_and_link(type, description, callout_info,
600 callout_len, aux, NULL, KEY_ALLOC_IN_QUOTA);
602 EXPORT_SYMBOL(request_key_async_with_auxdata);