Lines Matching +full:key +full:-
1 // SPDX-License-Identifier: GPL-2.0-or-later
4 * Copyright (C) 2004-2005, 2008, 2013 Red Hat, Inc. All Rights Reserved.
17 #include <keys/keyring-type.h>
18 #include <keys/user-type.h>
25 * When plumbing the depths of the key tree, this sets a hard limit
40 static inline struct key *keyring_ptr_to_key(const struct assoc_array_ptr *x) in keyring_ptr_to_key()
43 return (struct key *)((unsigned long)object & ~KEYRING_PTR_SUBTYPE); in keyring_ptr_to_key()
45 static inline void *keyring_key_to_ptr(struct key *key) in keyring_key_to_ptr() argument
47 if (key->type == &key_type_keyring) in keyring_key_to_ptr()
48 return (void *)((unsigned long)key | KEYRING_PTR_SUBTYPE); in keyring_key_to_ptr()
49 return key; in keyring_key_to_ptr()
60 list_del_init(&ns->keyring_name_list); in key_free_user_ns()
63 key_put(ns->user_keyring_register); in key_free_user_ns()
65 key_put(ns->persistent_keyring_register); in key_free_user_ns()
70 * The keyring key type definition. Keyrings are simply keys of this type and
76 static int keyring_instantiate(struct key *keyring,
78 static void keyring_revoke(struct key *keyring);
79 static void keyring_destroy(struct key *keyring);
80 static void keyring_describe(const struct key *keyring, struct seq_file *m);
81 static long keyring_read(const struct key *keyring,
107 static void keyring_publish_name(struct key *keyring) in keyring_publish_name()
111 if (keyring->description && in keyring_publish_name()
112 keyring->description[0] && in keyring_publish_name()
113 keyring->description[0] != '.') { in keyring_publish_name()
115 list_add_tail(&keyring->name_link, &ns->keyring_name_list); in keyring_publish_name()
125 return prep->datalen != 0 ? -EINVAL : 0; in keyring_preparse()
129 * Free a preparse of a user defined key payload
138 * Returns 0 on success, -EINVAL if given any data.
140 static int keyring_instantiate(struct key *keyring, in keyring_instantiate()
143 assoc_array_init(&keyring->keys); in keyring_instantiate()
150 * Multiply 64-bits by 32-bits to 96-bits and fold back to 64-bit. Ideally we'd
161 * Hash a key type and description.
167 const char *description = index_key->description; in hash_key_type_and_desc()
171 int n, desc_len = index_key->desc_len; in hash_key_type_and_desc()
173 type = (unsigned long)index_key->type; in hash_key_type_and_desc()
176 piece = (unsigned long)index_key->domain_tag; in hash_key_type_and_desc()
189 desc_len -= n; in hash_key_type_and_desc()
201 * zero for keyrings and non-zero otherwise. in hash_key_type_and_desc()
203 if (index_key->type != &key_type_keyring && (hash & fan_mask) == 0) in hash_key_type_and_desc()
204 hash |= (hash >> (ASSOC_ARRAY_KEY_CHUNK_SIZE - level_shift)) | 1; in hash_key_type_and_desc()
205 else if (index_key->type == &key_type_keyring && (hash & fan_mask) != 0) in hash_key_type_and_desc()
207 index_key->hash = hash; in hash_key_type_and_desc()
211 * Finalise an index key to include a part of the description actually in the
212 * index key, to set the domain tag and to calculate the hash.
217 size_t n = min_t(size_t, index_key->desc_len, sizeof(index_key->desc)); in key_set_index_key()
219 memcpy(index_key->desc, index_key->description, n); in key_set_index_key()
221 if (!index_key->domain_tag) { in key_set_index_key()
222 if (index_key->type->flags & KEY_TYPE_NET_DOMAIN) in key_set_index_key()
223 index_key->domain_tag = current->nsproxy->net_ns->key_domain; in key_set_index_key()
225 index_key->domain_tag = &default_domain_tag; in key_set_index_key()
232 * key_put_tag - Release a ref on a tag.
240 if (refcount_dec_and_test(&tag->usage)) { in key_put_tag()
249 * key_remove_domain - Kill off a key domain and gc its keys
258 domain_tag->removed = true; in key_remove_domain()
264 * Build the next index key chunk.
266 * We return it one word-sized chunk at a time.
273 int desc_len = index_key->desc_len, n = sizeof(chunk); in keyring_get_key_chunk()
278 return index_key->hash; in keyring_get_key_chunk()
280 return index_key->x; in keyring_get_key_chunk()
282 return (unsigned long)index_key->type; in keyring_get_key_chunk()
284 return (unsigned long)index_key->domain_tag; in keyring_get_key_chunk()
286 level -= 4; in keyring_get_key_chunk()
287 if (desc_len <= sizeof(index_key->desc)) in keyring_get_key_chunk()
290 d = index_key->description + sizeof(index_key->desc); in keyring_get_key_chunk()
292 desc_len -= sizeof(index_key->desc); in keyring_get_key_chunk()
298 } while (--desc_len > 0); in keyring_get_key_chunk()
305 const struct key *key = keyring_ptr_to_key(object); in keyring_get_object_key_chunk() local
306 return keyring_get_key_chunk(&key->index_key, level); in keyring_get_object_key_chunk()
312 const struct key *key = keyring_ptr_to_key(object); in keyring_compare_object() local
314 return key->index_key.type == index_key->type && in keyring_compare_object()
315 key->index_key.domain_tag == index_key->domain_tag && in keyring_compare_object()
316 key->index_key.desc_len == index_key->desc_len && in keyring_compare_object()
317 memcmp(key->index_key.description, index_key->description, in keyring_compare_object()
318 index_key->desc_len) == 0; in keyring_compare_object()
323 * at which they differ - if they differ.
327 const struct key *key_a = keyring_ptr_to_key(object); in keyring_diff_objects()
328 const struct keyring_index_key *a = &key_a->index_key; in keyring_diff_objects()
334 seg_a = a->hash; in keyring_diff_objects()
335 seg_b = b->hash; in keyring_diff_objects()
342 * can deal with as being machine word-size dependent. in keyring_diff_objects()
344 seg_a = a->x; in keyring_diff_objects()
345 seg_b = b->x; in keyring_diff_objects()
351 seg_a = (unsigned long)a->type; in keyring_diff_objects()
352 seg_b = (unsigned long)b->type; in keyring_diff_objects()
357 seg_a = (unsigned long)a->domain_tag; in keyring_diff_objects()
358 seg_b = (unsigned long)b->domain_tag; in keyring_diff_objects()
363 i = sizeof(a->desc); in keyring_diff_objects()
364 if (a->desc_len <= i) in keyring_diff_objects()
367 for (; i < a->desc_len; i++) { in keyring_diff_objects()
368 seg_a = *(unsigned char *)(a->description + i); in keyring_diff_objects()
369 seg_b = *(unsigned char *)(b->description + i); in keyring_diff_objects()
375 return -1; in keyring_diff_objects()
393 * Operations for keyring management by the index-tree routines.
412 static void keyring_destroy(struct key *keyring) in keyring_destroy()
414 if (keyring->description) { in keyring_destroy()
417 if (keyring->name_link.next != NULL && in keyring_destroy()
418 !list_empty(&keyring->name_link)) in keyring_destroy()
419 list_del(&keyring->name_link); in keyring_destroy()
424 if (keyring->restrict_link) { in keyring_destroy()
425 struct key_restriction *keyres = keyring->restrict_link; in keyring_destroy()
427 key_put(keyres->key); in keyring_destroy()
431 assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops); in keyring_destroy()
437 static void keyring_describe(const struct key *keyring, struct seq_file *m) in keyring_describe()
439 if (keyring->description) in keyring_describe()
440 seq_puts(m, keyring->description); in keyring_describe()
445 if (keyring->keys.nr_leaves_on_tree != 0) in keyring_describe()
446 seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree); in keyring_describe()
461 const struct key *key = keyring_ptr_to_key(object); in keyring_read_iterator() local
464 key->type->name, key->serial, ctx->count, ctx->buflen); in keyring_read_iterator()
466 if (ctx->count >= ctx->buflen) in keyring_read_iterator()
469 *ctx->buffer++ = key->serial; in keyring_read_iterator()
470 ctx->count += sizeof(key->serial); in keyring_read_iterator()
475 * Read a list of key IDs from the keyring's contents in binary form
477 * The keyring's semaphore is read-locked by the caller. This prevents someone
478 * from modifying it under us - which could cause us to read key IDs multiple
481 static long keyring_read(const struct key *keyring, in keyring_read()
489 if (buflen & (sizeof(key_serial_t) - 1)) in keyring_read()
490 return -EINVAL; in keyring_read()
492 /* Copy as many key IDs as fit into the buffer */ in keyring_read()
497 ret = assoc_array_iterate(&keyring->keys, in keyring_read()
506 ret = keyring->keys.nr_leaves_on_tree * sizeof(key_serial_t); in keyring_read()
517 struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid, in keyring_alloc()
521 struct key *dest) in keyring_alloc()
523 struct key *keyring; in keyring_alloc()
541 * restrict_link_reject - Give -EPERM to restrict link
543 * @type: The type of key being added.
544 * @payload: The payload of the key intended to be added.
549 * adding a key to a keyring.
554 int restrict_link_reject(struct key *keyring, in restrict_link_reject()
557 struct key *restriction_key) in restrict_link_reject()
559 return -EPERM; in restrict_link_reject()
565 bool key_default_cmp(const struct key *key, in key_default_cmp() argument
568 return strcmp(key->description, match_data->raw_data) == 0; in key_default_cmp()
572 * Iteration function to consider each key found.
577 const struct key *key = keyring_ptr_to_key(object); in keyring_search_iterator() local
578 unsigned long kflags = READ_ONCE(key->flags); in keyring_search_iterator()
579 short state = READ_ONCE(key->state); in keyring_search_iterator()
581 kenter("{%d}", key->serial); in keyring_search_iterator()
584 if (key->type != ctx->index_key.type) { in keyring_search_iterator()
590 if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) { in keyring_search_iterator()
591 time64_t expiry = READ_ONCE(key->expiry); in keyring_search_iterator()
595 ctx->result = ERR_PTR(-EKEYREVOKED); in keyring_search_iterator()
596 kleave(" = %d [invrev]", ctx->skipped_ret); in keyring_search_iterator()
600 if (expiry && ctx->now >= expiry) { in keyring_search_iterator()
601 if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED)) in keyring_search_iterator()
602 ctx->result = ERR_PTR(-EKEYEXPIRED); in keyring_search_iterator()
603 kleave(" = %d [expire]", ctx->skipped_ret); in keyring_search_iterator()
609 if (!ctx->match_data.cmp(key, &ctx->match_data)) { in keyring_search_iterator()
614 /* key must have search permissions */ in keyring_search_iterator()
615 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) && in keyring_search_iterator()
616 key_task_permission(make_key_ref(key, ctx->possessed), in keyring_search_iterator()
617 ctx->cred, KEY_NEED_SEARCH) < 0) { in keyring_search_iterator()
618 ctx->result = ERR_PTR(-EACCES); in keyring_search_iterator()
619 kleave(" = %d [!perm]", ctx->skipped_ret); in keyring_search_iterator()
623 if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) { in keyring_search_iterator()
624 /* we set a different error code if we pass a negative key */ in keyring_search_iterator()
626 ctx->result = ERR_PTR(state); in keyring_search_iterator()
627 kleave(" = %d [neg]", ctx->skipped_ret); in keyring_search_iterator()
633 ctx->result = make_key_ref(key, ctx->possessed); in keyring_search_iterator()
638 return ctx->skipped_ret; in keyring_search_iterator()
642 * Search inside a keyring for a key. We can search by walking to it
643 * directly based on its index-key or we can iterate over the entire
646 static int search_keyring(struct key *keyring, struct keyring_search_context *ctx) in search_keyring()
648 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_DIRECT) { in search_keyring()
651 object = assoc_array_find(&keyring->keys, in search_keyring()
653 &ctx->index_key); in search_keyring()
654 return object ? ctx->iterator(object, ctx) : 0; in search_keyring()
656 return assoc_array_iterate(&keyring->keys, ctx->iterator, ctx); in search_keyring()
663 static bool search_nested_keyrings(struct key *keyring, in search_nested_keyrings()
667 struct key *keyring; in search_nested_keyrings()
675 struct key *key; in search_nested_keyrings() local
679 keyring->serial, in search_nested_keyrings()
680 ctx->index_key.type->name, in search_nested_keyrings()
681 ctx->index_key.description); in search_nested_keyrings()
684 BUG_ON((ctx->flags & STATE_CHECKS) == 0 || in search_nested_keyrings()
685 (ctx->flags & STATE_CHECKS) == STATE_CHECKS); in search_nested_keyrings()
687 if (ctx->index_key.description) in search_nested_keyrings()
688 key_set_index_key(&ctx->index_key); in search_nested_keyrings()
690 /* Check to see if this top-level keyring is what we are looking for in search_nested_keyrings()
693 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_ITERATE || in search_nested_keyrings()
694 keyring_compare_object(keyring, &ctx->index_key)) { in search_nested_keyrings()
695 ctx->skipped_ret = 2; in search_nested_keyrings()
696 switch (ctx->iterator(keyring_key_to_ptr(keyring), ctx)) { in search_nested_keyrings()
706 ctx->skipped_ret = 0; in search_nested_keyrings()
710 kdebug("descend to %d", keyring->serial); in search_nested_keyrings()
711 if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) | in search_nested_keyrings()
726 * Non-keyrings avoid the leftmost branch of the root entirely (root in search_nested_keyrings()
727 * slots 1-15). in search_nested_keyrings()
729 if (!(ctx->flags & KEYRING_SEARCH_RECURSE)) in search_nested_keyrings()
732 ptr = READ_ONCE(keyring->keys.root); in search_nested_keyrings()
742 if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0) in search_nested_keyrings()
745 ptr = READ_ONCE(shortcut->next_node); in search_nested_keyrings()
751 ptr = node->slots[0]; in search_nested_keyrings()
762 ptr = READ_ONCE(shortcut->next_node); in search_nested_keyrings()
773 ptr = READ_ONCE(node->slots[slot]); in search_nested_keyrings()
776 if (node->back_pointer || in search_nested_keyrings()
784 key = keyring_ptr_to_key(ptr); in search_nested_keyrings()
787 if (ctx->flags & KEYRING_SEARCH_DETECT_TOO_DEEP) { in search_nested_keyrings()
788 ctx->result = ERR_PTR(-ELOOP); in search_nested_keyrings()
795 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) && in search_nested_keyrings()
796 key_task_permission(make_key_ref(key, ctx->possessed), in search_nested_keyrings()
797 ctx->cred, KEY_NEED_SEARCH) < 0) in search_nested_keyrings()
807 keyring = key; in search_nested_keyrings()
814 ptr = READ_ONCE(node->back_pointer); in search_nested_keyrings()
815 slot = node->parent_slot; in search_nested_keyrings()
819 ptr = READ_ONCE(shortcut->back_pointer); in search_nested_keyrings()
820 slot = shortcut->parent_slot; in search_nested_keyrings()
828 * finished processing the leftmost branch rather than the root slots - in search_nested_keyrings()
831 if (node->back_pointer) { in search_nested_keyrings()
837 * matching key. in search_nested_keyrings()
847 sp--; in search_nested_keyrings()
851 kdebug("ascend to %d [%d]", keyring->serial, slot); in search_nested_keyrings()
856 key = key_ref_to_ptr(ctx->result); in search_nested_keyrings()
857 key_check(key); in search_nested_keyrings()
858 if (!(ctx->flags & KEYRING_SEARCH_NO_UPDATE_TIME)) { in search_nested_keyrings()
859 key->last_used_at = ctx->now; in search_nested_keyrings()
860 keyring->last_used_at = ctx->now; in search_nested_keyrings()
862 stack[--sp].keyring->last_used_at = ctx->now; in search_nested_keyrings()
869 * keyring_search_rcu - Search a keyring tree for a matching key under RCU
873 * Search the supplied keyring tree for a key that matches the criteria given.
878 * addition, the LSM gets to forbid keyring searches and key matches.
880 * The search is performed as a breadth-then-depth search up to the prescribed
887 * match function may use any attributes of a key that it wishes to
888 * determine the match. Normally the match function from the key type would be
891 * RCU can be used to prevent the keyring key lists from disappearing without
894 * Returns a pointer to the found key and increments the key usage count if
895 * successful; -EAGAIN if no matching keys were found, or if expired or revoked
896 * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
900 * @keyring_ref is propagated to the returned key reference.
905 struct key *keyring; in keyring_search_rcu()
908 ctx->iterator = keyring_search_iterator; in keyring_search_rcu()
909 ctx->possessed = is_key_possessed(keyring_ref); in keyring_search_rcu()
910 ctx->result = ERR_PTR(-EAGAIN); in keyring_search_rcu()
915 if (keyring->type != &key_type_keyring) in keyring_search_rcu()
916 return ERR_PTR(-ENOTDIR); in keyring_search_rcu()
918 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM)) { in keyring_search_rcu()
919 err = key_task_permission(keyring_ref, ctx->cred, KEY_NEED_SEARCH); in keyring_search_rcu()
924 ctx->now = ktime_get_real_seconds(); in keyring_search_rcu()
926 __key_get(key_ref_to_ptr(ctx->result)); in keyring_search_rcu()
927 return ctx->result; in keyring_search_rcu()
931 * keyring_search - Search the supplied keyring tree for a matching key
955 key_ref_t key; in keyring_search() local
960 if (type->match_preparse) { in keyring_search()
961 ret = type->match_preparse(&ctx.match_data); in keyring_search()
967 key = keyring_search_rcu(keyring, &ctx); in keyring_search()
970 if (type->match_free) in keyring_search()
971 type->match_free(&ctx.match_data); in keyring_search()
972 return key; in keyring_search()
983 return ERR_PTR(-ENOMEM); in keyring_restriction_alloc()
985 keyres->check = check; in keyring_restriction_alloc()
992 * cycles through restriction key pointers.
1000 static bool keyring_detect_restriction_cycle(const struct key *dest_keyring, in keyring_detect_restriction_cycle()
1003 while (keyres && keyres->key && in keyring_detect_restriction_cycle()
1004 keyres->key->type == &key_type_keyring) { in keyring_detect_restriction_cycle()
1005 if (keyres->key == dest_keyring) in keyring_detect_restriction_cycle()
1008 keyres = keyres->key->restrict_link; in keyring_detect_restriction_cycle()
1015 * keyring_restrict - Look up and apply a restriction to a keyring
1017 * @type: The key type that will provide the restriction checker.
1021 * by the specific key type, but can be configured by the options specified in
1027 struct key *keyring; in keyring_restrict()
1035 if (keyring->type != &key_type_keyring) in keyring_restrict()
1036 return -ENOTDIR; in keyring_restrict()
1046 if (!restrict_type->lookup_restriction) { in keyring_restrict()
1047 ret = -ENOENT; in keyring_restrict()
1051 restrict_link = restrict_type->lookup_restriction(restriction); in keyring_restrict()
1059 down_write(&keyring->sem); in keyring_restrict()
1062 if (keyring->restrict_link) { in keyring_restrict()
1063 ret = -EEXIST; in keyring_restrict()
1065 ret = -EDEADLK; in keyring_restrict()
1067 keyring->restrict_link = restrict_link; in keyring_restrict()
1072 up_write(&keyring->sem); in keyring_restrict()
1075 key_put(restrict_link->key); in keyring_restrict()
1088 * Search the given keyring for a key that might be updated.
1094 * Returns a pointer to the found key with usage count incremented if
1099 * to the returned key reference.
1104 struct key *keyring, *key; in find_key_to_update() local
1110 keyring->serial, index_key->type->name, index_key->description); in find_key_to_update()
1112 object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops, in find_key_to_update()
1122 key = keyring_ptr_to_key(object); in find_key_to_update()
1123 if (key->flags & ((1 << KEY_FLAG_INVALIDATED) | in find_key_to_update()
1128 __key_get(key); in find_key_to_update()
1129 kleave(" = {%d}", key->serial); in find_key_to_update()
1130 return make_key_ref(key, is_key_possessed(keyring_ref)); in find_key_to_update()
1142 * incremented on success. -ENOKEY is returned if a key could not be found.
1144 struct key *find_keyring_by_name(const char *name, bool uid_keyring) in find_keyring_by_name()
1147 struct key *keyring; in find_keyring_by_name()
1150 return ERR_PTR(-EINVAL); in find_keyring_by_name()
1157 list_for_each_entry(keyring, &ns->keyring_name_list, name_link) { in find_keyring_by_name()
1158 if (!kuid_has_mapping(ns, keyring->user->uid)) in find_keyring_by_name()
1161 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags)) in find_keyring_by_name()
1164 if (strcmp(keyring->description, name) != 0) in find_keyring_by_name()
1169 &keyring->flags)) in find_keyring_by_name()
1180 if (!refcount_inc_not_zero(&keyring->usage)) in find_keyring_by_name()
1182 keyring->last_used_at = ktime_get_real_seconds(); in find_keyring_by_name()
1186 keyring = ERR_PTR(-ENOKEY); in find_keyring_by_name()
1196 const struct key *key = keyring_ptr_to_key(object); in keyring_detect_cycle_iterator() local
1198 kenter("{%d}", key->serial); in keyring_detect_cycle_iterator()
1200 /* We might get a keyring with matching index-key that is nonetheless a in keyring_detect_cycle_iterator()
1202 if (key != ctx->match_data.raw_data) in keyring_detect_cycle_iterator()
1205 ctx->result = ERR_PTR(-EDEADLK); in keyring_detect_cycle_iterator()
1216 static int keyring_detect_cycle(struct key *A, struct key *B) in keyring_detect_cycle()
1219 .index_key = A->index_key, in keyring_detect_cycle()
1233 return PTR_ERR(ctx.result) == -EAGAIN ? 0 : PTR_ERR(ctx.result); in keyring_detect_cycle()
1239 int __key_link_lock(struct key *keyring, in __key_link_lock()
1241 __acquires(&keyring->sem) in __key_link_lock()
1244 if (keyring->type != &key_type_keyring) in __key_link_lock()
1245 return -ENOTDIR; in __key_link_lock()
1247 down_write(&keyring->sem); in __key_link_lock()
1252 if (index_key->type == &key_type_keyring) in __key_link_lock()
1261 int __key_move_lock(struct key *l_keyring, struct key *u_keyring, in __key_move_lock()
1263 __acquires(&l_keyring->sem) in __key_move_lock()
1264 __acquires(&u_keyring->sem) in __key_move_lock()
1267 if (l_keyring->type != &key_type_keyring || in __key_move_lock()
1268 u_keyring->type != &key_type_keyring) in __key_move_lock()
1269 return -ENOTDIR; in __key_move_lock()
1276 down_write(&l_keyring->sem); in __key_move_lock()
1277 down_write_nested(&u_keyring->sem, 1); in __key_move_lock()
1279 down_write(&u_keyring->sem); in __key_move_lock()
1280 down_write_nested(&l_keyring->sem, 1); in __key_move_lock()
1286 if (index_key->type == &key_type_keyring) in __key_move_lock()
1293 * Preallocate memory so that a key can be linked into to a keyring.
1295 int __key_link_begin(struct key *keyring, in __key_link_begin()
1303 keyring->serial, index_key->type->name, index_key->description); in __key_link_begin()
1305 BUG_ON(index_key->desc_len == 0); in __key_link_begin()
1310 ret = -EKEYREVOKED; in __key_link_begin()
1311 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags)) in __key_link_begin()
1314 /* Create an edit script that will insert/replace the key in the in __key_link_begin()
1317 edit = assoc_array_insert(&keyring->keys, in __key_link_begin()
1326 /* If we're not replacing a link in-place then we're going to need some in __key_link_begin()
1329 if (!edit->dead_leaf) { in __key_link_begin()
1331 keyring->datalen + KEYQUOTA_LINK_BYTES); in __key_link_begin()
1353 int __key_link_check_live_key(struct key *keyring, struct key *key) in __key_link_check_live_key() argument
1355 if (key->type == &key_type_keyring) in __key_link_check_live_key()
1358 return keyring_detect_cycle(keyring, key); in __key_link_check_live_key()
1363 * Link a key into to a keyring.
1366 * already extant link to matching key if there is one, so that each keyring
1367 * holds at most one link to any given key of a particular type+description
1370 void __key_link(struct key *keyring, struct key *key, in __key_link() argument
1373 __key_get(key); in __key_link()
1374 assoc_array_insert_set_object(*_edit, keyring_key_to_ptr(key)); in __key_link()
1377 notify_key(keyring, NOTIFY_KEY_LINKED, key_serial(key)); in __key_link()
1381 * Finish linking a key into to a keyring.
1385 void __key_link_end(struct key *keyring, in __key_link_end()
1388 __releases(&keyring->sem) in __key_link_end()
1391 BUG_ON(index_key->type == NULL); in __key_link_end()
1392 kenter("%d,%s,", keyring->serial, index_key->type->name); in __key_link_end()
1395 if (!edit->dead_leaf) { in __key_link_end()
1397 keyring->datalen - KEYQUOTA_LINK_BYTES); in __key_link_end()
1401 up_write(&keyring->sem); in __key_link_end()
1403 if (index_key->type == &key_type_keyring) in __key_link_end()
1410 static int __key_link_check_restriction(struct key *keyring, struct key *key) in __key_link_check_restriction() argument
1412 if (!keyring->restrict_link || !keyring->restrict_link->check) in __key_link_check_restriction()
1414 return keyring->restrict_link->check(keyring, key->type, &key->payload, in __key_link_check_restriction()
1415 keyring->restrict_link->key); in __key_link_check_restriction()
1419 * key_link - Link a key to a keyring
1421 * @key: The key to link to.
1423 * Make a link in a keyring to a key, such that the keyring holds a reference
1424 * on that key and the key can potentially be found by searching that keyring.
1426 * This function will write-lock the keyring's semaphore and will consume some
1427 * of the user's key data quota to hold the link.
1429 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring,
1430 * -EKEYREVOKED if the keyring has been revoked, -ENFILE if the keyring is
1431 * full, -EDQUOT if there is insufficient key data quota remaining to add
1432 * another link or -ENOMEM if there's insufficient memory.
1435 * be made (the keyring should have Write permission and the key Link
1438 int key_link(struct key *keyring, struct key *key) in key_link() argument
1443 kenter("{%d,%d}", keyring->serial, refcount_read(&keyring->usage)); in key_link()
1446 key_check(key); in key_link()
1448 ret = __key_link_lock(keyring, &key->index_key); in key_link()
1452 ret = __key_link_begin(keyring, &key->index_key, &edit); in key_link()
1456 kdebug("begun {%d,%d}", keyring->serial, refcount_read(&keyring->usage)); in key_link()
1457 ret = __key_link_check_restriction(keyring, key); in key_link()
1459 ret = __key_link_check_live_key(keyring, key); in key_link()
1461 __key_link(keyring, key, &edit); in key_link()
1464 __key_link_end(keyring, &key->index_key, edit); in key_link()
1466 kleave(" = %d {%d,%d}", ret, keyring->serial, refcount_read(&keyring->usage)); in key_link()
1474 static int __key_unlink_lock(struct key *keyring) in __key_unlink_lock()
1475 __acquires(&keyring->sem) in __key_unlink_lock()
1477 if (keyring->type != &key_type_keyring) in __key_unlink_lock()
1478 return -ENOTDIR; in __key_unlink_lock()
1480 down_write(&keyring->sem); in __key_unlink_lock()
1485 * Begin the process of unlinking a key from a keyring.
1487 static int __key_unlink_begin(struct key *keyring, struct key *key, in __key_unlink_begin() argument
1494 edit = assoc_array_delete(&keyring->keys, &keyring_assoc_array_ops, in __key_unlink_begin()
1495 &key->index_key); in __key_unlink_begin()
1500 return -ENOENT; in __key_unlink_begin()
1509 static void __key_unlink(struct key *keyring, struct key *key, in __key_unlink() argument
1513 notify_key(keyring, NOTIFY_KEY_UNLINKED, key_serial(key)); in __key_unlink()
1515 key_payload_reserve(keyring, keyring->datalen - KEYQUOTA_LINK_BYTES); in __key_unlink()
1519 * Finish unlinking a key from to a keyring.
1521 static void __key_unlink_end(struct key *keyring, in __key_unlink_end() argument
1522 struct key *key, in __key_unlink_end()
1524 __releases(&keyring->sem) in __key_unlink_end()
1528 up_write(&keyring->sem); in __key_unlink_end()
1532 * key_unlink - Unlink the first link to a key from a keyring.
1534 * @key: The key the link is to.
1536 * Remove a link from a keyring to a key.
1538 * This function will write-lock the keyring's semaphore.
1540 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring, -ENOENT if
1541 * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
1546 * required on the key).
1548 int key_unlink(struct key *keyring, struct key *key) in key_unlink() argument
1554 key_check(key); in key_unlink()
1560 ret = __key_unlink_begin(keyring, key, &edit); in key_unlink()
1562 __key_unlink(keyring, key, &edit); in key_unlink()
1563 __key_unlink_end(keyring, key, edit); in key_unlink()
1569 * key_move - Move a key from one keyring to another
1570 * @key: The key to move
1575 * Make a link in @to_keyring to a key, such that the keyring holds a reference
1576 * on that key and the key can potentially be found by searching that keyring
1577 * whilst simultaneously removing a link to the key from @from_keyring.
1579 * This function will write-lock both keyring's semaphores and will consume
1580 * some of the user's key data quota to hold the link on @to_keyring.
1582 * Returns 0 if successful, -ENOTDIR if either keyring isn't a keyring,
1583 * -EKEYREVOKED if either keyring has been revoked, -ENFILE if the second
1584 * keyring is full, -EDQUOT if there is insufficient key data quota remaining
1585 * to add another link or -ENOMEM if there's insufficient memory. If
1586 * KEYCTL_MOVE_EXCL is set, then -EEXIST will be returned if there's already a
1587 * matching key in @to_keyring.
1590 * be made (the keyring should have Write permission and the key Link
1593 int key_move(struct key *key, in key_move() argument
1594 struct key *from_keyring, in key_move()
1595 struct key *to_keyring, in key_move()
1601 kenter("%d,%d,%d", key->serial, from_keyring->serial, to_keyring->serial); in key_move()
1606 key_check(key); in key_move()
1610 ret = __key_move_lock(from_keyring, to_keyring, &key->index_key); in key_move()
1613 ret = __key_unlink_begin(from_keyring, key, &from_edit); in key_move()
1616 ret = __key_link_begin(to_keyring, &key->index_key, &to_edit); in key_move()
1620 ret = -EEXIST; in key_move()
1621 if (to_edit->dead_leaf && (flags & KEYCTL_MOVE_EXCL)) in key_move()
1624 ret = __key_link_check_restriction(to_keyring, key); in key_move()
1627 ret = __key_link_check_live_key(to_keyring, key); in key_move()
1631 __key_unlink(from_keyring, key, &from_edit); in key_move()
1632 __key_link(to_keyring, key, &to_edit); in key_move()
1634 __key_link_end(to_keyring, &key->index_key, to_edit); in key_move()
1635 __key_unlink_end(from_keyring, key, from_edit); in key_move()
1643 * keyring_clear - Clear a keyring
1648 * Returns 0 if successful or -ENOTDIR if the keyring isn't a keyring.
1650 int keyring_clear(struct key *keyring) in keyring_clear()
1655 if (keyring->type != &key_type_keyring) in keyring_clear()
1656 return -ENOTDIR; in keyring_clear()
1658 down_write(&keyring->sem); in keyring_clear()
1660 edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops); in keyring_clear()
1671 up_write(&keyring->sem); in keyring_clear()
1679 * This is called with the key sem write-locked.
1681 static void keyring_revoke(struct key *keyring) in keyring_revoke()
1685 edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops); in keyring_revoke()
1695 struct key *key = keyring_ptr_to_key(object); in keyring_gc_select_iterator() local
1698 if (key_is_dead(key, *limit)) in keyring_gc_select_iterator()
1700 key_get(key); in keyring_gc_select_iterator()
1706 const struct key *key = keyring_ptr_to_key(object); in keyring_gc_check_iterator() local
1709 key_check(key); in keyring_gc_check_iterator()
1710 return key_is_dead(key, *limit); in keyring_gc_check_iterator()
1716 * Not called with any locks held. The keyring's key struct will not be
1719 void keyring_gc(struct key *keyring, time64_t limit) in keyring_gc()
1723 kenter("%x{%s}", keyring->serial, keyring->description ?: ""); in keyring_gc()
1725 if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) | in keyring_gc()
1731 result = assoc_array_iterate(&keyring->keys, in keyring_gc()
1742 down_write(&keyring->sem); in keyring_gc()
1743 assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops, in keyring_gc()
1745 up_write(&keyring->sem); in keyring_gc()
1752 * Keyring restrictions are associated with a key type, and must be cleaned
1753 * up if the key type is unregistered. The restriction is altered to always
1755 * a key type.
1757 * Not called with any keyring locks held. The keyring's key struct will not
1760 * The caller is required to hold key_types_sem and dead_type->sem. This is
1764 void keyring_restriction_gc(struct key *keyring, struct key_type *dead_type) in keyring_restriction_gc()
1768 kenter("%x{%s}", keyring->serial, keyring->description ?: ""); in keyring_restriction_gc()
1771 * keyring->restrict_link is only assigned at key allocation time in keyring_restriction_gc()
1772 * or with the key type locked, so the only values that could be in keyring_restriction_gc()
1773 * concurrently assigned to keyring->restrict_link are for key in keyring_restriction_gc()
1775 * the key type before acquiring keyring->sem. in keyring_restriction_gc()
1777 if (!dead_type || !keyring->restrict_link || in keyring_restriction_gc()
1778 keyring->restrict_link->keytype != dead_type) { in keyring_restriction_gc()
1784 down_write(&keyring->sem); in keyring_restriction_gc()
1786 keyres = keyring->restrict_link; in keyring_restriction_gc()
1788 keyres->check = restrict_link_reject; in keyring_restriction_gc()
1790 key_put(keyres->key); in keyring_restriction_gc()
1791 keyres->key = NULL; in keyring_restriction_gc()
1792 keyres->keytype = NULL; in keyring_restriction_gc()
1794 up_write(&keyring->sem); in keyring_restriction_gc()