1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Basic authentication token and access key management 3 * 4 * Copyright (C) 2004-2008 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #include <linux/export.h> 9 #include <linux/init.h> 10 #include <linux/poison.h> 11 #include <linux/sched.h> 12 #include <linux/slab.h> 13 #include <linux/security.h> 14 #include <linux/workqueue.h> 15 #include <linux/random.h> 16 #include <linux/ima.h> 17 #include <linux/err.h> 18 #include "internal.h" 19 20 struct kmem_cache *key_jar; 21 struct rb_root key_serial_tree; /* tree of keys indexed by serial */ 22 DEFINE_SPINLOCK(key_serial_lock); 23 24 struct rb_root key_user_tree; /* tree of quota records indexed by UID */ 25 DEFINE_SPINLOCK(key_user_lock); 26 27 unsigned int key_quota_root_maxkeys = 1000000; /* root's key count quota */ 28 unsigned int key_quota_root_maxbytes = 25000000; /* root's key space quota */ 29 unsigned int key_quota_maxkeys = 200; /* general key count quota */ 30 unsigned int key_quota_maxbytes = 20000; /* general key space quota */ 31 32 static LIST_HEAD(key_types_list); 33 static DECLARE_RWSEM(key_types_sem); 34 35 /* We serialise key instantiation and link */ 36 DEFINE_MUTEX(key_construction_mutex); 37 38 #ifdef KEY_DEBUGGING 39 void __key_check(const struct key *key) 40 { 41 printk("__key_check: key %p {%08x} should be {%08x}\n", 42 key, key->magic, KEY_DEBUG_MAGIC); 43 BUG(); 44 } 45 #endif 46 47 /* 48 * Get the key quota record for a user, allocating a new record if one doesn't 49 * already exist. 50 */ 51 struct key_user *key_user_lookup(kuid_t uid) 52 { 53 struct key_user *candidate = NULL, *user; 54 struct rb_node *parent, **p; 55 56 try_again: 57 parent = NULL; 58 p = &key_user_tree.rb_node; 59 spin_lock(&key_user_lock); 60 61 /* search the tree for a user record with a matching UID */ 62 while (*p) { 63 parent = *p; 64 user = rb_entry(parent, struct key_user, node); 65 66 if (uid_lt(uid, user->uid)) 67 p = &(*p)->rb_left; 68 else if (uid_gt(uid, user->uid)) 69 p = &(*p)->rb_right; 70 else 71 goto found; 72 } 73 74 /* if we get here, we failed to find a match in the tree */ 75 if (!candidate) { 76 /* allocate a candidate user record if we don't already have 77 * one */ 78 spin_unlock(&key_user_lock); 79 80 user = NULL; 81 candidate = kmalloc(sizeof(struct key_user), GFP_KERNEL); 82 if (unlikely(!candidate)) 83 goto out; 84 85 /* the allocation may have scheduled, so we need to repeat the 86 * search lest someone else added the record whilst we were 87 * asleep */ 88 goto try_again; 89 } 90 91 /* if we get here, then the user record still hadn't appeared on the 92 * second pass - so we use the candidate record */ 93 refcount_set(&candidate->usage, 1); 94 atomic_set(&candidate->nkeys, 0); 95 atomic_set(&candidate->nikeys, 0); 96 candidate->uid = uid; 97 candidate->qnkeys = 0; 98 candidate->qnbytes = 0; 99 spin_lock_init(&candidate->lock); 100 mutex_init(&candidate->cons_lock); 101 102 rb_link_node(&candidate->node, parent, p); 103 rb_insert_color(&candidate->node, &key_user_tree); 104 spin_unlock(&key_user_lock); 105 user = candidate; 106 goto out; 107 108 /* okay - we found a user record for this UID */ 109 found: 110 refcount_inc(&user->usage); 111 spin_unlock(&key_user_lock); 112 kfree(candidate); 113 out: 114 return user; 115 } 116 117 /* 118 * Dispose of a user structure 119 */ 120 void key_user_put(struct key_user *user) 121 { 122 if (refcount_dec_and_lock(&user->usage, &key_user_lock)) { 123 rb_erase(&user->node, &key_user_tree); 124 spin_unlock(&key_user_lock); 125 126 kfree(user); 127 } 128 } 129 130 /* 131 * Allocate a serial number for a key. These are assigned randomly to avoid 132 * security issues through covert channel problems. 133 */ 134 static inline void key_alloc_serial(struct key *key) 135 { 136 struct rb_node *parent, **p; 137 struct key *xkey; 138 139 /* propose a random serial number and look for a hole for it in the 140 * serial number tree */ 141 do { 142 get_random_bytes(&key->serial, sizeof(key->serial)); 143 144 key->serial >>= 1; /* negative numbers are not permitted */ 145 } while (key->serial < 3); 146 147 spin_lock(&key_serial_lock); 148 149 attempt_insertion: 150 parent = NULL; 151 p = &key_serial_tree.rb_node; 152 153 while (*p) { 154 parent = *p; 155 xkey = rb_entry(parent, struct key, serial_node); 156 157 if (key->serial < xkey->serial) 158 p = &(*p)->rb_left; 159 else if (key->serial > xkey->serial) 160 p = &(*p)->rb_right; 161 else 162 goto serial_exists; 163 } 164 165 /* we've found a suitable hole - arrange for this key to occupy it */ 166 rb_link_node(&key->serial_node, parent, p); 167 rb_insert_color(&key->serial_node, &key_serial_tree); 168 169 spin_unlock(&key_serial_lock); 170 return; 171 172 /* we found a key with the proposed serial number - walk the tree from 173 * that point looking for the next unused serial number */ 174 serial_exists: 175 for (;;) { 176 key->serial++; 177 if (key->serial < 3) { 178 key->serial = 3; 179 goto attempt_insertion; 180 } 181 182 parent = rb_next(parent); 183 if (!parent) 184 goto attempt_insertion; 185 186 xkey = rb_entry(parent, struct key, serial_node); 187 if (key->serial < xkey->serial) 188 goto attempt_insertion; 189 } 190 } 191 192 /** 193 * key_alloc - Allocate a key of the specified type. 194 * @type: The type of key to allocate. 195 * @desc: The key description to allow the key to be searched out. 196 * @uid: The owner of the new key. 197 * @gid: The group ID for the new key's group permissions. 198 * @cred: The credentials specifying UID namespace. 199 * @perm: The permissions mask of the new key. 200 * @flags: Flags specifying quota properties. 201 * @restrict_link: Optional link restriction for new keyrings. 202 * 203 * Allocate a key of the specified type with the attributes given. The key is 204 * returned in an uninstantiated state and the caller needs to instantiate the 205 * key before returning. 206 * 207 * The restrict_link structure (if not NULL) will be freed when the 208 * keyring is destroyed, so it must be dynamically allocated. 209 * 210 * The user's key count quota is updated to reflect the creation of the key and 211 * the user's key data quota has the default for the key type reserved. The 212 * instantiation function should amend this as necessary. If insufficient 213 * quota is available, -EDQUOT will be returned. 214 * 215 * The LSM security modules can prevent a key being created, in which case 216 * -EACCES will be returned. 217 * 218 * Returns a pointer to the new key if successful and an error code otherwise. 219 * 220 * Note that the caller needs to ensure the key type isn't uninstantiated. 221 * Internally this can be done by locking key_types_sem. Externally, this can 222 * be done by either never unregistering the key type, or making sure 223 * key_alloc() calls don't race with module unloading. 224 */ 225 struct key *key_alloc(struct key_type *type, const char *desc, 226 kuid_t uid, kgid_t gid, const struct cred *cred, 227 key_perm_t perm, unsigned long flags, 228 struct key_restriction *restrict_link) 229 { 230 struct key_user *user = NULL; 231 struct key *key; 232 size_t desclen, quotalen; 233 int ret; 234 235 key = ERR_PTR(-EINVAL); 236 if (!desc || !*desc) 237 goto error; 238 239 if (type->vet_description) { 240 ret = type->vet_description(desc); 241 if (ret < 0) { 242 key = ERR_PTR(ret); 243 goto error; 244 } 245 } 246 247 desclen = strlen(desc); 248 quotalen = desclen + 1 + type->def_datalen; 249 250 /* get hold of the key tracking for this user */ 251 user = key_user_lookup(uid); 252 if (!user) 253 goto no_memory_1; 254 255 /* check that the user's quota permits allocation of another key and 256 * its description */ 257 if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) { 258 unsigned maxkeys = uid_eq(uid, GLOBAL_ROOT_UID) ? 259 key_quota_root_maxkeys : key_quota_maxkeys; 260 unsigned maxbytes = uid_eq(uid, GLOBAL_ROOT_UID) ? 261 key_quota_root_maxbytes : key_quota_maxbytes; 262 263 spin_lock(&user->lock); 264 if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) { 265 if (user->qnkeys + 1 > maxkeys || 266 user->qnbytes + quotalen > maxbytes || 267 user->qnbytes + quotalen < user->qnbytes) 268 goto no_quota; 269 } 270 271 user->qnkeys++; 272 user->qnbytes += quotalen; 273 spin_unlock(&user->lock); 274 } 275 276 /* allocate and initialise the key and its description */ 277 key = kmem_cache_zalloc(key_jar, GFP_KERNEL); 278 if (!key) 279 goto no_memory_2; 280 281 key->index_key.desc_len = desclen; 282 key->index_key.description = kmemdup(desc, desclen + 1, GFP_KERNEL); 283 if (!key->index_key.description) 284 goto no_memory_3; 285 key->index_key.type = type; 286 key_set_index_key(&key->index_key); 287 288 refcount_set(&key->usage, 1); 289 init_rwsem(&key->sem); 290 lockdep_set_class(&key->sem, &type->lock_class); 291 key->user = user; 292 key->quotalen = quotalen; 293 key->datalen = type->def_datalen; 294 key->uid = uid; 295 key->gid = gid; 296 key->perm = perm; 297 key->restrict_link = restrict_link; 298 key->last_used_at = ktime_get_real_seconds(); 299 300 if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) 301 key->flags |= 1 << KEY_FLAG_IN_QUOTA; 302 if (flags & KEY_ALLOC_BUILT_IN) 303 key->flags |= 1 << KEY_FLAG_BUILTIN; 304 if (flags & KEY_ALLOC_UID_KEYRING) 305 key->flags |= 1 << KEY_FLAG_UID_KEYRING; 306 if (flags & KEY_ALLOC_SET_KEEP) 307 key->flags |= 1 << KEY_FLAG_KEEP; 308 309 #ifdef KEY_DEBUGGING 310 key->magic = KEY_DEBUG_MAGIC; 311 #endif 312 313 /* let the security module know about the key */ 314 ret = security_key_alloc(key, cred, flags); 315 if (ret < 0) 316 goto security_error; 317 318 /* publish the key by giving it a serial number */ 319 refcount_inc(&key->domain_tag->usage); 320 atomic_inc(&user->nkeys); 321 key_alloc_serial(key); 322 323 error: 324 return key; 325 326 security_error: 327 kfree(key->description); 328 kmem_cache_free(key_jar, key); 329 if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) { 330 spin_lock(&user->lock); 331 user->qnkeys--; 332 user->qnbytes -= quotalen; 333 spin_unlock(&user->lock); 334 } 335 key_user_put(user); 336 key = ERR_PTR(ret); 337 goto error; 338 339 no_memory_3: 340 kmem_cache_free(key_jar, key); 341 no_memory_2: 342 if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) { 343 spin_lock(&user->lock); 344 user->qnkeys--; 345 user->qnbytes -= quotalen; 346 spin_unlock(&user->lock); 347 } 348 key_user_put(user); 349 no_memory_1: 350 key = ERR_PTR(-ENOMEM); 351 goto error; 352 353 no_quota: 354 spin_unlock(&user->lock); 355 key_user_put(user); 356 key = ERR_PTR(-EDQUOT); 357 goto error; 358 } 359 EXPORT_SYMBOL(key_alloc); 360 361 /** 362 * key_payload_reserve - Adjust data quota reservation for the key's payload 363 * @key: The key to make the reservation for. 364 * @datalen: The amount of data payload the caller now wants. 365 * 366 * Adjust the amount of the owning user's key data quota that a key reserves. 367 * If the amount is increased, then -EDQUOT may be returned if there isn't 368 * enough free quota available. 369 * 370 * If successful, 0 is returned. 371 */ 372 int key_payload_reserve(struct key *key, size_t datalen) 373 { 374 int delta = (int)datalen - key->datalen; 375 int ret = 0; 376 377 key_check(key); 378 379 /* contemplate the quota adjustment */ 380 if (delta != 0 && test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 381 unsigned maxbytes = uid_eq(key->user->uid, GLOBAL_ROOT_UID) ? 382 key_quota_root_maxbytes : key_quota_maxbytes; 383 384 spin_lock(&key->user->lock); 385 386 if (delta > 0 && 387 (key->user->qnbytes + delta > maxbytes || 388 key->user->qnbytes + delta < key->user->qnbytes)) { 389 ret = -EDQUOT; 390 } 391 else { 392 key->user->qnbytes += delta; 393 key->quotalen += delta; 394 } 395 spin_unlock(&key->user->lock); 396 } 397 398 /* change the recorded data length if that didn't generate an error */ 399 if (ret == 0) 400 key->datalen = datalen; 401 402 return ret; 403 } 404 EXPORT_SYMBOL(key_payload_reserve); 405 406 /* 407 * Change the key state to being instantiated. 408 */ 409 static void mark_key_instantiated(struct key *key, int reject_error) 410 { 411 /* Commit the payload before setting the state; barrier versus 412 * key_read_state(). 413 */ 414 smp_store_release(&key->state, 415 (reject_error < 0) ? reject_error : KEY_IS_POSITIVE); 416 } 417 418 /* 419 * Instantiate a key and link it into the target keyring atomically. Must be 420 * called with the target keyring's semaphore writelocked. The target key's 421 * semaphore need not be locked as instantiation is serialised by 422 * key_construction_mutex. 423 */ 424 static int __key_instantiate_and_link(struct key *key, 425 struct key_preparsed_payload *prep, 426 struct key *keyring, 427 struct key *authkey, 428 struct assoc_array_edit **_edit) 429 { 430 int ret, awaken; 431 432 key_check(key); 433 key_check(keyring); 434 435 awaken = 0; 436 ret = -EBUSY; 437 438 mutex_lock(&key_construction_mutex); 439 440 /* can't instantiate twice */ 441 if (key->state == KEY_IS_UNINSTANTIATED) { 442 /* instantiate the key */ 443 ret = key->type->instantiate(key, prep); 444 445 if (ret == 0) { 446 /* mark the key as being instantiated */ 447 atomic_inc(&key->user->nikeys); 448 mark_key_instantiated(key, 0); 449 notify_key(key, NOTIFY_KEY_INSTANTIATED, 0); 450 451 if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) 452 awaken = 1; 453 454 /* and link it into the destination keyring */ 455 if (keyring) { 456 if (test_bit(KEY_FLAG_KEEP, &keyring->flags)) 457 set_bit(KEY_FLAG_KEEP, &key->flags); 458 459 __key_link(keyring, key, _edit); 460 } 461 462 /* disable the authorisation key */ 463 if (authkey) 464 key_invalidate(authkey); 465 466 if (prep->expiry != TIME64_MAX) { 467 key->expiry = prep->expiry; 468 key_schedule_gc(prep->expiry + key_gc_delay); 469 } 470 } 471 } 472 473 mutex_unlock(&key_construction_mutex); 474 475 /* wake up anyone waiting for a key to be constructed */ 476 if (awaken) 477 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 478 479 return ret; 480 } 481 482 /** 483 * key_instantiate_and_link - Instantiate a key and link it into the keyring. 484 * @key: The key to instantiate. 485 * @data: The data to use to instantiate the keyring. 486 * @datalen: The length of @data. 487 * @keyring: Keyring to create a link in on success (or NULL). 488 * @authkey: The authorisation token permitting instantiation. 489 * 490 * Instantiate a key that's in the uninstantiated state using the provided data 491 * and, if successful, link it in to the destination keyring if one is 492 * supplied. 493 * 494 * If successful, 0 is returned, the authorisation token is revoked and anyone 495 * waiting for the key is woken up. If the key was already instantiated, 496 * -EBUSY will be returned. 497 */ 498 int key_instantiate_and_link(struct key *key, 499 const void *data, 500 size_t datalen, 501 struct key *keyring, 502 struct key *authkey) 503 { 504 struct key_preparsed_payload prep; 505 struct assoc_array_edit *edit = NULL; 506 int ret; 507 508 memset(&prep, 0, sizeof(prep)); 509 prep.orig_description = key->description; 510 prep.data = data; 511 prep.datalen = datalen; 512 prep.quotalen = key->type->def_datalen; 513 prep.expiry = TIME64_MAX; 514 if (key->type->preparse) { 515 ret = key->type->preparse(&prep); 516 if (ret < 0) 517 goto error; 518 } 519 520 if (keyring) { 521 ret = __key_link_lock(keyring, &key->index_key); 522 if (ret < 0) 523 goto error; 524 525 ret = __key_link_begin(keyring, &key->index_key, &edit); 526 if (ret < 0) 527 goto error_link_end; 528 529 if (keyring->restrict_link && keyring->restrict_link->check) { 530 struct key_restriction *keyres = keyring->restrict_link; 531 532 ret = keyres->check(keyring, key->type, &prep.payload, 533 keyres->key); 534 if (ret < 0) 535 goto error_link_end; 536 } 537 } 538 539 ret = __key_instantiate_and_link(key, &prep, keyring, authkey, &edit); 540 541 error_link_end: 542 if (keyring) 543 __key_link_end(keyring, &key->index_key, edit); 544 545 error: 546 if (key->type->preparse) 547 key->type->free_preparse(&prep); 548 return ret; 549 } 550 551 EXPORT_SYMBOL(key_instantiate_and_link); 552 553 /** 554 * key_reject_and_link - Negatively instantiate a key and link it into the keyring. 555 * @key: The key to instantiate. 556 * @timeout: The timeout on the negative key. 557 * @error: The error to return when the key is hit. 558 * @keyring: Keyring to create a link in on success (or NULL). 559 * @authkey: The authorisation token permitting instantiation. 560 * 561 * Negatively instantiate a key that's in the uninstantiated state and, if 562 * successful, set its timeout and stored error and link it in to the 563 * destination keyring if one is supplied. The key and any links to the key 564 * will be automatically garbage collected after the timeout expires. 565 * 566 * Negative keys are used to rate limit repeated request_key() calls by causing 567 * them to return the stored error code (typically ENOKEY) until the negative 568 * key expires. 569 * 570 * If successful, 0 is returned, the authorisation token is revoked and anyone 571 * waiting for the key is woken up. If the key was already instantiated, 572 * -EBUSY will be returned. 573 */ 574 int key_reject_and_link(struct key *key, 575 unsigned timeout, 576 unsigned error, 577 struct key *keyring, 578 struct key *authkey) 579 { 580 struct assoc_array_edit *edit = NULL; 581 int ret, awaken, link_ret = 0; 582 583 key_check(key); 584 key_check(keyring); 585 586 awaken = 0; 587 ret = -EBUSY; 588 589 if (keyring) { 590 if (keyring->restrict_link) 591 return -EPERM; 592 593 link_ret = __key_link_lock(keyring, &key->index_key); 594 if (link_ret == 0) { 595 link_ret = __key_link_begin(keyring, &key->index_key, &edit); 596 if (link_ret < 0) 597 __key_link_end(keyring, &key->index_key, edit); 598 } 599 } 600 601 mutex_lock(&key_construction_mutex); 602 603 /* can't instantiate twice */ 604 if (key->state == KEY_IS_UNINSTANTIATED) { 605 /* mark the key as being negatively instantiated */ 606 atomic_inc(&key->user->nikeys); 607 mark_key_instantiated(key, -error); 608 notify_key(key, NOTIFY_KEY_INSTANTIATED, -error); 609 key->expiry = ktime_get_real_seconds() + timeout; 610 key_schedule_gc(key->expiry + key_gc_delay); 611 612 if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) 613 awaken = 1; 614 615 ret = 0; 616 617 /* and link it into the destination keyring */ 618 if (keyring && link_ret == 0) 619 __key_link(keyring, key, &edit); 620 621 /* disable the authorisation key */ 622 if (authkey) 623 key_invalidate(authkey); 624 } 625 626 mutex_unlock(&key_construction_mutex); 627 628 if (keyring && link_ret == 0) 629 __key_link_end(keyring, &key->index_key, edit); 630 631 /* wake up anyone waiting for a key to be constructed */ 632 if (awaken) 633 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 634 635 return ret == 0 ? link_ret : ret; 636 } 637 EXPORT_SYMBOL(key_reject_and_link); 638 639 /** 640 * key_put - Discard a reference to a key. 641 * @key: The key to discard a reference from. 642 * 643 * Discard a reference to a key, and when all the references are gone, we 644 * schedule the cleanup task to come and pull it out of the tree in process 645 * context at some later time. 646 */ 647 void key_put(struct key *key) 648 { 649 if (key) { 650 key_check(key); 651 652 if (refcount_dec_and_test(&key->usage)) 653 schedule_work(&key_gc_work); 654 } 655 } 656 EXPORT_SYMBOL(key_put); 657 658 /* 659 * Find a key by its serial number. 660 */ 661 struct key *key_lookup(key_serial_t id) 662 { 663 struct rb_node *n; 664 struct key *key; 665 666 spin_lock(&key_serial_lock); 667 668 /* search the tree for the specified key */ 669 n = key_serial_tree.rb_node; 670 while (n) { 671 key = rb_entry(n, struct key, serial_node); 672 673 if (id < key->serial) 674 n = n->rb_left; 675 else if (id > key->serial) 676 n = n->rb_right; 677 else 678 goto found; 679 } 680 681 not_found: 682 key = ERR_PTR(-ENOKEY); 683 goto error; 684 685 found: 686 /* A key is allowed to be looked up only if someone still owns a 687 * reference to it - otherwise it's awaiting the gc. 688 */ 689 if (!refcount_inc_not_zero(&key->usage)) 690 goto not_found; 691 692 error: 693 spin_unlock(&key_serial_lock); 694 return key; 695 } 696 697 /* 698 * Find and lock the specified key type against removal. 699 * 700 * We return with the sem read-locked if successful. If the type wasn't 701 * available -ENOKEY is returned instead. 702 */ 703 struct key_type *key_type_lookup(const char *type) 704 { 705 struct key_type *ktype; 706 707 down_read(&key_types_sem); 708 709 /* look up the key type to see if it's one of the registered kernel 710 * types */ 711 list_for_each_entry(ktype, &key_types_list, link) { 712 if (strcmp(ktype->name, type) == 0) 713 goto found_kernel_type; 714 } 715 716 up_read(&key_types_sem); 717 ktype = ERR_PTR(-ENOKEY); 718 719 found_kernel_type: 720 return ktype; 721 } 722 723 void key_set_timeout(struct key *key, unsigned timeout) 724 { 725 time64_t expiry = 0; 726 727 /* make the changes with the locks held to prevent races */ 728 down_write(&key->sem); 729 730 if (timeout > 0) 731 expiry = ktime_get_real_seconds() + timeout; 732 733 key->expiry = expiry; 734 key_schedule_gc(key->expiry + key_gc_delay); 735 736 up_write(&key->sem); 737 } 738 EXPORT_SYMBOL_GPL(key_set_timeout); 739 740 /* 741 * Unlock a key type locked by key_type_lookup(). 742 */ 743 void key_type_put(struct key_type *ktype) 744 { 745 up_read(&key_types_sem); 746 } 747 748 /* 749 * Attempt to update an existing key. 750 * 751 * The key is given to us with an incremented refcount that we need to discard 752 * if we get an error. 753 */ 754 static inline key_ref_t __key_update(key_ref_t key_ref, 755 struct key_preparsed_payload *prep) 756 { 757 struct key *key = key_ref_to_ptr(key_ref); 758 int ret; 759 760 /* need write permission on the key to update it */ 761 ret = key_permission(key_ref, KEY_NEED_WRITE); 762 if (ret < 0) 763 goto error; 764 765 ret = -EEXIST; 766 if (!key->type->update) 767 goto error; 768 769 down_write(&key->sem); 770 771 ret = key->type->update(key, prep); 772 if (ret == 0) { 773 /* Updating a negative key positively instantiates it */ 774 mark_key_instantiated(key, 0); 775 notify_key(key, NOTIFY_KEY_UPDATED, 0); 776 } 777 778 up_write(&key->sem); 779 780 if (ret < 0) 781 goto error; 782 out: 783 return key_ref; 784 785 error: 786 key_put(key); 787 key_ref = ERR_PTR(ret); 788 goto out; 789 } 790 791 /** 792 * key_create_or_update - Update or create and instantiate a key. 793 * @keyring_ref: A pointer to the destination keyring with possession flag. 794 * @type: The type of key. 795 * @description: The searchable description for the key. 796 * @payload: The data to use to instantiate or update the key. 797 * @plen: The length of @payload. 798 * @perm: The permissions mask for a new key. 799 * @flags: The quota flags for a new key. 800 * 801 * Search the destination keyring for a key of the same description and if one 802 * is found, update it, otherwise create and instantiate a new one and create a 803 * link to it from that keyring. 804 * 805 * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be 806 * concocted. 807 * 808 * Returns a pointer to the new key if successful, -ENODEV if the key type 809 * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the 810 * caller isn't permitted to modify the keyring or the LSM did not permit 811 * creation of the key. 812 * 813 * On success, the possession flag from the keyring ref will be tacked on to 814 * the key ref before it is returned. 815 */ 816 key_ref_t key_create_or_update(key_ref_t keyring_ref, 817 const char *type, 818 const char *description, 819 const void *payload, 820 size_t plen, 821 key_perm_t perm, 822 unsigned long flags) 823 { 824 struct keyring_index_key index_key = { 825 .description = description, 826 }; 827 struct key_preparsed_payload prep; 828 struct assoc_array_edit *edit = NULL; 829 const struct cred *cred = current_cred(); 830 struct key *keyring, *key = NULL; 831 key_ref_t key_ref; 832 int ret; 833 struct key_restriction *restrict_link = NULL; 834 835 /* look up the key type to see if it's one of the registered kernel 836 * types */ 837 index_key.type = key_type_lookup(type); 838 if (IS_ERR(index_key.type)) { 839 key_ref = ERR_PTR(-ENODEV); 840 goto error; 841 } 842 843 key_ref = ERR_PTR(-EINVAL); 844 if (!index_key.type->instantiate || 845 (!index_key.description && !index_key.type->preparse)) 846 goto error_put_type; 847 848 keyring = key_ref_to_ptr(keyring_ref); 849 850 key_check(keyring); 851 852 if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION)) 853 restrict_link = keyring->restrict_link; 854 855 key_ref = ERR_PTR(-ENOTDIR); 856 if (keyring->type != &key_type_keyring) 857 goto error_put_type; 858 859 memset(&prep, 0, sizeof(prep)); 860 prep.orig_description = description; 861 prep.data = payload; 862 prep.datalen = plen; 863 prep.quotalen = index_key.type->def_datalen; 864 prep.expiry = TIME64_MAX; 865 if (index_key.type->preparse) { 866 ret = index_key.type->preparse(&prep); 867 if (ret < 0) { 868 key_ref = ERR_PTR(ret); 869 goto error_free_prep; 870 } 871 if (!index_key.description) 872 index_key.description = prep.description; 873 key_ref = ERR_PTR(-EINVAL); 874 if (!index_key.description) 875 goto error_free_prep; 876 } 877 index_key.desc_len = strlen(index_key.description); 878 key_set_index_key(&index_key); 879 880 ret = __key_link_lock(keyring, &index_key); 881 if (ret < 0) { 882 key_ref = ERR_PTR(ret); 883 goto error_free_prep; 884 } 885 886 ret = __key_link_begin(keyring, &index_key, &edit); 887 if (ret < 0) { 888 key_ref = ERR_PTR(ret); 889 goto error_link_end; 890 } 891 892 if (restrict_link && restrict_link->check) { 893 ret = restrict_link->check(keyring, index_key.type, 894 &prep.payload, restrict_link->key); 895 if (ret < 0) { 896 key_ref = ERR_PTR(ret); 897 goto error_link_end; 898 } 899 } 900 901 /* if we're going to allocate a new key, we're going to have 902 * to modify the keyring */ 903 ret = key_permission(keyring_ref, KEY_NEED_WRITE); 904 if (ret < 0) { 905 key_ref = ERR_PTR(ret); 906 goto error_link_end; 907 } 908 909 /* if it's possible to update this type of key, search for an existing 910 * key of the same type and description in the destination keyring and 911 * update that instead if possible 912 */ 913 if (index_key.type->update) { 914 key_ref = find_key_to_update(keyring_ref, &index_key); 915 if (key_ref) 916 goto found_matching_key; 917 } 918 919 /* if the client doesn't provide, decide on the permissions we want */ 920 if (perm == KEY_PERM_UNDEF) { 921 perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR; 922 perm |= KEY_USR_VIEW; 923 924 if (index_key.type->read) 925 perm |= KEY_POS_READ; 926 927 if (index_key.type == &key_type_keyring || 928 index_key.type->update) 929 perm |= KEY_POS_WRITE; 930 } 931 932 /* allocate a new key */ 933 key = key_alloc(index_key.type, index_key.description, 934 cred->fsuid, cred->fsgid, cred, perm, flags, NULL); 935 if (IS_ERR(key)) { 936 key_ref = ERR_CAST(key); 937 goto error_link_end; 938 } 939 940 /* instantiate it and link it into the target keyring */ 941 ret = __key_instantiate_and_link(key, &prep, keyring, NULL, &edit); 942 if (ret < 0) { 943 key_put(key); 944 key_ref = ERR_PTR(ret); 945 goto error_link_end; 946 } 947 948 ima_post_key_create_or_update(keyring, key, payload, plen, 949 flags, true); 950 951 key_ref = make_key_ref(key, is_key_possessed(keyring_ref)); 952 953 error_link_end: 954 __key_link_end(keyring, &index_key, edit); 955 error_free_prep: 956 if (index_key.type->preparse) 957 index_key.type->free_preparse(&prep); 958 error_put_type: 959 key_type_put(index_key.type); 960 error: 961 return key_ref; 962 963 found_matching_key: 964 /* we found a matching key, so we're going to try to update it 965 * - we can drop the locks first as we have the key pinned 966 */ 967 __key_link_end(keyring, &index_key, edit); 968 969 key = key_ref_to_ptr(key_ref); 970 if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) { 971 ret = wait_for_key_construction(key, true); 972 if (ret < 0) { 973 key_ref_put(key_ref); 974 key_ref = ERR_PTR(ret); 975 goto error_free_prep; 976 } 977 } 978 979 key_ref = __key_update(key_ref, &prep); 980 981 if (!IS_ERR(key_ref)) 982 ima_post_key_create_or_update(keyring, key, 983 payload, plen, 984 flags, false); 985 986 goto error_free_prep; 987 } 988 EXPORT_SYMBOL(key_create_or_update); 989 990 /** 991 * key_update - Update a key's contents. 992 * @key_ref: The pointer (plus possession flag) to the key. 993 * @payload: The data to be used to update the key. 994 * @plen: The length of @payload. 995 * 996 * Attempt to update the contents of a key with the given payload data. The 997 * caller must be granted Write permission on the key. Negative keys can be 998 * instantiated by this method. 999 * 1000 * Returns 0 on success, -EACCES if not permitted and -EOPNOTSUPP if the key 1001 * type does not support updating. The key type may return other errors. 1002 */ 1003 int key_update(key_ref_t key_ref, const void *payload, size_t plen) 1004 { 1005 struct key_preparsed_payload prep; 1006 struct key *key = key_ref_to_ptr(key_ref); 1007 int ret; 1008 1009 key_check(key); 1010 1011 /* the key must be writable */ 1012 ret = key_permission(key_ref, KEY_NEED_WRITE); 1013 if (ret < 0) 1014 return ret; 1015 1016 /* attempt to update it if supported */ 1017 if (!key->type->update) 1018 return -EOPNOTSUPP; 1019 1020 memset(&prep, 0, sizeof(prep)); 1021 prep.data = payload; 1022 prep.datalen = plen; 1023 prep.quotalen = key->type->def_datalen; 1024 prep.expiry = TIME64_MAX; 1025 if (key->type->preparse) { 1026 ret = key->type->preparse(&prep); 1027 if (ret < 0) 1028 goto error; 1029 } 1030 1031 down_write(&key->sem); 1032 1033 ret = key->type->update(key, &prep); 1034 if (ret == 0) { 1035 /* Updating a negative key positively instantiates it */ 1036 mark_key_instantiated(key, 0); 1037 notify_key(key, NOTIFY_KEY_UPDATED, 0); 1038 } 1039 1040 up_write(&key->sem); 1041 1042 error: 1043 if (key->type->preparse) 1044 key->type->free_preparse(&prep); 1045 return ret; 1046 } 1047 EXPORT_SYMBOL(key_update); 1048 1049 /** 1050 * key_revoke - Revoke a key. 1051 * @key: The key to be revoked. 1052 * 1053 * Mark a key as being revoked and ask the type to free up its resources. The 1054 * revocation timeout is set and the key and all its links will be 1055 * automatically garbage collected after key_gc_delay amount of time if they 1056 * are not manually dealt with first. 1057 */ 1058 void key_revoke(struct key *key) 1059 { 1060 time64_t time; 1061 1062 key_check(key); 1063 1064 /* make sure no one's trying to change or use the key when we mark it 1065 * - we tell lockdep that we might nest because we might be revoking an 1066 * authorisation key whilst holding the sem on a key we've just 1067 * instantiated 1068 */ 1069 down_write_nested(&key->sem, 1); 1070 if (!test_and_set_bit(KEY_FLAG_REVOKED, &key->flags)) { 1071 notify_key(key, NOTIFY_KEY_REVOKED, 0); 1072 if (key->type->revoke) 1073 key->type->revoke(key); 1074 1075 /* set the death time to no more than the expiry time */ 1076 time = ktime_get_real_seconds(); 1077 if (key->revoked_at == 0 || key->revoked_at > time) { 1078 key->revoked_at = time; 1079 key_schedule_gc(key->revoked_at + key_gc_delay); 1080 } 1081 } 1082 1083 up_write(&key->sem); 1084 } 1085 EXPORT_SYMBOL(key_revoke); 1086 1087 /** 1088 * key_invalidate - Invalidate a key. 1089 * @key: The key to be invalidated. 1090 * 1091 * Mark a key as being invalidated and have it cleaned up immediately. The key 1092 * is ignored by all searches and other operations from this point. 1093 */ 1094 void key_invalidate(struct key *key) 1095 { 1096 kenter("%d", key_serial(key)); 1097 1098 key_check(key); 1099 1100 if (!test_bit(KEY_FLAG_INVALIDATED, &key->flags)) { 1101 down_write_nested(&key->sem, 1); 1102 if (!test_and_set_bit(KEY_FLAG_INVALIDATED, &key->flags)) { 1103 notify_key(key, NOTIFY_KEY_INVALIDATED, 0); 1104 key_schedule_gc_links(); 1105 } 1106 up_write(&key->sem); 1107 } 1108 } 1109 EXPORT_SYMBOL(key_invalidate); 1110 1111 /** 1112 * generic_key_instantiate - Simple instantiation of a key from preparsed data 1113 * @key: The key to be instantiated 1114 * @prep: The preparsed data to load. 1115 * 1116 * Instantiate a key from preparsed data. We assume we can just copy the data 1117 * in directly and clear the old pointers. 1118 * 1119 * This can be pointed to directly by the key type instantiate op pointer. 1120 */ 1121 int generic_key_instantiate(struct key *key, struct key_preparsed_payload *prep) 1122 { 1123 int ret; 1124 1125 pr_devel("==>%s()\n", __func__); 1126 1127 ret = key_payload_reserve(key, prep->quotalen); 1128 if (ret == 0) { 1129 rcu_assign_keypointer(key, prep->payload.data[0]); 1130 key->payload.data[1] = prep->payload.data[1]; 1131 key->payload.data[2] = prep->payload.data[2]; 1132 key->payload.data[3] = prep->payload.data[3]; 1133 prep->payload.data[0] = NULL; 1134 prep->payload.data[1] = NULL; 1135 prep->payload.data[2] = NULL; 1136 prep->payload.data[3] = NULL; 1137 } 1138 pr_devel("<==%s() = %d\n", __func__, ret); 1139 return ret; 1140 } 1141 EXPORT_SYMBOL(generic_key_instantiate); 1142 1143 /** 1144 * register_key_type - Register a type of key. 1145 * @ktype: The new key type. 1146 * 1147 * Register a new key type. 1148 * 1149 * Returns 0 on success or -EEXIST if a type of this name already exists. 1150 */ 1151 int register_key_type(struct key_type *ktype) 1152 { 1153 struct key_type *p; 1154 int ret; 1155 1156 memset(&ktype->lock_class, 0, sizeof(ktype->lock_class)); 1157 1158 ret = -EEXIST; 1159 down_write(&key_types_sem); 1160 1161 /* disallow key types with the same name */ 1162 list_for_each_entry(p, &key_types_list, link) { 1163 if (strcmp(p->name, ktype->name) == 0) 1164 goto out; 1165 } 1166 1167 /* store the type */ 1168 list_add(&ktype->link, &key_types_list); 1169 1170 pr_notice("Key type %s registered\n", ktype->name); 1171 ret = 0; 1172 1173 out: 1174 up_write(&key_types_sem); 1175 return ret; 1176 } 1177 EXPORT_SYMBOL(register_key_type); 1178 1179 /** 1180 * unregister_key_type - Unregister a type of key. 1181 * @ktype: The key type. 1182 * 1183 * Unregister a key type and mark all the extant keys of this type as dead. 1184 * Those keys of this type are then destroyed to get rid of their payloads and 1185 * they and their links will be garbage collected as soon as possible. 1186 */ 1187 void unregister_key_type(struct key_type *ktype) 1188 { 1189 down_write(&key_types_sem); 1190 list_del_init(&ktype->link); 1191 downgrade_write(&key_types_sem); 1192 key_gc_keytype(ktype); 1193 pr_notice("Key type %s unregistered\n", ktype->name); 1194 up_read(&key_types_sem); 1195 } 1196 EXPORT_SYMBOL(unregister_key_type); 1197 1198 /* 1199 * Initialise the key management state. 1200 */ 1201 void __init key_init(void) 1202 { 1203 /* allocate a slab in which we can store keys */ 1204 key_jar = kmem_cache_create("key_jar", sizeof(struct key), 1205 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); 1206 1207 /* add the special key types */ 1208 list_add_tail(&key_type_keyring.link, &key_types_list); 1209 list_add_tail(&key_type_dead.link, &key_types_list); 1210 list_add_tail(&key_type_user.link, &key_types_list); 1211 list_add_tail(&key_type_logon.link, &key_types_list); 1212 1213 /* record the root user tracking */ 1214 rb_link_node(&root_key_user.node, 1215 NULL, 1216 &key_user_tree.rb_node); 1217 1218 rb_insert_color(&root_key_user.node, 1219 &key_user_tree); 1220 } 1221