1 /* keyctl.c: userspace keyctl operations 2 * 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 4 * Written by David Howells (dhowells@redhat.com) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/init.h> 14 #include <linux/sched.h> 15 #include <linux/slab.h> 16 #include <linux/syscalls.h> 17 #include <linux/keyctl.h> 18 #include <linux/fs.h> 19 #include <linux/capability.h> 20 #include <linux/string.h> 21 #include <linux/err.h> 22 #include <linux/vmalloc.h> 23 #include <linux/security.h> 24 #include <asm/uaccess.h> 25 #include "internal.h" 26 27 static int key_get_type_from_user(char *type, 28 const char __user *_type, 29 unsigned len) 30 { 31 int ret; 32 33 ret = strncpy_from_user(type, _type, len); 34 35 if (ret < 0) 36 return -EFAULT; 37 38 if (ret == 0 || ret >= len) 39 return -EINVAL; 40 41 if (type[0] == '.') 42 return -EPERM; 43 44 type[len - 1] = '\0'; 45 46 return 0; 47 } 48 49 /*****************************************************************************/ 50 /* 51 * extract the description of a new key from userspace and either add it as a 52 * new key to the specified keyring or update a matching key in that keyring 53 * - the keyring must be writable 54 * - returns the new key's serial number 55 * - implements add_key() 56 */ 57 asmlinkage long sys_add_key(const char __user *_type, 58 const char __user *_description, 59 const void __user *_payload, 60 size_t plen, 61 key_serial_t ringid) 62 { 63 key_ref_t keyring_ref, key_ref; 64 char type[32], *description; 65 void *payload; 66 long ret; 67 bool vm; 68 69 ret = -EINVAL; 70 if (plen > 1024 * 1024 - 1) 71 goto error; 72 73 /* draw all the data into kernel space */ 74 ret = key_get_type_from_user(type, _type, sizeof(type)); 75 if (ret < 0) 76 goto error; 77 78 description = strndup_user(_description, PAGE_SIZE); 79 if (IS_ERR(description)) { 80 ret = PTR_ERR(description); 81 goto error; 82 } 83 84 /* pull the payload in if one was supplied */ 85 payload = NULL; 86 87 vm = false; 88 if (_payload) { 89 ret = -ENOMEM; 90 payload = kmalloc(plen, GFP_KERNEL); 91 if (!payload) { 92 if (plen <= PAGE_SIZE) 93 goto error2; 94 vm = true; 95 payload = vmalloc(plen); 96 if (!payload) 97 goto error2; 98 } 99 100 ret = -EFAULT; 101 if (copy_from_user(payload, _payload, plen) != 0) 102 goto error3; 103 } 104 105 /* find the target keyring (which must be writable) */ 106 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE); 107 if (IS_ERR(keyring_ref)) { 108 ret = PTR_ERR(keyring_ref); 109 goto error3; 110 } 111 112 /* create or update the requested key and add it to the target 113 * keyring */ 114 key_ref = key_create_or_update(keyring_ref, type, description, 115 payload, plen, KEY_PERM_UNDEF, 116 KEY_ALLOC_IN_QUOTA); 117 if (!IS_ERR(key_ref)) { 118 ret = key_ref_to_ptr(key_ref)->serial; 119 key_ref_put(key_ref); 120 } 121 else { 122 ret = PTR_ERR(key_ref); 123 } 124 125 key_ref_put(keyring_ref); 126 error3: 127 if (!vm) 128 kfree(payload); 129 else 130 vfree(payload); 131 error2: 132 kfree(description); 133 error: 134 return ret; 135 136 } /* end sys_add_key() */ 137 138 /*****************************************************************************/ 139 /* 140 * search the process keyrings for a matching key 141 * - nested keyrings may also be searched if they have Search permission 142 * - if a key is found, it will be attached to the destination keyring if 143 * there's one specified 144 * - /sbin/request-key will be invoked if _callout_info is non-NULL 145 * - the _callout_info string will be passed to /sbin/request-key 146 * - if the _callout_info string is empty, it will be rendered as "-" 147 * - implements request_key() 148 */ 149 asmlinkage long sys_request_key(const char __user *_type, 150 const char __user *_description, 151 const char __user *_callout_info, 152 key_serial_t destringid) 153 { 154 struct key_type *ktype; 155 struct key *key; 156 key_ref_t dest_ref; 157 size_t callout_len; 158 char type[32], *description, *callout_info; 159 long ret; 160 161 /* pull the type into kernel space */ 162 ret = key_get_type_from_user(type, _type, sizeof(type)); 163 if (ret < 0) 164 goto error; 165 166 /* pull the description into kernel space */ 167 description = strndup_user(_description, PAGE_SIZE); 168 if (IS_ERR(description)) { 169 ret = PTR_ERR(description); 170 goto error; 171 } 172 173 /* pull the callout info into kernel space */ 174 callout_info = NULL; 175 callout_len = 0; 176 if (_callout_info) { 177 callout_info = strndup_user(_callout_info, PAGE_SIZE); 178 if (IS_ERR(callout_info)) { 179 ret = PTR_ERR(callout_info); 180 goto error2; 181 } 182 callout_len = strlen(callout_info); 183 } 184 185 /* get the destination keyring if specified */ 186 dest_ref = NULL; 187 if (destringid) { 188 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE); 189 if (IS_ERR(dest_ref)) { 190 ret = PTR_ERR(dest_ref); 191 goto error3; 192 } 193 } 194 195 /* find the key type */ 196 ktype = key_type_lookup(type); 197 if (IS_ERR(ktype)) { 198 ret = PTR_ERR(ktype); 199 goto error4; 200 } 201 202 /* do the search */ 203 key = request_key_and_link(ktype, description, callout_info, 204 callout_len, NULL, key_ref_to_ptr(dest_ref), 205 KEY_ALLOC_IN_QUOTA); 206 if (IS_ERR(key)) { 207 ret = PTR_ERR(key); 208 goto error5; 209 } 210 211 ret = key->serial; 212 213 key_put(key); 214 error5: 215 key_type_put(ktype); 216 error4: 217 key_ref_put(dest_ref); 218 error3: 219 kfree(callout_info); 220 error2: 221 kfree(description); 222 error: 223 return ret; 224 225 } /* end sys_request_key() */ 226 227 /*****************************************************************************/ 228 /* 229 * get the ID of the specified process keyring 230 * - the keyring must have search permission to be found 231 * - implements keyctl(KEYCTL_GET_KEYRING_ID) 232 */ 233 long keyctl_get_keyring_ID(key_serial_t id, int create) 234 { 235 key_ref_t key_ref; 236 long ret; 237 238 key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH); 239 if (IS_ERR(key_ref)) { 240 ret = PTR_ERR(key_ref); 241 goto error; 242 } 243 244 ret = key_ref_to_ptr(key_ref)->serial; 245 key_ref_put(key_ref); 246 error: 247 return ret; 248 249 } /* end keyctl_get_keyring_ID() */ 250 251 /*****************************************************************************/ 252 /* 253 * join the session keyring 254 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING) 255 */ 256 long keyctl_join_session_keyring(const char __user *_name) 257 { 258 char *name; 259 long ret; 260 261 /* fetch the name from userspace */ 262 name = NULL; 263 if (_name) { 264 name = strndup_user(_name, PAGE_SIZE); 265 if (IS_ERR(name)) { 266 ret = PTR_ERR(name); 267 goto error; 268 } 269 } 270 271 /* join the session */ 272 ret = join_session_keyring(name); 273 274 error: 275 return ret; 276 277 } /* end keyctl_join_session_keyring() */ 278 279 /*****************************************************************************/ 280 /* 281 * update a key's data payload 282 * - the key must be writable 283 * - implements keyctl(KEYCTL_UPDATE) 284 */ 285 long keyctl_update_key(key_serial_t id, 286 const void __user *_payload, 287 size_t plen) 288 { 289 key_ref_t key_ref; 290 void *payload; 291 long ret; 292 293 ret = -EINVAL; 294 if (plen > PAGE_SIZE) 295 goto error; 296 297 /* pull the payload in if one was supplied */ 298 payload = NULL; 299 if (_payload) { 300 ret = -ENOMEM; 301 payload = kmalloc(plen, GFP_KERNEL); 302 if (!payload) 303 goto error; 304 305 ret = -EFAULT; 306 if (copy_from_user(payload, _payload, plen) != 0) 307 goto error2; 308 } 309 310 /* find the target key (which must be writable) */ 311 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE); 312 if (IS_ERR(key_ref)) { 313 ret = PTR_ERR(key_ref); 314 goto error2; 315 } 316 317 /* update the key */ 318 ret = key_update(key_ref, payload, plen); 319 320 key_ref_put(key_ref); 321 error2: 322 kfree(payload); 323 error: 324 return ret; 325 326 } /* end keyctl_update_key() */ 327 328 /*****************************************************************************/ 329 /* 330 * revoke a key 331 * - the key must be writable 332 * - implements keyctl(KEYCTL_REVOKE) 333 */ 334 long keyctl_revoke_key(key_serial_t id) 335 { 336 key_ref_t key_ref; 337 long ret; 338 339 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE); 340 if (IS_ERR(key_ref)) { 341 ret = PTR_ERR(key_ref); 342 goto error; 343 } 344 345 key_revoke(key_ref_to_ptr(key_ref)); 346 ret = 0; 347 348 key_ref_put(key_ref); 349 error: 350 return ret; 351 352 } /* end keyctl_revoke_key() */ 353 354 /*****************************************************************************/ 355 /* 356 * clear the specified process keyring 357 * - the keyring must be writable 358 * - implements keyctl(KEYCTL_CLEAR) 359 */ 360 long keyctl_keyring_clear(key_serial_t ringid) 361 { 362 key_ref_t keyring_ref; 363 long ret; 364 365 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE); 366 if (IS_ERR(keyring_ref)) { 367 ret = PTR_ERR(keyring_ref); 368 goto error; 369 } 370 371 ret = keyring_clear(key_ref_to_ptr(keyring_ref)); 372 373 key_ref_put(keyring_ref); 374 error: 375 return ret; 376 377 } /* end keyctl_keyring_clear() */ 378 379 /*****************************************************************************/ 380 /* 381 * link a key into a keyring 382 * - the keyring must be writable 383 * - the key must be linkable 384 * - implements keyctl(KEYCTL_LINK) 385 */ 386 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid) 387 { 388 key_ref_t keyring_ref, key_ref; 389 long ret; 390 391 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE); 392 if (IS_ERR(keyring_ref)) { 393 ret = PTR_ERR(keyring_ref); 394 goto error; 395 } 396 397 key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK); 398 if (IS_ERR(key_ref)) { 399 ret = PTR_ERR(key_ref); 400 goto error2; 401 } 402 403 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 404 405 key_ref_put(key_ref); 406 error2: 407 key_ref_put(keyring_ref); 408 error: 409 return ret; 410 411 } /* end keyctl_keyring_link() */ 412 413 /*****************************************************************************/ 414 /* 415 * unlink the first attachment of a key from a keyring 416 * - the keyring must be writable 417 * - we don't need any permissions on the key 418 * - implements keyctl(KEYCTL_UNLINK) 419 */ 420 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid) 421 { 422 key_ref_t keyring_ref, key_ref; 423 long ret; 424 425 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE); 426 if (IS_ERR(keyring_ref)) { 427 ret = PTR_ERR(keyring_ref); 428 goto error; 429 } 430 431 key_ref = lookup_user_key(NULL, id, 0, 0, 0); 432 if (IS_ERR(key_ref)) { 433 ret = PTR_ERR(key_ref); 434 goto error2; 435 } 436 437 ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 438 439 key_ref_put(key_ref); 440 error2: 441 key_ref_put(keyring_ref); 442 error: 443 return ret; 444 445 } /* end keyctl_keyring_unlink() */ 446 447 /*****************************************************************************/ 448 /* 449 * describe a user key 450 * - the key must have view permission 451 * - if there's a buffer, we place up to buflen bytes of data into it 452 * - unless there's an error, we return the amount of description available, 453 * irrespective of how much we may have copied 454 * - the description is formatted thus: 455 * type;uid;gid;perm;description<NUL> 456 * - implements keyctl(KEYCTL_DESCRIBE) 457 */ 458 long keyctl_describe_key(key_serial_t keyid, 459 char __user *buffer, 460 size_t buflen) 461 { 462 struct key *key, *instkey; 463 key_ref_t key_ref; 464 char *tmpbuf; 465 long ret; 466 467 key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW); 468 if (IS_ERR(key_ref)) { 469 /* viewing a key under construction is permitted if we have the 470 * authorisation token handy */ 471 if (PTR_ERR(key_ref) == -EACCES) { 472 instkey = key_get_instantiation_authkey(keyid); 473 if (!IS_ERR(instkey)) { 474 key_put(instkey); 475 key_ref = lookup_user_key(NULL, keyid, 476 0, 1, 0); 477 if (!IS_ERR(key_ref)) 478 goto okay; 479 } 480 } 481 482 ret = PTR_ERR(key_ref); 483 goto error; 484 } 485 486 okay: 487 /* calculate how much description we're going to return */ 488 ret = -ENOMEM; 489 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL); 490 if (!tmpbuf) 491 goto error2; 492 493 key = key_ref_to_ptr(key_ref); 494 495 ret = snprintf(tmpbuf, PAGE_SIZE - 1, 496 "%s;%d;%d;%08x;%s", 497 key_ref_to_ptr(key_ref)->type->name, 498 key_ref_to_ptr(key_ref)->uid, 499 key_ref_to_ptr(key_ref)->gid, 500 key_ref_to_ptr(key_ref)->perm, 501 key_ref_to_ptr(key_ref)->description ? 502 key_ref_to_ptr(key_ref)->description : "" 503 ); 504 505 /* include a NUL char at the end of the data */ 506 if (ret > PAGE_SIZE - 1) 507 ret = PAGE_SIZE - 1; 508 tmpbuf[ret] = 0; 509 ret++; 510 511 /* consider returning the data */ 512 if (buffer && buflen > 0) { 513 if (buflen > ret) 514 buflen = ret; 515 516 if (copy_to_user(buffer, tmpbuf, buflen) != 0) 517 ret = -EFAULT; 518 } 519 520 kfree(tmpbuf); 521 error2: 522 key_ref_put(key_ref); 523 error: 524 return ret; 525 526 } /* end keyctl_describe_key() */ 527 528 /*****************************************************************************/ 529 /* 530 * search the specified keyring for a matching key 531 * - the start keyring must be searchable 532 * - nested keyrings may also be searched if they are searchable 533 * - only keys with search permission may be found 534 * - if a key is found, it will be attached to the destination keyring if 535 * there's one specified 536 * - implements keyctl(KEYCTL_SEARCH) 537 */ 538 long keyctl_keyring_search(key_serial_t ringid, 539 const char __user *_type, 540 const char __user *_description, 541 key_serial_t destringid) 542 { 543 struct key_type *ktype; 544 key_ref_t keyring_ref, key_ref, dest_ref; 545 char type[32], *description; 546 long ret; 547 548 /* pull the type and description into kernel space */ 549 ret = key_get_type_from_user(type, _type, sizeof(type)); 550 if (ret < 0) 551 goto error; 552 553 description = strndup_user(_description, PAGE_SIZE); 554 if (IS_ERR(description)) { 555 ret = PTR_ERR(description); 556 goto error; 557 } 558 559 /* get the keyring at which to begin the search */ 560 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH); 561 if (IS_ERR(keyring_ref)) { 562 ret = PTR_ERR(keyring_ref); 563 goto error2; 564 } 565 566 /* get the destination keyring if specified */ 567 dest_ref = NULL; 568 if (destringid) { 569 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE); 570 if (IS_ERR(dest_ref)) { 571 ret = PTR_ERR(dest_ref); 572 goto error3; 573 } 574 } 575 576 /* find the key type */ 577 ktype = key_type_lookup(type); 578 if (IS_ERR(ktype)) { 579 ret = PTR_ERR(ktype); 580 goto error4; 581 } 582 583 /* do the search */ 584 key_ref = keyring_search(keyring_ref, ktype, description); 585 if (IS_ERR(key_ref)) { 586 ret = PTR_ERR(key_ref); 587 588 /* treat lack or presence of a negative key the same */ 589 if (ret == -EAGAIN) 590 ret = -ENOKEY; 591 goto error5; 592 } 593 594 /* link the resulting key to the destination keyring if we can */ 595 if (dest_ref) { 596 ret = key_permission(key_ref, KEY_LINK); 597 if (ret < 0) 598 goto error6; 599 600 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref)); 601 if (ret < 0) 602 goto error6; 603 } 604 605 ret = key_ref_to_ptr(key_ref)->serial; 606 607 error6: 608 key_ref_put(key_ref); 609 error5: 610 key_type_put(ktype); 611 error4: 612 key_ref_put(dest_ref); 613 error3: 614 key_ref_put(keyring_ref); 615 error2: 616 kfree(description); 617 error: 618 return ret; 619 620 } /* end keyctl_keyring_search() */ 621 622 /*****************************************************************************/ 623 /* 624 * read a user key's payload 625 * - the keyring must be readable or the key must be searchable from the 626 * process's keyrings 627 * - if there's a buffer, we place up to buflen bytes of data into it 628 * - unless there's an error, we return the amount of data in the key, 629 * irrespective of how much we may have copied 630 * - implements keyctl(KEYCTL_READ) 631 */ 632 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) 633 { 634 struct key *key; 635 key_ref_t key_ref; 636 long ret; 637 638 /* find the key first */ 639 key_ref = lookup_user_key(NULL, keyid, 0, 0, 0); 640 if (IS_ERR(key_ref)) { 641 ret = -ENOKEY; 642 goto error; 643 } 644 645 key = key_ref_to_ptr(key_ref); 646 647 /* see if we can read it directly */ 648 ret = key_permission(key_ref, KEY_READ); 649 if (ret == 0) 650 goto can_read_key; 651 if (ret != -EACCES) 652 goto error; 653 654 /* we can't; see if it's searchable from this process's keyrings 655 * - we automatically take account of the fact that it may be 656 * dangling off an instantiation key 657 */ 658 if (!is_key_possessed(key_ref)) { 659 ret = -EACCES; 660 goto error2; 661 } 662 663 /* the key is probably readable - now try to read it */ 664 can_read_key: 665 ret = key_validate(key); 666 if (ret == 0) { 667 ret = -EOPNOTSUPP; 668 if (key->type->read) { 669 /* read the data with the semaphore held (since we 670 * might sleep) */ 671 down_read(&key->sem); 672 ret = key->type->read(key, buffer, buflen); 673 up_read(&key->sem); 674 } 675 } 676 677 error2: 678 key_put(key); 679 error: 680 return ret; 681 682 } /* end keyctl_read_key() */ 683 684 /*****************************************************************************/ 685 /* 686 * change the ownership of a key 687 * - the keyring owned by the changer 688 * - if the uid or gid is -1, then that parameter is not changed 689 * - implements keyctl(KEYCTL_CHOWN) 690 */ 691 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid) 692 { 693 struct key_user *newowner, *zapowner = NULL; 694 struct key *key; 695 key_ref_t key_ref; 696 long ret; 697 698 ret = 0; 699 if (uid == (uid_t) -1 && gid == (gid_t) -1) 700 goto error; 701 702 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR); 703 if (IS_ERR(key_ref)) { 704 ret = PTR_ERR(key_ref); 705 goto error; 706 } 707 708 key = key_ref_to_ptr(key_ref); 709 710 /* make the changes with the locks held to prevent chown/chown races */ 711 ret = -EACCES; 712 down_write(&key->sem); 713 714 if (!capable(CAP_SYS_ADMIN)) { 715 /* only the sysadmin can chown a key to some other UID */ 716 if (uid != (uid_t) -1 && key->uid != uid) 717 goto error_put; 718 719 /* only the sysadmin can set the key's GID to a group other 720 * than one of those that the current process subscribes to */ 721 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid)) 722 goto error_put; 723 } 724 725 /* change the UID */ 726 if (uid != (uid_t) -1 && uid != key->uid) { 727 ret = -ENOMEM; 728 newowner = key_user_lookup(uid); 729 if (!newowner) 730 goto error_put; 731 732 /* transfer the quota burden to the new user */ 733 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) { 734 unsigned maxkeys = (uid == 0) ? 735 key_quota_root_maxkeys : key_quota_maxkeys; 736 unsigned maxbytes = (uid == 0) ? 737 key_quota_root_maxbytes : key_quota_maxbytes; 738 739 spin_lock(&newowner->lock); 740 if (newowner->qnkeys + 1 >= maxkeys || 741 newowner->qnbytes + key->quotalen >= maxbytes || 742 newowner->qnbytes + key->quotalen < 743 newowner->qnbytes) 744 goto quota_overrun; 745 746 newowner->qnkeys++; 747 newowner->qnbytes += key->quotalen; 748 spin_unlock(&newowner->lock); 749 750 spin_lock(&key->user->lock); 751 key->user->qnkeys--; 752 key->user->qnbytes -= key->quotalen; 753 spin_unlock(&key->user->lock); 754 } 755 756 atomic_dec(&key->user->nkeys); 757 atomic_inc(&newowner->nkeys); 758 759 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) { 760 atomic_dec(&key->user->nikeys); 761 atomic_inc(&newowner->nikeys); 762 } 763 764 zapowner = key->user; 765 key->user = newowner; 766 key->uid = uid; 767 } 768 769 /* change the GID */ 770 if (gid != (gid_t) -1) 771 key->gid = gid; 772 773 ret = 0; 774 775 error_put: 776 up_write(&key->sem); 777 key_put(key); 778 if (zapowner) 779 key_user_put(zapowner); 780 error: 781 return ret; 782 783 quota_overrun: 784 spin_unlock(&newowner->lock); 785 zapowner = newowner; 786 ret = -EDQUOT; 787 goto error_put; 788 789 } /* end keyctl_chown_key() */ 790 791 /*****************************************************************************/ 792 /* 793 * change the permission mask on a key 794 * - the keyring owned by the changer 795 * - implements keyctl(KEYCTL_SETPERM) 796 */ 797 long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 798 { 799 struct key *key; 800 key_ref_t key_ref; 801 long ret; 802 803 ret = -EINVAL; 804 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL)) 805 goto error; 806 807 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR); 808 if (IS_ERR(key_ref)) { 809 ret = PTR_ERR(key_ref); 810 goto error; 811 } 812 813 key = key_ref_to_ptr(key_ref); 814 815 /* make the changes with the locks held to prevent chown/chmod races */ 816 ret = -EACCES; 817 down_write(&key->sem); 818 819 /* if we're not the sysadmin, we can only change a key that we own */ 820 if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) { 821 key->perm = perm; 822 ret = 0; 823 } 824 825 up_write(&key->sem); 826 key_put(key); 827 error: 828 return ret; 829 830 } /* end keyctl_setperm_key() */ 831 832 /*****************************************************************************/ 833 /* 834 * instantiate the key with the specified payload, and, if one is given, link 835 * the key into the keyring 836 */ 837 long keyctl_instantiate_key(key_serial_t id, 838 const void __user *_payload, 839 size_t plen, 840 key_serial_t ringid) 841 { 842 struct request_key_auth *rka; 843 struct key *instkey; 844 key_ref_t keyring_ref; 845 void *payload; 846 long ret; 847 bool vm = false; 848 849 ret = -EINVAL; 850 if (plen > 1024 * 1024 - 1) 851 goto error; 852 853 /* the appropriate instantiation authorisation key must have been 854 * assumed before calling this */ 855 ret = -EPERM; 856 instkey = current->request_key_auth; 857 if (!instkey) 858 goto error; 859 860 rka = instkey->payload.data; 861 if (rka->target_key->serial != id) 862 goto error; 863 864 /* pull the payload in if one was supplied */ 865 payload = NULL; 866 867 if (_payload) { 868 ret = -ENOMEM; 869 payload = kmalloc(plen, GFP_KERNEL); 870 if (!payload) { 871 if (plen <= PAGE_SIZE) 872 goto error; 873 vm = true; 874 payload = vmalloc(plen); 875 if (!payload) 876 goto error; 877 } 878 879 ret = -EFAULT; 880 if (copy_from_user(payload, _payload, plen) != 0) 881 goto error2; 882 } 883 884 /* find the destination keyring amongst those belonging to the 885 * requesting task */ 886 keyring_ref = NULL; 887 if (ringid) { 888 keyring_ref = lookup_user_key(rka->context, ringid, 1, 0, 889 KEY_WRITE); 890 if (IS_ERR(keyring_ref)) { 891 ret = PTR_ERR(keyring_ref); 892 goto error2; 893 } 894 } 895 896 /* instantiate the key and link it into a keyring */ 897 ret = key_instantiate_and_link(rka->target_key, payload, plen, 898 key_ref_to_ptr(keyring_ref), instkey); 899 900 key_ref_put(keyring_ref); 901 902 /* discard the assumed authority if it's just been disabled by 903 * instantiation of the key */ 904 if (ret == 0) { 905 key_put(current->request_key_auth); 906 current->request_key_auth = NULL; 907 } 908 909 error2: 910 if (!vm) 911 kfree(payload); 912 else 913 vfree(payload); 914 error: 915 return ret; 916 917 } /* end keyctl_instantiate_key() */ 918 919 /*****************************************************************************/ 920 /* 921 * negatively instantiate the key with the given timeout (in seconds), and, if 922 * one is given, link the key into the keyring 923 */ 924 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid) 925 { 926 struct request_key_auth *rka; 927 struct key *instkey; 928 key_ref_t keyring_ref; 929 long ret; 930 931 /* the appropriate instantiation authorisation key must have been 932 * assumed before calling this */ 933 ret = -EPERM; 934 instkey = current->request_key_auth; 935 if (!instkey) 936 goto error; 937 938 rka = instkey->payload.data; 939 if (rka->target_key->serial != id) 940 goto error; 941 942 /* find the destination keyring if present (which must also be 943 * writable) */ 944 keyring_ref = NULL; 945 if (ringid) { 946 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE); 947 if (IS_ERR(keyring_ref)) { 948 ret = PTR_ERR(keyring_ref); 949 goto error; 950 } 951 } 952 953 /* instantiate the key and link it into a keyring */ 954 ret = key_negate_and_link(rka->target_key, timeout, 955 key_ref_to_ptr(keyring_ref), instkey); 956 957 key_ref_put(keyring_ref); 958 959 /* discard the assumed authority if it's just been disabled by 960 * instantiation of the key */ 961 if (ret == 0) { 962 key_put(current->request_key_auth); 963 current->request_key_auth = NULL; 964 } 965 966 error: 967 return ret; 968 969 } /* end keyctl_negate_key() */ 970 971 /*****************************************************************************/ 972 /* 973 * set the default keyring in which request_key() will cache keys 974 * - return the old setting 975 */ 976 long keyctl_set_reqkey_keyring(int reqkey_defl) 977 { 978 int ret; 979 980 switch (reqkey_defl) { 981 case KEY_REQKEY_DEFL_THREAD_KEYRING: 982 ret = install_thread_keyring(current); 983 if (ret < 0) 984 return ret; 985 goto set; 986 987 case KEY_REQKEY_DEFL_PROCESS_KEYRING: 988 ret = install_process_keyring(current); 989 if (ret < 0) 990 return ret; 991 992 case KEY_REQKEY_DEFL_DEFAULT: 993 case KEY_REQKEY_DEFL_SESSION_KEYRING: 994 case KEY_REQKEY_DEFL_USER_KEYRING: 995 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING: 996 set: 997 current->jit_keyring = reqkey_defl; 998 999 case KEY_REQKEY_DEFL_NO_CHANGE: 1000 return current->jit_keyring; 1001 1002 case KEY_REQKEY_DEFL_GROUP_KEYRING: 1003 default: 1004 return -EINVAL; 1005 } 1006 1007 } /* end keyctl_set_reqkey_keyring() */ 1008 1009 /*****************************************************************************/ 1010 /* 1011 * set or clear the timeout for a key 1012 */ 1013 long keyctl_set_timeout(key_serial_t id, unsigned timeout) 1014 { 1015 struct timespec now; 1016 struct key *key; 1017 key_ref_t key_ref; 1018 time_t expiry; 1019 long ret; 1020 1021 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR); 1022 if (IS_ERR(key_ref)) { 1023 ret = PTR_ERR(key_ref); 1024 goto error; 1025 } 1026 1027 key = key_ref_to_ptr(key_ref); 1028 1029 /* make the changes with the locks held to prevent races */ 1030 down_write(&key->sem); 1031 1032 expiry = 0; 1033 if (timeout > 0) { 1034 now = current_kernel_time(); 1035 expiry = now.tv_sec + timeout; 1036 } 1037 1038 key->expiry = expiry; 1039 1040 up_write(&key->sem); 1041 key_put(key); 1042 1043 ret = 0; 1044 error: 1045 return ret; 1046 1047 } /* end keyctl_set_timeout() */ 1048 1049 /*****************************************************************************/ 1050 /* 1051 * assume the authority to instantiate the specified key 1052 */ 1053 long keyctl_assume_authority(key_serial_t id) 1054 { 1055 struct key *authkey; 1056 long ret; 1057 1058 /* special key IDs aren't permitted */ 1059 ret = -EINVAL; 1060 if (id < 0) 1061 goto error; 1062 1063 /* we divest ourselves of authority if given an ID of 0 */ 1064 if (id == 0) { 1065 key_put(current->request_key_auth); 1066 current->request_key_auth = NULL; 1067 ret = 0; 1068 goto error; 1069 } 1070 1071 /* attempt to assume the authority temporarily granted to us whilst we 1072 * instantiate the specified key 1073 * - the authorisation key must be in the current task's keyrings 1074 * somewhere 1075 */ 1076 authkey = key_get_instantiation_authkey(id); 1077 if (IS_ERR(authkey)) { 1078 ret = PTR_ERR(authkey); 1079 goto error; 1080 } 1081 1082 key_put(current->request_key_auth); 1083 current->request_key_auth = authkey; 1084 ret = authkey->serial; 1085 1086 error: 1087 return ret; 1088 1089 } /* end keyctl_assume_authority() */ 1090 1091 /* 1092 * get the security label of a key 1093 * - the key must grant us view permission 1094 * - if there's a buffer, we place up to buflen bytes of data into it 1095 * - unless there's an error, we return the amount of information available, 1096 * irrespective of how much we may have copied (including the terminal NUL) 1097 * - implements keyctl(KEYCTL_GET_SECURITY) 1098 */ 1099 long keyctl_get_security(key_serial_t keyid, 1100 char __user *buffer, 1101 size_t buflen) 1102 { 1103 struct key *key, *instkey; 1104 key_ref_t key_ref; 1105 char *context; 1106 long ret; 1107 1108 key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW); 1109 if (IS_ERR(key_ref)) { 1110 if (PTR_ERR(key_ref) != -EACCES) 1111 return PTR_ERR(key_ref); 1112 1113 /* viewing a key under construction is also permitted if we 1114 * have the authorisation token handy */ 1115 instkey = key_get_instantiation_authkey(keyid); 1116 if (IS_ERR(instkey)) 1117 return PTR_ERR(key_ref); 1118 key_put(instkey); 1119 1120 key_ref = lookup_user_key(NULL, keyid, 0, 1, 0); 1121 if (IS_ERR(key_ref)) 1122 return PTR_ERR(key_ref); 1123 } 1124 1125 key = key_ref_to_ptr(key_ref); 1126 ret = security_key_getsecurity(key, &context); 1127 if (ret == 0) { 1128 /* if no information was returned, give userspace an empty 1129 * string */ 1130 ret = 1; 1131 if (buffer && buflen > 0 && 1132 copy_to_user(buffer, "", 1) != 0) 1133 ret = -EFAULT; 1134 } else if (ret > 0) { 1135 /* return as much data as there's room for */ 1136 if (buffer && buflen > 0) { 1137 if (buflen > ret) 1138 buflen = ret; 1139 1140 if (copy_to_user(buffer, context, buflen) != 0) 1141 ret = -EFAULT; 1142 } 1143 1144 kfree(context); 1145 } 1146 1147 key_ref_put(key_ref); 1148 return ret; 1149 } 1150 1151 /*****************************************************************************/ 1152 /* 1153 * the key control system call 1154 */ 1155 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3, 1156 unsigned long arg4, unsigned long arg5) 1157 { 1158 switch (option) { 1159 case KEYCTL_GET_KEYRING_ID: 1160 return keyctl_get_keyring_ID((key_serial_t) arg2, 1161 (int) arg3); 1162 1163 case KEYCTL_JOIN_SESSION_KEYRING: 1164 return keyctl_join_session_keyring((const char __user *) arg2); 1165 1166 case KEYCTL_UPDATE: 1167 return keyctl_update_key((key_serial_t) arg2, 1168 (const void __user *) arg3, 1169 (size_t) arg4); 1170 1171 case KEYCTL_REVOKE: 1172 return keyctl_revoke_key((key_serial_t) arg2); 1173 1174 case KEYCTL_DESCRIBE: 1175 return keyctl_describe_key((key_serial_t) arg2, 1176 (char __user *) arg3, 1177 (unsigned) arg4); 1178 1179 case KEYCTL_CLEAR: 1180 return keyctl_keyring_clear((key_serial_t) arg2); 1181 1182 case KEYCTL_LINK: 1183 return keyctl_keyring_link((key_serial_t) arg2, 1184 (key_serial_t) arg3); 1185 1186 case KEYCTL_UNLINK: 1187 return keyctl_keyring_unlink((key_serial_t) arg2, 1188 (key_serial_t) arg3); 1189 1190 case KEYCTL_SEARCH: 1191 return keyctl_keyring_search((key_serial_t) arg2, 1192 (const char __user *) arg3, 1193 (const char __user *) arg4, 1194 (key_serial_t) arg5); 1195 1196 case KEYCTL_READ: 1197 return keyctl_read_key((key_serial_t) arg2, 1198 (char __user *) arg3, 1199 (size_t) arg4); 1200 1201 case KEYCTL_CHOWN: 1202 return keyctl_chown_key((key_serial_t) arg2, 1203 (uid_t) arg3, 1204 (gid_t) arg4); 1205 1206 case KEYCTL_SETPERM: 1207 return keyctl_setperm_key((key_serial_t) arg2, 1208 (key_perm_t) arg3); 1209 1210 case KEYCTL_INSTANTIATE: 1211 return keyctl_instantiate_key((key_serial_t) arg2, 1212 (const void __user *) arg3, 1213 (size_t) arg4, 1214 (key_serial_t) arg5); 1215 1216 case KEYCTL_NEGATE: 1217 return keyctl_negate_key((key_serial_t) arg2, 1218 (unsigned) arg3, 1219 (key_serial_t) arg4); 1220 1221 case KEYCTL_SET_REQKEY_KEYRING: 1222 return keyctl_set_reqkey_keyring(arg2); 1223 1224 case KEYCTL_SET_TIMEOUT: 1225 return keyctl_set_timeout((key_serial_t) arg2, 1226 (unsigned) arg3); 1227 1228 case KEYCTL_ASSUME_AUTHORITY: 1229 return keyctl_assume_authority((key_serial_t) arg2); 1230 1231 case KEYCTL_GET_SECURITY: 1232 return keyctl_get_security((key_serial_t) arg2, 1233 (char *) arg3, 1234 (size_t) arg4); 1235 1236 default: 1237 return -EOPNOTSUPP; 1238 } 1239 1240 } /* end sys_keyctl() */ 1241