1
2
3
4
5
6
7
8
9
10
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
16#include <linux/keyctl.h>
17#include <linux/fs.h>
18#include <linux/err.h>
19#include <linux/mutex.h>
20#include <linux/security.h>
21#include <linux/user_namespace.h>
22#include <asm/uaccess.h>
23#include "internal.h"
24
25
26static DEFINE_MUTEX(key_session_mutex);
27
28
29static DEFINE_MUTEX(key_user_keyring_mutex);
30
31
32struct key_user root_key_user = {
33 .usage = ATOMIC_INIT(3),
34 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
35 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
36 .nkeys = ATOMIC_INIT(2),
37 .nikeys = ATOMIC_INIT(2),
38 .uid = 0,
39 .user_ns = &init_user_ns,
40};
41
42
43
44
45
46int install_user_keyrings(void)
47{
48 struct user_struct *user;
49 const struct cred *cred;
50 struct key *uid_keyring, *session_keyring;
51 char buf[20];
52 int ret;
53
54 cred = current_cred();
55 user = cred->user;
56
57 kenter("%p{%u}", user, user->uid);
58
59 if (user->uid_keyring) {
60 kleave(" = 0 [exist]");
61 return 0;
62 }
63
64 mutex_lock(&key_user_keyring_mutex);
65 ret = 0;
66
67 if (!user->uid_keyring) {
68
69
70
71
72 sprintf(buf, "_uid.%u", user->uid);
73
74 uid_keyring = find_keyring_by_name(buf, true);
75 if (IS_ERR(uid_keyring)) {
76 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
77 cred, KEY_ALLOC_IN_QUOTA,
78 NULL);
79 if (IS_ERR(uid_keyring)) {
80 ret = PTR_ERR(uid_keyring);
81 goto error;
82 }
83 }
84
85
86
87 sprintf(buf, "_uid_ses.%u", user->uid);
88
89 session_keyring = find_keyring_by_name(buf, true);
90 if (IS_ERR(session_keyring)) {
91 session_keyring =
92 keyring_alloc(buf, user->uid, (gid_t) -1,
93 cred, KEY_ALLOC_IN_QUOTA, NULL);
94 if (IS_ERR(session_keyring)) {
95 ret = PTR_ERR(session_keyring);
96 goto error_release;
97 }
98
99
100
101 ret = key_link(session_keyring, uid_keyring);
102 if (ret < 0)
103 goto error_release_both;
104 }
105
106
107 user->uid_keyring = uid_keyring;
108 user->session_keyring = session_keyring;
109 }
110
111 mutex_unlock(&key_user_keyring_mutex);
112 kleave(" = 0");
113 return 0;
114
115error_release_both:
116 key_put(session_keyring);
117error_release:
118 key_put(uid_keyring);
119error:
120 mutex_unlock(&key_user_keyring_mutex);
121 kleave(" = %d", ret);
122 return ret;
123}
124
125
126
127
128int install_thread_keyring_to_cred(struct cred *new)
129{
130 struct key *keyring;
131
132 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
133 KEY_ALLOC_QUOTA_OVERRUN, NULL);
134 if (IS_ERR(keyring))
135 return PTR_ERR(keyring);
136
137 new->thread_keyring = keyring;
138 return 0;
139}
140
141
142
143
144static int install_thread_keyring(void)
145{
146 struct cred *new;
147 int ret;
148
149 new = prepare_creds();
150 if (!new)
151 return -ENOMEM;
152
153 BUG_ON(new->thread_keyring);
154
155 ret = install_thread_keyring_to_cred(new);
156 if (ret < 0) {
157 abort_creds(new);
158 return ret;
159 }
160
161 return commit_creds(new);
162}
163
164
165
166
167
168
169int install_process_keyring_to_cred(struct cred *new)
170{
171 struct key *keyring;
172 int ret;
173
174 if (new->tgcred->process_keyring)
175 return -EEXIST;
176
177 keyring = keyring_alloc("_pid", new->uid, new->gid,
178 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
179 if (IS_ERR(keyring))
180 return PTR_ERR(keyring);
181
182 spin_lock_irq(&new->tgcred->lock);
183 if (!new->tgcred->process_keyring) {
184 new->tgcred->process_keyring = keyring;
185 keyring = NULL;
186 ret = 0;
187 } else {
188 ret = -EEXIST;
189 }
190 spin_unlock_irq(&new->tgcred->lock);
191 key_put(keyring);
192 return ret;
193}
194
195
196
197
198
199static int install_process_keyring(void)
200{
201 struct cred *new;
202 int ret;
203
204 new = prepare_creds();
205 if (!new)
206 return -ENOMEM;
207
208 ret = install_process_keyring_to_cred(new);
209 if (ret < 0) {
210 abort_creds(new);
211 return ret != -EEXIST ?: 0;
212 }
213
214 return commit_creds(new);
215}
216
217
218
219
220static int install_session_keyring_to_cred(struct cred *cred,
221 struct key *keyring)
222{
223 unsigned long flags;
224 struct key *old;
225
226 might_sleep();
227
228
229 if (!keyring) {
230 flags = KEY_ALLOC_QUOTA_OVERRUN;
231 if (cred->tgcred->session_keyring)
232 flags = KEY_ALLOC_IN_QUOTA;
233
234 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
235 cred, flags, NULL);
236 if (IS_ERR(keyring))
237 return PTR_ERR(keyring);
238 } else {
239 atomic_inc(&keyring->usage);
240 }
241
242
243 spin_lock_irq(&cred->tgcred->lock);
244 old = cred->tgcred->session_keyring;
245 rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
246 spin_unlock_irq(&cred->tgcred->lock);
247
248
249
250 if (old) {
251 synchronize_rcu();
252 key_put(old);
253 }
254
255 return 0;
256}
257
258
259
260
261
262static int install_session_keyring(struct key *keyring)
263{
264 struct cred *new;
265 int ret;
266
267 new = prepare_creds();
268 if (!new)
269 return -ENOMEM;
270
271 ret = install_session_keyring_to_cred(new, NULL);
272 if (ret < 0) {
273 abort_creds(new);
274 return ret;
275 }
276
277 return commit_creds(new);
278}
279
280
281
282
283
284void key_fsuid_changed(struct task_struct *tsk)
285{
286
287 BUG_ON(!tsk->cred);
288 if (tsk->cred->thread_keyring) {
289 down_write(&tsk->cred->thread_keyring->sem);
290 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
291 up_write(&tsk->cred->thread_keyring->sem);
292 }
293
294}
295
296
297
298
299
300void key_fsgid_changed(struct task_struct *tsk)
301{
302
303 BUG_ON(!tsk->cred);
304 if (tsk->cred->thread_keyring) {
305 down_write(&tsk->cred->thread_keyring->sem);
306 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
307 up_write(&tsk->cred->thread_keyring->sem);
308 }
309
310}
311
312
313
314
315
316
317
318
319
320key_ref_t search_process_keyrings(struct key_type *type,
321 const void *description,
322 key_match_func_t match,
323 const struct cred *cred)
324{
325 struct request_key_auth *rka;
326 key_ref_t key_ref, ret, err;
327
328 might_sleep();
329
330
331
332
333
334
335
336
337 key_ref = NULL;
338 ret = NULL;
339 err = ERR_PTR(-EAGAIN);
340
341
342 if (cred->thread_keyring) {
343 key_ref = keyring_search_aux(
344 make_key_ref(cred->thread_keyring, 1),
345 cred, type, description, match);
346 if (!IS_ERR(key_ref))
347 goto found;
348
349 switch (PTR_ERR(key_ref)) {
350 case -EAGAIN:
351 if (ret)
352 break;
353 case -ENOKEY:
354 ret = key_ref;
355 break;
356 default:
357 err = key_ref;
358 break;
359 }
360 }
361
362
363 if (cred->tgcred->process_keyring) {
364 key_ref = keyring_search_aux(
365 make_key_ref(cred->tgcred->process_keyring, 1),
366 cred, type, description, match);
367 if (!IS_ERR(key_ref))
368 goto found;
369
370 switch (PTR_ERR(key_ref)) {
371 case -EAGAIN:
372 if (ret)
373 break;
374 case -ENOKEY:
375 ret = key_ref;
376 break;
377 default:
378 err = key_ref;
379 break;
380 }
381 }
382
383
384 if (cred->tgcred->session_keyring) {
385 rcu_read_lock();
386 key_ref = keyring_search_aux(
387 make_key_ref(rcu_dereference(
388 cred->tgcred->session_keyring),
389 1),
390 cred, type, description, match);
391 rcu_read_unlock();
392
393 if (!IS_ERR(key_ref))
394 goto found;
395
396 switch (PTR_ERR(key_ref)) {
397 case -EAGAIN:
398 if (ret)
399 break;
400 case -ENOKEY:
401 ret = key_ref;
402 break;
403 default:
404 err = key_ref;
405 break;
406 }
407 }
408
409 else if (cred->user->session_keyring) {
410 key_ref = keyring_search_aux(
411 make_key_ref(cred->user->session_keyring, 1),
412 cred, type, description, match);
413 if (!IS_ERR(key_ref))
414 goto found;
415
416 switch (PTR_ERR(key_ref)) {
417 case -EAGAIN:
418 if (ret)
419 break;
420 case -ENOKEY:
421 ret = key_ref;
422 break;
423 default:
424 err = key_ref;
425 break;
426 }
427 }
428
429
430
431
432
433 if (cred->request_key_auth &&
434 cred == current_cred() &&
435 type != &key_type_request_key_auth
436 ) {
437
438 down_read(&cred->request_key_auth->sem);
439
440 if (key_validate(cred->request_key_auth) == 0) {
441 rka = cred->request_key_auth->payload.data;
442
443 key_ref = search_process_keyrings(type, description,
444 match, rka->cred);
445
446 up_read(&cred->request_key_auth->sem);
447
448 if (!IS_ERR(key_ref))
449 goto found;
450
451 switch (PTR_ERR(key_ref)) {
452 case -EAGAIN:
453 if (ret)
454 break;
455 case -ENOKEY:
456 ret = key_ref;
457 break;
458 default:
459 err = key_ref;
460 break;
461 }
462 } else {
463 up_read(&cred->request_key_auth->sem);
464 }
465 }
466
467
468 key_ref = ret ? ret : err;
469
470found:
471 return key_ref;
472
473}
474
475
476
477
478
479static int lookup_user_key_possessed(const struct key *key, const void *target)
480{
481 return key == target;
482
483}
484
485
486
487
488
489
490
491key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
492 key_perm_t perm)
493{
494 struct request_key_auth *rka;
495 const struct cred *cred;
496 struct key *key;
497 key_ref_t key_ref, skey_ref;
498 int ret;
499
500try_again:
501 cred = get_current_cred();
502 key_ref = ERR_PTR(-ENOKEY);
503
504 switch (id) {
505 case KEY_SPEC_THREAD_KEYRING:
506 if (!cred->thread_keyring) {
507 if (!(lflags & KEY_LOOKUP_CREATE))
508 goto error;
509
510 ret = install_thread_keyring();
511 if (ret < 0) {
512 key = ERR_PTR(ret);
513 goto error;
514 }
515 goto reget_creds;
516 }
517
518 key = cred->thread_keyring;
519 atomic_inc(&key->usage);
520 key_ref = make_key_ref(key, 1);
521 break;
522
523 case KEY_SPEC_PROCESS_KEYRING:
524 if (!cred->tgcred->process_keyring) {
525 if (!(lflags & KEY_LOOKUP_CREATE))
526 goto error;
527
528 ret = install_process_keyring();
529 if (ret < 0) {
530 key = ERR_PTR(ret);
531 goto error;
532 }
533 goto reget_creds;
534 }
535
536 key = cred->tgcred->process_keyring;
537 atomic_inc(&key->usage);
538 key_ref = make_key_ref(key, 1);
539 break;
540
541 case KEY_SPEC_SESSION_KEYRING:
542 if (!cred->tgcred->session_keyring) {
543
544
545 ret = install_user_keyrings();
546 if (ret < 0)
547 goto error;
548 ret = install_session_keyring(
549 cred->user->session_keyring);
550
551 if (ret < 0)
552 goto error;
553 goto reget_creds;
554 }
555
556 rcu_read_lock();
557 key = rcu_dereference(cred->tgcred->session_keyring);
558 atomic_inc(&key->usage);
559 rcu_read_unlock();
560 key_ref = make_key_ref(key, 1);
561 break;
562
563 case KEY_SPEC_USER_KEYRING:
564 if (!cred->user->uid_keyring) {
565 ret = install_user_keyrings();
566 if (ret < 0)
567 goto error;
568 }
569
570 key = cred->user->uid_keyring;
571 atomic_inc(&key->usage);
572 key_ref = make_key_ref(key, 1);
573 break;
574
575 case KEY_SPEC_USER_SESSION_KEYRING:
576 if (!cred->user->session_keyring) {
577 ret = install_user_keyrings();
578 if (ret < 0)
579 goto error;
580 }
581
582 key = cred->user->session_keyring;
583 atomic_inc(&key->usage);
584 key_ref = make_key_ref(key, 1);
585 break;
586
587 case KEY_SPEC_GROUP_KEYRING:
588
589 key = ERR_PTR(-EINVAL);
590 goto error;
591
592 case KEY_SPEC_REQKEY_AUTH_KEY:
593 key = cred->request_key_auth;
594 if (!key)
595 goto error;
596
597 atomic_inc(&key->usage);
598 key_ref = make_key_ref(key, 1);
599 break;
600
601 case KEY_SPEC_REQUESTOR_KEYRING:
602 if (!cred->request_key_auth)
603 goto error;
604
605 down_read(&cred->request_key_auth->sem);
606 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
607 key_ref = ERR_PTR(-EKEYREVOKED);
608 key = NULL;
609 } else {
610 rka = cred->request_key_auth->payload.data;
611 key = rka->dest_keyring;
612 atomic_inc(&key->usage);
613 }
614 up_read(&cred->request_key_auth->sem);
615 if (!key)
616 goto error;
617 key_ref = make_key_ref(key, 1);
618 break;
619
620 default:
621 key_ref = ERR_PTR(-EINVAL);
622 if (id < 1)
623 goto error;
624
625 key = key_lookup(id);
626 if (IS_ERR(key)) {
627 key_ref = ERR_CAST(key);
628 goto error;
629 }
630
631 key_ref = make_key_ref(key, 0);
632
633
634 skey_ref = search_process_keyrings(key->type, key,
635 lookup_user_key_possessed,
636 cred);
637
638 if (!IS_ERR(skey_ref)) {
639 key_put(key);
640 key_ref = skey_ref;
641 }
642
643 break;
644 }
645
646
647
648 if (lflags & KEY_LOOKUP_FOR_UNLINK) {
649 ret = 0;
650 goto error;
651 }
652
653 if (!(lflags & KEY_LOOKUP_PARTIAL)) {
654 ret = wait_for_key_construction(key, true);
655 switch (ret) {
656 case -ERESTARTSYS:
657 goto invalid_key;
658 default:
659 if (perm)
660 goto invalid_key;
661 case 0:
662 break;
663 }
664 } else if (perm) {
665 ret = key_validate(key);
666 if (ret < 0)
667 goto invalid_key;
668 }
669
670 ret = -EIO;
671 if (!(lflags & KEY_LOOKUP_PARTIAL) &&
672 !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
673 goto invalid_key;
674
675
676 ret = key_task_permission(key_ref, cred, perm);
677 if (ret < 0)
678 goto invalid_key;
679
680error:
681 put_cred(cred);
682 return key_ref;
683
684invalid_key:
685 key_ref_put(key_ref);
686 key_ref = ERR_PTR(ret);
687 goto error;
688
689
690
691reget_creds:
692 put_cred(cred);
693 goto try_again;
694
695}
696
697
698
699
700
701
702
703
704long join_session_keyring(const char *name)
705{
706 const struct cred *old;
707 struct cred *new;
708 struct key *keyring;
709 long ret, serial;
710
711
712
713
714 if (!current_is_single_threaded())
715 return -EMLINK;
716
717 new = prepare_creds();
718 if (!new)
719 return -ENOMEM;
720 old = current_cred();
721
722
723 if (!name) {
724 ret = install_session_keyring_to_cred(new, NULL);
725 if (ret < 0)
726 goto error;
727
728 serial = new->tgcred->session_keyring->serial;
729 ret = commit_creds(new);
730 if (ret == 0)
731 ret = serial;
732 goto okay;
733 }
734
735
736 mutex_lock(&key_session_mutex);
737
738
739 keyring = find_keyring_by_name(name, false);
740 if (PTR_ERR(keyring) == -ENOKEY) {
741
742 keyring = keyring_alloc(name, old->uid, old->gid, old,
743 KEY_ALLOC_IN_QUOTA, NULL);
744 if (IS_ERR(keyring)) {
745 ret = PTR_ERR(keyring);
746 goto error2;
747 }
748 } else if (IS_ERR(keyring)) {
749 ret = PTR_ERR(keyring);
750 goto error2;
751 }
752
753
754 ret = install_session_keyring_to_cred(new, keyring);
755 if (ret < 0)
756 goto error2;
757
758 commit_creds(new);
759 mutex_unlock(&key_session_mutex);
760
761 ret = keyring->serial;
762 key_put(keyring);
763okay:
764 return ret;
765
766error2:
767 mutex_unlock(&key_session_mutex);
768error:
769 abort_creds(new);
770 return ret;
771}
772
773
774
775
776
777void key_replace_session_keyring(void)
778{
779 const struct cred *old;
780 struct cred *new;
781
782 if (!current->replacement_session_keyring)
783 return;
784
785 write_lock_irq(&tasklist_lock);
786 new = current->replacement_session_keyring;
787 current->replacement_session_keyring = NULL;
788 write_unlock_irq(&tasklist_lock);
789
790 if (!new)
791 return;
792
793 old = current_cred();
794 new-> uid = old-> uid;
795 new-> euid = old-> euid;
796 new-> suid = old-> suid;
797 new->fsuid = old->fsuid;
798 new-> gid = old-> gid;
799 new-> egid = old-> egid;
800 new-> sgid = old-> sgid;
801 new->fsgid = old->fsgid;
802 new->user = get_uid(old->user);
803 new->group_info = get_group_info(old->group_info);
804
805 new->securebits = old->securebits;
806 new->cap_inheritable = old->cap_inheritable;
807 new->cap_permitted = old->cap_permitted;
808 new->cap_effective = old->cap_effective;
809 new->cap_bset = old->cap_bset;
810
811 new->jit_keyring = old->jit_keyring;
812 new->thread_keyring = key_get(old->thread_keyring);
813 new->tgcred->tgid = old->tgcred->tgid;
814 new->tgcred->process_keyring = key_get(old->tgcred->process_keyring);
815
816 security_transfer_creds(new, old);
817
818 commit_creds(new);
819}
820