1
2
3
4
5
6
7
8
9
10
11
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/sched.h>
15#include <linux/slab.h>
16#include <linux/security.h>
17#include <linux/seq_file.h>
18#include <linux/err.h>
19#include <keys/keyring-type.h>
20#include <keys/user-type.h>
21#include <linux/assoc_array_priv.h>
22#include <linux/uaccess.h>
23#include "internal.h"
24
25
26
27
28
29#define KEYRING_SEARCH_MAX_DEPTH 6
30
31
32
33
34#define KEYRING_NAME_HASH_SIZE (1 << 5)
35
36
37
38
39
40#define KEYRING_PTR_SUBTYPE 0x2UL
41
42static inline bool keyring_ptr_is_keyring(const struct assoc_array_ptr *x)
43{
44 return (unsigned long)x & KEYRING_PTR_SUBTYPE;
45}
46static inline struct key *keyring_ptr_to_key(const struct assoc_array_ptr *x)
47{
48 void *object = assoc_array_ptr_to_leaf(x);
49 return (struct key *)((unsigned long)object & ~KEYRING_PTR_SUBTYPE);
50}
51static inline void *keyring_key_to_ptr(struct key *key)
52{
53 if (key->type == &key_type_keyring)
54 return (void *)((unsigned long)key | KEYRING_PTR_SUBTYPE);
55 return key;
56}
57
58static struct list_head keyring_name_hash[KEYRING_NAME_HASH_SIZE];
59static DEFINE_RWLOCK(keyring_name_lock);
60
61static inline unsigned keyring_hash(const char *desc)
62{
63 unsigned bucket = 0;
64
65 for (; *desc; desc++)
66 bucket += (unsigned char)*desc;
67
68 return bucket & (KEYRING_NAME_HASH_SIZE - 1);
69}
70
71
72
73
74
75
76static int keyring_preparse(struct key_preparsed_payload *prep);
77static void keyring_free_preparse(struct key_preparsed_payload *prep);
78static int keyring_instantiate(struct key *keyring,
79 struct key_preparsed_payload *prep);
80static void keyring_revoke(struct key *keyring);
81static void keyring_destroy(struct key *keyring);
82static void keyring_describe(const struct key *keyring, struct seq_file *m);
83static long keyring_read(const struct key *keyring,
84 char __user *buffer, size_t buflen);
85
86struct key_type key_type_keyring = {
87 .name = "keyring",
88 .def_datalen = 0,
89 .preparse = keyring_preparse,
90 .free_preparse = keyring_free_preparse,
91 .instantiate = keyring_instantiate,
92 .revoke = keyring_revoke,
93 .destroy = keyring_destroy,
94 .describe = keyring_describe,
95 .read = keyring_read,
96};
97EXPORT_SYMBOL(key_type_keyring);
98
99
100
101
102
103static DECLARE_RWSEM(keyring_serialise_link_sem);
104
105
106
107
108
109static void keyring_publish_name(struct key *keyring)
110{
111 int bucket;
112
113 if (keyring->description) {
114 bucket = keyring_hash(keyring->description);
115
116 write_lock(&keyring_name_lock);
117
118 if (!keyring_name_hash[bucket].next)
119 INIT_LIST_HEAD(&keyring_name_hash[bucket]);
120
121 list_add_tail(&keyring->name_link,
122 &keyring_name_hash[bucket]);
123
124 write_unlock(&keyring_name_lock);
125 }
126}
127
128
129
130
131static int keyring_preparse(struct key_preparsed_payload *prep)
132{
133 return prep->datalen != 0 ? -EINVAL : 0;
134}
135
136
137
138
139static void keyring_free_preparse(struct key_preparsed_payload *prep)
140{
141}
142
143
144
145
146
147
148static int keyring_instantiate(struct key *keyring,
149 struct key_preparsed_payload *prep)
150{
151 assoc_array_init(&keyring->keys);
152
153 keyring_publish_name(keyring);
154 return 0;
155}
156
157
158
159
160
161static u64 mult_64x32_and_fold(u64 x, u32 y)
162{
163 u64 hi = (u64)(u32)(x >> 32) * y;
164 u64 lo = (u64)(u32)(x) * y;
165 return lo + ((u64)(u32)hi << 32) + (u32)(hi >> 32);
166}
167
168
169
170
171static unsigned long hash_key_type_and_desc(const struct keyring_index_key *index_key)
172{
173 const unsigned level_shift = ASSOC_ARRAY_LEVEL_STEP;
174 const unsigned long fan_mask = ASSOC_ARRAY_FAN_MASK;
175 const char *description = index_key->description;
176 unsigned long hash, type;
177 u32 piece;
178 u64 acc;
179 int n, desc_len = index_key->desc_len;
180
181 type = (unsigned long)index_key->type;
182
183 acc = mult_64x32_and_fold(type, desc_len + 13);
184 acc = mult_64x32_and_fold(acc, 9207);
185 for (;;) {
186 n = desc_len;
187 if (n <= 0)
188 break;
189 if (n > 4)
190 n = 4;
191 piece = 0;
192 memcpy(&piece, description, n);
193 description += n;
194 desc_len -= n;
195 acc = mult_64x32_and_fold(acc, piece);
196 acc = mult_64x32_and_fold(acc, 9207);
197 }
198
199
200 hash = acc;
201 if (ASSOC_ARRAY_KEY_CHUNK_SIZE == 32)
202 hash ^= acc >> 32;
203
204
205
206
207
208 if (index_key->type != &key_type_keyring && (hash & fan_mask) == 0)
209 return hash | (hash >> (ASSOC_ARRAY_KEY_CHUNK_SIZE - level_shift)) | 1;
210 if (index_key->type == &key_type_keyring && (hash & fan_mask) != 0)
211 return (hash + (hash << level_shift)) & ~fan_mask;
212 return hash;
213}
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230static unsigned long keyring_get_key_chunk(const void *data, int level)
231{
232 const struct keyring_index_key *index_key = data;
233 unsigned long chunk = 0;
234 long offset = 0;
235 int desc_len = index_key->desc_len, n = sizeof(chunk);
236
237 level /= ASSOC_ARRAY_KEY_CHUNK_SIZE;
238 switch (level) {
239 case 0:
240 return hash_key_type_and_desc(index_key);
241 case 1:
242 return ((unsigned long)index_key->type << 8) | desc_len;
243 case 2:
244 if (desc_len == 0)
245 return (u8)((unsigned long)index_key->type >>
246 (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
247 n--;
248 offset = 1;
249 default:
250 offset += sizeof(chunk) - 1;
251 offset += (level - 3) * sizeof(chunk);
252 if (offset >= desc_len)
253 return 0;
254 desc_len -= offset;
255 if (desc_len > n)
256 desc_len = n;
257 offset += desc_len;
258 do {
259 chunk <<= 8;
260 chunk |= ((u8*)index_key->description)[--offset];
261 } while (--desc_len > 0);
262
263 if (level == 2) {
264 chunk <<= 8;
265 chunk |= (u8)((unsigned long)index_key->type >>
266 (ASSOC_ARRAY_KEY_CHUNK_SIZE - 8));
267 }
268 return chunk;
269 }
270}
271
272static unsigned long keyring_get_object_key_chunk(const void *object, int level)
273{
274 const struct key *key = keyring_ptr_to_key(object);
275 return keyring_get_key_chunk(&key->index_key, level);
276}
277
278static bool keyring_compare_object(const void *object, const void *data)
279{
280 const struct keyring_index_key *index_key = data;
281 const struct key *key = keyring_ptr_to_key(object);
282
283 return key->index_key.type == index_key->type &&
284 key->index_key.desc_len == index_key->desc_len &&
285 memcmp(key->index_key.description, index_key->description,
286 index_key->desc_len) == 0;
287}
288
289
290
291
292
293static int keyring_diff_objects(const void *object, const void *data)
294{
295 const struct key *key_a = keyring_ptr_to_key(object);
296 const struct keyring_index_key *a = &key_a->index_key;
297 const struct keyring_index_key *b = data;
298 unsigned long seg_a, seg_b;
299 int level, i;
300
301 level = 0;
302 seg_a = hash_key_type_and_desc(a);
303 seg_b = hash_key_type_and_desc(b);
304 if ((seg_a ^ seg_b) != 0)
305 goto differ;
306
307
308
309
310
311 level += ASSOC_ARRAY_KEY_CHUNK_SIZE / 8;
312 seg_a = a->desc_len;
313 seg_b = b->desc_len;
314 if ((seg_a ^ seg_b) != 0)
315 goto differ;
316
317
318 level++;
319 seg_a = (unsigned long)a->type;
320 seg_b = (unsigned long)b->type;
321 if ((seg_a ^ seg_b) != 0)
322 goto differ;
323
324 level += sizeof(unsigned long);
325 if (a->desc_len == 0)
326 goto same;
327
328 i = 0;
329 if (((unsigned long)a->description | (unsigned long)b->description) &
330 (sizeof(unsigned long) - 1)) {
331 do {
332 seg_a = *(unsigned long *)(a->description + i);
333 seg_b = *(unsigned long *)(b->description + i);
334 if ((seg_a ^ seg_b) != 0)
335 goto differ_plus_i;
336 i += sizeof(unsigned long);
337 } while (i < (a->desc_len & (sizeof(unsigned long) - 1)));
338 }
339
340 for (; i < a->desc_len; i++) {
341 seg_a = *(unsigned char *)(a->description + i);
342 seg_b = *(unsigned char *)(b->description + i);
343 if ((seg_a ^ seg_b) != 0)
344 goto differ_plus_i;
345 }
346
347same:
348 return -1;
349
350differ_plus_i:
351 level += i;
352differ:
353 i = level * 8 + __ffs(seg_a ^ seg_b);
354 return i;
355}
356
357
358
359
360static void keyring_free_object(void *object)
361{
362 key_put(keyring_ptr_to_key(object));
363}
364
365
366
367
368static const struct assoc_array_ops keyring_assoc_array_ops = {
369 .get_key_chunk = keyring_get_key_chunk,
370 .get_object_key_chunk = keyring_get_object_key_chunk,
371 .compare_object = keyring_compare_object,
372 .diff_objects = keyring_diff_objects,
373 .free_object = keyring_free_object,
374};
375
376
377
378
379
380
381
382
383
384
385static void keyring_destroy(struct key *keyring)
386{
387 if (keyring->description) {
388 write_lock(&keyring_name_lock);
389
390 if (keyring->name_link.next != NULL &&
391 !list_empty(&keyring->name_link))
392 list_del(&keyring->name_link);
393
394 write_unlock(&keyring_name_lock);
395 }
396
397 assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops);
398}
399
400
401
402
403static void keyring_describe(const struct key *keyring, struct seq_file *m)
404{
405 if (keyring->description)
406 seq_puts(m, keyring->description);
407 else
408 seq_puts(m, "[anon]");
409
410 if (key_is_instantiated(keyring)) {
411 if (keyring->keys.nr_leaves_on_tree != 0)
412 seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
413 else
414 seq_puts(m, ": empty");
415 }
416}
417
418struct keyring_read_iterator_context {
419 size_t qty;
420 size_t count;
421 key_serial_t __user *buffer;
422};
423
424static int keyring_read_iterator(const void *object, void *data)
425{
426 struct keyring_read_iterator_context *ctx = data;
427 const struct key *key = keyring_ptr_to_key(object);
428 int ret;
429
430 kenter("{%s,%d},,{%zu/%zu}",
431 key->type->name, key->serial, ctx->count, ctx->qty);
432
433 if (ctx->count >= ctx->qty)
434 return 1;
435
436 ret = put_user(key->serial, ctx->buffer);
437 if (ret < 0)
438 return ret;
439 ctx->buffer++;
440 ctx->count += sizeof(key->serial);
441 return 0;
442}
443
444
445
446
447
448
449
450
451static long keyring_read(const struct key *keyring,
452 char __user *buffer, size_t buflen)
453{
454 struct keyring_read_iterator_context ctx;
455 unsigned long nr_keys;
456 int ret;
457
458 kenter("{%d},,%zu", key_serial(keyring), buflen);
459
460 if (buflen & (sizeof(key_serial_t) - 1))
461 return -EINVAL;
462
463 nr_keys = keyring->keys.nr_leaves_on_tree;
464 if (nr_keys == 0)
465 return 0;
466
467
468 ctx.qty = nr_keys * sizeof(key_serial_t);
469
470 if (!buffer || !buflen)
471 return ctx.qty;
472
473 if (buflen > ctx.qty)
474 ctx.qty = buflen;
475
476
477 ctx.buffer = (key_serial_t __user *)buffer;
478 ctx.count = 0;
479 ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
480 if (ret < 0) {
481 kleave(" = %d [iterate]", ret);
482 return ret;
483 }
484
485 kleave(" = %zu [ok]", ctx.count);
486 return ctx.count;
487}
488
489
490
491
492struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
493 const struct cred *cred, key_perm_t perm,
494 unsigned long flags,
495 int (*restrict_link)(struct key *,
496 const struct key_type *,
497 const union key_payload *),
498 struct key *dest)
499{
500 struct key *keyring;
501 int ret;
502
503 keyring = key_alloc(&key_type_keyring, description,
504 uid, gid, cred, perm, flags, restrict_link);
505 if (!IS_ERR(keyring)) {
506 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
507 if (ret < 0) {
508 key_put(keyring);
509 keyring = ERR_PTR(ret);
510 }
511 }
512
513 return keyring;
514}
515EXPORT_SYMBOL(keyring_alloc);
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530int restrict_link_reject(struct key *keyring,
531 const struct key_type *type,
532 const union key_payload *payload)
533{
534 return -EPERM;
535}
536
537
538
539
540bool key_default_cmp(const struct key *key,
541 const struct key_match_data *match_data)
542{
543 return strcmp(key->description, match_data->raw_data) == 0;
544}
545
546
547
548
549static int keyring_search_iterator(const void *object, void *iterator_data)
550{
551 struct keyring_search_context *ctx = iterator_data;
552 const struct key *key = keyring_ptr_to_key(object);
553 unsigned long kflags = key->flags;
554
555 kenter("{%d}", key->serial);
556
557
558 if (key->type != ctx->index_key.type) {
559 kleave(" = 0 [!type]");
560 return 0;
561 }
562
563
564 if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
565 if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
566 (1 << KEY_FLAG_REVOKED))) {
567 ctx->result = ERR_PTR(-EKEYREVOKED);
568 kleave(" = %d [invrev]", ctx->skipped_ret);
569 goto skipped;
570 }
571
572 if (key->expiry && ctx->now.tv_sec >= key->expiry) {
573 if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))
574 ctx->result = ERR_PTR(-EKEYEXPIRED);
575 kleave(" = %d [expire]", ctx->skipped_ret);
576 goto skipped;
577 }
578 }
579
580
581 if (!ctx->match_data.cmp(key, &ctx->match_data)) {
582 kleave(" = 0 [!match]");
583 return 0;
584 }
585
586
587 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
588 key_task_permission(make_key_ref(key, ctx->possessed),
589 ctx->cred, KEY_NEED_SEARCH) < 0) {
590 ctx->result = ERR_PTR(-EACCES);
591 kleave(" = %d [!perm]", ctx->skipped_ret);
592 goto skipped;
593 }
594
595 if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
596
597 if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
598 smp_rmb();
599 ctx->result = ERR_PTR(key->reject_error);
600 kleave(" = %d [neg]", ctx->skipped_ret);
601 goto skipped;
602 }
603 }
604
605
606 ctx->result = make_key_ref(key, ctx->possessed);
607 kleave(" = 1 [found]");
608 return 1;
609
610skipped:
611 return ctx->skipped_ret;
612}
613
614
615
616
617
618
619static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)
620{
621 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_DIRECT) {
622 const void *object;
623
624 object = assoc_array_find(&keyring->keys,
625 &keyring_assoc_array_ops,
626 &ctx->index_key);
627 return object ? ctx->iterator(object, ctx) : 0;
628 }
629 return assoc_array_iterate(&keyring->keys, ctx->iterator, ctx);
630}
631
632
633
634
635
636static bool search_nested_keyrings(struct key *keyring,
637 struct keyring_search_context *ctx)
638{
639 struct {
640 struct key *keyring;
641 struct assoc_array_node *node;
642 int slot;
643 } stack[KEYRING_SEARCH_MAX_DEPTH];
644
645 struct assoc_array_shortcut *shortcut;
646 struct assoc_array_node *node;
647 struct assoc_array_ptr *ptr;
648 struct key *key;
649 int sp = 0, slot;
650
651 kenter("{%d},{%s,%s}",
652 keyring->serial,
653 ctx->index_key.type->name,
654 ctx->index_key.description);
655
656#define STATE_CHECKS (KEYRING_SEARCH_NO_STATE_CHECK | KEYRING_SEARCH_DO_STATE_CHECK)
657 BUG_ON((ctx->flags & STATE_CHECKS) == 0 ||
658 (ctx->flags & STATE_CHECKS) == STATE_CHECKS);
659
660 if (ctx->index_key.description)
661 ctx->index_key.desc_len = strlen(ctx->index_key.description);
662
663
664
665
666 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_ITERATE ||
667 keyring_compare_object(keyring, &ctx->index_key)) {
668 ctx->skipped_ret = 2;
669 switch (ctx->iterator(keyring_key_to_ptr(keyring), ctx)) {
670 case 1:
671 goto found;
672 case 2:
673 return false;
674 default:
675 break;
676 }
677 }
678
679 ctx->skipped_ret = 0;
680
681
682descend_to_keyring:
683 kdebug("descend to %d", keyring->serial);
684 if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
685 (1 << KEY_FLAG_REVOKED)))
686 goto not_this_keyring;
687
688
689
690
691 if (search_keyring(keyring, ctx))
692 goto found;
693
694
695
696
697
698
699
700
701
702 ptr = ACCESS_ONCE(keyring->keys.root);
703 if (!ptr)
704 goto not_this_keyring;
705
706 if (assoc_array_ptr_is_shortcut(ptr)) {
707
708
709
710
711 shortcut = assoc_array_ptr_to_shortcut(ptr);
712 smp_read_barrier_depends();
713 if ((shortcut->index_key[0] & ASSOC_ARRAY_FAN_MASK) != 0)
714 goto not_this_keyring;
715
716 ptr = ACCESS_ONCE(shortcut->next_node);
717 node = assoc_array_ptr_to_node(ptr);
718 goto begin_node;
719 }
720
721 node = assoc_array_ptr_to_node(ptr);
722 smp_read_barrier_depends();
723
724 ptr = node->slots[0];
725 if (!assoc_array_ptr_is_meta(ptr))
726 goto begin_node;
727
728descend_to_node:
729
730
731
732 kdebug("descend");
733 if (assoc_array_ptr_is_shortcut(ptr)) {
734 shortcut = assoc_array_ptr_to_shortcut(ptr);
735 smp_read_barrier_depends();
736 ptr = ACCESS_ONCE(shortcut->next_node);
737 BUG_ON(!assoc_array_ptr_is_node(ptr));
738 }
739 node = assoc_array_ptr_to_node(ptr);
740
741begin_node:
742 kdebug("begin_node");
743 smp_read_barrier_depends();
744 slot = 0;
745ascend_to_node:
746
747 for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {
748 ptr = ACCESS_ONCE(node->slots[slot]);
749
750 if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)
751 goto descend_to_node;
752
753 if (!keyring_ptr_is_keyring(ptr))
754 continue;
755
756 key = keyring_ptr_to_key(ptr);
757
758 if (sp >= KEYRING_SEARCH_MAX_DEPTH) {
759 if (ctx->flags & KEYRING_SEARCH_DETECT_TOO_DEEP) {
760 ctx->result = ERR_PTR(-ELOOP);
761 return false;
762 }
763 goto not_this_keyring;
764 }
765
766
767 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM) &&
768 key_task_permission(make_key_ref(key, ctx->possessed),
769 ctx->cred, KEY_NEED_SEARCH) < 0)
770 continue;
771
772
773 stack[sp].keyring = keyring;
774 stack[sp].node = node;
775 stack[sp].slot = slot;
776 sp++;
777
778
779 keyring = key;
780 goto descend_to_keyring;
781 }
782
783
784
785
786 ptr = ACCESS_ONCE(node->back_pointer);
787 slot = node->parent_slot;
788
789 if (ptr && assoc_array_ptr_is_shortcut(ptr)) {
790 shortcut = assoc_array_ptr_to_shortcut(ptr);
791 smp_read_barrier_depends();
792 ptr = ACCESS_ONCE(shortcut->back_pointer);
793 slot = shortcut->parent_slot;
794 }
795 if (!ptr)
796 goto not_this_keyring;
797 node = assoc_array_ptr_to_node(ptr);
798 smp_read_barrier_depends();
799 slot++;
800
801
802
803
804
805 if (node->back_pointer) {
806 kdebug("ascend %d", slot);
807 goto ascend_to_node;
808 }
809
810
811
812
813not_this_keyring:
814 kdebug("not_this_keyring %d", sp);
815 if (sp <= 0) {
816 kleave(" = false");
817 return false;
818 }
819
820
821 sp--;
822 keyring = stack[sp].keyring;
823 node = stack[sp].node;
824 slot = stack[sp].slot + 1;
825 kdebug("ascend to %d [%d]", keyring->serial, slot);
826 goto ascend_to_node;
827
828
829found:
830 key = key_ref_to_ptr(ctx->result);
831 key_check(key);
832 if (!(ctx->flags & KEYRING_SEARCH_NO_UPDATE_TIME)) {
833 key->last_used_at = ctx->now.tv_sec;
834 keyring->last_used_at = ctx->now.tv_sec;
835 while (sp > 0)
836 stack[--sp].keyring->last_used_at = ctx->now.tv_sec;
837 }
838 kleave(" = true");
839 return true;
840}
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874key_ref_t keyring_search_aux(key_ref_t keyring_ref,
875 struct keyring_search_context *ctx)
876{
877 struct key *keyring;
878 long err;
879
880 ctx->iterator = keyring_search_iterator;
881 ctx->possessed = is_key_possessed(keyring_ref);
882 ctx->result = ERR_PTR(-EAGAIN);
883
884 keyring = key_ref_to_ptr(keyring_ref);
885 key_check(keyring);
886
887 if (keyring->type != &key_type_keyring)
888 return ERR_PTR(-ENOTDIR);
889
890 if (!(ctx->flags & KEYRING_SEARCH_NO_CHECK_PERM)) {
891 err = key_task_permission(keyring_ref, ctx->cred, KEY_NEED_SEARCH);
892 if (err < 0)
893 return ERR_PTR(err);
894 }
895
896 rcu_read_lock();
897 ctx->now = current_kernel_time();
898 if (search_nested_keyrings(keyring, ctx))
899 __key_get(key_ref_to_ptr(ctx->result));
900 rcu_read_unlock();
901 return ctx->result;
902}
903
904
905
906
907
908
909
910
911
912
913key_ref_t keyring_search(key_ref_t keyring,
914 struct key_type *type,
915 const char *description)
916{
917 struct keyring_search_context ctx = {
918 .index_key.type = type,
919 .index_key.description = description,
920 .cred = current_cred(),
921 .match_data.cmp = key_default_cmp,
922 .match_data.raw_data = description,
923 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
924 .flags = KEYRING_SEARCH_DO_STATE_CHECK,
925 };
926 key_ref_t key;
927 int ret;
928
929 if (type->match_preparse) {
930 ret = type->match_preparse(&ctx.match_data);
931 if (ret < 0)
932 return ERR_PTR(ret);
933 }
934
935 key = keyring_search_aux(keyring, &ctx);
936
937 if (type->match_free)
938 type->match_free(&ctx.match_data);
939 return key;
940}
941EXPORT_SYMBOL(keyring_search);
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957key_ref_t find_key_to_update(key_ref_t keyring_ref,
958 const struct keyring_index_key *index_key)
959{
960 struct key *keyring, *key;
961 const void *object;
962
963 keyring = key_ref_to_ptr(keyring_ref);
964
965 kenter("{%d},{%s,%s}",
966 keyring->serial, index_key->type->name, index_key->description);
967
968 object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops,
969 index_key);
970
971 if (object)
972 goto found;
973
974 kleave(" = NULL");
975 return NULL;
976
977found:
978 key = keyring_ptr_to_key(object);
979 if (key->flags & ((1 << KEY_FLAG_INVALIDATED) |
980 (1 << KEY_FLAG_REVOKED))) {
981 kleave(" = NULL [x]");
982 return NULL;
983 }
984 __key_get(key);
985 kleave(" = {%d}", key->serial);
986 return make_key_ref(key, is_key_possessed(keyring_ref));
987}
988
989
990
991
992
993
994
995
996
997
998
999
1000struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
1001{
1002 struct key *keyring;
1003 int bucket;
1004
1005 if (!name)
1006 return ERR_PTR(-EINVAL);
1007
1008 bucket = keyring_hash(name);
1009
1010 read_lock(&keyring_name_lock);
1011
1012 if (keyring_name_hash[bucket].next) {
1013
1014
1015 list_for_each_entry(keyring,
1016 &keyring_name_hash[bucket],
1017 name_link
1018 ) {
1019 if (!kuid_has_mapping(current_user_ns(), keyring->user->uid))
1020 continue;
1021
1022 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
1023 continue;
1024
1025 if (strcmp(keyring->description, name) != 0)
1026 continue;
1027
1028 if (!skip_perm_check &&
1029 key_permission(make_key_ref(keyring, 0),
1030 KEY_NEED_SEARCH) < 0)
1031 continue;
1032
1033
1034
1035
1036 if (!atomic_inc_not_zero(&keyring->usage))
1037 continue;
1038 keyring->last_used_at = current_kernel_time().tv_sec;
1039 goto out;
1040 }
1041 }
1042
1043 keyring = ERR_PTR(-ENOKEY);
1044out:
1045 read_unlock(&keyring_name_lock);
1046 return keyring;
1047}
1048
1049static int keyring_detect_cycle_iterator(const void *object,
1050 void *iterator_data)
1051{
1052 struct keyring_search_context *ctx = iterator_data;
1053 const struct key *key = keyring_ptr_to_key(object);
1054
1055 kenter("{%d}", key->serial);
1056
1057
1058
1059 if (key != ctx->match_data.raw_data)
1060 return 0;
1061
1062 ctx->result = ERR_PTR(-EDEADLK);
1063 return 1;
1064}
1065
1066
1067
1068
1069
1070
1071
1072
1073static int keyring_detect_cycle(struct key *A, struct key *B)
1074{
1075 struct keyring_search_context ctx = {
1076 .index_key = A->index_key,
1077 .match_data.raw_data = A,
1078 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
1079 .iterator = keyring_detect_cycle_iterator,
1080 .flags = (KEYRING_SEARCH_NO_STATE_CHECK |
1081 KEYRING_SEARCH_NO_UPDATE_TIME |
1082 KEYRING_SEARCH_NO_CHECK_PERM |
1083 KEYRING_SEARCH_DETECT_TOO_DEEP),
1084 };
1085
1086 rcu_read_lock();
1087 search_nested_keyrings(B, &ctx);
1088 rcu_read_unlock();
1089 return PTR_ERR(ctx.result) == -EAGAIN ? 0 : PTR_ERR(ctx.result);
1090}
1091
1092
1093
1094
1095int __key_link_begin(struct key *keyring,
1096 const struct keyring_index_key *index_key,
1097 struct assoc_array_edit **_edit)
1098 __acquires(&keyring->sem)
1099 __acquires(&keyring_serialise_link_sem)
1100{
1101 struct assoc_array_edit *edit;
1102 int ret;
1103
1104 kenter("%d,%s,%s,",
1105 keyring->serial, index_key->type->name, index_key->description);
1106
1107 BUG_ON(index_key->desc_len == 0);
1108
1109 if (keyring->type != &key_type_keyring)
1110 return -ENOTDIR;
1111
1112 down_write(&keyring->sem);
1113
1114 ret = -EKEYREVOKED;
1115 if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
1116 goto error_krsem;
1117
1118
1119
1120 if (index_key->type == &key_type_keyring)
1121 down_write(&keyring_serialise_link_sem);
1122
1123
1124
1125
1126 edit = assoc_array_insert(&keyring->keys,
1127 &keyring_assoc_array_ops,
1128 index_key,
1129 NULL);
1130 if (IS_ERR(edit)) {
1131 ret = PTR_ERR(edit);
1132 goto error_sem;
1133 }
1134
1135
1136
1137
1138 if (!edit->dead_leaf) {
1139 ret = key_payload_reserve(keyring,
1140 keyring->datalen + KEYQUOTA_LINK_BYTES);
1141 if (ret < 0)
1142 goto error_cancel;
1143 }
1144
1145 *_edit = edit;
1146 kleave(" = 0");
1147 return 0;
1148
1149error_cancel:
1150 assoc_array_cancel_edit(edit);
1151error_sem:
1152 if (index_key->type == &key_type_keyring)
1153 up_write(&keyring_serialise_link_sem);
1154error_krsem:
1155 up_write(&keyring->sem);
1156 kleave(" = %d", ret);
1157 return ret;
1158}
1159
1160
1161
1162
1163
1164
1165
1166int __key_link_check_live_key(struct key *keyring, struct key *key)
1167{
1168 if (key->type == &key_type_keyring)
1169
1170
1171 return keyring_detect_cycle(keyring, key);
1172 return 0;
1173}
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183void __key_link(struct key *key, struct assoc_array_edit **_edit)
1184{
1185 __key_get(key);
1186 assoc_array_insert_set_object(*_edit, keyring_key_to_ptr(key));
1187 assoc_array_apply_edit(*_edit);
1188 *_edit = NULL;
1189}
1190
1191
1192
1193
1194
1195
1196void __key_link_end(struct key *keyring,
1197 const struct keyring_index_key *index_key,
1198 struct assoc_array_edit *edit)
1199 __releases(&keyring->sem)
1200 __releases(&keyring_serialise_link_sem)
1201{
1202 BUG_ON(index_key->type == NULL);
1203 kenter("%d,%s,", keyring->serial, index_key->type->name);
1204
1205 if (index_key->type == &key_type_keyring)
1206 up_write(&keyring_serialise_link_sem);
1207
1208 if (edit) {
1209 if (!edit->dead_leaf) {
1210 key_payload_reserve(keyring,
1211 keyring->datalen - KEYQUOTA_LINK_BYTES);
1212 }
1213 assoc_array_cancel_edit(edit);
1214 }
1215 up_write(&keyring->sem);
1216}
1217
1218
1219
1220
1221static int __key_link_check_restriction(struct key *keyring, struct key *key)
1222{
1223 if (!keyring->restrict_link)
1224 return 0;
1225 return keyring->restrict_link(keyring, key->type, &key->payload);
1226}
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248int key_link(struct key *keyring, struct key *key)
1249{
1250 struct assoc_array_edit *edit;
1251 int ret;
1252
1253 kenter("{%d,%d}", keyring->serial, atomic_read(&keyring->usage));
1254
1255 key_check(keyring);
1256 key_check(key);
1257
1258 ret = __key_link_begin(keyring, &key->index_key, &edit);
1259 if (ret == 0) {
1260 kdebug("begun {%d,%d}", keyring->serial, atomic_read(&keyring->usage));
1261 ret = __key_link_check_restriction(keyring, key);
1262 if (ret == 0)
1263 ret = __key_link_check_live_key(keyring, key);
1264 if (ret == 0)
1265 __key_link(key, &edit);
1266 __key_link_end(keyring, &key->index_key, edit);
1267 }
1268
1269 kleave(" = %d {%d,%d}", ret, keyring->serial, atomic_read(&keyring->usage));
1270 return ret;
1271}
1272EXPORT_SYMBOL(key_link);
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291int key_unlink(struct key *keyring, struct key *key)
1292{
1293 struct assoc_array_edit *edit;
1294 int ret;
1295
1296 key_check(keyring);
1297 key_check(key);
1298
1299 if (keyring->type != &key_type_keyring)
1300 return -ENOTDIR;
1301
1302 down_write(&keyring->sem);
1303
1304 edit = assoc_array_delete(&keyring->keys, &keyring_assoc_array_ops,
1305 &key->index_key);
1306 if (IS_ERR(edit)) {
1307 ret = PTR_ERR(edit);
1308 goto error;
1309 }
1310 ret = -ENOENT;
1311 if (edit == NULL)
1312 goto error;
1313
1314 assoc_array_apply_edit(edit);
1315 key_payload_reserve(keyring, keyring->datalen - KEYQUOTA_LINK_BYTES);
1316 ret = 0;
1317
1318error:
1319 up_write(&keyring->sem);
1320 return ret;
1321}
1322EXPORT_SYMBOL(key_unlink);
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332int keyring_clear(struct key *keyring)
1333{
1334 struct assoc_array_edit *edit;
1335 int ret;
1336
1337 if (keyring->type != &key_type_keyring)
1338 return -ENOTDIR;
1339
1340 down_write(&keyring->sem);
1341
1342 edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
1343 if (IS_ERR(edit)) {
1344 ret = PTR_ERR(edit);
1345 } else {
1346 if (edit)
1347 assoc_array_apply_edit(edit);
1348 key_payload_reserve(keyring, 0);
1349 ret = 0;
1350 }
1351
1352 up_write(&keyring->sem);
1353 return ret;
1354}
1355EXPORT_SYMBOL(keyring_clear);
1356
1357
1358
1359
1360
1361
1362static void keyring_revoke(struct key *keyring)
1363{
1364 struct assoc_array_edit *edit;
1365
1366 edit = assoc_array_clear(&keyring->keys, &keyring_assoc_array_ops);
1367 if (!IS_ERR(edit)) {
1368 if (edit)
1369 assoc_array_apply_edit(edit);
1370 key_payload_reserve(keyring, 0);
1371 }
1372}
1373
1374static bool keyring_gc_select_iterator(void *object, void *iterator_data)
1375{
1376 struct key *key = keyring_ptr_to_key(object);
1377 time_t *limit = iterator_data;
1378
1379 if (key_is_dead(key, *limit))
1380 return false;
1381 key_get(key);
1382 return true;
1383}
1384
1385static int keyring_gc_check_iterator(const void *object, void *iterator_data)
1386{
1387 const struct key *key = keyring_ptr_to_key(object);
1388 time_t *limit = iterator_data;
1389
1390 key_check(key);
1391 return key_is_dead(key, *limit);
1392}
1393
1394
1395
1396
1397
1398
1399
1400void keyring_gc(struct key *keyring, time_t limit)
1401{
1402 int result;
1403
1404 kenter("%x{%s}", keyring->serial, keyring->description ?: "");
1405
1406 if (keyring->flags & ((1 << KEY_FLAG_INVALIDATED) |
1407 (1 << KEY_FLAG_REVOKED)))
1408 goto dont_gc;
1409
1410
1411 rcu_read_lock();
1412 result = assoc_array_iterate(&keyring->keys,
1413 keyring_gc_check_iterator, &limit);
1414 rcu_read_unlock();
1415 if (result == true)
1416 goto do_gc;
1417
1418dont_gc:
1419 kleave(" [no gc]");
1420 return;
1421
1422do_gc:
1423 down_write(&keyring->sem);
1424 assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops,
1425 keyring_gc_select_iterator, &limit);
1426 up_write(&keyring->sem);
1427 kleave(" [gc]");
1428}
1429