1 /* Management of a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/slab.h>
16 #include <linux/keyctl.h>
18 #include <linux/err.h>
19 #include <linux/mutex.h>
20 #include <linux/security.h>
21 #include <linux/user_namespace.h>
22 #include <asm/uaccess.h>
25 /* session keyring create vs join semaphore */
26 static DEFINE_MUTEX(key_session_mutex);
28 /* user keyring creation semaphore */
29 static DEFINE_MUTEX(key_user_keyring_mutex);
31 /* the root user's tracking struct */
32 struct key_user root_key_user = {
33 .usage = ATOMIC_INIT(3),
34 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
35 .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
36 .nkeys = ATOMIC_INIT(2),
37 .nikeys = ATOMIC_INIT(2),
39 .user_ns = &init_user_ns,
42 /*****************************************************************************/
44 * install user and user session keyrings for a particular UID
46 int install_user_keyrings(void)
48 struct user_struct *user;
49 const struct cred *cred;
50 struct key *uid_keyring, *session_keyring;
54 cred = current_cred();
57 kenter("%p{%u}", user, user->uid);
59 if (user->uid_keyring) {
60 kleave(" = 0 [exist]");
64 mutex_lock(&key_user_keyring_mutex);
67 if (!user->uid_keyring) {
68 /* get the UID-specific keyring
69 * - there may be one in existence already as it may have been
70 * pinned by a session, but the user_struct pointing to it
71 * may have been destroyed by setuid */
72 sprintf(buf, "_uid.%u", user->uid);
74 uid_keyring = find_keyring_by_name(buf, true);
75 if (IS_ERR(uid_keyring)) {
76 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
77 cred, KEY_ALLOC_IN_QUOTA,
79 if (IS_ERR(uid_keyring)) {
80 ret = PTR_ERR(uid_keyring);
85 /* get a default session keyring (which might also exist
87 sprintf(buf, "_uid_ses.%u", user->uid);
89 session_keyring = find_keyring_by_name(buf, true);
90 if (IS_ERR(session_keyring)) {
92 keyring_alloc(buf, user->uid, (gid_t) -1,
93 cred, KEY_ALLOC_IN_QUOTA, NULL);
94 if (IS_ERR(session_keyring)) {
95 ret = PTR_ERR(session_keyring);
99 /* we install a link from the user session keyring to
100 * the user keyring */
101 ret = key_link(session_keyring, uid_keyring);
103 goto error_release_both;
106 /* install the keyrings */
107 user->uid_keyring = uid_keyring;
108 user->session_keyring = session_keyring;
111 mutex_unlock(&key_user_keyring_mutex);
116 key_put(session_keyring);
118 key_put(uid_keyring);
120 mutex_unlock(&key_user_keyring_mutex);
121 kleave(" = %d", ret);
126 * install a fresh thread keyring directly to new credentials
128 int install_thread_keyring_to_cred(struct cred *new)
132 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
133 KEY_ALLOC_QUOTA_OVERRUN, NULL);
135 return PTR_ERR(keyring);
137 new->thread_keyring = keyring;
142 * install a fresh thread keyring, discarding the old one
144 static int install_thread_keyring(void)
149 new = prepare_creds();
153 BUG_ON(new->thread_keyring);
155 ret = install_thread_keyring_to_cred(new);
161 return commit_creds(new);
165 * install a process keyring directly to a credentials struct
166 * - returns -EEXIST if there was already a process keyring, 0 if one installed,
167 * and other -ve on any other error
169 int install_process_keyring_to_cred(struct cred *new)
174 if (new->tgcred->process_keyring)
177 keyring = keyring_alloc("_pid", new->uid, new->gid,
178 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
180 return PTR_ERR(keyring);
182 spin_lock_irq(&new->tgcred->lock);
183 if (!new->tgcred->process_keyring) {
184 new->tgcred->process_keyring = keyring;
190 spin_unlock_irq(&new->tgcred->lock);
196 * make sure a process keyring is installed
199 static int install_process_keyring(void)
204 new = prepare_creds();
208 ret = install_process_keyring_to_cred(new);
211 return ret != -EEXIST ?: 0;
214 return commit_creds(new);
218 * install a session keyring directly to a credentials struct
220 static int install_session_keyring_to_cred(struct cred *cred,
228 /* create an empty session keyring */
230 flags = KEY_ALLOC_QUOTA_OVERRUN;
231 if (cred->tgcred->session_keyring)
232 flags = KEY_ALLOC_IN_QUOTA;
234 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
237 return PTR_ERR(keyring);
239 atomic_inc(&keyring->usage);
242 /* install the keyring */
243 spin_lock_irq(&cred->tgcred->lock);
244 old = cred->tgcred->session_keyring;
245 rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
246 spin_unlock_irq(&cred->tgcred->lock);
248 /* we're using RCU on the pointer, but there's no point synchronising
249 * on it if it didn't previously point to anything */
259 * install a session keyring, discarding the old one
260 * - if a keyring is not supplied, an empty one is invented
262 static int install_session_keyring(struct key *keyring)
267 new = prepare_creds();
271 ret = install_session_keyring_to_cred(new, NULL);
277 return commit_creds(new);
280 /*****************************************************************************/
282 * the filesystem user ID changed
284 void key_fsuid_changed(struct task_struct *tsk)
286 /* update the ownership of the thread keyring */
288 if (tsk->cred->thread_keyring) {
289 down_write(&tsk->cred->thread_keyring->sem);
290 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
291 up_write(&tsk->cred->thread_keyring->sem);
294 } /* end key_fsuid_changed() */
296 /*****************************************************************************/
298 * the filesystem group ID changed
300 void key_fsgid_changed(struct task_struct *tsk)
302 /* update the ownership of the thread keyring */
304 if (tsk->cred->thread_keyring) {
305 down_write(&tsk->cred->thread_keyring->sem);
306 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
307 up_write(&tsk->cred->thread_keyring->sem);
310 } /* end key_fsgid_changed() */
312 /*****************************************************************************/
314 * search the process keyrings for the first matching key
315 * - we use the supplied match function to see if the description (or other
316 * feature of interest) matches
317 * - we return -EAGAIN if we didn't find any matching key
318 * - we return -ENOKEY if we found only negative matching keys
320 key_ref_t search_process_keyrings(struct key_type *type,
321 const void *description,
322 key_match_func_t match,
323 const struct cred *cred)
325 struct request_key_auth *rka;
326 key_ref_t key_ref, ret, err;
330 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
331 * searchable, but we failed to find a key or we found a negative key;
332 * otherwise we want to return a sample error (probably -EACCES) if
333 * none of the keyrings were searchable
335 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
339 err = ERR_PTR(-EAGAIN);
341 /* search the thread keyring first */
342 if (cred->thread_keyring) {
343 key_ref = keyring_search_aux(
344 make_key_ref(cred->thread_keyring, 1),
345 cred, type, description, match);
346 if (!IS_ERR(key_ref))
349 switch (PTR_ERR(key_ref)) {
350 case -EAGAIN: /* no key */
353 case -ENOKEY: /* negative key */
362 /* search the process keyring second */
363 if (cred->tgcred->process_keyring) {
364 key_ref = keyring_search_aux(
365 make_key_ref(cred->tgcred->process_keyring, 1),
366 cred, type, description, match);
367 if (!IS_ERR(key_ref))
370 switch (PTR_ERR(key_ref)) {
371 case -EAGAIN: /* no key */
374 case -ENOKEY: /* negative key */
383 /* search the session keyring */
384 if (cred->tgcred->session_keyring) {
386 key_ref = keyring_search_aux(
387 make_key_ref(rcu_dereference(
388 cred->tgcred->session_keyring),
390 cred, type, description, match);
393 if (!IS_ERR(key_ref))
396 switch (PTR_ERR(key_ref)) {
397 case -EAGAIN: /* no key */
400 case -ENOKEY: /* negative key */
408 /* or search the user-session keyring */
409 else if (cred->user->session_keyring) {
410 key_ref = keyring_search_aux(
411 make_key_ref(cred->user->session_keyring, 1),
412 cred, type, description, match);
413 if (!IS_ERR(key_ref))
416 switch (PTR_ERR(key_ref)) {
417 case -EAGAIN: /* no key */
420 case -ENOKEY: /* negative key */
429 /* if this process has an instantiation authorisation key, then we also
430 * search the keyrings of the process mentioned there
431 * - we don't permit access to request_key auth keys via this method
433 if (cred->request_key_auth &&
434 cred == current_cred() &&
435 type != &key_type_request_key_auth
437 /* defend against the auth key being revoked */
438 down_read(&cred->request_key_auth->sem);
440 if (key_validate(cred->request_key_auth) == 0) {
441 rka = cred->request_key_auth->payload.data;
443 key_ref = search_process_keyrings(type, description,
446 up_read(&cred->request_key_auth->sem);
448 if (!IS_ERR(key_ref))
451 switch (PTR_ERR(key_ref)) {
452 case -EAGAIN: /* no key */
455 case -ENOKEY: /* negative key */
463 up_read(&cred->request_key_auth->sem);
467 /* no key - decide on the error we're going to go for */
468 key_ref = ret ? ret : err;
473 } /* end search_process_keyrings() */
475 /*****************************************************************************/
477 * see if the key we're looking at is the target key
479 static int lookup_user_key_possessed(const struct key *key, const void *target)
481 return key == target;
483 } /* end lookup_user_key_possessed() */
485 /*****************************************************************************/
487 * lookup a key given a key ID from userspace with a given permissions mask
488 * - don't create special keyrings unless so requested
489 * - partially constructed keys aren't found unless requested
491 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
494 struct request_key_auth *rka;
495 const struct cred *cred;
497 key_ref_t key_ref, skey_ref;
501 cred = get_current_cred();
502 key_ref = ERR_PTR(-ENOKEY);
505 case KEY_SPEC_THREAD_KEYRING:
506 if (!cred->thread_keyring) {
507 if (!(lflags & KEY_LOOKUP_CREATE))
510 ret = install_thread_keyring();
518 key = cred->thread_keyring;
519 atomic_inc(&key->usage);
520 key_ref = make_key_ref(key, 1);
523 case KEY_SPEC_PROCESS_KEYRING:
524 if (!cred->tgcred->process_keyring) {
525 if (!(lflags & KEY_LOOKUP_CREATE))
528 ret = install_process_keyring();
536 key = cred->tgcred->process_keyring;
537 atomic_inc(&key->usage);
538 key_ref = make_key_ref(key, 1);
541 case KEY_SPEC_SESSION_KEYRING:
542 if (!cred->tgcred->session_keyring) {
543 /* always install a session keyring upon access if one
544 * doesn't exist yet */
545 ret = install_user_keyrings();
548 ret = install_session_keyring(
549 cred->user->session_keyring);
557 key = rcu_dereference(cred->tgcred->session_keyring);
558 atomic_inc(&key->usage);
560 key_ref = make_key_ref(key, 1);
563 case KEY_SPEC_USER_KEYRING:
564 if (!cred->user->uid_keyring) {
565 ret = install_user_keyrings();
570 key = cred->user->uid_keyring;
571 atomic_inc(&key->usage);
572 key_ref = make_key_ref(key, 1);
575 case KEY_SPEC_USER_SESSION_KEYRING:
576 if (!cred->user->session_keyring) {
577 ret = install_user_keyrings();
582 key = cred->user->session_keyring;
583 atomic_inc(&key->usage);
584 key_ref = make_key_ref(key, 1);
587 case KEY_SPEC_GROUP_KEYRING:
588 /* group keyrings are not yet supported */
589 key = ERR_PTR(-EINVAL);
592 case KEY_SPEC_REQKEY_AUTH_KEY:
593 key = cred->request_key_auth;
597 atomic_inc(&key->usage);
598 key_ref = make_key_ref(key, 1);
601 case KEY_SPEC_REQUESTOR_KEYRING:
602 if (!cred->request_key_auth)
605 down_read(&cred->request_key_auth->sem);
606 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
607 key_ref = ERR_PTR(-EKEYREVOKED);
610 rka = cred->request_key_auth->payload.data;
611 key = rka->dest_keyring;
612 atomic_inc(&key->usage);
614 up_read(&cred->request_key_auth->sem);
617 key_ref = make_key_ref(key, 1);
621 key_ref = ERR_PTR(-EINVAL);
625 key = key_lookup(id);
627 key_ref = ERR_CAST(key);
631 key_ref = make_key_ref(key, 0);
633 /* check to see if we possess the key */
634 skey_ref = search_process_keyrings(key->type, key,
635 lookup_user_key_possessed,
638 if (!IS_ERR(skey_ref)) {
646 /* unlink does not use the nominated key in any way, so can skip all
647 * the permission checks as it is only concerned with the keyring */
648 if (lflags & KEY_LOOKUP_FOR_UNLINK) {
653 if (!(lflags & KEY_LOOKUP_PARTIAL)) {
654 ret = wait_for_key_construction(key, true);
665 ret = key_validate(key);
671 if (!(lflags & KEY_LOOKUP_PARTIAL) &&
672 !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
675 /* check the permissions */
676 ret = key_task_permission(key_ref, cred, perm);
685 key_ref_put(key_ref);
686 key_ref = ERR_PTR(ret);
689 /* if we attempted to install a keyring, then it may have caused new
690 * creds to be installed */
695 } /* end lookup_user_key() */
697 /*****************************************************************************/
699 * join the named keyring as the session keyring if possible, or attempt to
700 * create a new one of that name if not
701 * - if the name is NULL, an empty anonymous keyring is installed instead
702 * - named session keyring joining is done with a semaphore held
704 long join_session_keyring(const char *name)
706 const struct cred *old;
711 /* only permit this if there's a single thread in the thread group -
712 * this avoids us having to adjust the creds on all threads and risking
714 if (!current_is_single_threaded())
717 new = prepare_creds();
720 old = current_cred();
722 /* if no name is provided, install an anonymous keyring */
724 ret = install_session_keyring_to_cred(new, NULL);
728 serial = new->tgcred->session_keyring->serial;
729 ret = commit_creds(new);
735 /* allow the user to join or create a named keyring */
736 mutex_lock(&key_session_mutex);
738 /* look for an existing keyring of this name */
739 keyring = find_keyring_by_name(name, false);
740 if (PTR_ERR(keyring) == -ENOKEY) {
741 /* not found - try and create a new one */
742 keyring = keyring_alloc(name, old->uid, old->gid, old,
743 KEY_ALLOC_IN_QUOTA, NULL);
744 if (IS_ERR(keyring)) {
745 ret = PTR_ERR(keyring);
748 } else if (IS_ERR(keyring)) {
749 ret = PTR_ERR(keyring);
753 /* we've got a keyring - now to install it */
754 ret = install_session_keyring_to_cred(new, keyring);
759 mutex_unlock(&key_session_mutex);
761 ret = keyring->serial;
767 mutex_unlock(&key_session_mutex);
774 * Replace a process's session keyring when that process resumes userspace on
775 * behalf of one of its children
777 void key_replace_session_keyring(void)
779 const struct cred *old;
782 if (!current->replacement_session_keyring)
785 write_lock_irq(&tasklist_lock);
786 new = current->replacement_session_keyring;
787 current->replacement_session_keyring = NULL;
788 write_unlock_irq(&tasklist_lock);
793 old = current_cred();
794 new-> uid = old-> uid;
795 new-> euid = old-> euid;
796 new-> suid = old-> suid;
797 new->fsuid = old->fsuid;
798 new-> gid = old-> gid;
799 new-> egid = old-> egid;
800 new-> sgid = old-> sgid;
801 new->fsgid = old->fsgid;
802 new->user = get_uid(old->user);
803 new->group_info = get_group_info(old->group_info);
805 new->securebits = old->securebits;
806 new->cap_inheritable = old->cap_inheritable;
807 new->cap_permitted = old->cap_permitted;
808 new->cap_effective = old->cap_effective;
809 new->cap_bset = old->cap_bset;
811 new->jit_keyring = old->jit_keyring;
812 new->thread_keyring = key_get(old->thread_keyring);
813 new->tgcred->tgid = old->tgcred->tgid;
814 new->tgcred->process_keyring = key_get(old->tgcred->process_keyring);
816 security_transfer_creds(new, old);