1 /* Manage a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/keyctl.h>
17 #include <linux/err.h>
18 #include <linux/mutex.h>
19 #include <linux/security.h>
20 #include <linux/user_namespace.h>
21 #include <asm/uaccess.h>
24 /* Session keyring create vs join semaphore */
25 static DEFINE_MUTEX(key_session_mutex
);
27 /* User keyring creation semaphore */
28 static DEFINE_MUTEX(key_user_keyring_mutex
);
30 /* The root user's tracking struct */
31 struct key_user root_key_user
= {
32 .usage
= ATOMIC_INIT(3),
33 .cons_lock
= __MUTEX_INITIALIZER(root_key_user
.cons_lock
),
34 .lock
= __SPIN_LOCK_UNLOCKED(root_key_user
.lock
),
35 .nkeys
= ATOMIC_INIT(2),
36 .nikeys
= ATOMIC_INIT(2),
37 .uid
= GLOBAL_ROOT_UID
,
41 * Install the user and user session keyrings for the current process's UID.
43 int install_user_keyrings(void)
45 struct user_struct
*user
;
46 const struct cred
*cred
;
47 struct key
*uid_keyring
, *session_keyring
;
48 key_perm_t user_keyring_perm
;
53 user_keyring_perm
= (KEY_POS_ALL
& ~KEY_POS_SETATTR
) | KEY_USR_ALL
;
54 cred
= current_cred();
56 uid
= from_kuid(cred
->user_ns
, user
->uid
);
58 kenter("%p{%u}", user
, uid
);
60 if (user
->uid_keyring
&& user
->session_keyring
) {
61 kleave(" = 0 [exist]");
65 mutex_lock(&key_user_keyring_mutex
);
68 if (!user
->uid_keyring
) {
69 /* get the UID-specific keyring
70 * - there may be one in existence already as it may have been
71 * pinned by a session, but the user_struct pointing to it
72 * may have been destroyed by setuid */
73 sprintf(buf
, "_uid.%u", uid
);
75 uid_keyring
= find_keyring_by_name(buf
, true);
76 if (IS_ERR(uid_keyring
)) {
77 uid_keyring
= keyring_alloc(buf
, user
->uid
, INVALID_GID
,
78 cred
, user_keyring_perm
,
79 KEY_ALLOC_IN_QUOTA
, NULL
);
80 if (IS_ERR(uid_keyring
)) {
81 ret
= PTR_ERR(uid_keyring
);
86 /* get a default session keyring (which might also exist
88 sprintf(buf
, "_uid_ses.%u", uid
);
90 session_keyring
= find_keyring_by_name(buf
, true);
91 if (IS_ERR(session_keyring
)) {
93 keyring_alloc(buf
, user
->uid
, INVALID_GID
,
94 cred
, user_keyring_perm
,
95 KEY_ALLOC_IN_QUOTA
, NULL
);
96 if (IS_ERR(session_keyring
)) {
97 ret
= PTR_ERR(session_keyring
);
101 /* we install a link from the user session keyring to
102 * the user keyring */
103 ret
= key_link(session_keyring
, uid_keyring
);
105 goto error_release_both
;
108 /* install the keyrings */
109 user
->uid_keyring
= uid_keyring
;
110 user
->session_keyring
= session_keyring
;
113 mutex_unlock(&key_user_keyring_mutex
);
118 key_put(session_keyring
);
120 key_put(uid_keyring
);
122 mutex_unlock(&key_user_keyring_mutex
);
123 kleave(" = %d", ret
);
128 * Install a thread keyring to the given credentials struct if it didn't have
129 * one already. This is allowed to overrun the quota.
131 * Return: 0 if a thread keyring is now present; -errno on failure.
133 int install_thread_keyring_to_cred(struct cred
*new)
137 if (new->thread_keyring
)
140 keyring
= keyring_alloc("_tid", new->uid
, new->gid
, new,
141 KEY_POS_ALL
| KEY_USR_VIEW
,
142 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
144 return PTR_ERR(keyring
);
146 new->thread_keyring
= keyring
;
151 * Install a thread keyring to the current task if it didn't have one already.
153 * Return: 0 if a thread keyring is now present; -errno on failure.
155 static int install_thread_keyring(void)
160 new = prepare_creds();
164 ret
= install_thread_keyring_to_cred(new);
170 return commit_creds(new);
174 * Install a process keyring to the given credentials struct if it didn't have
175 * one already. This is allowed to overrun the quota.
177 * Return: 0 if a process keyring is now present; -errno on failure.
179 int install_process_keyring_to_cred(struct cred
*new)
183 if (new->process_keyring
)
186 keyring
= keyring_alloc("_pid", new->uid
, new->gid
, new,
187 KEY_POS_ALL
| KEY_USR_VIEW
,
188 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
190 return PTR_ERR(keyring
);
192 new->process_keyring
= keyring
;
197 * Install a process keyring to the current task if it didn't have one already.
199 * Return: 0 if a process keyring is now present; -errno on failure.
201 static int install_process_keyring(void)
206 new = prepare_creds();
210 ret
= install_process_keyring_to_cred(new);
216 return commit_creds(new);
220 * Install the given keyring as the session keyring of the given credentials
221 * struct, replacing the existing one if any. If the given keyring is NULL,
222 * then install a new anonymous session keyring.
224 * Return: 0 on success; -errno on failure.
226 int install_session_keyring_to_cred(struct cred
*cred
, struct key
*keyring
)
233 /* create an empty session keyring */
235 flags
= KEY_ALLOC_QUOTA_OVERRUN
;
236 if (cred
->session_keyring
)
237 flags
= KEY_ALLOC_IN_QUOTA
;
239 keyring
= keyring_alloc("_ses", cred
->uid
, cred
->gid
, cred
,
240 KEY_POS_ALL
| KEY_USR_VIEW
| KEY_USR_READ
,
243 return PTR_ERR(keyring
);
245 atomic_inc(&keyring
->usage
);
248 /* install the keyring */
249 old
= cred
->session_keyring
;
250 rcu_assign_pointer(cred
->session_keyring
, keyring
);
259 * Install the given keyring as the session keyring of the current task,
260 * replacing the existing one if any. If the given keyring is NULL, then
261 * install a new anonymous session keyring.
263 * Return: 0 on success; -errno on failure.
265 static int install_session_keyring(struct key
*keyring
)
270 new = prepare_creds();
274 ret
= install_session_keyring_to_cred(new, keyring
);
280 return commit_creds(new);
284 * Handle the fsuid changing.
286 void key_fsuid_changed(struct task_struct
*tsk
)
288 /* update the ownership of the thread keyring */
290 if (tsk
->cred
->thread_keyring
) {
291 down_write(&tsk
->cred
->thread_keyring
->sem
);
292 tsk
->cred
->thread_keyring
->uid
= tsk
->cred
->fsuid
;
293 up_write(&tsk
->cred
->thread_keyring
->sem
);
298 * Handle the fsgid changing.
300 void key_fsgid_changed(struct task_struct
*tsk
)
302 /* update the ownership of the thread keyring */
304 if (tsk
->cred
->thread_keyring
) {
305 down_write(&tsk
->cred
->thread_keyring
->sem
);
306 tsk
->cred
->thread_keyring
->gid
= tsk
->cred
->fsgid
;
307 up_write(&tsk
->cred
->thread_keyring
->sem
);
312 * Search the process keyrings attached to the supplied cred for the first
315 * The search criteria are the type and the match function. The description is
316 * given to the match function as a parameter, but doesn't otherwise influence
317 * the search. Typically the match function will compare the description
318 * parameter to the key's description.
320 * This can only search keyrings that grant Search permission to the supplied
321 * credentials. Keyrings linked to searched keyrings will also be searched if
322 * they grant Search permission too. Keys can only be found if they grant
323 * Search permission to the credentials.
325 * Returns a pointer to the key with the key usage count incremented if
326 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
327 * matched negative keys.
329 * In the case of a successful return, the possession attribute is set on the
330 * returned key reference.
332 key_ref_t
search_my_process_keyrings(struct key_type
*type
,
333 const void *description
,
334 key_match_func_t match
,
336 const struct cred
*cred
)
338 key_ref_t key_ref
, ret
, err
;
340 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
341 * searchable, but we failed to find a key or we found a negative key;
342 * otherwise we want to return a sample error (probably -EACCES) if
343 * none of the keyrings were searchable
345 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
349 err
= ERR_PTR(-EAGAIN
);
351 /* search the thread keyring first */
352 if (cred
->thread_keyring
) {
353 key_ref
= keyring_search_aux(
354 make_key_ref(cred
->thread_keyring
, 1),
355 cred
, type
, description
, match
, no_state_check
);
356 if (!IS_ERR(key_ref
))
359 switch (PTR_ERR(key_ref
)) {
360 case -EAGAIN
: /* no key */
361 case -ENOKEY
: /* negative key */
370 /* search the process keyring second */
371 if (cred
->process_keyring
) {
372 key_ref
= keyring_search_aux(
373 make_key_ref(cred
->process_keyring
, 1),
374 cred
, type
, description
, match
, no_state_check
);
375 if (!IS_ERR(key_ref
))
378 switch (PTR_ERR(key_ref
)) {
379 case -EAGAIN
: /* no key */
382 case -ENOKEY
: /* negative key */
391 /* search the session keyring */
392 if (cred
->session_keyring
) {
394 key_ref
= keyring_search_aux(
395 make_key_ref(rcu_dereference(cred
->session_keyring
), 1),
396 cred
, type
, description
, match
, no_state_check
);
399 if (!IS_ERR(key_ref
))
402 switch (PTR_ERR(key_ref
)) {
403 case -EAGAIN
: /* no key */
406 case -ENOKEY
: /* negative key */
414 /* or search the user-session keyring */
415 else if (cred
->user
->session_keyring
) {
416 key_ref
= keyring_search_aux(
417 make_key_ref(cred
->user
->session_keyring
, 1),
418 cred
, type
, description
, match
, no_state_check
);
419 if (!IS_ERR(key_ref
))
422 switch (PTR_ERR(key_ref
)) {
423 case -EAGAIN
: /* no key */
426 case -ENOKEY
: /* negative key */
435 /* no key - decide on the error we're going to go for */
436 key_ref
= ret
? ret
: err
;
443 * Search the process keyrings attached to the supplied cred for the first
444 * matching key in the manner of search_my_process_keyrings(), but also search
445 * the keys attached to the assumed authorisation key using its credentials if
448 * Return same as search_my_process_keyrings().
450 key_ref_t
search_process_keyrings(struct key_type
*type
,
451 const void *description
,
452 key_match_func_t match
,
453 const struct cred
*cred
)
455 struct request_key_auth
*rka
;
456 key_ref_t key_ref
, ret
= ERR_PTR(-EACCES
), err
;
460 key_ref
= search_my_process_keyrings(type
, description
, match
,
462 if (!IS_ERR(key_ref
))
466 /* if this process has an instantiation authorisation key, then we also
467 * search the keyrings of the process mentioned there
468 * - we don't permit access to request_key auth keys via this method
470 if (cred
->request_key_auth
&&
471 cred
== current_cred() &&
472 type
!= &key_type_request_key_auth
474 /* defend against the auth key being revoked */
475 down_read(&cred
->request_key_auth
->sem
);
477 if (key_validate(cred
->request_key_auth
) == 0) {
478 rka
= cred
->request_key_auth
->payload
.data
;
480 key_ref
= search_process_keyrings(type
, description
,
483 up_read(&cred
->request_key_auth
->sem
);
485 if (!IS_ERR(key_ref
))
490 up_read(&cred
->request_key_auth
->sem
);
494 /* no key - decide on the error we're going to go for */
495 if (err
== ERR_PTR(-ENOKEY
) || ret
== ERR_PTR(-ENOKEY
))
496 key_ref
= ERR_PTR(-ENOKEY
);
497 else if (err
== ERR_PTR(-EACCES
))
507 * See if the key we're looking at is the target key.
509 int lookup_user_key_possessed(const struct key
*key
, const void *target
)
511 return key
== target
;
515 * Look up a key ID given us by userspace with a given permissions mask to get
516 * the key it refers to.
518 * Flags can be passed to request that special keyrings be created if referred
519 * to directly, to permit partially constructed keys to be found and to skip
520 * validity and permission checks on the found key.
522 * Returns a pointer to the key with an incremented usage count if successful;
523 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
524 * to a key or the best found key was a negative key; -EKEYREVOKED or
525 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
526 * found key doesn't grant the requested permit or the LSM denied access to it;
527 * or -ENOMEM if a special keyring couldn't be created.
529 * In the case of a successful return, the possession attribute is set on the
530 * returned key reference.
532 key_ref_t
lookup_user_key(key_serial_t id
, unsigned long lflags
,
535 struct request_key_auth
*rka
;
536 const struct cred
*cred
;
538 key_ref_t key_ref
, skey_ref
;
542 cred
= get_current_cred();
543 key_ref
= ERR_PTR(-ENOKEY
);
546 case KEY_SPEC_THREAD_KEYRING
:
547 if (!cred
->thread_keyring
) {
548 if (!(lflags
& KEY_LOOKUP_CREATE
))
551 ret
= install_thread_keyring();
553 key_ref
= ERR_PTR(ret
);
559 key
= cred
->thread_keyring
;
560 atomic_inc(&key
->usage
);
561 key_ref
= make_key_ref(key
, 1);
564 case KEY_SPEC_PROCESS_KEYRING
:
565 if (!cred
->process_keyring
) {
566 if (!(lflags
& KEY_LOOKUP_CREATE
))
569 ret
= install_process_keyring();
571 key_ref
= ERR_PTR(ret
);
577 key
= cred
->process_keyring
;
578 atomic_inc(&key
->usage
);
579 key_ref
= make_key_ref(key
, 1);
582 case KEY_SPEC_SESSION_KEYRING
:
583 if (!cred
->session_keyring
) {
584 /* always install a session keyring upon access if one
585 * doesn't exist yet */
586 ret
= install_user_keyrings();
589 if (lflags
& KEY_LOOKUP_CREATE
)
590 ret
= join_session_keyring(NULL
);
592 ret
= install_session_keyring(
593 cred
->user
->session_keyring
);
598 } else if (cred
->session_keyring
==
599 cred
->user
->session_keyring
&&
600 lflags
& KEY_LOOKUP_CREATE
) {
601 ret
= join_session_keyring(NULL
);
608 key
= rcu_dereference(cred
->session_keyring
);
609 atomic_inc(&key
->usage
);
611 key_ref
= make_key_ref(key
, 1);
614 case KEY_SPEC_USER_KEYRING
:
615 if (!cred
->user
->uid_keyring
) {
616 ret
= install_user_keyrings();
621 key
= cred
->user
->uid_keyring
;
622 atomic_inc(&key
->usage
);
623 key_ref
= make_key_ref(key
, 1);
626 case KEY_SPEC_USER_SESSION_KEYRING
:
627 if (!cred
->user
->session_keyring
) {
628 ret
= install_user_keyrings();
633 key
= cred
->user
->session_keyring
;
634 atomic_inc(&key
->usage
);
635 key_ref
= make_key_ref(key
, 1);
638 case KEY_SPEC_GROUP_KEYRING
:
639 /* group keyrings are not yet supported */
640 key_ref
= ERR_PTR(-EINVAL
);
643 case KEY_SPEC_REQKEY_AUTH_KEY
:
644 key
= cred
->request_key_auth
;
648 atomic_inc(&key
->usage
);
649 key_ref
= make_key_ref(key
, 1);
652 case KEY_SPEC_REQUESTOR_KEYRING
:
653 if (!cred
->request_key_auth
)
656 down_read(&cred
->request_key_auth
->sem
);
657 if (test_bit(KEY_FLAG_REVOKED
,
658 &cred
->request_key_auth
->flags
)) {
659 key_ref
= ERR_PTR(-EKEYREVOKED
);
662 rka
= cred
->request_key_auth
->payload
.data
;
663 key
= rka
->dest_keyring
;
664 atomic_inc(&key
->usage
);
666 up_read(&cred
->request_key_auth
->sem
);
669 key_ref
= make_key_ref(key
, 1);
673 key_ref
= ERR_PTR(-EINVAL
);
677 key
= key_lookup(id
);
679 key_ref
= ERR_CAST(key
);
683 key_ref
= make_key_ref(key
, 0);
685 /* check to see if we possess the key */
686 skey_ref
= search_process_keyrings(key
->type
, key
,
687 lookup_user_key_possessed
,
690 if (!IS_ERR(skey_ref
)) {
698 /* unlink does not use the nominated key in any way, so can skip all
699 * the permission checks as it is only concerned with the keyring */
700 if (lflags
& KEY_LOOKUP_FOR_UNLINK
) {
705 if (!(lflags
& KEY_LOOKUP_PARTIAL
)) {
706 ret
= wait_for_key_construction(key
, true);
717 ret
= key_validate(key
);
723 if (!(lflags
& KEY_LOOKUP_PARTIAL
) &&
724 !test_bit(KEY_FLAG_INSTANTIATED
, &key
->flags
))
727 /* check the permissions */
728 ret
= key_task_permission(key_ref
, cred
, perm
);
732 key
->last_used_at
= current_kernel_time().tv_sec
;
739 key_ref_put(key_ref
);
740 key_ref
= ERR_PTR(ret
);
743 /* if we attempted to install a keyring, then it may have caused new
744 * creds to be installed */
751 * Join the named keyring as the session keyring if possible else attempt to
752 * create a new one of that name and join that.
754 * If the name is NULL, an empty anonymous keyring will be installed as the
757 * Named session keyrings are joined with a semaphore held to prevent the
758 * keyrings from going away whilst the attempt is made to going them and also
759 * to prevent a race in creating compatible session keyrings.
761 long join_session_keyring(const char *name
)
763 const struct cred
*old
;
768 new = prepare_creds();
771 old
= current_cred();
773 /* if no name is provided, install an anonymous keyring */
775 ret
= install_session_keyring_to_cred(new, NULL
);
779 serial
= new->session_keyring
->serial
;
780 ret
= commit_creds(new);
786 /* allow the user to join or create a named keyring */
787 mutex_lock(&key_session_mutex
);
789 /* look for an existing keyring of this name */
790 keyring
= find_keyring_by_name(name
, false);
791 if (PTR_ERR(keyring
) == -ENOKEY
) {
792 /* not found - try and create a new one */
793 keyring
= keyring_alloc(
794 name
, old
->uid
, old
->gid
, old
,
795 KEY_POS_ALL
| KEY_USR_VIEW
| KEY_USR_READ
| KEY_USR_LINK
,
796 KEY_ALLOC_IN_QUOTA
, NULL
);
797 if (IS_ERR(keyring
)) {
798 ret
= PTR_ERR(keyring
);
801 } else if (IS_ERR(keyring
)) {
802 ret
= PTR_ERR(keyring
);
804 } else if (keyring
== new->session_keyring
) {
810 /* we've got a keyring - now to install it */
811 ret
= install_session_keyring_to_cred(new, keyring
);
816 mutex_unlock(&key_session_mutex
);
818 ret
= keyring
->serial
;
824 mutex_unlock(&key_session_mutex
);
831 * Replace a process's session keyring on behalf of one of its children when
832 * the target process is about to resume userspace execution.
834 void key_change_session_keyring(struct callback_head
*twork
)
836 const struct cred
*old
= current_cred();
837 struct cred
*new = container_of(twork
, struct cred
, rcu
);
839 if (unlikely(current
->flags
& PF_EXITING
)) {
844 new-> uid
= old
-> uid
;
845 new-> euid
= old
-> euid
;
846 new-> suid
= old
-> suid
;
847 new->fsuid
= old
->fsuid
;
848 new-> gid
= old
-> gid
;
849 new-> egid
= old
-> egid
;
850 new-> sgid
= old
-> sgid
;
851 new->fsgid
= old
->fsgid
;
852 new->user
= get_uid(old
->user
);
853 new->user_ns
= get_user_ns(old
->user_ns
);
854 new->group_info
= get_group_info(old
->group_info
);
856 new->securebits
= old
->securebits
;
857 new->cap_inheritable
= old
->cap_inheritable
;
858 new->cap_permitted
= old
->cap_permitted
;
859 new->cap_effective
= old
->cap_effective
;
860 new->cap_bset
= old
->cap_bset
;
862 new->jit_keyring
= old
->jit_keyring
;
863 new->thread_keyring
= key_get(old
->thread_keyring
);
864 new->process_keyring
= key_get(old
->process_keyring
);
866 security_transfer_creds(new, old
);