[deliverable/linux.git] / security / keys / request_key_auth.c

/* request_key_auth.c: request key authorisation controlling key def
 *
 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * See Documentation/keys-request-key.txt
 */

#include <linux/module.h>
#include <linux/sched.h>
#include <linux/err.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include "internal.h"

static int request_key_auth_instantiate(struct key *, const void *, size_t);
static void request_key_auth_describe(const struct key *, struct seq_file *);
static void request_key_auth_revoke(struct key *);
static void request_key_auth_destroy(struct key *);
static long request_key_auth_read(const struct key *, char __user *, size_t);

/*
 * the request-key authorisation key type definition
 */
struct key_type key_type_request_key_auth = {
	.name		= ".request_key_auth",
	.def_datalen	= sizeof(struct request_key_auth),
	.instantiate	= request_key_auth_instantiate,
	.describe	= request_key_auth_describe,
	.revoke		= request_key_auth_revoke,
	.destroy	= request_key_auth_destroy,
	.read		= request_key_auth_read,
};

/*****************************************************************************/
/*
 * instantiate a request-key authorisation key
 */
static int request_key_auth_instantiate(struct key *key,
					const void *data,
					size_t datalen)
{
	key->payload.data = (struct request_key_auth *) data;
	return 0;

} /* end request_key_auth_instantiate() */

/*****************************************************************************/
/*
 * reading a request-key authorisation key retrieves the callout information
 */
static void request_key_auth_describe(const struct key *key,
				      struct seq_file *m)
{
	struct request_key_auth *rka = key->payload.data;

	seq_puts(m, "key:");
	seq_puts(m, key->description);
	seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);

} /* end request_key_auth_describe() */

/*****************************************************************************/
/*
 * read the callout_info data
 * - the key's semaphore is read-locked
 */
static long request_key_auth_read(const struct key *key,
				  char __user *buffer, size_t buflen)
{
	struct request_key_auth *rka = key->payload.data;
	size_t datalen;
	long ret;

	datalen = rka->callout_len;
	ret = datalen;

	/* we can return the data as is */
	if (buffer && buflen > 0) {
		if (buflen > datalen)
			buflen = datalen;

		if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
			ret = -EFAULT;
	}

	return ret;

} /* end request_key_auth_read() */

/*****************************************************************************/
/*
 * handle revocation of an authorisation token key
 * - called with the key sem write-locked
 */
static void request_key_auth_revoke(struct key *key)
{
	struct request_key_auth *rka = key->payload.data;

	kenter("{%d}", key->serial);

	if (rka->context) {
		put_task_struct(rka->context);
		rka->context = NULL;
	}

} /* end request_key_auth_revoke() */

/*****************************************************************************/
/*
 * destroy an instantiation authorisation token key
 */
static void request_key_auth_destroy(struct key *key)
{
	struct request_key_auth *rka = key->payload.data;

	kenter("{%d}", key->serial);

	if (rka->context) {
		put_task_struct(rka->context);
		rka->context = NULL;
	}

	key_put(rka->target_key);
	kfree(rka->callout_info);
	kfree(rka);

} /* end request_key_auth_destroy() */

/*****************************************************************************/
/*
 * create an authorisation token for /sbin/request-key or whoever to gain
 * access to the caller's security data
 */
struct key *request_key_auth_new(struct key *target, const void *callout_info,
				 size_t callout_len)
{
	struct request_key_auth *rka, *irka;
	struct key *authkey = NULL;
	char desc[20];
	int ret;

	kenter("%d,", target->serial);

	/* allocate a auth record */
	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
	if (!rka) {
		kleave(" = -ENOMEM");
		return ERR_PTR(-ENOMEM);
	}
	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
	if (!rka->callout_info) {
		kleave(" = -ENOMEM");
		kfree(rka);
		return ERR_PTR(-ENOMEM);
	}

	/* see if the calling process is already servicing the key request of
	 * another process */
	if (current->request_key_auth) {
		/* it is - use that instantiation context here too */
		down_read(&current->request_key_auth->sem);

		/* if the auth key has been revoked, then the key we're
		 * servicing is already instantiated */
		if (test_bit(KEY_FLAG_REVOKED,
			     &current->request_key_auth->flags))
			goto auth_key_revoked;

		irka = current->request_key_auth->payload.data;
		rka->context = irka->context;
		rka->pid = irka->pid;
		get_task_struct(rka->context);

		up_read(&current->request_key_auth->sem);
	}
	else {
		/* it isn't - use this process as the context */
		rka->context = current;
		rka->pid = current->pid;
		get_task_struct(rka->context);
	}

	rka->target_key = key_get(target);
	memcpy(rka->callout_info, callout_info, callout_len);
	rka->callout_len = callout_len;

	/* allocate the auth key */
	sprintf(desc, "%x", target->serial);

	authkey = key_alloc(&key_type_request_key_auth, desc,
			    current->fsuid, current->fsgid, current,
			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
	if (IS_ERR(authkey)) {
		ret = PTR_ERR(authkey);
		goto error_alloc;
	}

	/* construct and attach to the keyring */
	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
	if (ret < 0)
		goto error_inst;

	kleave(" = {%d}", authkey->serial);
	return authkey;

auth_key_revoked:
	up_read(&current->request_key_auth->sem);
	kfree(rka->callout_info);
	kfree(rka);
	kleave("= -EKEYREVOKED");
	return ERR_PTR(-EKEYREVOKED);

error_inst:
	key_revoke(authkey);
	key_put(authkey);
error_alloc:
	key_put(rka->target_key);
	kfree(rka->callout_info);
	kfree(rka);
	kleave("= %d", ret);
	return ERR_PTR(ret);

} /* end request_key_auth_new() */

/*****************************************************************************/
/*
 * see if an authorisation key is associated with a particular key
 */
static int key_get_instantiation_authkey_match(const struct key *key,
					       const void *_id)
{
	struct request_key_auth *rka = key->payload.data;
	key_serial_t id = (key_serial_t)(unsigned long) _id;

	return rka->target_key->serial == id;

} /* end key_get_instantiation_authkey_match() */

/*****************************************************************************/
/*
 * get the authorisation key for instantiation of a specific key if attached to
 * the current process's keyrings
 * - this key is inserted into a keyring and that is set as /sbin/request-key's
 *   session keyring
 * - a target_id of zero specifies any valid token
 */
struct key *key_get_instantiation_authkey(key_serial_t target_id)
{
	struct key *authkey;
	key_ref_t authkey_ref;

	authkey_ref = search_process_keyrings(
		&key_type_request_key_auth,
		(void *) (unsigned long) target_id,
		key_get_instantiation_authkey_match,
		current);

	if (IS_ERR(authkey_ref)) {
		authkey = ERR_CAST(authkey_ref);
		goto error;
	}

	authkey = key_ref_to_ptr(authkey_ref);
	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
		key_put(authkey);
		authkey = ERR_PTR(-EKEYREVOKED);
	}

error:
	return authkey;

} /* end key_get_instantiation_authkey() */
Commit	Line	Data
3e30148c DH	1	/* request_key_auth.c: request key authorisation controlling key def
	2	*
	3	* Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
	4	* Written by David Howells (dhowells@redhat.com)
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the License, or (at your option) any later version.
f1a9badc DH	10	*
f1a9badc DH	11	* See Documentation/keys-request-key.txt
3e30148c DH	12	*/
	13
	14	#include <linux/module.h>
	15	#include <linux/sched.h>
	16	#include <linux/err.h>
	17	#include <linux/seq_file.h>
fdb89bce	18	#include <linux/slab.h>
b5f545c8	19	#include <asm/uaccess.h>
3e30148c DH	20	#include "internal.h"
	21
	22	static int request_key_auth_instantiate(struct key , const void , size_t);
	23	static void request_key_auth_describe(const struct key , struct seq_file );
04c567d9	24	static void request_key_auth_revoke(struct key *);
3e30148c	25	static void request_key_auth_destroy(struct key *);
b5f545c8	26	static long request_key_auth_read(const struct key , char __user , size_t);
3e30148c DH	27
	28	/*
	29	* the request-key authorisation key type definition
	30	*/
	31	struct key_type key_type_request_key_auth = {
	32	.name = ".request_key_auth",
	33	.def_datalen = sizeof(struct request_key_auth),
	34	.instantiate = request_key_auth_instantiate,
	35	.describe = request_key_auth_describe,
04c567d9	36	.revoke = request_key_auth_revoke,
3e30148c	37	.destroy = request_key_auth_destroy,
b5f545c8	38	.read = request_key_auth_read,
3e30148c DH	39	};
	40
	41	/*****************************************************************************/
	42	/*
b5f545c8	43	* instantiate a request-key authorisation key
3e30148c DH	44	*/
	45	static int request_key_auth_instantiate(struct key *key,
	46	const void *data,
	47	size_t datalen)
	48	{
b5f545c8 DH	49	key->payload.data = (struct request_key_auth *) data;
b5f545c8 DH	50	return 0;
3e30148c DH	51
	52	} /* end request_key_auth_instantiate() */
	53
	54	/*****************************************************************************/
	55	/*
b5f545c8	56	* reading a request-key authorisation key retrieves the callout information
3e30148c DH	57	*/
	58	static void request_key_auth_describe(const struct key *key,
	59	struct seq_file *m)
	60	{
	61	struct request_key_auth *rka = key->payload.data;
	62
	63	seq_puts(m, "key:");
	64	seq_puts(m, key->description);
4a38e122	65	seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
3e30148c DH	66
	67	} /* end request_key_auth_describe() */
	68
b5f545c8 DH	69	/*****************************************************************************/
	70	/*
	71	* read the callout_info data
	72	* - the key's semaphore is read-locked
	73	*/
	74	static long request_key_auth_read(const struct key *key,
	75	char __user *buffer, size_t buflen)
	76	{
	77	struct request_key_auth *rka = key->payload.data;
	78	size_t datalen;
	79	long ret;
	80
4a38e122	81	datalen = rka->callout_len;
b5f545c8 DH	82	ret = datalen;
	83
	84	/* we can return the data as is */
	85	if (buffer && buflen > 0) {
	86	if (buflen > datalen)
	87	buflen = datalen;
	88
	89	if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
	90	ret = -EFAULT;
	91	}
	92
	93	return ret;
	94
	95	} /* end request_key_auth_read() */
	96
04c567d9 DH	97	/*****************************************************************************/
	98	/*
	99	* handle revocation of an authorisation token key
	100	* - called with the key sem write-locked
	101	*/
	102	static void request_key_auth_revoke(struct key *key)
	103	{
	104	struct request_key_auth *rka = key->payload.data;
	105
	106	kenter("{%d}", key->serial);
	107
	108	if (rka->context) {
	109	put_task_struct(rka->context);
	110	rka->context = NULL;
	111	}
	112
	113	} /* end request_key_auth_revoke() */
	114
3e30148c DH	115	/*****************************************************************************/
	116	/*
	117	* destroy an instantiation authorisation token key
	118	*/
	119	static void request_key_auth_destroy(struct key *key)
	120	{
	121	struct request_key_auth *rka = key->payload.data;
	122
	123	kenter("{%d}", key->serial);
	124
04c567d9 DH	125	if (rka->context) {
	126	put_task_struct(rka->context);
	127	rka->context = NULL;
	128	}
	129
3e30148c	130	key_put(rka->target_key);
76181c13	131	kfree(rka->callout_info);
74fd92c5	132	kfree(rka);
3e30148c DH	133
	134	} /* end request_key_auth_destroy() */
	135
	136	/*****************************************************************************/
	137	/*
b5f545c8 DH	138	* create an authorisation token for /sbin/request-key or whoever to gain
b5f545c8 DH	139	* access to the caller's security data
3e30148c	140	*/
4a38e122 DH	141	struct key request_key_auth_new(struct key target, const void *callout_info,
4a38e122 DH	142	size_t callout_len)
3e30148c	143	{
b5f545c8 DH	144	struct request_key_auth rka, irka;
b5f545c8 DH	145	struct key *authkey = NULL;
3e30148c DH	146	char desc[20];
	147	int ret;
	148
	149	kenter("%d,", target->serial);
	150
b5f545c8 DH	151	/* allocate a auth record */
	152	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
	153	if (!rka) {
	154	kleave(" = -ENOMEM");
	155	return ERR_PTR(-ENOMEM);
	156	}
4a38e122	157	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
76181c13 DH	158	if (!rka->callout_info) {
	159	kleave(" = -ENOMEM");
	160	kfree(rka);
	161	return ERR_PTR(-ENOMEM);
	162	}
3e30148c	163
b5f545c8 DH	164	/* see if the calling process is already servicing the key request of
	165	* another process */
	166	if (current->request_key_auth) {
	167	/* it is - use that instantiation context here too */
04c567d9 DH	168	down_read(&current->request_key_auth->sem);
	169
	170	/* if the auth key has been revoked, then the key we're
	171	* servicing is already instantiated */
	172	if (test_bit(KEY_FLAG_REVOKED,
	173	&current->request_key_auth->flags))
	174	goto auth_key_revoked;
	175
b5f545c8 DH	176	irka = current->request_key_auth->payload.data;
	177	rka->context = irka->context;
	178	rka->pid = irka->pid;
04c567d9 DH	179	get_task_struct(rka->context);
	180
	181	up_read(&current->request_key_auth->sem);
3e30148c	182	}
b5f545c8 DH	183	else {
	184	/* it isn't - use this process as the context */
	185	rka->context = current;
	186	rka->pid = current->pid;
04c567d9	187	get_task_struct(rka->context);
b5f545c8 DH	188	}
	189
	190	rka->target_key = key_get(target);
4a38e122 DH	191	memcpy(rka->callout_info, callout_info, callout_len);
4a38e122 DH	192	rka->callout_len = callout_len;
3e30148c DH	193
	194	/* allocate the auth key */
	195	sprintf(desc, "%x", target->serial);
	196
b5f545c8	197	authkey = key_alloc(&key_type_request_key_auth, desc,
d720024e	198	current->fsuid, current->fsgid, current,
b5f545c8	199	KEY_POS_VIEW \| KEY_POS_READ \| KEY_POS_SEARCH \|
7e047ef5	200	KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
b5f545c8 DH	201	if (IS_ERR(authkey)) {
	202	ret = PTR_ERR(authkey);
	203	goto error_alloc;
3e30148c DH	204	}
	205
	206	/* construct and attach to the keyring */
b5f545c8 DH	207	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
	208	if (ret < 0)
	209	goto error_inst;
3e30148c	210
04c567d9	211	kleave(" = {%d}", authkey->serial);
b5f545c8 DH	212	return authkey;
b5f545c8 DH	213
04c567d9 DH	214	auth_key_revoked:
04c567d9 DH	215	up_read(&current->request_key_auth->sem);
76181c13	216	kfree(rka->callout_info);
04c567d9 DH	217	kfree(rka);
	218	kleave("= -EKEYREVOKED");
	219	return ERR_PTR(-EKEYREVOKED);
	220
b5f545c8 DH	221	error_inst:
	222	key_revoke(authkey);
	223	key_put(authkey);
	224	error_alloc:
	225	key_put(rka->target_key);
76181c13	226	kfree(rka->callout_info);
b5f545c8 DH	227	kfree(rka);
	228	kleave("= %d", ret);
	229	return ERR_PTR(ret);
3e30148c DH	230
	231	} /* end request_key_auth_new() */
	232
b5f545c8 DH	233	/*****************************************************************************/
	234	/*
	235	* see if an authorisation key is associated with a particular key
	236	*/
	237	static int key_get_instantiation_authkey_match(const struct key *key,
	238	const void *_id)
	239	{
	240	struct request_key_auth *rka = key->payload.data;
	241	key_serial_t id = (key_serial_t)(unsigned long) _id;
	242
	243	return rka->target_key->serial == id;
	244
	245	} /* end key_get_instantiation_authkey_match() */
	246
3e30148c DH	247	/*****************************************************************************/
	248	/*
	249	* get the authorisation key for instantiation of a specific key if attached to
	250	* the current process's keyrings
	251	* - this key is inserted into a keyring and that is set as /sbin/request-key's
	252	* session keyring
	253	* - a target_id of zero specifies any valid token
	254	*/
	255	struct key *key_get_instantiation_authkey(key_serial_t target_id)
	256	{
b5f545c8 DH	257	struct key *authkey;
	258	key_ref_t authkey_ref;
	259
	260	authkey_ref = search_process_keyrings(
	261	&key_type_request_key_auth,
	262	(void *) (unsigned long) target_id,
	263	key_get_instantiation_authkey_match,
	264	current);
	265
	266	if (IS_ERR(authkey_ref)) {
e231c2ee	267	authkey = ERR_CAST(authkey_ref);
b5f545c8 DH	268	goto error;
b5f545c8 DH	269	}
3e30148c	270
b5f545c8 DH	271	authkey = key_ref_to_ptr(authkey_ref);
	272	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
	273	key_put(authkey);
	274	authkey = ERR_PTR(-EKEYREVOKED);
	275	}
3e30148c	276
b5f545c8 DH	277	error:
b5f545c8 DH	278	return authkey;
3e30148c DH	279
3e30148c DH	280	} /* end key_get_instantiation_authkey() */