[deliverable/linux.git] / security / keys / request_key_auth.c

/* request_key_auth.c: request key authorisation controlling key def
 *
 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 * See Documentation/keys-request-key.txt
 */

#include <linux/module.h>
#include <linux/sched.h>
#include <linux/err.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include "internal.h"

static int request_key_auth_instantiate(struct key *, const void *, size_t);
static void request_key_auth_describe(const struct key *, struct seq_file *);
static void request_key_auth_revoke(struct key *);
static void request_key_auth_destroy(struct key *);
static long request_key_auth_read(const struct key *, char __user *, size_t);

/*
 * the request-key authorisation key type definition
 */
struct key_type key_type_request_key_auth = {
	.name		= ".request_key_auth",
	.def_datalen	= sizeof(struct request_key_auth),
	.instantiate	= request_key_auth_instantiate,
	.describe	= request_key_auth_describe,
	.revoke		= request_key_auth_revoke,
	.destroy	= request_key_auth_destroy,
	.read		= request_key_auth_read,
};

/*****************************************************************************/
/*
 * instantiate a request-key authorisation key
 */
static int request_key_auth_instantiate(struct key *key,
					const void *data,
					size_t datalen)
{
	key->payload.data = (struct request_key_auth *) data;
	return 0;

} /* end request_key_auth_instantiate() */

/*****************************************************************************/
/*
 * reading a request-key authorisation key retrieves the callout information
 */
static void request_key_auth_describe(const struct key *key,
				      struct seq_file *m)
{
	struct request_key_auth *rka = key->payload.data;

	seq_puts(m, "key:");
	seq_puts(m, key->description);
	seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);

} /* end request_key_auth_describe() */

/*****************************************************************************/
/*
 * read the callout_info data
 * - the key's semaphore is read-locked
 */
static long request_key_auth_read(const struct key *key,
				  char __user *buffer, size_t buflen)
{
	struct request_key_auth *rka = key->payload.data;
	size_t datalen;
	long ret;

	datalen = rka->callout_len;
	ret = datalen;

	/* we can return the data as is */
	if (buffer && buflen > 0) {
		if (buflen > datalen)
			buflen = datalen;

		if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
			ret = -EFAULT;
	}

	return ret;

} /* end request_key_auth_read() */

/*****************************************************************************/
/*
 * handle revocation of an authorisation token key
 * - called with the key sem write-locked
 */
static void request_key_auth_revoke(struct key *key)
{
	struct request_key_auth *rka = key->payload.data;

	kenter("{%d}", key->serial);

	if (rka->context) {
		put_task_struct(rka->context);
		rka->context = NULL;
	}

} /* end request_key_auth_revoke() */

/*****************************************************************************/
/*
 * destroy an instantiation authorisation token key
 */
static void request_key_auth_destroy(struct key *key)
{
	struct request_key_auth *rka = key->payload.data;

	kenter("{%d}", key->serial);

	if (rka->context) {
		put_task_struct(rka->context);
		rka->context = NULL;
	}

	key_put(rka->target_key);
	key_put(rka->dest_keyring);
	kfree(rka->callout_info);
	kfree(rka);

} /* end request_key_auth_destroy() */

/*****************************************************************************/
/*
 * create an authorisation token for /sbin/request-key or whoever to gain
 * access to the caller's security data
 */
struct key *request_key_auth_new(struct key *target, const void *callout_info,
				 size_t callout_len, struct key *dest_keyring)
{
	struct request_key_auth *rka, *irka;
	struct key *authkey = NULL;
	char desc[20];
	int ret;

	kenter("%d,", target->serial);

	/* allocate a auth record */
	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
	if (!rka) {
		kleave(" = -ENOMEM");
		return ERR_PTR(-ENOMEM);
	}
	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
	if (!rka->callout_info) {
		kleave(" = -ENOMEM");
		kfree(rka);
		return ERR_PTR(-ENOMEM);
	}

	/* see if the calling process is already servicing the key request of
	 * another process */
	if (current->cred->request_key_auth) {
		/* it is - use that instantiation context here too */
		down_read(&current->cred->request_key_auth->sem);

		/* if the auth key has been revoked, then the key we're
		 * servicing is already instantiated */
		if (test_bit(KEY_FLAG_REVOKED,
			     &current->cred->request_key_auth->flags))
			goto auth_key_revoked;

		irka = current->cred->request_key_auth->payload.data;
		rka->context = irka->context;
		rka->pid = irka->pid;
		get_task_struct(rka->context);

		up_read(&current->cred->request_key_auth->sem);
	}
	else {
		/* it isn't - use this process as the context */
		rka->context = current;
		rka->pid = current->pid;
		get_task_struct(rka->context);
	}

	rka->target_key = key_get(target);
	rka->dest_keyring = key_get(dest_keyring);
	memcpy(rka->callout_info, callout_info, callout_len);
	rka->callout_len = callout_len;

	/* allocate the auth key */
	sprintf(desc, "%x", target->serial);

	authkey = key_alloc(&key_type_request_key_auth, desc,
			    current_fsuid(), current_fsgid(), current,
			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
	if (IS_ERR(authkey)) {
		ret = PTR_ERR(authkey);
		goto error_alloc;
	}

	/* construct and attach to the keyring */
	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
	if (ret < 0)
		goto error_inst;

	kleave(" = {%d}", authkey->serial);
	return authkey;

auth_key_revoked:
	up_read(&current->cred->request_key_auth->sem);
	kfree(rka->callout_info);
	kfree(rka);
	kleave("= -EKEYREVOKED");
	return ERR_PTR(-EKEYREVOKED);

error_inst:
	key_revoke(authkey);
	key_put(authkey);
error_alloc:
	key_put(rka->target_key);
	key_put(rka->dest_keyring);
	kfree(rka->callout_info);
	kfree(rka);
	kleave("= %d", ret);
	return ERR_PTR(ret);

} /* end request_key_auth_new() */

/*****************************************************************************/
/*
 * see if an authorisation key is associated with a particular key
 */
static int key_get_instantiation_authkey_match(const struct key *key,
					       const void *_id)
{
	struct request_key_auth *rka = key->payload.data;
	key_serial_t id = (key_serial_t)(unsigned long) _id;

	return rka->target_key->serial == id;

} /* end key_get_instantiation_authkey_match() */

/*****************************************************************************/
/*
 * get the authorisation key for instantiation of a specific key if attached to
 * the current process's keyrings
 * - this key is inserted into a keyring and that is set as /sbin/request-key's
 *   session keyring
 * - a target_id of zero specifies any valid token
 */
struct key *key_get_instantiation_authkey(key_serial_t target_id)
{
	struct key *authkey;
	key_ref_t authkey_ref;

	authkey_ref = search_process_keyrings(
		&key_type_request_key_auth,
		(void *) (unsigned long) target_id,
		key_get_instantiation_authkey_match,
		current);

	if (IS_ERR(authkey_ref)) {
		authkey = ERR_CAST(authkey_ref);
		goto error;
	}

	authkey = key_ref_to_ptr(authkey_ref);
	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
		key_put(authkey);
		authkey = ERR_PTR(-EKEYREVOKED);
	}

error:
	return authkey;

} /* end key_get_instantiation_authkey() */
Commit	Line	Data
3e30148c DH	1	/* request_key_auth.c: request key authorisation controlling key def
	2	*
	3	* Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
	4	* Written by David Howells (dhowells@redhat.com)
	5	*
	6	* This program is free software; you can redistribute it and/or
	7	* modify it under the terms of the GNU General Public License
	8	* as published by the Free Software Foundation; either version
	9	* 2 of the License, or (at your option) any later version.
f1a9badc DH	10	*
f1a9badc DH	11	* See Documentation/keys-request-key.txt
3e30148c DH	12	*/
	13
	14	#include <linux/module.h>
	15	#include <linux/sched.h>
	16	#include <linux/err.h>
	17	#include <linux/seq_file.h>
fdb89bce	18	#include <linux/slab.h>
b5f545c8	19	#include <asm/uaccess.h>
3e30148c DH	20	#include "internal.h"
	21
	22	static int request_key_auth_instantiate(struct key , const void , size_t);
	23	static void request_key_auth_describe(const struct key , struct seq_file );
04c567d9	24	static void request_key_auth_revoke(struct key *);
3e30148c	25	static void request_key_auth_destroy(struct key *);
b5f545c8	26	static long request_key_auth_read(const struct key , char __user , size_t);
3e30148c DH	27
	28	/*
	29	* the request-key authorisation key type definition
	30	*/
	31	struct key_type key_type_request_key_auth = {
	32	.name = ".request_key_auth",
	33	.def_datalen = sizeof(struct request_key_auth),
	34	.instantiate = request_key_auth_instantiate,
	35	.describe = request_key_auth_describe,
04c567d9	36	.revoke = request_key_auth_revoke,
3e30148c	37	.destroy = request_key_auth_destroy,
b5f545c8	38	.read = request_key_auth_read,
3e30148c DH	39	};
	40
	41	/*****************************************************************************/
	42	/*
b5f545c8	43	* instantiate a request-key authorisation key
3e30148c DH	44	*/
	45	static int request_key_auth_instantiate(struct key *key,
	46	const void *data,
	47	size_t datalen)
	48	{
b5f545c8 DH	49	key->payload.data = (struct request_key_auth *) data;
b5f545c8 DH	50	return 0;
3e30148c DH	51
	52	} /* end request_key_auth_instantiate() */
	53
	54	/*****************************************************************************/
	55	/*
b5f545c8	56	* reading a request-key authorisation key retrieves the callout information
3e30148c DH	57	*/
	58	static void request_key_auth_describe(const struct key *key,
	59	struct seq_file *m)
	60	{
	61	struct request_key_auth *rka = key->payload.data;
	62
	63	seq_puts(m, "key:");
	64	seq_puts(m, key->description);
4a38e122	65	seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
3e30148c DH	66
	67	} /* end request_key_auth_describe() */
	68
b5f545c8 DH	69	/*****************************************************************************/
	70	/*
	71	* read the callout_info data
	72	* - the key's semaphore is read-locked
	73	*/
	74	static long request_key_auth_read(const struct key *key,
	75	char __user *buffer, size_t buflen)
	76	{
	77	struct request_key_auth *rka = key->payload.data;
	78	size_t datalen;
	79	long ret;
	80
4a38e122	81	datalen = rka->callout_len;
b5f545c8 DH	82	ret = datalen;
	83
	84	/* we can return the data as is */
	85	if (buffer && buflen > 0) {
	86	if (buflen > datalen)
	87	buflen = datalen;
	88
	89	if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
	90	ret = -EFAULT;
	91	}
	92
	93	return ret;
	94
	95	} /* end request_key_auth_read() */
	96
04c567d9 DH	97	/*****************************************************************************/
	98	/*
	99	* handle revocation of an authorisation token key
	100	* - called with the key sem write-locked
	101	*/
	102	static void request_key_auth_revoke(struct key *key)
	103	{
	104	struct request_key_auth *rka = key->payload.data;
	105
	106	kenter("{%d}", key->serial);
	107
	108	if (rka->context) {
	109	put_task_struct(rka->context);
	110	rka->context = NULL;
	111	}
	112
	113	} /* end request_key_auth_revoke() */
	114
3e30148c DH	115	/*****************************************************************************/
	116	/*
	117	* destroy an instantiation authorisation token key
	118	*/
	119	static void request_key_auth_destroy(struct key *key)
	120	{
	121	struct request_key_auth *rka = key->payload.data;
	122
	123	kenter("{%d}", key->serial);
	124
04c567d9 DH	125	if (rka->context) {
	126	put_task_struct(rka->context);
	127	rka->context = NULL;
	128	}
	129
3e30148c	130	key_put(rka->target_key);
8bbf4976	131	key_put(rka->dest_keyring);
76181c13	132	kfree(rka->callout_info);
74fd92c5	133	kfree(rka);
3e30148c DH	134
	135	} /* end request_key_auth_destroy() */
	136
	137	/*****************************************************************************/
	138	/*
b5f545c8 DH	139	* create an authorisation token for /sbin/request-key or whoever to gain
b5f545c8 DH	140	* access to the caller's security data
3e30148c	141	*/
4a38e122	142	struct key request_key_auth_new(struct key target, const void *callout_info,
8bbf4976	143	size_t callout_len, struct key *dest_keyring)
3e30148c	144	{
b5f545c8 DH	145	struct request_key_auth rka, irka;
b5f545c8 DH	146	struct key *authkey = NULL;
3e30148c DH	147	char desc[20];
	148	int ret;
	149
	150	kenter("%d,", target->serial);
	151
b5f545c8 DH	152	/* allocate a auth record */
	153	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
	154	if (!rka) {
	155	kleave(" = -ENOMEM");
	156	return ERR_PTR(-ENOMEM);
	157	}
4a38e122	158	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
76181c13 DH	159	if (!rka->callout_info) {
	160	kleave(" = -ENOMEM");
	161	kfree(rka);
	162	return ERR_PTR(-ENOMEM);
	163	}
3e30148c	164
b5f545c8 DH	165	/* see if the calling process is already servicing the key request of
b5f545c8 DH	166	* another process */
b6dff3ec	167	if (current->cred->request_key_auth) {
b5f545c8	168	/* it is - use that instantiation context here too */
b6dff3ec	169	down_read(&current->cred->request_key_auth->sem);
04c567d9 DH	170
	171	/* if the auth key has been revoked, then the key we're
	172	* servicing is already instantiated */
	173	if (test_bit(KEY_FLAG_REVOKED,
b6dff3ec	174	&current->cred->request_key_auth->flags))
04c567d9 DH	175	goto auth_key_revoked;
04c567d9 DH	176
b6dff3ec	177	irka = current->cred->request_key_auth->payload.data;
b5f545c8 DH	178	rka->context = irka->context;
b5f545c8 DH	179	rka->pid = irka->pid;
04c567d9 DH	180	get_task_struct(rka->context);
04c567d9 DH	181
b6dff3ec	182	up_read(&current->cred->request_key_auth->sem);
3e30148c	183	}
b5f545c8 DH	184	else {
	185	/* it isn't - use this process as the context */
	186	rka->context = current;
	187	rka->pid = current->pid;
04c567d9	188	get_task_struct(rka->context);
b5f545c8 DH	189	}
	190
	191	rka->target_key = key_get(target);
8bbf4976	192	rka->dest_keyring = key_get(dest_keyring);
4a38e122 DH	193	memcpy(rka->callout_info, callout_info, callout_len);
4a38e122 DH	194	rka->callout_len = callout_len;
3e30148c DH	195
	196	/* allocate the auth key */
	197	sprintf(desc, "%x", target->serial);
	198
b5f545c8	199	authkey = key_alloc(&key_type_request_key_auth, desc,
47d804bf	200	current_fsuid(), current_fsgid(), current,
b5f545c8	201	KEY_POS_VIEW \| KEY_POS_READ \| KEY_POS_SEARCH \|
7e047ef5	202	KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
b5f545c8 DH	203	if (IS_ERR(authkey)) {
	204	ret = PTR_ERR(authkey);
	205	goto error_alloc;
3e30148c DH	206	}
	207
	208	/* construct and attach to the keyring */
b5f545c8 DH	209	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
	210	if (ret < 0)
	211	goto error_inst;
3e30148c	212
04c567d9	213	kleave(" = {%d}", authkey->serial);
b5f545c8 DH	214	return authkey;
b5f545c8 DH	215
04c567d9	216	auth_key_revoked:
b6dff3ec	217	up_read(&current->cred->request_key_auth->sem);
76181c13	218	kfree(rka->callout_info);
04c567d9 DH	219	kfree(rka);
	220	kleave("= -EKEYREVOKED");
	221	return ERR_PTR(-EKEYREVOKED);
	222
b5f545c8 DH	223	error_inst:
	224	key_revoke(authkey);
	225	key_put(authkey);
	226	error_alloc:
	227	key_put(rka->target_key);
8bbf4976	228	key_put(rka->dest_keyring);
76181c13	229	kfree(rka->callout_info);
b5f545c8 DH	230	kfree(rka);
	231	kleave("= %d", ret);
	232	return ERR_PTR(ret);
3e30148c DH	233
	234	} /* end request_key_auth_new() */
	235
b5f545c8 DH	236	/*****************************************************************************/
	237	/*
	238	* see if an authorisation key is associated with a particular key
	239	*/
	240	static int key_get_instantiation_authkey_match(const struct key *key,
	241	const void *_id)
	242	{
	243	struct request_key_auth *rka = key->payload.data;
	244	key_serial_t id = (key_serial_t)(unsigned long) _id;
	245
	246	return rka->target_key->serial == id;
	247
	248	} /* end key_get_instantiation_authkey_match() */
	249
3e30148c DH	250	/*****************************************************************************/
	251	/*
	252	* get the authorisation key for instantiation of a specific key if attached to
	253	* the current process's keyrings
	254	* - this key is inserted into a keyring and that is set as /sbin/request-key's
	255	* session keyring
	256	* - a target_id of zero specifies any valid token
	257	*/
	258	struct key *key_get_instantiation_authkey(key_serial_t target_id)
	259	{
b5f545c8 DH	260	struct key *authkey;
	261	key_ref_t authkey_ref;
	262
	263	authkey_ref = search_process_keyrings(
	264	&key_type_request_key_auth,
	265	(void *) (unsigned long) target_id,
	266	key_get_instantiation_authkey_match,
	267	current);
	268
	269	if (IS_ERR(authkey_ref)) {
e231c2ee	270	authkey = ERR_CAST(authkey_ref);
b5f545c8 DH	271	goto error;
b5f545c8 DH	272	}
3e30148c	273
b5f545c8 DH	274	authkey = key_ref_to_ptr(authkey_ref);
	275	if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
	276	key_put(authkey);
	277	authkey = ERR_PTR(-EKEYREVOKED);
	278	}
3e30148c	279
b5f545c8 DH	280	error:
b5f545c8 DH	281	return authkey;
3e30148c DH	282
3e30148c DH	283	} /* end key_get_instantiation_authkey() */