security/keys/keyctl.c

   1 /* keyctl.c: userspace keyctl operations
   2  *
   3  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/sched.h>
  15 #include <linux/slab.h>
  16 #include <linux/syscalls.h>
  17 #include <linux/keyctl.h>
  18 #include <linux/fs.h>
  19 #include <linux/capability.h>
  20 #include <linux/string.h>
  21 #include <linux/err.h>
  22 #include <asm/uaccess.h>
  23 #include "internal.h"
  24
  25 static int key_get_type_from_user(char *type,
  26                                   const char __user *_type,
  27                                   unsigned len)
  28 {
  29         int ret;
  30
  31         ret = strncpy_from_user(type, _type, len);
  32
  33         if (ret < 0)
  34                 return -EFAULT;
  35
  36         if (ret == 0 || ret >= len)
  37                 return -EINVAL;
  38
  39         if (type[0] == '.')
  40                 return -EPERM;
  41
  42         type[len - 1] = '\0';
  43
  44         return 0;
  45 }
  46
  47 /*****************************************************************************/
  48 /*
  49  * extract the description of a new key from userspace and either add it as a
  50  * new key to the specified keyring or update a matching key in that keyring
  51  * - the keyring must be writable
  52  * - returns the new key's serial number
  53  * - implements add_key()
  54  */
  55 asmlinkage long sys_add_key(const char __user *_type,
  56                             const char __user *_description,
  57                             const void __user *_payload,
  58                             size_t plen,
  59                             key_serial_t ringid)
  60 {
  61         key_ref_t keyring_ref, key_ref;
  62         char type[32], *description;
  63         void *payload;
  64         long ret;
  65
  66         ret = -EINVAL;
  67         if (plen > 32767)
  68                 goto error;
  69
  70         /* draw all the data into kernel space */
  71         ret = key_get_type_from_user(type, _type, sizeof(type));
  72         if (ret < 0)
  73                 goto error;
  74
  75         description = strndup_user(_description, PAGE_SIZE);
  76         if (IS_ERR(description)) {
  77                 ret = PTR_ERR(description);
  78                 goto error;
  79         }
  80
  81         /* pull the payload in if one was supplied */
  82         payload = NULL;
  83
  84         if (_payload) {
  85                 ret = -ENOMEM;
  86                 payload = kmalloc(plen, GFP_KERNEL);
  87                 if (!payload)
  88                         goto error2;
  89
  90                 ret = -EFAULT;
  91                 if (copy_from_user(payload, _payload, plen) != 0)
  92                         goto error3;
  93         }
  94
  95         /* find the target keyring (which must be writable) */
  96         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  97         if (IS_ERR(keyring_ref)) {
  98                 ret = PTR_ERR(keyring_ref);
  99                 goto error3;
 100         }
 101
 102         /* create or update the requested key and add it to the target
 103          * keyring */
 104         key_ref = key_create_or_update(keyring_ref, type, description,
 105                                        payload, plen, KEY_ALLOC_IN_QUOTA);
 106         if (!IS_ERR(key_ref)) {
 107                 ret = key_ref_to_ptr(key_ref)->serial;
 108                 key_ref_put(key_ref);
 109         }
 110         else {
 111                 ret = PTR_ERR(key_ref);
 112         }
 113
 114         key_ref_put(keyring_ref);
 115  error3:
 116         kfree(payload);
 117  error2:
 118         kfree(description);
 119  error:
 120         return ret;
 121
 122 } /* end sys_add_key() */
 123
 124 /*****************************************************************************/
 125 /*
 126  * search the process keyrings for a matching key
 127  * - nested keyrings may also be searched if they have Search permission
 128  * - if a key is found, it will be attached to the destination keyring if
 129  *   there's one specified
 130  * - /sbin/request-key will be invoked if _callout_info is non-NULL
 131  *   - the _callout_info string will be passed to /sbin/request-key
 132  *   - if the _callout_info string is empty, it will be rendered as "-"
 133  * - implements request_key()
 134  */
 135 asmlinkage long sys_request_key(const char __user *_type,
 136                                 const char __user *_description,
 137                                 const char __user *_callout_info,
 138                                 key_serial_t destringid)
 139 {
 140         struct key_type *ktype;
 141         struct key *key;
 142         key_ref_t dest_ref;
 143         char type[32], *description, *callout_info;
 144         long ret;
 145
 146         /* pull the type into kernel space */
 147         ret = key_get_type_from_user(type, _type, sizeof(type));
 148         if (ret < 0)
 149                 goto error;
 150
 151         /* pull the description into kernel space */
 152         description = strndup_user(_description, PAGE_SIZE);
 153         if (IS_ERR(description)) {
 154                 ret = PTR_ERR(description);
 155                 goto error;
 156         }
 157
 158         /* pull the callout info into kernel space */
 159         callout_info = NULL;
 160         if (_callout_info) {
 161                 callout_info = strndup_user(_callout_info, PAGE_SIZE);
 162                 if (IS_ERR(callout_info)) {
 163                         ret = PTR_ERR(callout_info);
 164                         goto error2;
 165                 }
 166         }
 167
 168         /* get the destination keyring if specified */
 169         dest_ref = NULL;
 170         if (destringid) {
 171                 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
 172                 if (IS_ERR(dest_ref)) {
 173                         ret = PTR_ERR(dest_ref);
 174                         goto error3;
 175                 }
 176         }
 177
 178         /* find the key type */
 179         ktype = key_type_lookup(type);
 180         if (IS_ERR(ktype)) {
 181                 ret = PTR_ERR(ktype);
 182                 goto error4;
 183         }
 184
 185         /* do the search */
 186         key = request_key_and_link(ktype, description, callout_info,
 187                                    key_ref_to_ptr(dest_ref),
 188                                    KEY_ALLOC_IN_QUOTA);
 189         if (IS_ERR(key)) {
 190                 ret = PTR_ERR(key);
 191                 goto error5;
 192         }
 193
 194         ret = key->serial;
 195
 196         key_put(key);
 197  error5:
 198         key_type_put(ktype);
 199  error4:
 200         key_ref_put(dest_ref);
 201  error3:
 202         kfree(callout_info);
 203  error2:
 204         kfree(description);
 205  error:
 206         return ret;
 207
 208 } /* end sys_request_key() */
 209
 210 /*****************************************************************************/
 211 /*
 212  * get the ID of the specified process keyring
 213  * - the keyring must have search permission to be found
 214  * - implements keyctl(KEYCTL_GET_KEYRING_ID)
 215  */
 216 long keyctl_get_keyring_ID(key_serial_t id, int create)
 217 {
 218         key_ref_t key_ref;
 219         long ret;
 220
 221         key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
 222         if (IS_ERR(key_ref)) {
 223                 ret = PTR_ERR(key_ref);
 224                 goto error;
 225         }
 226
 227         ret = key_ref_to_ptr(key_ref)->serial;
 228         key_ref_put(key_ref);
 229  error:
 230         return ret;
 231
 232 } /* end keyctl_get_keyring_ID() */
 233
 234 /*****************************************************************************/
 235 /*
 236  * join the session keyring
 237  * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
 238  */
 239 long keyctl_join_session_keyring(const char __user *_name)
 240 {
 241         char *name;
 242         long ret;
 243
 244         /* fetch the name from userspace */
 245         name = NULL;
 246         if (_name) {
 247                 name = strndup_user(_name, PAGE_SIZE);
 248                 if (IS_ERR(name)) {
 249                         ret = PTR_ERR(name);
 250                         goto error;
 251                 }
 252         }
 253
 254         /* join the session */
 255         ret = join_session_keyring(name);
 256
 257  error:
 258         return ret;
 259
 260 } /* end keyctl_join_session_keyring() */
 261
 262 /*****************************************************************************/
 263 /*
 264  * update a key's data payload
 265  * - the key must be writable
 266  * - implements keyctl(KEYCTL_UPDATE)
 267  */
 268 long keyctl_update_key(key_serial_t id,
 269                        const void __user *_payload,
 270                        size_t plen)
 271 {
 272         key_ref_t key_ref;
 273         void *payload;
 274         long ret;
 275
 276         ret = -EINVAL;
 277         if (plen > PAGE_SIZE)
 278                 goto error;
 279
 280         /* pull the payload in if one was supplied */
 281         payload = NULL;
 282         if (_payload) {
 283                 ret = -ENOMEM;
 284                 payload = kmalloc(plen, GFP_KERNEL);
 285                 if (!payload)
 286                         goto error;
 287
 288                 ret = -EFAULT;
 289                 if (copy_from_user(payload, _payload, plen) != 0)
 290                         goto error2;
 291         }
 292
 293         /* find the target key (which must be writable) */
 294         key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
 295         if (IS_ERR(key_ref)) {
 296                 ret = PTR_ERR(key_ref);
 297                 goto error2;
 298         }
 299
 300         /* update the key */
 301         ret = key_update(key_ref, payload, plen);
 302
 303         key_ref_put(key_ref);
 304  error2:
 305         kfree(payload);
 306  error:
 307         return ret;
 308
 309 } /* end keyctl_update_key() */
 310
 311 /*****************************************************************************/
 312 /*
 313  * revoke a key
 314  * - the key must be writable
 315  * - implements keyctl(KEYCTL_REVOKE)
 316  */
 317 long keyctl_revoke_key(key_serial_t id)
 318 {
 319         key_ref_t key_ref;
 320         long ret;
 321
 322         key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
 323         if (IS_ERR(key_ref)) {
 324                 ret = PTR_ERR(key_ref);
 325                 goto error;
 326         }
 327
 328         key_revoke(key_ref_to_ptr(key_ref));
 329         ret = 0;
 330
 331         key_ref_put(key_ref);
 332  error:
 333         return ret;
 334
 335 } /* end keyctl_revoke_key() */
 336
 337 /*****************************************************************************/
 338 /*
 339  * clear the specified process keyring
 340  * - the keyring must be writable
 341  * - implements keyctl(KEYCTL_CLEAR)
 342  */
 343 long keyctl_keyring_clear(key_serial_t ringid)
 344 {
 345         key_ref_t keyring_ref;
 346         long ret;
 347
 348         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 349         if (IS_ERR(keyring_ref)) {
 350                 ret = PTR_ERR(keyring_ref);
 351                 goto error;
 352         }
 353
 354         ret = keyring_clear(key_ref_to_ptr(keyring_ref));
 355
 356         key_ref_put(keyring_ref);
 357  error:
 358         return ret;
 359
 360 } /* end keyctl_keyring_clear() */
 361
 362 /*****************************************************************************/
 363 /*
 364  * link a key into a keyring
 365  * - the keyring must be writable
 366  * - the key must be linkable
 367  * - implements keyctl(KEYCTL_LINK)
 368  */
 369 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
 370 {
 371         key_ref_t keyring_ref, key_ref;
 372         long ret;
 373
 374         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 375         if (IS_ERR(keyring_ref)) {
 376                 ret = PTR_ERR(keyring_ref);
 377                 goto error;
 378         }
 379
 380         key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
 381         if (IS_ERR(key_ref)) {
 382                 ret = PTR_ERR(key_ref);
 383                 goto error2;
 384         }
 385
 386         ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 387
 388         key_ref_put(key_ref);
 389  error2:
 390         key_ref_put(keyring_ref);
 391  error:
 392         return ret;
 393
 394 } /* end keyctl_keyring_link() */
 395
 396 /*****************************************************************************/
 397 /*
 398  * unlink the first attachment of a key from a keyring
 399  * - the keyring must be writable
 400  * - we don't need any permissions on the key
 401  * - implements keyctl(KEYCTL_UNLINK)
 402  */
 403 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
 404 {
 405         key_ref_t keyring_ref, key_ref;
 406         long ret;
 407
 408         keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
 409         if (IS_ERR(keyring_ref)) {
 410                 ret = PTR_ERR(keyring_ref);
 411                 goto error;
 412         }
 413
 414         key_ref = lookup_user_key(NULL, id, 0, 0, 0);
 415         if (IS_ERR(key_ref)) {
 416                 ret = PTR_ERR(key_ref);
 417                 goto error2;
 418         }
 419
 420         ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 421
 422         key_ref_put(key_ref);
 423  error2:
 424         key_ref_put(keyring_ref);
 425  error:
 426         return ret;
 427
 428 } /* end keyctl_keyring_unlink() */
 429
 430 /*****************************************************************************/
 431 /*
 432  * describe a user key
 433  * - the key must have view permission
 434  * - if there's a buffer, we place up to buflen bytes of data into it
 435  * - unless there's an error, we return the amount of description available,
 436  *   irrespective of how much we may have copied
 437  * - the description is formatted thus:
 438  *      type;uid;gid;perm;description<NUL>
 439  * - implements keyctl(KEYCTL_DESCRIBE)
 440  */
 441 long keyctl_describe_key(key_serial_t keyid,
 442                          char __user *buffer,
 443                          size_t buflen)
 444 {
 445         struct key *key, *instkey;
 446         key_ref_t key_ref;
 447         char *tmpbuf;
 448         long ret;
 449
 450         key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
 451         if (IS_ERR(key_ref)) {
 452                 /* viewing a key under construction is permitted if we have the
 453                  * authorisation token handy */
 454                 if (PTR_ERR(key_ref) == -EACCES) {
 455                         instkey = key_get_instantiation_authkey(keyid);
 456                         if (!IS_ERR(instkey)) {
 457                                 key_put(instkey);
 458                                 key_ref = lookup_user_key(NULL, keyid,
 459                                                           0, 1, 0);
 460                                 if (!IS_ERR(key_ref))
 461                                         goto okay;
 462                         }
 463                 }
 464
 465                 ret = PTR_ERR(key_ref);
 466                 goto error;
 467         }
 468
 469 okay:
 470         /* calculate how much description we're going to return */
 471         ret = -ENOMEM;
 472         tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 473         if (!tmpbuf)
 474                 goto error2;
 475
 476         key = key_ref_to_ptr(key_ref);
 477
 478         ret = snprintf(tmpbuf, PAGE_SIZE - 1,
 479                        "%s;%d;%d;%08x;%s",
 480                        key_ref_to_ptr(key_ref)->type->name,
 481                        key_ref_to_ptr(key_ref)->uid,
 482                        key_ref_to_ptr(key_ref)->gid,
 483                        key_ref_to_ptr(key_ref)->perm,
 484                        key_ref_to_ptr(key_ref)->description ?
 485                        key_ref_to_ptr(key_ref)->description : ""
 486                        );
 487
 488         /* include a NUL char at the end of the data */
 489         if (ret > PAGE_SIZE - 1)
 490                 ret = PAGE_SIZE - 1;
 491         tmpbuf[ret] = 0;
 492         ret++;
 493
 494         /* consider returning the data */
 495         if (buffer && buflen > 0) {
 496                 if (buflen > ret)
 497                         buflen = ret;
 498
 499                 if (copy_to_user(buffer, tmpbuf, buflen) != 0)
 500                         ret = -EFAULT;
 501         }
 502
 503         kfree(tmpbuf);
 504  error2:
 505         key_ref_put(key_ref);
 506  error:
 507         return ret;
 508
 509 } /* end keyctl_describe_key() */
 510
 511 /*****************************************************************************/
 512 /*
 513  * search the specified keyring for a matching key
 514  * - the start keyring must be searchable
 515  * - nested keyrings may also be searched if they are searchable
 516  * - only keys with search permission may be found
 517  * - if a key is found, it will be attached to the destination keyring if
 518  *   there's one specified
 519  * - implements keyctl(KEYCTL_SEARCH)
 520  */
 521 long keyctl_keyring_search(key_serial_t ringid,
 522                            const char __user *_type,
 523                            const char __user *_description,
 524                            key_serial_t destringid)
 525 {
 526         struct key_type *ktype;
 527         key_ref_t keyring_ref, key_ref, dest_ref;
 528         char type[32], *description;
 529         long ret;
 530
 531         /* pull the type and description into kernel space */
 532         ret = key_get_type_from_user(type, _type, sizeof(type));
 533         if (ret < 0)
 534                 goto error;
 535
 536         description = strndup_user(_description, PAGE_SIZE);
 537         if (IS_ERR(description)) {
 538                 ret = PTR_ERR(description);
 539                 goto error;
 540         }
 541
 542         /* get the keyring at which to begin the search */
 543         keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
 544         if (IS_ERR(keyring_ref)) {
 545                 ret = PTR_ERR(keyring_ref);
 546                 goto error2;
 547         }
 548
 549         /* get the destination keyring if specified */
 550         dest_ref = NULL;
 551         if (destringid) {
 552                 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
 553                 if (IS_ERR(dest_ref)) {
 554                         ret = PTR_ERR(dest_ref);
 555                         goto error3;
 556                 }
 557         }
 558
 559         /* find the key type */
 560         ktype = key_type_lookup(type);
 561         if (IS_ERR(ktype)) {
 562                 ret = PTR_ERR(ktype);
 563                 goto error4;
 564         }
 565
 566         /* do the search */
 567         key_ref = keyring_search(keyring_ref, ktype, description);
 568         if (IS_ERR(key_ref)) {
 569                 ret = PTR_ERR(key_ref);
 570
 571                 /* treat lack or presence of a negative key the same */
 572                 if (ret == -EAGAIN)
 573                         ret = -ENOKEY;
 574                 goto error5;
 575         }
 576
 577         /* link the resulting key to the destination keyring if we can */
 578         if (dest_ref) {
 579                 ret = key_permission(key_ref, KEY_LINK);
 580                 if (ret < 0)
 581                         goto error6;
 582
 583                 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
 584                 if (ret < 0)
 585                         goto error6;
 586         }
 587
 588         ret = key_ref_to_ptr(key_ref)->serial;
 589
 590  error6:
 591         key_ref_put(key_ref);
 592  error5:
 593         key_type_put(ktype);
 594  error4:
 595         key_ref_put(dest_ref);
 596  error3:
 597         key_ref_put(keyring_ref);
 598  error2:
 599         kfree(description);
 600  error:
 601         return ret;
 602
 603 } /* end keyctl_keyring_search() */
 604
 605 /*****************************************************************************/
 606 /*
 607  * read a user key's payload
 608  * - the keyring must be readable or the key must be searchable from the
 609  *   process's keyrings
 610  * - if there's a buffer, we place up to buflen bytes of data into it
 611  * - unless there's an error, we return the amount of data in the key,
 612  *   irrespective of how much we may have copied
 613  * - implements keyctl(KEYCTL_READ)
 614  */
 615 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 616 {
 617         struct key *key;
 618         key_ref_t key_ref;
 619         long ret;
 620
 621         /* find the key first */
 622         key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
 623         if (IS_ERR(key_ref)) {
 624                 ret = -ENOKEY;
 625                 goto error;
 626         }
 627
 628         key = key_ref_to_ptr(key_ref);
 629
 630         /* see if we can read it directly */
 631         ret = key_permission(key_ref, KEY_READ);
 632         if (ret == 0)
 633                 goto can_read_key;
 634         if (ret != -EACCES)
 635                 goto error;
 636
 637         /* we can't; see if it's searchable from this process's keyrings
 638          * - we automatically take account of the fact that it may be
 639          *   dangling off an instantiation key
 640          */
 641         if (!is_key_possessed(key_ref)) {
 642                 ret = -EACCES;
 643                 goto error2;
 644         }
 645
 646         /* the key is probably readable - now try to read it */
 647  can_read_key:
 648         ret = key_validate(key);
 649         if (ret == 0) {
 650                 ret = -EOPNOTSUPP;
 651                 if (key->type->read) {
 652                         /* read the data with the semaphore held (since we
 653                          * might sleep) */
 654                         down_read(&key->sem);
 655                         ret = key->type->read(key, buffer, buflen);
 656                         up_read(&key->sem);
 657                 }
 658         }
 659
 660  error2:
 661         key_put(key);
 662  error:
 663         return ret;
 664
 665 } /* end keyctl_read_key() */
 666
 667 /*****************************************************************************/
 668 /*
 669  * change the ownership of a key
 670  * - the keyring owned by the changer
 671  * - if the uid or gid is -1, then that parameter is not changed
 672  * - implements keyctl(KEYCTL_CHOWN)
 673  */
 674 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 675 {
 676         struct key *key;
 677         key_ref_t key_ref;
 678         long ret;
 679
 680         ret = 0;
 681         if (uid == (uid_t) -1 && gid == (gid_t) -1)
 682                 goto error;
 683
 684         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 685         if (IS_ERR(key_ref)) {
 686                 ret = PTR_ERR(key_ref);
 687                 goto error;
 688         }
 689
 690         key = key_ref_to_ptr(key_ref);
 691
 692         /* make the changes with the locks held to prevent chown/chown races */
 693         ret = -EACCES;
 694         down_write(&key->sem);
 695
 696         if (!capable(CAP_SYS_ADMIN)) {
 697                 /* only the sysadmin can chown a key to some other UID */
 698                 if (uid != (uid_t) -1 && key->uid != uid)
 699                         goto no_access;
 700
 701                 /* only the sysadmin can set the key's GID to a group other
 702                  * than one of those that the current process subscribes to */
 703                 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
 704                         goto no_access;
 705         }
 706
 707         /* change the UID (have to update the quotas) */
 708         if (uid != (uid_t) -1 && uid != key->uid) {
 709                 /* don't support UID changing yet */
 710                 ret = -EOPNOTSUPP;
 711                 goto no_access;
 712         }
 713
 714         /* change the GID */
 715         if (gid != (gid_t) -1)
 716                 key->gid = gid;
 717
 718         ret = 0;
 719
 720  no_access:
 721         up_write(&key->sem);
 722         key_put(key);
 723  error:
 724         return ret;
 725
 726 } /* end keyctl_chown_key() */
 727
 728 /*****************************************************************************/
 729 /*
 730  * change the permission mask on a key
 731  * - the keyring owned by the changer
 732  * - implements keyctl(KEYCTL_SETPERM)
 733  */
 734 long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
 735 {
 736         struct key *key;
 737         key_ref_t key_ref;
 738         long ret;
 739
 740         ret = -EINVAL;
 741         if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
 742                 goto error;
 743
 744         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 745         if (IS_ERR(key_ref)) {
 746                 ret = PTR_ERR(key_ref);
 747                 goto error;
 748         }
 749
 750         key = key_ref_to_ptr(key_ref);
 751
 752         /* make the changes with the locks held to prevent chown/chmod races */
 753         ret = -EACCES;
 754         down_write(&key->sem);
 755
 756         /* if we're not the sysadmin, we can only change a key that we own */
 757         if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
 758                 key->perm = perm;
 759                 ret = 0;
 760         }
 761
 762         up_write(&key->sem);
 763         key_put(key);
 764 error:
 765         return ret;
 766
 767 } /* end keyctl_setperm_key() */
 768
 769 /*****************************************************************************/
 770 /*
 771  * instantiate the key with the specified payload, and, if one is given, link
 772  * the key into the keyring
 773  */
 774 long keyctl_instantiate_key(key_serial_t id,
 775                             const void __user *_payload,
 776                             size_t plen,
 777                             key_serial_t ringid)
 778 {
 779         struct request_key_auth *rka;
 780         struct key *instkey;
 781         key_ref_t keyring_ref;
 782         void *payload;
 783         long ret;
 784
 785         ret = -EINVAL;
 786         if (plen > 32767)
 787                 goto error;
 788
 789         /* the appropriate instantiation authorisation key must have been
 790          * assumed before calling this */
 791         ret = -EPERM;
 792         instkey = current->request_key_auth;
 793         if (!instkey)
 794                 goto error;
 795
 796         rka = instkey->payload.data;
 797         if (rka->target_key->serial != id)
 798                 goto error;
 799
 800         /* pull the payload in if one was supplied */
 801         payload = NULL;
 802
 803         if (_payload) {
 804                 ret = -ENOMEM;
 805                 payload = kmalloc(plen, GFP_KERNEL);
 806                 if (!payload)
 807                         goto error;
 808
 809                 ret = -EFAULT;
 810                 if (copy_from_user(payload, _payload, plen) != 0)
 811                         goto error2;
 812         }
 813
 814         /* find the destination keyring amongst those belonging to the
 815          * requesting task */
 816         keyring_ref = NULL;
 817         if (ringid) {
 818                 keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
 819                                               KEY_WRITE);
 820                 if (IS_ERR(keyring_ref)) {
 821                         ret = PTR_ERR(keyring_ref);
 822                         goto error2;
 823                 }
 824         }
 825
 826         /* instantiate the key and link it into a keyring */
 827         ret = key_instantiate_and_link(rka->target_key, payload, plen,
 828                                        key_ref_to_ptr(keyring_ref), instkey);
 829
 830         key_ref_put(keyring_ref);
 831
 832         /* discard the assumed authority if it's just been disabled by
 833          * instantiation of the key */
 834         if (ret == 0) {
 835                 key_put(current->request_key_auth);
 836                 current->request_key_auth = NULL;
 837         }
 838
 839 error2:
 840         kfree(payload);
 841 error:
 842         return ret;
 843
 844 } /* end keyctl_instantiate_key() */
 845
 846 /*****************************************************************************/
 847 /*
 848  * negatively instantiate the key with the given timeout (in seconds), and, if
 849  * one is given, link the key into the keyring
 850  */
 851 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 852 {
 853         struct request_key_auth *rka;
 854         struct key *instkey;
 855         key_ref_t keyring_ref;
 856         long ret;
 857
 858         /* the appropriate instantiation authorisation key must have been
 859          * assumed before calling this */
 860         ret = -EPERM;
 861         instkey = current->request_key_auth;
 862         if (!instkey)
 863                 goto error;
 864
 865         rka = instkey->payload.data;
 866         if (rka->target_key->serial != id)
 867                 goto error;
 868
 869         /* find the destination keyring if present (which must also be
 870          * writable) */
 871         keyring_ref = NULL;
 872         if (ringid) {
 873                 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 874                 if (IS_ERR(keyring_ref)) {
 875                         ret = PTR_ERR(keyring_ref);
 876                         goto error;
 877                 }
 878         }
 879
 880         /* instantiate the key and link it into a keyring */
 881         ret = key_negate_and_link(rka->target_key, timeout,
 882                                   key_ref_to_ptr(keyring_ref), instkey);
 883
 884         key_ref_put(keyring_ref);
 885
 886         /* discard the assumed authority if it's just been disabled by
 887          * instantiation of the key */
 888         if (ret == 0) {
 889                 key_put(current->request_key_auth);
 890                 current->request_key_auth = NULL;
 891         }
 892
 893 error:
 894         return ret;
 895
 896 } /* end keyctl_negate_key() */
 897
 898 /*****************************************************************************/
 899 /*
 900  * set the default keyring in which request_key() will cache keys
 901  * - return the old setting
 902  */
 903 long keyctl_set_reqkey_keyring(int reqkey_defl)
 904 {
 905         int ret;
 906
 907         switch (reqkey_defl) {
 908         case KEY_REQKEY_DEFL_THREAD_KEYRING:
 909                 ret = install_thread_keyring(current);
 910                 if (ret < 0)
 911                         return ret;
 912                 goto set;
 913
 914         case KEY_REQKEY_DEFL_PROCESS_KEYRING:
 915                 ret = install_process_keyring(current);
 916                 if (ret < 0)
 917                         return ret;
 918
 919         case KEY_REQKEY_DEFL_DEFAULT:
 920         case KEY_REQKEY_DEFL_SESSION_KEYRING:
 921         case KEY_REQKEY_DEFL_USER_KEYRING:
 922         case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
 923         set:
 924                 current->jit_keyring = reqkey_defl;
 925
 926         case KEY_REQKEY_DEFL_NO_CHANGE:
 927                 return current->jit_keyring;
 928
 929         case KEY_REQKEY_DEFL_GROUP_KEYRING:
 930         default:
 931                 return -EINVAL;
 932         }
 933
 934 } /* end keyctl_set_reqkey_keyring() */
 935
 936 /*****************************************************************************/
 937 /*
 938  * set or clear the timeout for a key
 939  */
 940 long keyctl_set_timeout(key_serial_t id, unsigned timeout)
 941 {
 942         struct timespec now;
 943         struct key *key;
 944         key_ref_t key_ref;
 945         time_t expiry;
 946         long ret;
 947
 948         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 949         if (IS_ERR(key_ref)) {
 950                 ret = PTR_ERR(key_ref);
 951                 goto error;
 952         }
 953
 954         key = key_ref_to_ptr(key_ref);
 955
 956         /* make the changes with the locks held to prevent races */
 957         down_write(&key->sem);
 958
 959         expiry = 0;
 960         if (timeout > 0) {
 961                 now = current_kernel_time();
 962                 expiry = now.tv_sec + timeout;
 963         }
 964
 965         key->expiry = expiry;
 966
 967         up_write(&key->sem);
 968         key_put(key);
 969
 970         ret = 0;
 971 error:
 972         return ret;
 973
 974 } /* end keyctl_set_timeout() */
 975
 976 /*****************************************************************************/
 977 /*
 978  * assume the authority to instantiate the specified key
 979  */
 980 long keyctl_assume_authority(key_serial_t id)
 981 {
 982         struct key *authkey;
 983         long ret;
 984
 985         /* special key IDs aren't permitted */
 986         ret = -EINVAL;
 987         if (id < 0)
 988                 goto error;
 989
 990         /* we divest ourselves of authority if given an ID of 0 */
 991         if (id == 0) {
 992                 key_put(current->request_key_auth);
 993                 current->request_key_auth = NULL;
 994                 ret = 0;
 995                 goto error;
 996         }
 997
 998         /* attempt to assume the authority temporarily granted to us whilst we
 999          * instantiate the specified key
1000          * - the authorisation key must be in the current task's keyrings
1001          *   somewhere
1002          */
1003         authkey = key_get_instantiation_authkey(id);
1004         if (IS_ERR(authkey)) {
1005                 ret = PTR_ERR(authkey);
1006                 goto error;
1007         }
1008
1009         key_put(current->request_key_auth);
1010         current->request_key_auth = authkey;
1011         ret = authkey->serial;
1012
1013 error:
1014         return ret;
1015
1016 } /* end keyctl_assume_authority() */
1017
1018 /*****************************************************************************/
1019 /*
1020  * the key control system call
1021  */
1022 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
1023                            unsigned long arg4, unsigned long arg5)
1024 {
1025         switch (option) {
1026         case KEYCTL_GET_KEYRING_ID:
1027                 return keyctl_get_keyring_ID((key_serial_t) arg2,
1028                                              (int) arg3);
1029
1030         case KEYCTL_JOIN_SESSION_KEYRING:
1031                 return keyctl_join_session_keyring((const char __user *) arg2);
1032
1033         case KEYCTL_UPDATE:
1034                 return keyctl_update_key((key_serial_t) arg2,
1035                                          (const void __user *) arg3,
1036                                          (size_t) arg4);
1037
1038         case KEYCTL_REVOKE:
1039                 return keyctl_revoke_key((key_serial_t) arg2);
1040
1041         case KEYCTL_DESCRIBE:
1042                 return keyctl_describe_key((key_serial_t) arg2,
1043                                            (char __user *) arg3,
1044                                            (unsigned) arg4);
1045
1046         case KEYCTL_CLEAR:
1047                 return keyctl_keyring_clear((key_serial_t) arg2);
1048
1049         case KEYCTL_LINK:
1050                 return keyctl_keyring_link((key_serial_t) arg2,
1051                                            (key_serial_t) arg3);
1052
1053         case KEYCTL_UNLINK:
1054                 return keyctl_keyring_unlink((key_serial_t) arg2,
1055                                              (key_serial_t) arg3);
1056
1057         case KEYCTL_SEARCH:
1058                 return keyctl_keyring_search((key_serial_t) arg2,
1059                                              (const char __user *) arg3,
1060                                              (const char __user *) arg4,
1061                                              (key_serial_t) arg5);
1062
1063         case KEYCTL_READ:
1064                 return keyctl_read_key((key_serial_t) arg2,
1065                                        (char __user *) arg3,
1066                                        (size_t) arg4);
1067
1068         case KEYCTL_CHOWN:
1069                 return keyctl_chown_key((key_serial_t) arg2,
1070                                         (uid_t) arg3,
1071                                         (gid_t) arg4);
1072
1073         case KEYCTL_SETPERM:
1074                 return keyctl_setperm_key((key_serial_t) arg2,
1075                                           (key_perm_t) arg3);
1076
1077         case KEYCTL_INSTANTIATE:
1078                 return keyctl_instantiate_key((key_serial_t) arg2,
1079                                               (const void __user *) arg3,
1080                                               (size_t) arg4,
1081                                               (key_serial_t) arg5);
1082
1083         case KEYCTL_NEGATE:
1084                 return keyctl_negate_key((key_serial_t) arg2,
1085                                          (unsigned) arg3,
1086                                          (key_serial_t) arg4);
1087
1088         case KEYCTL_SET_REQKEY_KEYRING:
1089                 return keyctl_set_reqkey_keyring(arg2);
1090
1091         case KEYCTL_SET_TIMEOUT:
1092                 return keyctl_set_timeout((key_serial_t) arg2,
1093                                           (unsigned) arg3);
1094
1095         case KEYCTL_ASSUME_AUTHORITY:
1096                 return keyctl_assume_authority((key_serial_t) arg2);
1097
1098         default:
1099                 return -EOPNOTSUPP;
1100         }
1101
1102 } /* end sys_keyctl() */