1 /* Manage a process's keyrings
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/sched.h>
15 #include <linux/keyctl.h>
17 #include <linux/err.h>
18 #include <linux/mutex.h>
19 #include <linux/security.h>
20 #include <linux/user_namespace.h>
21 #include <asm/uaccess.h>
24 /* Session keyring create vs join semaphore */
25 static DEFINE_MUTEX(key_session_mutex
);
27 /* User keyring creation semaphore */
28 static DEFINE_MUTEX(key_user_keyring_mutex
);
30 /* The root user's tracking struct */
31 struct key_user root_key_user
= {
32 .usage
= ATOMIC_INIT(3),
33 .cons_lock
= __MUTEX_INITIALIZER(root_key_user
.cons_lock
),
34 .lock
= __SPIN_LOCK_UNLOCKED(root_key_user
.lock
),
35 .nkeys
= ATOMIC_INIT(2),
36 .nikeys
= ATOMIC_INIT(2),
37 .uid
= GLOBAL_ROOT_UID
,
41 * Install the user and user session keyrings for the current process's UID.
43 int install_user_keyrings(void)
45 struct user_struct
*user
;
46 const struct cred
*cred
;
47 struct key
*uid_keyring
, *session_keyring
;
52 cred
= current_cred();
54 uid
= from_kuid(cred
->user_ns
, user
->uid
);
56 kenter("%p{%u}", user
, uid
);
58 if (user
->uid_keyring
) {
59 kleave(" = 0 [exist]");
63 mutex_lock(&key_user_keyring_mutex
);
66 if (!user
->uid_keyring
) {
67 /* get the UID-specific keyring
68 * - there may be one in existence already as it may have been
69 * pinned by a session, but the user_struct pointing to it
70 * may have been destroyed by setuid */
71 sprintf(buf
, "_uid.%u", uid
);
73 uid_keyring
= find_keyring_by_name(buf
, true);
74 if (IS_ERR(uid_keyring
)) {
75 uid_keyring
= keyring_alloc(buf
, user
->uid
, INVALID_GID
,
76 cred
, KEY_ALLOC_IN_QUOTA
,
78 if (IS_ERR(uid_keyring
)) {
79 ret
= PTR_ERR(uid_keyring
);
84 /* get a default session keyring (which might also exist
86 sprintf(buf
, "_uid_ses.%u", uid
);
88 session_keyring
= find_keyring_by_name(buf
, true);
89 if (IS_ERR(session_keyring
)) {
91 keyring_alloc(buf
, user
->uid
, INVALID_GID
,
92 cred
, KEY_ALLOC_IN_QUOTA
, NULL
);
93 if (IS_ERR(session_keyring
)) {
94 ret
= PTR_ERR(session_keyring
);
98 /* we install a link from the user session keyring to
100 ret
= key_link(session_keyring
, uid_keyring
);
102 goto error_release_both
;
105 /* install the keyrings */
106 user
->uid_keyring
= uid_keyring
;
107 user
->session_keyring
= session_keyring
;
110 mutex_unlock(&key_user_keyring_mutex
);
115 key_put(session_keyring
);
117 key_put(uid_keyring
);
119 mutex_unlock(&key_user_keyring_mutex
);
120 kleave(" = %d", ret
);
125 * Install a fresh thread keyring directly to new credentials. This keyring is
126 * allowed to overrun the quota.
128 int install_thread_keyring_to_cred(struct cred
*new)
132 keyring
= keyring_alloc("_tid", new->uid
, new->gid
, new,
133 KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
135 return PTR_ERR(keyring
);
137 new->thread_keyring
= keyring
;
142 * Install a fresh thread keyring, discarding the old one.
144 static int install_thread_keyring(void)
149 new = prepare_creds();
153 BUG_ON(new->thread_keyring
);
155 ret
= install_thread_keyring_to_cred(new);
161 return commit_creds(new);
165 * Install a process keyring directly to a credentials struct.
167 * Returns -EEXIST if there was already a process keyring, 0 if one installed,
168 * and other value on any other error
170 int install_process_keyring_to_cred(struct cred
*new)
175 if (new->tgcred
->process_keyring
)
178 keyring
= keyring_alloc("_pid", new->uid
, new->gid
,
179 new, KEY_ALLOC_QUOTA_OVERRUN
, NULL
);
181 return PTR_ERR(keyring
);
183 spin_lock_irq(&new->tgcred
->lock
);
184 if (!new->tgcred
->process_keyring
) {
185 new->tgcred
->process_keyring
= keyring
;
191 spin_unlock_irq(&new->tgcred
->lock
);
197 * Make sure a process keyring is installed for the current process. The
198 * existing process keyring is not replaced.
200 * Returns 0 if there is a process keyring by the end of this function, some
203 static int install_process_keyring(void)
208 new = prepare_creds();
212 ret
= install_process_keyring_to_cred(new);
215 return ret
!= -EEXIST
? ret
: 0;
218 return commit_creds(new);
222 * Install a session keyring directly to a credentials struct.
224 int install_session_keyring_to_cred(struct cred
*cred
, struct key
*keyring
)
231 /* create an empty session keyring */
233 flags
= KEY_ALLOC_QUOTA_OVERRUN
;
234 if (cred
->tgcred
->session_keyring
)
235 flags
= KEY_ALLOC_IN_QUOTA
;
237 keyring
= keyring_alloc("_ses", cred
->uid
, cred
->gid
,
240 return PTR_ERR(keyring
);
242 atomic_inc(&keyring
->usage
);
245 /* install the keyring */
246 spin_lock_irq(&cred
->tgcred
->lock
);
247 old
= cred
->tgcred
->session_keyring
;
248 rcu_assign_pointer(cred
->tgcred
->session_keyring
, keyring
);
249 spin_unlock_irq(&cred
->tgcred
->lock
);
251 /* we're using RCU on the pointer, but there's no point synchronising
252 * on it if it didn't previously point to anything */
262 * Install a session keyring, discarding the old one. If a keyring is not
263 * supplied, an empty one is invented.
265 static int install_session_keyring(struct key
*keyring
)
270 new = prepare_creds();
274 ret
= install_session_keyring_to_cred(new, keyring
);
280 return commit_creds(new);
284 * Handle the fsuid changing.
286 void key_fsuid_changed(struct task_struct
*tsk
)
288 /* update the ownership of the thread keyring */
290 if (tsk
->cred
->thread_keyring
) {
291 down_write(&tsk
->cred
->thread_keyring
->sem
);
292 tsk
->cred
->thread_keyring
->uid
= tsk
->cred
->fsuid
;
293 up_write(&tsk
->cred
->thread_keyring
->sem
);
298 * Handle the fsgid changing.
300 void key_fsgid_changed(struct task_struct
*tsk
)
302 /* update the ownership of the thread keyring */
304 if (tsk
->cred
->thread_keyring
) {
305 down_write(&tsk
->cred
->thread_keyring
->sem
);
306 tsk
->cred
->thread_keyring
->gid
= tsk
->cred
->fsgid
;
307 up_write(&tsk
->cred
->thread_keyring
->sem
);
312 * Search the process keyrings attached to the supplied cred for the first
315 * The search criteria are the type and the match function. The description is
316 * given to the match function as a parameter, but doesn't otherwise influence
317 * the search. Typically the match function will compare the description
318 * parameter to the key's description.
320 * This can only search keyrings that grant Search permission to the supplied
321 * credentials. Keyrings linked to searched keyrings will also be searched if
322 * they grant Search permission too. Keys can only be found if they grant
323 * Search permission to the credentials.
325 * Returns a pointer to the key with the key usage count incremented if
326 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
327 * matched negative keys.
329 * In the case of a successful return, the possession attribute is set on the
330 * returned key reference.
332 key_ref_t
search_my_process_keyrings(struct key_type
*type
,
333 const void *description
,
334 key_match_func_t match
,
336 const struct cred
*cred
)
338 key_ref_t key_ref
, ret
, err
;
340 /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
341 * searchable, but we failed to find a key or we found a negative key;
342 * otherwise we want to return a sample error (probably -EACCES) if
343 * none of the keyrings were searchable
345 * in terms of priority: success > -ENOKEY > -EAGAIN > other error
349 err
= ERR_PTR(-EAGAIN
);
351 /* search the thread keyring first */
352 if (cred
->thread_keyring
) {
353 key_ref
= keyring_search_aux(
354 make_key_ref(cred
->thread_keyring
, 1),
355 cred
, type
, description
, match
, no_state_check
);
356 if (!IS_ERR(key_ref
))
359 switch (PTR_ERR(key_ref
)) {
360 case -EAGAIN
: /* no key */
363 case -ENOKEY
: /* negative key */
372 /* search the process keyring second */
373 if (cred
->tgcred
->process_keyring
) {
374 key_ref
= keyring_search_aux(
375 make_key_ref(cred
->tgcred
->process_keyring
, 1),
376 cred
, type
, description
, match
, no_state_check
);
377 if (!IS_ERR(key_ref
))
380 switch (PTR_ERR(key_ref
)) {
381 case -EAGAIN
: /* no key */
384 case -ENOKEY
: /* negative key */
393 /* search the session keyring */
394 if (cred
->tgcred
->session_keyring
) {
396 key_ref
= keyring_search_aux(
397 make_key_ref(rcu_dereference(
398 cred
->tgcred
->session_keyring
),
400 cred
, type
, description
, match
, no_state_check
);
403 if (!IS_ERR(key_ref
))
406 switch (PTR_ERR(key_ref
)) {
407 case -EAGAIN
: /* no key */
410 case -ENOKEY
: /* negative key */
418 /* or search the user-session keyring */
419 else if (cred
->user
->session_keyring
) {
420 key_ref
= keyring_search_aux(
421 make_key_ref(cred
->user
->session_keyring
, 1),
422 cred
, type
, description
, match
, no_state_check
);
423 if (!IS_ERR(key_ref
))
426 switch (PTR_ERR(key_ref
)) {
427 case -EAGAIN
: /* no key */
430 case -ENOKEY
: /* negative key */
439 /* no key - decide on the error we're going to go for */
440 key_ref
= ret
? ret
: err
;
447 * Search the process keyrings attached to the supplied cred for the first
448 * matching key in the manner of search_my_process_keyrings(), but also search
449 * the keys attached to the assumed authorisation key using its credentials if
452 * Return same as search_my_process_keyrings().
454 key_ref_t
search_process_keyrings(struct key_type
*type
,
455 const void *description
,
456 key_match_func_t match
,
457 const struct cred
*cred
)
459 struct request_key_auth
*rka
;
460 key_ref_t key_ref
, ret
= ERR_PTR(-EACCES
), err
;
464 key_ref
= search_my_process_keyrings(type
, description
, match
,
466 if (!IS_ERR(key_ref
))
470 /* if this process has an instantiation authorisation key, then we also
471 * search the keyrings of the process mentioned there
472 * - we don't permit access to request_key auth keys via this method
474 if (cred
->request_key_auth
&&
475 cred
== current_cred() &&
476 type
!= &key_type_request_key_auth
478 /* defend against the auth key being revoked */
479 down_read(&cred
->request_key_auth
->sem
);
481 if (key_validate(cred
->request_key_auth
) == 0) {
482 rka
= cred
->request_key_auth
->payload
.data
;
484 key_ref
= search_process_keyrings(type
, description
,
487 up_read(&cred
->request_key_auth
->sem
);
489 if (!IS_ERR(key_ref
))
494 up_read(&cred
->request_key_auth
->sem
);
498 /* no key - decide on the error we're going to go for */
499 if (err
== ERR_PTR(-ENOKEY
) || ret
== ERR_PTR(-ENOKEY
))
500 key_ref
= ERR_PTR(-ENOKEY
);
501 else if (err
== ERR_PTR(-EACCES
))
511 * See if the key we're looking at is the target key.
513 int lookup_user_key_possessed(const struct key
*key
, const void *target
)
515 return key
== target
;
519 * Look up a key ID given us by userspace with a given permissions mask to get
520 * the key it refers to.
522 * Flags can be passed to request that special keyrings be created if referred
523 * to directly, to permit partially constructed keys to be found and to skip
524 * validity and permission checks on the found key.
526 * Returns a pointer to the key with an incremented usage count if successful;
527 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
528 * to a key or the best found key was a negative key; -EKEYREVOKED or
529 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
530 * found key doesn't grant the requested permit or the LSM denied access to it;
531 * or -ENOMEM if a special keyring couldn't be created.
533 * In the case of a successful return, the possession attribute is set on the
534 * returned key reference.
536 key_ref_t
lookup_user_key(key_serial_t id
, unsigned long lflags
,
539 struct request_key_auth
*rka
;
540 const struct cred
*cred
;
542 key_ref_t key_ref
, skey_ref
;
546 cred
= get_current_cred();
547 key_ref
= ERR_PTR(-ENOKEY
);
550 case KEY_SPEC_THREAD_KEYRING
:
551 if (!cred
->thread_keyring
) {
552 if (!(lflags
& KEY_LOOKUP_CREATE
))
555 ret
= install_thread_keyring();
557 key_ref
= ERR_PTR(ret
);
563 key
= cred
->thread_keyring
;
564 atomic_inc(&key
->usage
);
565 key_ref
= make_key_ref(key
, 1);
568 case KEY_SPEC_PROCESS_KEYRING
:
569 if (!cred
->tgcred
->process_keyring
) {
570 if (!(lflags
& KEY_LOOKUP_CREATE
))
573 ret
= install_process_keyring();
575 key_ref
= ERR_PTR(ret
);
581 key
= cred
->tgcred
->process_keyring
;
582 atomic_inc(&key
->usage
);
583 key_ref
= make_key_ref(key
, 1);
586 case KEY_SPEC_SESSION_KEYRING
:
587 if (!cred
->tgcred
->session_keyring
) {
588 /* always install a session keyring upon access if one
589 * doesn't exist yet */
590 ret
= install_user_keyrings();
593 if (lflags
& KEY_LOOKUP_CREATE
)
594 ret
= join_session_keyring(NULL
);
596 ret
= install_session_keyring(
597 cred
->user
->session_keyring
);
602 } else if (cred
->tgcred
->session_keyring
==
603 cred
->user
->session_keyring
&&
604 lflags
& KEY_LOOKUP_CREATE
) {
605 ret
= join_session_keyring(NULL
);
612 key
= rcu_dereference(cred
->tgcred
->session_keyring
);
613 atomic_inc(&key
->usage
);
615 key_ref
= make_key_ref(key
, 1);
618 case KEY_SPEC_USER_KEYRING
:
619 if (!cred
->user
->uid_keyring
) {
620 ret
= install_user_keyrings();
625 key
= cred
->user
->uid_keyring
;
626 atomic_inc(&key
->usage
);
627 key_ref
= make_key_ref(key
, 1);
630 case KEY_SPEC_USER_SESSION_KEYRING
:
631 if (!cred
->user
->session_keyring
) {
632 ret
= install_user_keyrings();
637 key
= cred
->user
->session_keyring
;
638 atomic_inc(&key
->usage
);
639 key_ref
= make_key_ref(key
, 1);
642 case KEY_SPEC_GROUP_KEYRING
:
643 /* group keyrings are not yet supported */
644 key_ref
= ERR_PTR(-EINVAL
);
647 case KEY_SPEC_REQKEY_AUTH_KEY
:
648 key
= cred
->request_key_auth
;
652 atomic_inc(&key
->usage
);
653 key_ref
= make_key_ref(key
, 1);
656 case KEY_SPEC_REQUESTOR_KEYRING
:
657 if (!cred
->request_key_auth
)
660 down_read(&cred
->request_key_auth
->sem
);
661 if (test_bit(KEY_FLAG_REVOKED
,
662 &cred
->request_key_auth
->flags
)) {
663 key_ref
= ERR_PTR(-EKEYREVOKED
);
666 rka
= cred
->request_key_auth
->payload
.data
;
667 key
= rka
->dest_keyring
;
668 atomic_inc(&key
->usage
);
670 up_read(&cred
->request_key_auth
->sem
);
673 key_ref
= make_key_ref(key
, 1);
677 key_ref
= ERR_PTR(-EINVAL
);
681 key
= key_lookup(id
);
683 key_ref
= ERR_CAST(key
);
687 key_ref
= make_key_ref(key
, 0);
689 /* check to see if we possess the key */
690 skey_ref
= search_process_keyrings(key
->type
, key
,
691 lookup_user_key_possessed
,
694 if (!IS_ERR(skey_ref
)) {
702 /* unlink does not use the nominated key in any way, so can skip all
703 * the permission checks as it is only concerned with the keyring */
704 if (lflags
& KEY_LOOKUP_FOR_UNLINK
) {
709 if (!(lflags
& KEY_LOOKUP_PARTIAL
)) {
710 ret
= wait_for_key_construction(key
, true);
721 ret
= key_validate(key
);
727 if (!(lflags
& KEY_LOOKUP_PARTIAL
) &&
728 !test_bit(KEY_FLAG_INSTANTIATED
, &key
->flags
))
731 /* check the permissions */
732 ret
= key_task_permission(key_ref
, cred
, perm
);
736 key
->last_used_at
= current_kernel_time().tv_sec
;
743 key_ref_put(key_ref
);
744 key_ref
= ERR_PTR(ret
);
747 /* if we attempted to install a keyring, then it may have caused new
748 * creds to be installed */
755 * Join the named keyring as the session keyring if possible else attempt to
756 * create a new one of that name and join that.
758 * If the name is NULL, an empty anonymous keyring will be installed as the
761 * Named session keyrings are joined with a semaphore held to prevent the
762 * keyrings from going away whilst the attempt is made to going them and also
763 * to prevent a race in creating compatible session keyrings.
765 long join_session_keyring(const char *name
)
767 const struct cred
*old
;
772 /* only permit this if there's a single thread in the thread group -
773 * this avoids us having to adjust the creds on all threads and risking
775 if (!current_is_single_threaded())
778 new = prepare_creds();
781 old
= current_cred();
783 /* if no name is provided, install an anonymous keyring */
785 ret
= install_session_keyring_to_cred(new, NULL
);
789 serial
= new->tgcred
->session_keyring
->serial
;
790 ret
= commit_creds(new);
796 /* allow the user to join or create a named keyring */
797 mutex_lock(&key_session_mutex
);
799 /* look for an existing keyring of this name */
800 keyring
= find_keyring_by_name(name
, false);
801 if (PTR_ERR(keyring
) == -ENOKEY
) {
802 /* not found - try and create a new one */
803 keyring
= keyring_alloc(name
, old
->uid
, old
->gid
, old
,
804 KEY_ALLOC_IN_QUOTA
, NULL
);
805 if (IS_ERR(keyring
)) {
806 ret
= PTR_ERR(keyring
);
809 } else if (IS_ERR(keyring
)) {
810 ret
= PTR_ERR(keyring
);
814 /* we've got a keyring - now to install it */
815 ret
= install_session_keyring_to_cred(new, keyring
);
820 mutex_unlock(&key_session_mutex
);
822 ret
= keyring
->serial
;
828 mutex_unlock(&key_session_mutex
);
835 * Replace a process's session keyring on behalf of one of its children when
836 * the target process is about to resume userspace execution.
838 void key_change_session_keyring(struct callback_head
*twork
)
840 const struct cred
*old
= current_cred();
841 struct cred
*new = container_of(twork
, struct cred
, rcu
);
843 if (unlikely(current
->flags
& PF_EXITING
)) {
848 new-> uid
= old
-> uid
;
849 new-> euid
= old
-> euid
;
850 new-> suid
= old
-> suid
;
851 new->fsuid
= old
->fsuid
;
852 new-> gid
= old
-> gid
;
853 new-> egid
= old
-> egid
;
854 new-> sgid
= old
-> sgid
;
855 new->fsgid
= old
->fsgid
;
856 new->user
= get_uid(old
->user
);
857 new->user_ns
= get_user_ns(new->user_ns
);
858 new->group_info
= get_group_info(old
->group_info
);
860 new->securebits
= old
->securebits
;
861 new->cap_inheritable
= old
->cap_inheritable
;
862 new->cap_permitted
= old
->cap_permitted
;
863 new->cap_effective
= old
->cap_effective
;
864 new->cap_bset
= old
->cap_bset
;
866 new->jit_keyring
= old
->jit_keyring
;
867 new->thread_keyring
= key_get(old
->thread_keyring
);
868 new->tgcred
->tgid
= old
->tgcred
->tgid
;
869 new->tgcred
->process_keyring
= key_get(old
->tgcred
->process_keyring
);
871 security_transfer_creds(new, old
);