keyctl.c 26 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142
  1. /* keyctl.c: userspace keyctl operations
  2. *
  3. * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
  4. * Written by David Howells (dhowells@redhat.com)
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. */
  11. #include <linux/module.h>
  12. #include <linux/init.h>
  13. #include <linux/sched.h>
  14. #include <linux/slab.h>
  15. #include <linux/syscalls.h>
  16. #include <linux/keyctl.h>
  17. #include <linux/fs.h>
  18. #include <linux/capability.h>
  19. #include <linux/string.h>
  20. #include <linux/err.h>
  21. #include <asm/uaccess.h>
  22. #include "internal.h"
  23. static int key_get_type_from_user(char *type,
  24. const char __user *_type,
  25. unsigned len)
  26. {
  27. int ret;
  28. ret = strncpy_from_user(type, _type, len);
  29. if (ret < 0)
  30. return -EFAULT;
  31. if (ret == 0 || ret >= len)
  32. return -EINVAL;
  33. if (type[0] == '.')
  34. return -EPERM;
  35. type[len - 1] = '\0';
  36. return 0;
  37. }
  38. /*****************************************************************************/
  39. /*
  40. * extract the description of a new key from userspace and either add it as a
  41. * new key to the specified keyring or update a matching key in that keyring
  42. * - the keyring must be writable
  43. * - returns the new key's serial number
  44. * - implements add_key()
  45. */
  46. asmlinkage long sys_add_key(const char __user *_type,
  47. const char __user *_description,
  48. const void __user *_payload,
  49. size_t plen,
  50. key_serial_t ringid)
  51. {
  52. key_ref_t keyring_ref, key_ref;
  53. char type[32], *description;
  54. void *payload;
  55. long ret;
  56. ret = -EINVAL;
  57. if (plen > 32767)
  58. goto error;
  59. /* draw all the data into kernel space */
  60. ret = key_get_type_from_user(type, _type, sizeof(type));
  61. if (ret < 0)
  62. goto error;
  63. description = strndup_user(_description, PAGE_SIZE);
  64. if (IS_ERR(description)) {
  65. ret = PTR_ERR(description);
  66. goto error;
  67. }
  68. /* pull the payload in if one was supplied */
  69. payload = NULL;
  70. if (_payload) {
  71. ret = -ENOMEM;
  72. payload = kmalloc(plen, GFP_KERNEL);
  73. if (!payload)
  74. goto error2;
  75. ret = -EFAULT;
  76. if (copy_from_user(payload, _payload, plen) != 0)
  77. goto error3;
  78. }
  79. /* find the target keyring (which must be writable) */
  80. keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  81. if (IS_ERR(keyring_ref)) {
  82. ret = PTR_ERR(keyring_ref);
  83. goto error3;
  84. }
  85. /* create or update the requested key and add it to the target
  86. * keyring */
  87. key_ref = key_create_or_update(keyring_ref, type, description,
  88. payload, plen, KEY_ALLOC_IN_QUOTA);
  89. if (!IS_ERR(key_ref)) {
  90. ret = key_ref_to_ptr(key_ref)->serial;
  91. key_ref_put(key_ref);
  92. }
  93. else {
  94. ret = PTR_ERR(key_ref);
  95. }
  96. key_ref_put(keyring_ref);
  97. error3:
  98. kfree(payload);
  99. error2:
  100. kfree(description);
  101. error:
  102. return ret;
  103. } /* end sys_add_key() */
  104. /*****************************************************************************/
  105. /*
  106. * search the process keyrings for a matching key
  107. * - nested keyrings may also be searched if they have Search permission
  108. * - if a key is found, it will be attached to the destination keyring if
  109. * there's one specified
  110. * - /sbin/request-key will be invoked if _callout_info is non-NULL
  111. * - the _callout_info string will be passed to /sbin/request-key
  112. * - if the _callout_info string is empty, it will be rendered as "-"
  113. * - implements request_key()
  114. */
  115. asmlinkage long sys_request_key(const char __user *_type,
  116. const char __user *_description,
  117. const char __user *_callout_info,
  118. key_serial_t destringid)
  119. {
  120. struct key_type *ktype;
  121. struct key *key;
  122. key_ref_t dest_ref;
  123. char type[32], *description, *callout_info;
  124. long ret;
  125. /* pull the type into kernel space */
  126. ret = key_get_type_from_user(type, _type, sizeof(type));
  127. if (ret < 0)
  128. goto error;
  129. /* pull the description into kernel space */
  130. description = strndup_user(_description, PAGE_SIZE);
  131. if (IS_ERR(description)) {
  132. ret = PTR_ERR(description);
  133. goto error;
  134. }
  135. /* pull the callout info into kernel space */
  136. callout_info = NULL;
  137. if (_callout_info) {
  138. callout_info = strndup_user(_callout_info, PAGE_SIZE);
  139. if (IS_ERR(callout_info)) {
  140. ret = PTR_ERR(callout_info);
  141. goto error2;
  142. }
  143. }
  144. /* get the destination keyring if specified */
  145. dest_ref = NULL;
  146. if (destringid) {
  147. dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
  148. if (IS_ERR(dest_ref)) {
  149. ret = PTR_ERR(dest_ref);
  150. goto error3;
  151. }
  152. }
  153. /* find the key type */
  154. ktype = key_type_lookup(type);
  155. if (IS_ERR(ktype)) {
  156. ret = PTR_ERR(ktype);
  157. goto error4;
  158. }
  159. /* do the search */
  160. key = request_key_and_link(ktype, description, callout_info, NULL,
  161. key_ref_to_ptr(dest_ref),
  162. KEY_ALLOC_IN_QUOTA);
  163. if (IS_ERR(key)) {
  164. ret = PTR_ERR(key);
  165. goto error5;
  166. }
  167. ret = key->serial;
  168. key_put(key);
  169. error5:
  170. key_type_put(ktype);
  171. error4:
  172. key_ref_put(dest_ref);
  173. error3:
  174. kfree(callout_info);
  175. error2:
  176. kfree(description);
  177. error:
  178. return ret;
  179. } /* end sys_request_key() */
  180. /*****************************************************************************/
  181. /*
  182. * get the ID of the specified process keyring
  183. * - the keyring must have search permission to be found
  184. * - implements keyctl(KEYCTL_GET_KEYRING_ID)
  185. */
  186. long keyctl_get_keyring_ID(key_serial_t id, int create)
  187. {
  188. key_ref_t key_ref;
  189. long ret;
  190. key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
  191. if (IS_ERR(key_ref)) {
  192. ret = PTR_ERR(key_ref);
  193. goto error;
  194. }
  195. ret = key_ref_to_ptr(key_ref)->serial;
  196. key_ref_put(key_ref);
  197. error:
  198. return ret;
  199. } /* end keyctl_get_keyring_ID() */
  200. /*****************************************************************************/
  201. /*
  202. * join the session keyring
  203. * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
  204. */
  205. long keyctl_join_session_keyring(const char __user *_name)
  206. {
  207. char *name;
  208. long ret;
  209. /* fetch the name from userspace */
  210. name = NULL;
  211. if (_name) {
  212. name = strndup_user(_name, PAGE_SIZE);
  213. if (IS_ERR(name)) {
  214. ret = PTR_ERR(name);
  215. goto error;
  216. }
  217. }
  218. /* join the session */
  219. ret = join_session_keyring(name);
  220. error:
  221. return ret;
  222. } /* end keyctl_join_session_keyring() */
  223. /*****************************************************************************/
  224. /*
  225. * update a key's data payload
  226. * - the key must be writable
  227. * - implements keyctl(KEYCTL_UPDATE)
  228. */
  229. long keyctl_update_key(key_serial_t id,
  230. const void __user *_payload,
  231. size_t plen)
  232. {
  233. key_ref_t key_ref;
  234. void *payload;
  235. long ret;
  236. ret = -EINVAL;
  237. if (plen > PAGE_SIZE)
  238. goto error;
  239. /* pull the payload in if one was supplied */
  240. payload = NULL;
  241. if (_payload) {
  242. ret = -ENOMEM;
  243. payload = kmalloc(plen, GFP_KERNEL);
  244. if (!payload)
  245. goto error;
  246. ret = -EFAULT;
  247. if (copy_from_user(payload, _payload, plen) != 0)
  248. goto error2;
  249. }
  250. /* find the target key (which must be writable) */
  251. key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
  252. if (IS_ERR(key_ref)) {
  253. ret = PTR_ERR(key_ref);
  254. goto error2;
  255. }
  256. /* update the key */
  257. ret = key_update(key_ref, payload, plen);
  258. key_ref_put(key_ref);
  259. error2:
  260. kfree(payload);
  261. error:
  262. return ret;
  263. } /* end keyctl_update_key() */
  264. /*****************************************************************************/
  265. /*
  266. * revoke a key
  267. * - the key must be writable
  268. * - implements keyctl(KEYCTL_REVOKE)
  269. */
  270. long keyctl_revoke_key(key_serial_t id)
  271. {
  272. key_ref_t key_ref;
  273. long ret;
  274. key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
  275. if (IS_ERR(key_ref)) {
  276. ret = PTR_ERR(key_ref);
  277. goto error;
  278. }
  279. key_revoke(key_ref_to_ptr(key_ref));
  280. ret = 0;
  281. key_ref_put(key_ref);
  282. error:
  283. return ret;
  284. } /* end keyctl_revoke_key() */
  285. /*****************************************************************************/
  286. /*
  287. * clear the specified process keyring
  288. * - the keyring must be writable
  289. * - implements keyctl(KEYCTL_CLEAR)
  290. */
  291. long keyctl_keyring_clear(key_serial_t ringid)
  292. {
  293. key_ref_t keyring_ref;
  294. long ret;
  295. keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  296. if (IS_ERR(keyring_ref)) {
  297. ret = PTR_ERR(keyring_ref);
  298. goto error;
  299. }
  300. ret = keyring_clear(key_ref_to_ptr(keyring_ref));
  301. key_ref_put(keyring_ref);
  302. error:
  303. return ret;
  304. } /* end keyctl_keyring_clear() */
  305. /*****************************************************************************/
  306. /*
  307. * link a key into a keyring
  308. * - the keyring must be writable
  309. * - the key must be linkable
  310. * - implements keyctl(KEYCTL_LINK)
  311. */
  312. long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
  313. {
  314. key_ref_t keyring_ref, key_ref;
  315. long ret;
  316. keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  317. if (IS_ERR(keyring_ref)) {
  318. ret = PTR_ERR(keyring_ref);
  319. goto error;
  320. }
  321. key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
  322. if (IS_ERR(key_ref)) {
  323. ret = PTR_ERR(key_ref);
  324. goto error2;
  325. }
  326. ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
  327. key_ref_put(key_ref);
  328. error2:
  329. key_ref_put(keyring_ref);
  330. error:
  331. return ret;
  332. } /* end keyctl_keyring_link() */
  333. /*****************************************************************************/
  334. /*
  335. * unlink the first attachment of a key from a keyring
  336. * - the keyring must be writable
  337. * - we don't need any permissions on the key
  338. * - implements keyctl(KEYCTL_UNLINK)
  339. */
  340. long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
  341. {
  342. key_ref_t keyring_ref, key_ref;
  343. long ret;
  344. keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
  345. if (IS_ERR(keyring_ref)) {
  346. ret = PTR_ERR(keyring_ref);
  347. goto error;
  348. }
  349. key_ref = lookup_user_key(NULL, id, 0, 0, 0);
  350. if (IS_ERR(key_ref)) {
  351. ret = PTR_ERR(key_ref);
  352. goto error2;
  353. }
  354. ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
  355. key_ref_put(key_ref);
  356. error2:
  357. key_ref_put(keyring_ref);
  358. error:
  359. return ret;
  360. } /* end keyctl_keyring_unlink() */
  361. /*****************************************************************************/
  362. /*
  363. * describe a user key
  364. * - the key must have view permission
  365. * - if there's a buffer, we place up to buflen bytes of data into it
  366. * - unless there's an error, we return the amount of description available,
  367. * irrespective of how much we may have copied
  368. * - the description is formatted thus:
  369. * type;uid;gid;perm;description<NUL>
  370. * - implements keyctl(KEYCTL_DESCRIBE)
  371. */
  372. long keyctl_describe_key(key_serial_t keyid,
  373. char __user *buffer,
  374. size_t buflen)
  375. {
  376. struct key *key, *instkey;
  377. key_ref_t key_ref;
  378. char *tmpbuf;
  379. long ret;
  380. key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
  381. if (IS_ERR(key_ref)) {
  382. /* viewing a key under construction is permitted if we have the
  383. * authorisation token handy */
  384. if (PTR_ERR(key_ref) == -EACCES) {
  385. instkey = key_get_instantiation_authkey(keyid);
  386. if (!IS_ERR(instkey)) {
  387. key_put(instkey);
  388. key_ref = lookup_user_key(NULL, keyid,
  389. 0, 1, 0);
  390. if (!IS_ERR(key_ref))
  391. goto okay;
  392. }
  393. }
  394. ret = PTR_ERR(key_ref);
  395. goto error;
  396. }
  397. okay:
  398. /* calculate how much description we're going to return */
  399. ret = -ENOMEM;
  400. tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
  401. if (!tmpbuf)
  402. goto error2;
  403. key = key_ref_to_ptr(key_ref);
  404. ret = snprintf(tmpbuf, PAGE_SIZE - 1,
  405. "%s;%d;%d;%08x;%s",
  406. key_ref_to_ptr(key_ref)->type->name,
  407. key_ref_to_ptr(key_ref)->uid,
  408. key_ref_to_ptr(key_ref)->gid,
  409. key_ref_to_ptr(key_ref)->perm,
  410. key_ref_to_ptr(key_ref)->description ?
  411. key_ref_to_ptr(key_ref)->description : ""
  412. );
  413. /* include a NUL char at the end of the data */
  414. if (ret > PAGE_SIZE - 1)
  415. ret = PAGE_SIZE - 1;
  416. tmpbuf[ret] = 0;
  417. ret++;
  418. /* consider returning the data */
  419. if (buffer && buflen > 0) {
  420. if (buflen > ret)
  421. buflen = ret;
  422. if (copy_to_user(buffer, tmpbuf, buflen) != 0)
  423. ret = -EFAULT;
  424. }
  425. kfree(tmpbuf);
  426. error2:
  427. key_ref_put(key_ref);
  428. error:
  429. return ret;
  430. } /* end keyctl_describe_key() */
  431. /*****************************************************************************/
  432. /*
  433. * search the specified keyring for a matching key
  434. * - the start keyring must be searchable
  435. * - nested keyrings may also be searched if they are searchable
  436. * - only keys with search permission may be found
  437. * - if a key is found, it will be attached to the destination keyring if
  438. * there's one specified
  439. * - implements keyctl(KEYCTL_SEARCH)
  440. */
  441. long keyctl_keyring_search(key_serial_t ringid,
  442. const char __user *_type,
  443. const char __user *_description,
  444. key_serial_t destringid)
  445. {
  446. struct key_type *ktype;
  447. key_ref_t keyring_ref, key_ref, dest_ref;
  448. char type[32], *description;
  449. long ret;
  450. /* pull the type and description into kernel space */
  451. ret = key_get_type_from_user(type, _type, sizeof(type));
  452. if (ret < 0)
  453. goto error;
  454. description = strndup_user(_description, PAGE_SIZE);
  455. if (IS_ERR(description)) {
  456. ret = PTR_ERR(description);
  457. goto error;
  458. }
  459. /* get the keyring at which to begin the search */
  460. keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
  461. if (IS_ERR(keyring_ref)) {
  462. ret = PTR_ERR(keyring_ref);
  463. goto error2;
  464. }
  465. /* get the destination keyring if specified */
  466. dest_ref = NULL;
  467. if (destringid) {
  468. dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
  469. if (IS_ERR(dest_ref)) {
  470. ret = PTR_ERR(dest_ref);
  471. goto error3;
  472. }
  473. }
  474. /* find the key type */
  475. ktype = key_type_lookup(type);
  476. if (IS_ERR(ktype)) {
  477. ret = PTR_ERR(ktype);
  478. goto error4;
  479. }
  480. /* do the search */
  481. key_ref = keyring_search(keyring_ref, ktype, description);
  482. if (IS_ERR(key_ref)) {
  483. ret = PTR_ERR(key_ref);
  484. /* treat lack or presence of a negative key the same */
  485. if (ret == -EAGAIN)
  486. ret = -ENOKEY;
  487. goto error5;
  488. }
  489. /* link the resulting key to the destination keyring if we can */
  490. if (dest_ref) {
  491. ret = key_permission(key_ref, KEY_LINK);
  492. if (ret < 0)
  493. goto error6;
  494. ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
  495. if (ret < 0)
  496. goto error6;
  497. }
  498. ret = key_ref_to_ptr(key_ref)->serial;
  499. error6:
  500. key_ref_put(key_ref);
  501. error5:
  502. key_type_put(ktype);
  503. error4:
  504. key_ref_put(dest_ref);
  505. error3:
  506. key_ref_put(keyring_ref);
  507. error2:
  508. kfree(description);
  509. error:
  510. return ret;
  511. } /* end keyctl_keyring_search() */
  512. /*****************************************************************************/
  513. /*
  514. * read a user key's payload
  515. * - the keyring must be readable or the key must be searchable from the
  516. * process's keyrings
  517. * - if there's a buffer, we place up to buflen bytes of data into it
  518. * - unless there's an error, we return the amount of data in the key,
  519. * irrespective of how much we may have copied
  520. * - implements keyctl(KEYCTL_READ)
  521. */
  522. long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
  523. {
  524. struct key *key;
  525. key_ref_t key_ref;
  526. long ret;
  527. /* find the key first */
  528. key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
  529. if (IS_ERR(key_ref)) {
  530. ret = -ENOKEY;
  531. goto error;
  532. }
  533. key = key_ref_to_ptr(key_ref);
  534. /* see if we can read it directly */
  535. ret = key_permission(key_ref, KEY_READ);
  536. if (ret == 0)
  537. goto can_read_key;
  538. if (ret != -EACCES)
  539. goto error;
  540. /* we can't; see if it's searchable from this process's keyrings
  541. * - we automatically take account of the fact that it may be
  542. * dangling off an instantiation key
  543. */
  544. if (!is_key_possessed(key_ref)) {
  545. ret = -EACCES;
  546. goto error2;
  547. }
  548. /* the key is probably readable - now try to read it */
  549. can_read_key:
  550. ret = key_validate(key);
  551. if (ret == 0) {
  552. ret = -EOPNOTSUPP;
  553. if (key->type->read) {
  554. /* read the data with the semaphore held (since we
  555. * might sleep) */
  556. down_read(&key->sem);
  557. ret = key->type->read(key, buffer, buflen);
  558. up_read(&key->sem);
  559. }
  560. }
  561. error2:
  562. key_put(key);
  563. error:
  564. return ret;
  565. } /* end keyctl_read_key() */
  566. /*****************************************************************************/
  567. /*
  568. * change the ownership of a key
  569. * - the keyring owned by the changer
  570. * - if the uid or gid is -1, then that parameter is not changed
  571. * - implements keyctl(KEYCTL_CHOWN)
  572. */
  573. long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
  574. {
  575. struct key_user *newowner, *zapowner = NULL;
  576. struct key *key;
  577. key_ref_t key_ref;
  578. long ret;
  579. ret = 0;
  580. if (uid == (uid_t) -1 && gid == (gid_t) -1)
  581. goto error;
  582. key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
  583. if (IS_ERR(key_ref)) {
  584. ret = PTR_ERR(key_ref);
  585. goto error;
  586. }
  587. key = key_ref_to_ptr(key_ref);
  588. /* make the changes with the locks held to prevent chown/chown races */
  589. ret = -EACCES;
  590. down_write(&key->sem);
  591. if (!capable(CAP_SYS_ADMIN)) {
  592. /* only the sysadmin can chown a key to some other UID */
  593. if (uid != (uid_t) -1 && key->uid != uid)
  594. goto error_put;
  595. /* only the sysadmin can set the key's GID to a group other
  596. * than one of those that the current process subscribes to */
  597. if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
  598. goto error_put;
  599. }
  600. /* change the UID */
  601. if (uid != (uid_t) -1 && uid != key->uid) {
  602. ret = -ENOMEM;
  603. newowner = key_user_lookup(uid);
  604. if (!newowner)
  605. goto error_put;
  606. /* transfer the quota burden to the new user */
  607. if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
  608. spin_lock(&newowner->lock);
  609. if (newowner->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
  610. newowner->qnbytes + key->quotalen >=
  611. KEYQUOTA_MAX_BYTES)
  612. goto quota_overrun;
  613. newowner->qnkeys++;
  614. newowner->qnbytes += key->quotalen;
  615. spin_unlock(&newowner->lock);
  616. spin_lock(&key->user->lock);
  617. key->user->qnkeys--;
  618. key->user->qnbytes -= key->quotalen;
  619. spin_unlock(&key->user->lock);
  620. }
  621. atomic_dec(&key->user->nkeys);
  622. atomic_inc(&newowner->nkeys);
  623. if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
  624. atomic_dec(&key->user->nikeys);
  625. atomic_inc(&newowner->nikeys);
  626. }
  627. zapowner = key->user;
  628. key->user = newowner;
  629. key->uid = uid;
  630. }
  631. /* change the GID */
  632. if (gid != (gid_t) -1)
  633. key->gid = gid;
  634. ret = 0;
  635. error_put:
  636. up_write(&key->sem);
  637. key_put(key);
  638. if (zapowner)
  639. key_user_put(zapowner);
  640. error:
  641. return ret;
  642. quota_overrun:
  643. spin_unlock(&newowner->lock);
  644. zapowner = newowner;
  645. ret = -EDQUOT;
  646. goto error_put;
  647. } /* end keyctl_chown_key() */
  648. /*****************************************************************************/
  649. /*
  650. * change the permission mask on a key
  651. * - the keyring owned by the changer
  652. * - implements keyctl(KEYCTL_SETPERM)
  653. */
  654. long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
  655. {
  656. struct key *key;
  657. key_ref_t key_ref;
  658. long ret;
  659. ret = -EINVAL;
  660. if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
  661. goto error;
  662. key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
  663. if (IS_ERR(key_ref)) {
  664. ret = PTR_ERR(key_ref);
  665. goto error;
  666. }
  667. key = key_ref_to_ptr(key_ref);
  668. /* make the changes with the locks held to prevent chown/chmod races */
  669. ret = -EACCES;
  670. down_write(&key->sem);
  671. /* if we're not the sysadmin, we can only change a key that we own */
  672. if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
  673. key->perm = perm;
  674. ret = 0;
  675. }
  676. up_write(&key->sem);
  677. key_put(key);
  678. error:
  679. return ret;
  680. } /* end keyctl_setperm_key() */
  681. /*****************************************************************************/
  682. /*
  683. * instantiate the key with the specified payload, and, if one is given, link
  684. * the key into the keyring
  685. */
  686. long keyctl_instantiate_key(key_serial_t id,
  687. const void __user *_payload,
  688. size_t plen,
  689. key_serial_t ringid)
  690. {
  691. struct request_key_auth *rka;
  692. struct key *instkey;
  693. key_ref_t keyring_ref;
  694. void *payload;
  695. long ret;
  696. ret = -EINVAL;
  697. if (plen > 32767)
  698. goto error;
  699. /* the appropriate instantiation authorisation key must have been
  700. * assumed before calling this */
  701. ret = -EPERM;
  702. instkey = current->request_key_auth;
  703. if (!instkey)
  704. goto error;
  705. rka = instkey->payload.data;
  706. if (rka->target_key->serial != id)
  707. goto error;
  708. /* pull the payload in if one was supplied */
  709. payload = NULL;
  710. if (_payload) {
  711. ret = -ENOMEM;
  712. payload = kmalloc(plen, GFP_KERNEL);
  713. if (!payload)
  714. goto error;
  715. ret = -EFAULT;
  716. if (copy_from_user(payload, _payload, plen) != 0)
  717. goto error2;
  718. }
  719. /* find the destination keyring amongst those belonging to the
  720. * requesting task */
  721. keyring_ref = NULL;
  722. if (ringid) {
  723. keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
  724. KEY_WRITE);
  725. if (IS_ERR(keyring_ref)) {
  726. ret = PTR_ERR(keyring_ref);
  727. goto error2;
  728. }
  729. }
  730. /* instantiate the key and link it into a keyring */
  731. ret = key_instantiate_and_link(rka->target_key, payload, plen,
  732. key_ref_to_ptr(keyring_ref), instkey);
  733. key_ref_put(keyring_ref);
  734. /* discard the assumed authority if it's just been disabled by
  735. * instantiation of the key */
  736. if (ret == 0) {
  737. key_put(current->request_key_auth);
  738. current->request_key_auth = NULL;
  739. }
  740. error2:
  741. kfree(payload);
  742. error:
  743. return ret;
  744. } /* end keyctl_instantiate_key() */
  745. /*****************************************************************************/
  746. /*
  747. * negatively instantiate the key with the given timeout (in seconds), and, if
  748. * one is given, link the key into the keyring
  749. */
  750. long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
  751. {
  752. struct request_key_auth *rka;
  753. struct key *instkey;
  754. key_ref_t keyring_ref;
  755. long ret;
  756. /* the appropriate instantiation authorisation key must have been
  757. * assumed before calling this */
  758. ret = -EPERM;
  759. instkey = current->request_key_auth;
  760. if (!instkey)
  761. goto error;
  762. rka = instkey->payload.data;
  763. if (rka->target_key->serial != id)
  764. goto error;
  765. /* find the destination keyring if present (which must also be
  766. * writable) */
  767. keyring_ref = NULL;
  768. if (ringid) {
  769. keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  770. if (IS_ERR(keyring_ref)) {
  771. ret = PTR_ERR(keyring_ref);
  772. goto error;
  773. }
  774. }
  775. /* instantiate the key and link it into a keyring */
  776. ret = key_negate_and_link(rka->target_key, timeout,
  777. key_ref_to_ptr(keyring_ref), instkey);
  778. key_ref_put(keyring_ref);
  779. /* discard the assumed authority if it's just been disabled by
  780. * instantiation of the key */
  781. if (ret == 0) {
  782. key_put(current->request_key_auth);
  783. current->request_key_auth = NULL;
  784. }
  785. error:
  786. return ret;
  787. } /* end keyctl_negate_key() */
  788. /*****************************************************************************/
  789. /*
  790. * set the default keyring in which request_key() will cache keys
  791. * - return the old setting
  792. */
  793. long keyctl_set_reqkey_keyring(int reqkey_defl)
  794. {
  795. int ret;
  796. switch (reqkey_defl) {
  797. case KEY_REQKEY_DEFL_THREAD_KEYRING:
  798. ret = install_thread_keyring(current);
  799. if (ret < 0)
  800. return ret;
  801. goto set;
  802. case KEY_REQKEY_DEFL_PROCESS_KEYRING:
  803. ret = install_process_keyring(current);
  804. if (ret < 0)
  805. return ret;
  806. case KEY_REQKEY_DEFL_DEFAULT:
  807. case KEY_REQKEY_DEFL_SESSION_KEYRING:
  808. case KEY_REQKEY_DEFL_USER_KEYRING:
  809. case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
  810. set:
  811. current->jit_keyring = reqkey_defl;
  812. case KEY_REQKEY_DEFL_NO_CHANGE:
  813. return current->jit_keyring;
  814. case KEY_REQKEY_DEFL_GROUP_KEYRING:
  815. default:
  816. return -EINVAL;
  817. }
  818. } /* end keyctl_set_reqkey_keyring() */
  819. /*****************************************************************************/
  820. /*
  821. * set or clear the timeout for a key
  822. */
  823. long keyctl_set_timeout(key_serial_t id, unsigned timeout)
  824. {
  825. struct timespec now;
  826. struct key *key;
  827. key_ref_t key_ref;
  828. time_t expiry;
  829. long ret;
  830. key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
  831. if (IS_ERR(key_ref)) {
  832. ret = PTR_ERR(key_ref);
  833. goto error;
  834. }
  835. key = key_ref_to_ptr(key_ref);
  836. /* make the changes with the locks held to prevent races */
  837. down_write(&key->sem);
  838. expiry = 0;
  839. if (timeout > 0) {
  840. now = current_kernel_time();
  841. expiry = now.tv_sec + timeout;
  842. }
  843. key->expiry = expiry;
  844. up_write(&key->sem);
  845. key_put(key);
  846. ret = 0;
  847. error:
  848. return ret;
  849. } /* end keyctl_set_timeout() */
  850. /*****************************************************************************/
  851. /*
  852. * assume the authority to instantiate the specified key
  853. */
  854. long keyctl_assume_authority(key_serial_t id)
  855. {
  856. struct key *authkey;
  857. long ret;
  858. /* special key IDs aren't permitted */
  859. ret = -EINVAL;
  860. if (id < 0)
  861. goto error;
  862. /* we divest ourselves of authority if given an ID of 0 */
  863. if (id == 0) {
  864. key_put(current->request_key_auth);
  865. current->request_key_auth = NULL;
  866. ret = 0;
  867. goto error;
  868. }
  869. /* attempt to assume the authority temporarily granted to us whilst we
  870. * instantiate the specified key
  871. * - the authorisation key must be in the current task's keyrings
  872. * somewhere
  873. */
  874. authkey = key_get_instantiation_authkey(id);
  875. if (IS_ERR(authkey)) {
  876. ret = PTR_ERR(authkey);
  877. goto error;
  878. }
  879. key_put(current->request_key_auth);
  880. current->request_key_auth = authkey;
  881. ret = authkey->serial;
  882. error:
  883. return ret;
  884. } /* end keyctl_assume_authority() */
  885. /*****************************************************************************/
  886. /*
  887. * the key control system call
  888. */
  889. asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
  890. unsigned long arg4, unsigned long arg5)
  891. {
  892. switch (option) {
  893. case KEYCTL_GET_KEYRING_ID:
  894. return keyctl_get_keyring_ID((key_serial_t) arg2,
  895. (int) arg3);
  896. case KEYCTL_JOIN_SESSION_KEYRING:
  897. return keyctl_join_session_keyring((const char __user *) arg2);
  898. case KEYCTL_UPDATE:
  899. return keyctl_update_key((key_serial_t) arg2,
  900. (const void __user *) arg3,
  901. (size_t) arg4);
  902. case KEYCTL_REVOKE:
  903. return keyctl_revoke_key((key_serial_t) arg2);
  904. case KEYCTL_DESCRIBE:
  905. return keyctl_describe_key((key_serial_t) arg2,
  906. (char __user *) arg3,
  907. (unsigned) arg4);
  908. case KEYCTL_CLEAR:
  909. return keyctl_keyring_clear((key_serial_t) arg2);
  910. case KEYCTL_LINK:
  911. return keyctl_keyring_link((key_serial_t) arg2,
  912. (key_serial_t) arg3);
  913. case KEYCTL_UNLINK:
  914. return keyctl_keyring_unlink((key_serial_t) arg2,
  915. (key_serial_t) arg3);
  916. case KEYCTL_SEARCH:
  917. return keyctl_keyring_search((key_serial_t) arg2,
  918. (const char __user *) arg3,
  919. (const char __user *) arg4,
  920. (key_serial_t) arg5);
  921. case KEYCTL_READ:
  922. return keyctl_read_key((key_serial_t) arg2,
  923. (char __user *) arg3,
  924. (size_t) arg4);
  925. case KEYCTL_CHOWN:
  926. return keyctl_chown_key((key_serial_t) arg2,
  927. (uid_t) arg3,
  928. (gid_t) arg4);
  929. case KEYCTL_SETPERM:
  930. return keyctl_setperm_key((key_serial_t) arg2,
  931. (key_perm_t) arg3);
  932. case KEYCTL_INSTANTIATE:
  933. return keyctl_instantiate_key((key_serial_t) arg2,
  934. (const void __user *) arg3,
  935. (size_t) arg4,
  936. (key_serial_t) arg5);
  937. case KEYCTL_NEGATE:
  938. return keyctl_negate_key((key_serial_t) arg2,
  939. (unsigned) arg3,
  940. (key_serial_t) arg4);
  941. case KEYCTL_SET_REQKEY_KEYRING:
  942. return keyctl_set_reqkey_keyring(arg2);
  943. case KEYCTL_SET_TIMEOUT:
  944. return keyctl_set_timeout((key_serial_t) arg2,
  945. (unsigned) arg3);
  946. case KEYCTL_ASSUME_AUTHORITY:
  947. return keyctl_assume_authority((key_serial_t) arg2);
  948. default:
  949. return -EOPNOTSUPP;
  950. }
  951. } /* end sys_keyctl() */