process_keys.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765
  1. /* process_keys.c: management of a process's keyrings
  2. *
  3. * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
  4. * Written by David Howells (dhowells@redhat.com)
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. */
  11. #include <linux/module.h>
  12. #include <linux/init.h>
  13. #include <linux/sched.h>
  14. #include <linux/slab.h>
  15. #include <linux/keyctl.h>
  16. #include <linux/fs.h>
  17. #include <linux/err.h>
  18. #include <linux/mutex.h>
  19. #include <asm/uaccess.h>
  20. #include "internal.h"
  21. /* session keyring create vs join semaphore */
  22. static DEFINE_MUTEX(key_session_mutex);
  23. /* the root user's tracking struct */
  24. struct key_user root_key_user = {
  25. .usage = ATOMIC_INIT(3),
  26. .consq = LIST_HEAD_INIT(root_key_user.consq),
  27. .lock = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
  28. .nkeys = ATOMIC_INIT(2),
  29. .nikeys = ATOMIC_INIT(2),
  30. .uid = 0,
  31. };
  32. /* the root user's UID keyring */
  33. struct key root_user_keyring = {
  34. .usage = ATOMIC_INIT(1),
  35. .serial = 2,
  36. .type = &key_type_keyring,
  37. .user = &root_key_user,
  38. .sem = __RWSEM_INITIALIZER(root_user_keyring.sem),
  39. .perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
  40. .flags = 1 << KEY_FLAG_INSTANTIATED,
  41. .description = "_uid.0",
  42. #ifdef KEY_DEBUGGING
  43. .magic = KEY_DEBUG_MAGIC,
  44. #endif
  45. };
  46. /* the root user's default session keyring */
  47. struct key root_session_keyring = {
  48. .usage = ATOMIC_INIT(1),
  49. .serial = 1,
  50. .type = &key_type_keyring,
  51. .user = &root_key_user,
  52. .sem = __RWSEM_INITIALIZER(root_session_keyring.sem),
  53. .perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
  54. .flags = 1 << KEY_FLAG_INSTANTIATED,
  55. .description = "_uid_ses.0",
  56. #ifdef KEY_DEBUGGING
  57. .magic = KEY_DEBUG_MAGIC,
  58. #endif
  59. };
  60. /*****************************************************************************/
  61. /*
  62. * allocate the keyrings to be associated with a UID
  63. */
  64. int alloc_uid_keyring(struct user_struct *user,
  65. struct task_struct *ctx)
  66. {
  67. struct key *uid_keyring, *session_keyring;
  68. char buf[20];
  69. int ret;
  70. /* concoct a default session keyring */
  71. sprintf(buf, "_uid_ses.%u", user->uid);
  72. session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx,
  73. KEY_ALLOC_IN_QUOTA, NULL);
  74. if (IS_ERR(session_keyring)) {
  75. ret = PTR_ERR(session_keyring);
  76. goto error;
  77. }
  78. /* and a UID specific keyring, pointed to by the default session
  79. * keyring */
  80. sprintf(buf, "_uid.%u", user->uid);
  81. uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx,
  82. KEY_ALLOC_IN_QUOTA, session_keyring);
  83. if (IS_ERR(uid_keyring)) {
  84. key_put(session_keyring);
  85. ret = PTR_ERR(uid_keyring);
  86. goto error;
  87. }
  88. /* install the keyrings */
  89. user->uid_keyring = uid_keyring;
  90. user->session_keyring = session_keyring;
  91. ret = 0;
  92. error:
  93. return ret;
  94. } /* end alloc_uid_keyring() */
  95. /*****************************************************************************/
  96. /*
  97. * deal with the UID changing
  98. */
  99. void switch_uid_keyring(struct user_struct *new_user)
  100. {
  101. #if 0 /* do nothing for now */
  102. struct key *old;
  103. /* switch to the new user's session keyring if we were running under
  104. * root's default session keyring */
  105. if (new_user->uid != 0 &&
  106. current->session_keyring == &root_session_keyring
  107. ) {
  108. atomic_inc(&new_user->session_keyring->usage);
  109. task_lock(current);
  110. old = current->session_keyring;
  111. current->session_keyring = new_user->session_keyring;
  112. task_unlock(current);
  113. key_put(old);
  114. }
  115. #endif
  116. } /* end switch_uid_keyring() */
  117. /*****************************************************************************/
  118. /*
  119. * install a fresh thread keyring, discarding the old one
  120. */
  121. int install_thread_keyring(struct task_struct *tsk)
  122. {
  123. struct key *keyring, *old;
  124. char buf[20];
  125. int ret;
  126. sprintf(buf, "_tid.%u", tsk->pid);
  127. keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
  128. KEY_ALLOC_QUOTA_OVERRUN, NULL);
  129. if (IS_ERR(keyring)) {
  130. ret = PTR_ERR(keyring);
  131. goto error;
  132. }
  133. task_lock(tsk);
  134. old = tsk->thread_keyring;
  135. tsk->thread_keyring = keyring;
  136. task_unlock(tsk);
  137. ret = 0;
  138. key_put(old);
  139. error:
  140. return ret;
  141. } /* end install_thread_keyring() */
  142. /*****************************************************************************/
  143. /*
  144. * make sure a process keyring is installed
  145. */
  146. int install_process_keyring(struct task_struct *tsk)
  147. {
  148. struct key *keyring;
  149. char buf[20];
  150. int ret;
  151. might_sleep();
  152. if (!tsk->signal->process_keyring) {
  153. sprintf(buf, "_pid.%u", tsk->tgid);
  154. keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
  155. KEY_ALLOC_QUOTA_OVERRUN, NULL);
  156. if (IS_ERR(keyring)) {
  157. ret = PTR_ERR(keyring);
  158. goto error;
  159. }
  160. /* attach keyring */
  161. spin_lock_irq(&tsk->sighand->siglock);
  162. if (!tsk->signal->process_keyring) {
  163. tsk->signal->process_keyring = keyring;
  164. keyring = NULL;
  165. }
  166. spin_unlock_irq(&tsk->sighand->siglock);
  167. key_put(keyring);
  168. }
  169. ret = 0;
  170. error:
  171. return ret;
  172. } /* end install_process_keyring() */
  173. /*****************************************************************************/
  174. /*
  175. * install a session keyring, discarding the old one
  176. * - if a keyring is not supplied, an empty one is invented
  177. */
  178. static int install_session_keyring(struct task_struct *tsk,
  179. struct key *keyring)
  180. {
  181. unsigned long flags;
  182. struct key *old;
  183. char buf[20];
  184. might_sleep();
  185. /* create an empty session keyring */
  186. if (!keyring) {
  187. sprintf(buf, "_ses.%u", tsk->tgid);
  188. flags = KEY_ALLOC_QUOTA_OVERRUN;
  189. if (tsk->signal->session_keyring)
  190. flags = KEY_ALLOC_IN_QUOTA;
  191. keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk,
  192. flags, NULL);
  193. if (IS_ERR(keyring))
  194. return PTR_ERR(keyring);
  195. }
  196. else {
  197. atomic_inc(&keyring->usage);
  198. }
  199. /* install the keyring */
  200. spin_lock_irq(&tsk->sighand->siglock);
  201. old = tsk->signal->session_keyring;
  202. rcu_assign_pointer(tsk->signal->session_keyring, keyring);
  203. spin_unlock_irq(&tsk->sighand->siglock);
  204. /* we're using RCU on the pointer, but there's no point synchronising
  205. * on it if it didn't previously point to anything */
  206. if (old) {
  207. synchronize_rcu();
  208. key_put(old);
  209. }
  210. return 0;
  211. } /* end install_session_keyring() */
  212. /*****************************************************************************/
  213. /*
  214. * copy the keys in a thread group for fork without CLONE_THREAD
  215. */
  216. int copy_thread_group_keys(struct task_struct *tsk)
  217. {
  218. key_check(current->thread_group->session_keyring);
  219. key_check(current->thread_group->process_keyring);
  220. /* no process keyring yet */
  221. tsk->signal->process_keyring = NULL;
  222. /* same session keyring */
  223. rcu_read_lock();
  224. tsk->signal->session_keyring =
  225. key_get(rcu_dereference(current->signal->session_keyring));
  226. rcu_read_unlock();
  227. return 0;
  228. } /* end copy_thread_group_keys() */
  229. /*****************************************************************************/
  230. /*
  231. * copy the keys for fork
  232. */
  233. int copy_keys(unsigned long clone_flags, struct task_struct *tsk)
  234. {
  235. key_check(tsk->thread_keyring);
  236. key_check(tsk->request_key_auth);
  237. /* no thread keyring yet */
  238. tsk->thread_keyring = NULL;
  239. /* copy the request_key() authorisation for this thread */
  240. key_get(tsk->request_key_auth);
  241. return 0;
  242. } /* end copy_keys() */
  243. /*****************************************************************************/
  244. /*
  245. * dispose of thread group keys upon thread group destruction
  246. */
  247. void exit_thread_group_keys(struct signal_struct *tg)
  248. {
  249. key_put(tg->session_keyring);
  250. key_put(tg->process_keyring);
  251. } /* end exit_thread_group_keys() */
  252. /*****************************************************************************/
  253. /*
  254. * dispose of per-thread keys upon thread exit
  255. */
  256. void exit_keys(struct task_struct *tsk)
  257. {
  258. key_put(tsk->thread_keyring);
  259. key_put(tsk->request_key_auth);
  260. } /* end exit_keys() */
  261. /*****************************************************************************/
  262. /*
  263. * deal with execve()
  264. */
  265. int exec_keys(struct task_struct *tsk)
  266. {
  267. struct key *old;
  268. /* newly exec'd tasks don't get a thread keyring */
  269. task_lock(tsk);
  270. old = tsk->thread_keyring;
  271. tsk->thread_keyring = NULL;
  272. task_unlock(tsk);
  273. key_put(old);
  274. /* discard the process keyring from a newly exec'd task */
  275. spin_lock_irq(&tsk->sighand->siglock);
  276. old = tsk->signal->process_keyring;
  277. tsk->signal->process_keyring = NULL;
  278. spin_unlock_irq(&tsk->sighand->siglock);
  279. key_put(old);
  280. return 0;
  281. } /* end exec_keys() */
  282. /*****************************************************************************/
  283. /*
  284. * deal with SUID programs
  285. * - we might want to make this invent a new session keyring
  286. */
  287. int suid_keys(struct task_struct *tsk)
  288. {
  289. return 0;
  290. } /* end suid_keys() */
  291. /*****************************************************************************/
  292. /*
  293. * the filesystem user ID changed
  294. */
  295. void key_fsuid_changed(struct task_struct *tsk)
  296. {
  297. /* update the ownership of the thread keyring */
  298. if (tsk->thread_keyring) {
  299. down_write(&tsk->thread_keyring->sem);
  300. tsk->thread_keyring->uid = tsk->fsuid;
  301. up_write(&tsk->thread_keyring->sem);
  302. }
  303. } /* end key_fsuid_changed() */
  304. /*****************************************************************************/
  305. /*
  306. * the filesystem group ID changed
  307. */
  308. void key_fsgid_changed(struct task_struct *tsk)
  309. {
  310. /* update the ownership of the thread keyring */
  311. if (tsk->thread_keyring) {
  312. down_write(&tsk->thread_keyring->sem);
  313. tsk->thread_keyring->gid = tsk->fsgid;
  314. up_write(&tsk->thread_keyring->sem);
  315. }
  316. } /* end key_fsgid_changed() */
  317. /*****************************************************************************/
  318. /*
  319. * search the process keyrings for the first matching key
  320. * - we use the supplied match function to see if the description (or other
  321. * feature of interest) matches
  322. * - we return -EAGAIN if we didn't find any matching key
  323. * - we return -ENOKEY if we found only negative matching keys
  324. */
  325. key_ref_t search_process_keyrings(struct key_type *type,
  326. const void *description,
  327. key_match_func_t match,
  328. struct task_struct *context)
  329. {
  330. struct request_key_auth *rka;
  331. key_ref_t key_ref, ret, err;
  332. might_sleep();
  333. /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
  334. * searchable, but we failed to find a key or we found a negative key;
  335. * otherwise we want to return a sample error (probably -EACCES) if
  336. * none of the keyrings were searchable
  337. *
  338. * in terms of priority: success > -ENOKEY > -EAGAIN > other error
  339. */
  340. key_ref = NULL;
  341. ret = NULL;
  342. err = ERR_PTR(-EAGAIN);
  343. /* search the thread keyring first */
  344. if (context->thread_keyring) {
  345. key_ref = keyring_search_aux(
  346. make_key_ref(context->thread_keyring, 1),
  347. context, type, description, match);
  348. if (!IS_ERR(key_ref))
  349. goto found;
  350. switch (PTR_ERR(key_ref)) {
  351. case -EAGAIN: /* no key */
  352. if (ret)
  353. break;
  354. case -ENOKEY: /* negative key */
  355. ret = key_ref;
  356. break;
  357. default:
  358. err = key_ref;
  359. break;
  360. }
  361. }
  362. /* search the process keyring second */
  363. if (context->signal->process_keyring) {
  364. key_ref = keyring_search_aux(
  365. make_key_ref(context->signal->process_keyring, 1),
  366. context, type, description, match);
  367. if (!IS_ERR(key_ref))
  368. goto found;
  369. switch (PTR_ERR(key_ref)) {
  370. case -EAGAIN: /* no key */
  371. if (ret)
  372. break;
  373. case -ENOKEY: /* negative key */
  374. ret = key_ref;
  375. break;
  376. default:
  377. err = key_ref;
  378. break;
  379. }
  380. }
  381. /* search the session keyring */
  382. if (context->signal->session_keyring) {
  383. rcu_read_lock();
  384. key_ref = keyring_search_aux(
  385. make_key_ref(rcu_dereference(
  386. context->signal->session_keyring),
  387. 1),
  388. context, type, description, match);
  389. rcu_read_unlock();
  390. if (!IS_ERR(key_ref))
  391. goto found;
  392. switch (PTR_ERR(key_ref)) {
  393. case -EAGAIN: /* no key */
  394. if (ret)
  395. break;
  396. case -ENOKEY: /* negative key */
  397. ret = key_ref;
  398. break;
  399. default:
  400. err = key_ref;
  401. break;
  402. }
  403. }
  404. /* or search the user-session keyring */
  405. else {
  406. key_ref = keyring_search_aux(
  407. make_key_ref(context->user->session_keyring, 1),
  408. context, type, description, match);
  409. if (!IS_ERR(key_ref))
  410. goto found;
  411. switch (PTR_ERR(key_ref)) {
  412. case -EAGAIN: /* no key */
  413. if (ret)
  414. break;
  415. case -ENOKEY: /* negative key */
  416. ret = key_ref;
  417. break;
  418. default:
  419. err = key_ref;
  420. break;
  421. }
  422. }
  423. /* if this process has an instantiation authorisation key, then we also
  424. * search the keyrings of the process mentioned there
  425. * - we don't permit access to request_key auth keys via this method
  426. */
  427. if (context->request_key_auth &&
  428. context == current &&
  429. type != &key_type_request_key_auth
  430. ) {
  431. /* defend against the auth key being revoked */
  432. down_read(&context->request_key_auth->sem);
  433. if (key_validate(context->request_key_auth) == 0) {
  434. rka = context->request_key_auth->payload.data;
  435. key_ref = search_process_keyrings(type, description,
  436. match, rka->context);
  437. up_read(&context->request_key_auth->sem);
  438. if (!IS_ERR(key_ref))
  439. goto found;
  440. switch (PTR_ERR(key_ref)) {
  441. case -EAGAIN: /* no key */
  442. if (ret)
  443. break;
  444. case -ENOKEY: /* negative key */
  445. ret = key_ref;
  446. break;
  447. default:
  448. err = key_ref;
  449. break;
  450. }
  451. } else {
  452. up_read(&context->request_key_auth->sem);
  453. }
  454. }
  455. /* no key - decide on the error we're going to go for */
  456. key_ref = ret ? ret : err;
  457. found:
  458. return key_ref;
  459. } /* end search_process_keyrings() */
  460. /*****************************************************************************/
  461. /*
  462. * see if the key we're looking at is the target key
  463. */
  464. static int lookup_user_key_possessed(const struct key *key, const void *target)
  465. {
  466. return key == target;
  467. } /* end lookup_user_key_possessed() */
  468. /*****************************************************************************/
  469. /*
  470. * lookup a key given a key ID from userspace with a given permissions mask
  471. * - don't create special keyrings unless so requested
  472. * - partially constructed keys aren't found unless requested
  473. */
  474. key_ref_t lookup_user_key(struct task_struct *context, key_serial_t id,
  475. int create, int partial, key_perm_t perm)
  476. {
  477. key_ref_t key_ref, skey_ref;
  478. struct key *key;
  479. int ret;
  480. if (!context)
  481. context = current;
  482. key_ref = ERR_PTR(-ENOKEY);
  483. switch (id) {
  484. case KEY_SPEC_THREAD_KEYRING:
  485. if (!context->thread_keyring) {
  486. if (!create)
  487. goto error;
  488. ret = install_thread_keyring(context);
  489. if (ret < 0) {
  490. key = ERR_PTR(ret);
  491. goto error;
  492. }
  493. }
  494. key = context->thread_keyring;
  495. atomic_inc(&key->usage);
  496. key_ref = make_key_ref(key, 1);
  497. break;
  498. case KEY_SPEC_PROCESS_KEYRING:
  499. if (!context->signal->process_keyring) {
  500. if (!create)
  501. goto error;
  502. ret = install_process_keyring(context);
  503. if (ret < 0) {
  504. key = ERR_PTR(ret);
  505. goto error;
  506. }
  507. }
  508. key = context->signal->process_keyring;
  509. atomic_inc(&key->usage);
  510. key_ref = make_key_ref(key, 1);
  511. break;
  512. case KEY_SPEC_SESSION_KEYRING:
  513. if (!context->signal->session_keyring) {
  514. /* always install a session keyring upon access if one
  515. * doesn't exist yet */
  516. ret = install_session_keyring(
  517. context, context->user->session_keyring);
  518. if (ret < 0)
  519. goto error;
  520. }
  521. rcu_read_lock();
  522. key = rcu_dereference(context->signal->session_keyring);
  523. atomic_inc(&key->usage);
  524. rcu_read_unlock();
  525. key_ref = make_key_ref(key, 1);
  526. break;
  527. case KEY_SPEC_USER_KEYRING:
  528. key = context->user->uid_keyring;
  529. atomic_inc(&key->usage);
  530. key_ref = make_key_ref(key, 1);
  531. break;
  532. case KEY_SPEC_USER_SESSION_KEYRING:
  533. key = context->user->session_keyring;
  534. atomic_inc(&key->usage);
  535. key_ref = make_key_ref(key, 1);
  536. break;
  537. case KEY_SPEC_GROUP_KEYRING:
  538. /* group keyrings are not yet supported */
  539. key = ERR_PTR(-EINVAL);
  540. goto error;
  541. case KEY_SPEC_REQKEY_AUTH_KEY:
  542. key = context->request_key_auth;
  543. if (!key)
  544. goto error;
  545. atomic_inc(&key->usage);
  546. key_ref = make_key_ref(key, 1);
  547. break;
  548. default:
  549. key_ref = ERR_PTR(-EINVAL);
  550. if (id < 1)
  551. goto error;
  552. key = key_lookup(id);
  553. if (IS_ERR(key)) {
  554. key_ref = ERR_PTR(PTR_ERR(key));
  555. goto error;
  556. }
  557. key_ref = make_key_ref(key, 0);
  558. /* check to see if we possess the key */
  559. skey_ref = search_process_keyrings(key->type, key,
  560. lookup_user_key_possessed,
  561. current);
  562. if (!IS_ERR(skey_ref)) {
  563. key_put(key);
  564. key_ref = skey_ref;
  565. }
  566. break;
  567. }
  568. /* check the status */
  569. if (perm) {
  570. ret = key_validate(key);
  571. if (ret < 0)
  572. goto invalid_key;
  573. }
  574. ret = -EIO;
  575. if (!partial && !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
  576. goto invalid_key;
  577. /* check the permissions */
  578. ret = key_task_permission(key_ref, context, perm);
  579. if (ret < 0)
  580. goto invalid_key;
  581. error:
  582. return key_ref;
  583. invalid_key:
  584. key_ref_put(key_ref);
  585. key_ref = ERR_PTR(ret);
  586. goto error;
  587. } /* end lookup_user_key() */
  588. /*****************************************************************************/
  589. /*
  590. * join the named keyring as the session keyring if possible, or attempt to
  591. * create a new one of that name if not
  592. * - if the name is NULL, an empty anonymous keyring is installed instead
  593. * - named session keyring joining is done with a semaphore held
  594. */
  595. long join_session_keyring(const char *name)
  596. {
  597. struct task_struct *tsk = current;
  598. struct key *keyring;
  599. long ret;
  600. /* if no name is provided, install an anonymous keyring */
  601. if (!name) {
  602. ret = install_session_keyring(tsk, NULL);
  603. if (ret < 0)
  604. goto error;
  605. rcu_read_lock();
  606. ret = rcu_dereference(tsk->signal->session_keyring)->serial;
  607. rcu_read_unlock();
  608. goto error;
  609. }
  610. /* allow the user to join or create a named keyring */
  611. mutex_lock(&key_session_mutex);
  612. /* look for an existing keyring of this name */
  613. keyring = find_keyring_by_name(name, 0);
  614. if (PTR_ERR(keyring) == -ENOKEY) {
  615. /* not found - try and create a new one */
  616. keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk,
  617. KEY_ALLOC_IN_QUOTA, NULL);
  618. if (IS_ERR(keyring)) {
  619. ret = PTR_ERR(keyring);
  620. goto error2;
  621. }
  622. }
  623. else if (IS_ERR(keyring)) {
  624. ret = PTR_ERR(keyring);
  625. goto error2;
  626. }
  627. /* we've got a keyring - now to install it */
  628. ret = install_session_keyring(tsk, keyring);
  629. if (ret < 0)
  630. goto error2;
  631. ret = keyring->serial;
  632. key_put(keyring);
  633. error2:
  634. mutex_unlock(&key_session_mutex);
  635. error:
  636. return ret;
  637. } /* end join_session_keyring() */