request_key_auth.c 7.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268
  1. /* request_key_auth.c: request key authorisation controlling key def
  2. *
  3. * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
  4. * Written by David Howells (dhowells@redhat.com)
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. *
  11. * See Documentation/keys-request-key.txt
  12. */
  13. #include <linux/module.h>
  14. #include <linux/sched.h>
  15. #include <linux/err.h>
  16. #include <linux/seq_file.h>
  17. #include <asm/uaccess.h>
  18. #include "internal.h"
  19. static int request_key_auth_instantiate(struct key *, const void *, size_t);
  20. static void request_key_auth_describe(const struct key *, struct seq_file *);
  21. static void request_key_auth_revoke(struct key *);
  22. static void request_key_auth_destroy(struct key *);
  23. static long request_key_auth_read(const struct key *, char __user *, size_t);
  24. /*
  25. * the request-key authorisation key type definition
  26. */
  27. struct key_type key_type_request_key_auth = {
  28. .name = ".request_key_auth",
  29. .def_datalen = sizeof(struct request_key_auth),
  30. .instantiate = request_key_auth_instantiate,
  31. .describe = request_key_auth_describe,
  32. .revoke = request_key_auth_revoke,
  33. .destroy = request_key_auth_destroy,
  34. .read = request_key_auth_read,
  35. };
  36. /*****************************************************************************/
  37. /*
  38. * instantiate a request-key authorisation key
  39. */
  40. static int request_key_auth_instantiate(struct key *key,
  41. const void *data,
  42. size_t datalen)
  43. {
  44. key->payload.data = (struct request_key_auth *) data;
  45. return 0;
  46. } /* end request_key_auth_instantiate() */
  47. /*****************************************************************************/
  48. /*
  49. * reading a request-key authorisation key retrieves the callout information
  50. */
  51. static void request_key_auth_describe(const struct key *key,
  52. struct seq_file *m)
  53. {
  54. struct request_key_auth *rka = key->payload.data;
  55. seq_puts(m, "key:");
  56. seq_puts(m, key->description);
  57. seq_printf(m, " pid:%d ci:%zu", rka->pid, strlen(rka->callout_info));
  58. } /* end request_key_auth_describe() */
  59. /*****************************************************************************/
  60. /*
  61. * read the callout_info data
  62. * - the key's semaphore is read-locked
  63. */
  64. static long request_key_auth_read(const struct key *key,
  65. char __user *buffer, size_t buflen)
  66. {
  67. struct request_key_auth *rka = key->payload.data;
  68. size_t datalen;
  69. long ret;
  70. datalen = strlen(rka->callout_info);
  71. ret = datalen;
  72. /* we can return the data as is */
  73. if (buffer && buflen > 0) {
  74. if (buflen > datalen)
  75. buflen = datalen;
  76. if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
  77. ret = -EFAULT;
  78. }
  79. return ret;
  80. } /* end request_key_auth_read() */
  81. /*****************************************************************************/
  82. /*
  83. * handle revocation of an authorisation token key
  84. * - called with the key sem write-locked
  85. */
  86. static void request_key_auth_revoke(struct key *key)
  87. {
  88. struct request_key_auth *rka = key->payload.data;
  89. kenter("{%d}", key->serial);
  90. if (rka->context) {
  91. put_task_struct(rka->context);
  92. rka->context = NULL;
  93. }
  94. } /* end request_key_auth_revoke() */
  95. /*****************************************************************************/
  96. /*
  97. * destroy an instantiation authorisation token key
  98. */
  99. static void request_key_auth_destroy(struct key *key)
  100. {
  101. struct request_key_auth *rka = key->payload.data;
  102. kenter("{%d}", key->serial);
  103. if (rka->context) {
  104. put_task_struct(rka->context);
  105. rka->context = NULL;
  106. }
  107. key_put(rka->target_key);
  108. kfree(rka);
  109. } /* end request_key_auth_destroy() */
  110. /*****************************************************************************/
  111. /*
  112. * create an authorisation token for /sbin/request-key or whoever to gain
  113. * access to the caller's security data
  114. */
  115. struct key *request_key_auth_new(struct key *target, const char *callout_info)
  116. {
  117. struct request_key_auth *rka, *irka;
  118. struct key *authkey = NULL;
  119. char desc[20];
  120. int ret;
  121. kenter("%d,", target->serial);
  122. /* allocate a auth record */
  123. rka = kmalloc(sizeof(*rka), GFP_KERNEL);
  124. if (!rka) {
  125. kleave(" = -ENOMEM");
  126. return ERR_PTR(-ENOMEM);
  127. }
  128. /* see if the calling process is already servicing the key request of
  129. * another process */
  130. if (current->request_key_auth) {
  131. /* it is - use that instantiation context here too */
  132. down_read(&current->request_key_auth->sem);
  133. /* if the auth key has been revoked, then the key we're
  134. * servicing is already instantiated */
  135. if (test_bit(KEY_FLAG_REVOKED,
  136. &current->request_key_auth->flags))
  137. goto auth_key_revoked;
  138. irka = current->request_key_auth->payload.data;
  139. rka->context = irka->context;
  140. rka->pid = irka->pid;
  141. get_task_struct(rka->context);
  142. up_read(&current->request_key_auth->sem);
  143. }
  144. else {
  145. /* it isn't - use this process as the context */
  146. rka->context = current;
  147. rka->pid = current->pid;
  148. get_task_struct(rka->context);
  149. }
  150. rka->target_key = key_get(target);
  151. rka->callout_info = callout_info;
  152. /* allocate the auth key */
  153. sprintf(desc, "%x", target->serial);
  154. authkey = key_alloc(&key_type_request_key_auth, desc,
  155. current->fsuid, current->fsgid, current,
  156. KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
  157. KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
  158. if (IS_ERR(authkey)) {
  159. ret = PTR_ERR(authkey);
  160. goto error_alloc;
  161. }
  162. /* construct and attach to the keyring */
  163. ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
  164. if (ret < 0)
  165. goto error_inst;
  166. kleave(" = {%d}", authkey->serial);
  167. return authkey;
  168. auth_key_revoked:
  169. up_read(&current->request_key_auth->sem);
  170. kfree(rka);
  171. kleave("= -EKEYREVOKED");
  172. return ERR_PTR(-EKEYREVOKED);
  173. error_inst:
  174. key_revoke(authkey);
  175. key_put(authkey);
  176. error_alloc:
  177. key_put(rka->target_key);
  178. kfree(rka);
  179. kleave("= %d", ret);
  180. return ERR_PTR(ret);
  181. } /* end request_key_auth_new() */
  182. /*****************************************************************************/
  183. /*
  184. * see if an authorisation key is associated with a particular key
  185. */
  186. static int key_get_instantiation_authkey_match(const struct key *key,
  187. const void *_id)
  188. {
  189. struct request_key_auth *rka = key->payload.data;
  190. key_serial_t id = (key_serial_t)(unsigned long) _id;
  191. return rka->target_key->serial == id;
  192. } /* end key_get_instantiation_authkey_match() */
  193. /*****************************************************************************/
  194. /*
  195. * get the authorisation key for instantiation of a specific key if attached to
  196. * the current process's keyrings
  197. * - this key is inserted into a keyring and that is set as /sbin/request-key's
  198. * session keyring
  199. * - a target_id of zero specifies any valid token
  200. */
  201. struct key *key_get_instantiation_authkey(key_serial_t target_id)
  202. {
  203. struct key *authkey;
  204. key_ref_t authkey_ref;
  205. authkey_ref = search_process_keyrings(
  206. &key_type_request_key_auth,
  207. (void *) (unsigned long) target_id,
  208. key_get_instantiation_authkey_match,
  209. current);
  210. if (IS_ERR(authkey_ref)) {
  211. authkey = ERR_PTR(PTR_ERR(authkey_ref));
  212. goto error;
  213. }
  214. authkey = key_ref_to_ptr(authkey_ref);
  215. if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
  216. key_put(authkey);
  217. authkey = ERR_PTR(-EKEYREVOKED);
  218. }
  219. error:
  220. return authkey;
  221. } /* end key_get_instantiation_authkey() */