internal.h 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /* Authentication token and access key management internal defs
  3. *
  4. * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #ifndef _INTERNAL_H
  8. #define _INTERNAL_H
  9. #include <linux/sched.h>
  10. #include <linux/wait_bit.h>
  11. #include <linux/cred.h>
  12. #include <linux/key-type.h>
  13. #include <linux/task_work.h>
  14. #include <linux/keyctl.h>
  15. #include <linux/refcount.h>
  16. #include <linux/watch_queue.h>
  17. #include <linux/compat.h>
  18. #include <linux/mm.h>
  19. #include <linux/vmalloc.h>
  20. struct iovec;
  21. #ifdef __KDEBUG
  22. #define kenter(FMT, ...) \
  23. printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
  24. #define kleave(FMT, ...) \
  25. printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
  26. #define kdebug(FMT, ...) \
  27. printk(KERN_DEBUG " "FMT"\n", ##__VA_ARGS__)
  28. #else
  29. #define kenter(FMT, ...) \
  30. no_printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
  31. #define kleave(FMT, ...) \
  32. no_printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
  33. #define kdebug(FMT, ...) \
  34. no_printk(KERN_DEBUG FMT"\n", ##__VA_ARGS__)
  35. #endif
  36. extern struct key_type key_type_dead;
  37. extern struct key_type key_type_user;
  38. extern struct key_type key_type_logon;
  39. /*****************************************************************************/
  40. /*
  41. * Keep track of keys for a user.
  42. *
  43. * This needs to be separate to user_struct to avoid a refcount-loop
  44. * (user_struct pins some keyrings which pin this struct).
  45. *
  46. * We also keep track of keys under request from userspace for this UID here.
  47. */
  48. struct key_user {
  49. struct rb_node node;
  50. struct mutex cons_lock; /* construction initiation lock */
  51. spinlock_t lock;
  52. refcount_t usage; /* for accessing qnkeys & qnbytes */
  53. atomic_t nkeys; /* number of keys */
  54. atomic_t nikeys; /* number of instantiated keys */
  55. kuid_t uid;
  56. int qnkeys; /* number of keys allocated to this user */
  57. int qnbytes; /* number of bytes allocated to this user */
  58. };
  59. extern struct rb_root key_user_tree;
  60. extern spinlock_t key_user_lock;
  61. extern struct key_user root_key_user;
  62. extern struct key_user *key_user_lookup(kuid_t uid);
  63. extern void key_user_put(struct key_user *user);
  64. /*
  65. * Key quota limits.
  66. * - root has its own separate limits to everyone else
  67. */
  68. extern unsigned key_quota_root_maxkeys;
  69. extern unsigned key_quota_root_maxbytes;
  70. extern unsigned key_quota_maxkeys;
  71. extern unsigned key_quota_maxbytes;
  72. #define KEYQUOTA_LINK_BYTES 4 /* a link in a keyring is worth 4 bytes */
  73. extern struct kmem_cache *key_jar;
  74. extern struct rb_root key_serial_tree;
  75. extern spinlock_t key_serial_lock;
  76. extern struct mutex key_construction_mutex;
  77. extern wait_queue_head_t request_key_conswq;
  78. extern void key_set_index_key(struct keyring_index_key *index_key);
  79. extern struct key_type *key_type_lookup(const char *type);
  80. extern void key_type_put(struct key_type *ktype);
  81. extern int __key_link_lock(struct key *keyring,
  82. const struct keyring_index_key *index_key);
  83. extern int __key_move_lock(struct key *l_keyring, struct key *u_keyring,
  84. const struct keyring_index_key *index_key);
  85. extern int __key_link_begin(struct key *keyring,
  86. const struct keyring_index_key *index_key,
  87. struct assoc_array_edit **_edit);
  88. extern int __key_link_check_live_key(struct key *keyring, struct key *key);
  89. extern void __key_link(struct key *keyring, struct key *key,
  90. struct assoc_array_edit **_edit);
  91. extern void __key_link_end(struct key *keyring,
  92. const struct keyring_index_key *index_key,
  93. struct assoc_array_edit *edit);
  94. extern key_ref_t find_key_to_update(key_ref_t keyring_ref,
  95. const struct keyring_index_key *index_key);
  96. extern struct key *keyring_search_instkey(struct key *keyring,
  97. key_serial_t target_id);
  98. extern int iterate_over_keyring(const struct key *keyring,
  99. int (*func)(const struct key *key, void *data),
  100. void *data);
  101. struct keyring_search_context {
  102. struct keyring_index_key index_key;
  103. const struct cred *cred;
  104. struct key_match_data match_data;
  105. unsigned flags;
  106. #define KEYRING_SEARCH_NO_STATE_CHECK 0x0001 /* Skip state checks */
  107. #define KEYRING_SEARCH_DO_STATE_CHECK 0x0002 /* Override NO_STATE_CHECK */
  108. #define KEYRING_SEARCH_NO_UPDATE_TIME 0x0004 /* Don't update times */
  109. #define KEYRING_SEARCH_NO_CHECK_PERM 0x0008 /* Don't check permissions */
  110. #define KEYRING_SEARCH_DETECT_TOO_DEEP 0x0010 /* Give an error on excessive depth */
  111. #define KEYRING_SEARCH_SKIP_EXPIRED 0x0020 /* Ignore expired keys (intention to replace) */
  112. #define KEYRING_SEARCH_RECURSE 0x0040 /* Search child keyrings also */
  113. int (*iterator)(const void *object, void *iterator_data);
  114. /* Internal stuff */
  115. int skipped_ret;
  116. bool possessed;
  117. key_ref_t result;
  118. time64_t now;
  119. };
  120. extern bool key_default_cmp(const struct key *key,
  121. const struct key_match_data *match_data);
  122. extern key_ref_t keyring_search_rcu(key_ref_t keyring_ref,
  123. struct keyring_search_context *ctx);
  124. extern key_ref_t search_cred_keyrings_rcu(struct keyring_search_context *ctx);
  125. extern key_ref_t search_process_keyrings_rcu(struct keyring_search_context *ctx);
  126. extern struct key *find_keyring_by_name(const char *name, bool uid_keyring);
  127. extern int look_up_user_keyrings(struct key **, struct key **);
  128. extern struct key *get_user_session_keyring_rcu(const struct cred *);
  129. extern int install_thread_keyring_to_cred(struct cred *);
  130. extern int install_process_keyring_to_cred(struct cred *);
  131. extern int install_session_keyring_to_cred(struct cred *, struct key *);
  132. extern struct key *request_key_and_link(struct key_type *type,
  133. const char *description,
  134. struct key_tag *domain_tag,
  135. const void *callout_info,
  136. size_t callout_len,
  137. void *aux,
  138. struct key *dest_keyring,
  139. unsigned long flags);
  140. extern bool lookup_user_key_possessed(const struct key *key,
  141. const struct key_match_data *match_data);
  142. #define KEY_LOOKUP_CREATE 0x01
  143. #define KEY_LOOKUP_PARTIAL 0x02
  144. extern long join_session_keyring(const char *name);
  145. extern void key_change_session_keyring(struct callback_head *twork);
  146. extern struct work_struct key_gc_work;
  147. extern unsigned key_gc_delay;
  148. extern void keyring_gc(struct key *keyring, time64_t limit);
  149. extern void keyring_restriction_gc(struct key *keyring,
  150. struct key_type *dead_type);
  151. extern void key_schedule_gc(time64_t gc_at);
  152. extern void key_schedule_gc_links(void);
  153. extern void key_gc_keytype(struct key_type *ktype);
  154. extern int key_task_permission(const key_ref_t key_ref,
  155. const struct cred *cred,
  156. enum key_need_perm need_perm);
  157. static inline void notify_key(struct key *key,
  158. enum key_notification_subtype subtype, u32 aux)
  159. {
  160. #ifdef CONFIG_KEY_NOTIFICATIONS
  161. struct key_notification n = {
  162. .watch.type = WATCH_TYPE_KEY_NOTIFY,
  163. .watch.subtype = subtype,
  164. .watch.info = watch_sizeof(n),
  165. .key_id = key_serial(key),
  166. .aux = aux,
  167. };
  168. post_watch_notification(key->watchers, &n.watch, current_cred(),
  169. n.key_id);
  170. #endif
  171. }
  172. /*
  173. * Check to see whether permission is granted to use a key in the desired way.
  174. */
  175. static inline int key_permission(const key_ref_t key_ref,
  176. enum key_need_perm need_perm)
  177. {
  178. return key_task_permission(key_ref, current_cred(), need_perm);
  179. }
  180. extern struct key_type key_type_request_key_auth;
  181. extern struct key *request_key_auth_new(struct key *target,
  182. const char *op,
  183. const void *callout_info,
  184. size_t callout_len,
  185. struct key *dest_keyring);
  186. extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
  187. /*
  188. * Determine whether a key is dead.
  189. */
  190. static inline bool key_is_dead(const struct key *key, time64_t limit)
  191. {
  192. return
  193. key->flags & ((1 << KEY_FLAG_DEAD) |
  194. (1 << KEY_FLAG_INVALIDATED)) ||
  195. (key->expiry > 0 && key->expiry <= limit) ||
  196. key->domain_tag->removed;
  197. }
  198. /*
  199. * keyctl() functions
  200. */
  201. extern long keyctl_get_keyring_ID(key_serial_t, int);
  202. extern long keyctl_join_session_keyring(const char __user *);
  203. extern long keyctl_update_key(key_serial_t, const void __user *, size_t);
  204. extern long keyctl_revoke_key(key_serial_t);
  205. extern long keyctl_keyring_clear(key_serial_t);
  206. extern long keyctl_keyring_link(key_serial_t, key_serial_t);
  207. extern long keyctl_keyring_move(key_serial_t, key_serial_t, key_serial_t, unsigned int);
  208. extern long keyctl_keyring_unlink(key_serial_t, key_serial_t);
  209. extern long keyctl_describe_key(key_serial_t, char __user *, size_t);
  210. extern long keyctl_keyring_search(key_serial_t, const char __user *,
  211. const char __user *, key_serial_t);
  212. extern long keyctl_read_key(key_serial_t, char __user *, size_t);
  213. extern long keyctl_chown_key(key_serial_t, uid_t, gid_t);
  214. extern long keyctl_setperm_key(key_serial_t, key_perm_t);
  215. extern long keyctl_instantiate_key(key_serial_t, const void __user *,
  216. size_t, key_serial_t);
  217. extern long keyctl_negate_key(key_serial_t, unsigned, key_serial_t);
  218. extern long keyctl_set_reqkey_keyring(int);
  219. extern long keyctl_set_timeout(key_serial_t, unsigned);
  220. extern long keyctl_assume_authority(key_serial_t);
  221. extern long keyctl_get_security(key_serial_t keyid, char __user *buffer,
  222. size_t buflen);
  223. extern long keyctl_session_to_parent(void);
  224. extern long keyctl_reject_key(key_serial_t, unsigned, unsigned, key_serial_t);
  225. extern long keyctl_instantiate_key_iov(key_serial_t,
  226. const struct iovec __user *,
  227. unsigned, key_serial_t);
  228. extern long keyctl_invalidate_key(key_serial_t);
  229. extern long keyctl_restrict_keyring(key_serial_t id,
  230. const char __user *_type,
  231. const char __user *_restriction);
  232. #ifdef CONFIG_PERSISTENT_KEYRINGS
  233. extern long keyctl_get_persistent(uid_t, key_serial_t);
  234. extern unsigned persistent_keyring_expiry;
  235. #else
  236. static inline long keyctl_get_persistent(uid_t uid, key_serial_t destring)
  237. {
  238. return -EOPNOTSUPP;
  239. }
  240. #endif
  241. #ifdef CONFIG_KEY_DH_OPERATIONS
  242. extern long keyctl_dh_compute(struct keyctl_dh_params __user *, char __user *,
  243. size_t, struct keyctl_kdf_params __user *);
  244. extern long __keyctl_dh_compute(struct keyctl_dh_params __user *, char __user *,
  245. size_t, struct keyctl_kdf_params *);
  246. #ifdef CONFIG_COMPAT
  247. extern long compat_keyctl_dh_compute(struct keyctl_dh_params __user *params,
  248. char __user *buffer, size_t buflen,
  249. struct compat_keyctl_kdf_params __user *kdf);
  250. #endif
  251. #define KEYCTL_KDF_MAX_OUTPUT_LEN 1024 /* max length of KDF output */
  252. #define KEYCTL_KDF_MAX_OI_LEN 64 /* max length of otherinfo */
  253. #else
  254. static inline long keyctl_dh_compute(struct keyctl_dh_params __user *params,
  255. char __user *buffer, size_t buflen,
  256. struct keyctl_kdf_params __user *kdf)
  257. {
  258. return -EOPNOTSUPP;
  259. }
  260. #ifdef CONFIG_COMPAT
  261. static inline long compat_keyctl_dh_compute(
  262. struct keyctl_dh_params __user *params,
  263. char __user *buffer, size_t buflen,
  264. struct keyctl_kdf_params __user *kdf)
  265. {
  266. return -EOPNOTSUPP;
  267. }
  268. #endif
  269. #endif
  270. #ifdef CONFIG_ASYMMETRIC_KEY_TYPE
  271. extern long keyctl_pkey_query(key_serial_t,
  272. const char __user *,
  273. struct keyctl_pkey_query __user *);
  274. extern long keyctl_pkey_verify(const struct keyctl_pkey_params __user *,
  275. const char __user *,
  276. const void __user *, const void __user *);
  277. extern long keyctl_pkey_e_d_s(int,
  278. const struct keyctl_pkey_params __user *,
  279. const char __user *,
  280. const void __user *, void __user *);
  281. #else
  282. static inline long keyctl_pkey_query(key_serial_t id,
  283. const char __user *_info,
  284. struct keyctl_pkey_query __user *_res)
  285. {
  286. return -EOPNOTSUPP;
  287. }
  288. static inline long keyctl_pkey_verify(const struct keyctl_pkey_params __user *params,
  289. const char __user *_info,
  290. const void __user *_in,
  291. const void __user *_in2)
  292. {
  293. return -EOPNOTSUPP;
  294. }
  295. static inline long keyctl_pkey_e_d_s(int op,
  296. const struct keyctl_pkey_params __user *params,
  297. const char __user *_info,
  298. const void __user *_in,
  299. void __user *_out)
  300. {
  301. return -EOPNOTSUPP;
  302. }
  303. #endif
  304. extern long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen);
  305. #ifdef CONFIG_KEY_NOTIFICATIONS
  306. extern long keyctl_watch_key(key_serial_t, int, int);
  307. #else
  308. static inline long keyctl_watch_key(key_serial_t key_id, int watch_fd, int watch_id)
  309. {
  310. return -EOPNOTSUPP;
  311. }
  312. #endif
  313. /*
  314. * Debugging key validation
  315. */
  316. #ifdef KEY_DEBUGGING
  317. extern void __key_check(const struct key *);
  318. static inline void key_check(const struct key *key)
  319. {
  320. if (key && (IS_ERR(key) || key->magic != KEY_DEBUG_MAGIC))
  321. __key_check(key);
  322. }
  323. #else
  324. #define key_check(key) do {} while(0)
  325. #endif
  326. #endif /* _INTERNAL_H */