permission.c 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Key permission checking
  3. *
  4. * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #include <linux/export.h>
  8. #include <linux/security.h>
  9. #include "internal.h"
  10. /**
  11. * key_task_permission - Check a key can be used
  12. * @key_ref: The key to check.
  13. * @cred: The credentials to use.
  14. * @need_perm: The permission required.
  15. *
  16. * Check to see whether permission is granted to use a key in the desired way,
  17. * but permit the security modules to override.
  18. *
  19. * The caller must hold either a ref on cred or must hold the RCU readlock.
  20. *
  21. * Returns 0 if successful, -EACCES if access is denied based on the
  22. * permissions bits or the LSM check.
  23. */
  24. int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
  25. enum key_need_perm need_perm)
  26. {
  27. struct key *key;
  28. key_perm_t kperm, mask;
  29. int ret;
  30. switch (need_perm) {
  31. default:
  32. WARN_ON(1);
  33. return -EACCES;
  34. case KEY_NEED_UNLINK:
  35. case KEY_SYSADMIN_OVERRIDE:
  36. case KEY_AUTHTOKEN_OVERRIDE:
  37. case KEY_DEFER_PERM_CHECK:
  38. goto lsm;
  39. case KEY_NEED_VIEW: mask = KEY_OTH_VIEW; break;
  40. case KEY_NEED_READ: mask = KEY_OTH_READ; break;
  41. case KEY_NEED_WRITE: mask = KEY_OTH_WRITE; break;
  42. case KEY_NEED_SEARCH: mask = KEY_OTH_SEARCH; break;
  43. case KEY_NEED_LINK: mask = KEY_OTH_LINK; break;
  44. case KEY_NEED_SETATTR: mask = KEY_OTH_SETATTR; break;
  45. }
  46. key = key_ref_to_ptr(key_ref);
  47. /* use the second 8-bits of permissions for keys the caller owns */
  48. if (uid_eq(key->uid, cred->fsuid)) {
  49. kperm = key->perm >> 16;
  50. goto use_these_perms;
  51. }
  52. /* use the third 8-bits of permissions for keys the caller has a group
  53. * membership in common with */
  54. if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) {
  55. if (gid_eq(key->gid, cred->fsgid)) {
  56. kperm = key->perm >> 8;
  57. goto use_these_perms;
  58. }
  59. ret = groups_search(cred->group_info, key->gid);
  60. if (ret) {
  61. kperm = key->perm >> 8;
  62. goto use_these_perms;
  63. }
  64. }
  65. /* otherwise use the least-significant 8-bits */
  66. kperm = key->perm;
  67. use_these_perms:
  68. /* use the top 8-bits of permissions for keys the caller possesses
  69. * - possessor permissions are additive with other permissions
  70. */
  71. if (is_key_possessed(key_ref))
  72. kperm |= key->perm >> 24;
  73. if ((kperm & mask) != mask)
  74. return -EACCES;
  75. /* let LSM be the final arbiter */
  76. lsm:
  77. return security_key_permission(key_ref, cred, need_perm);
  78. }
  79. EXPORT_SYMBOL(key_task_permission);
  80. /**
  81. * key_validate - Validate a key.
  82. * @key: The key to be validated.
  83. *
  84. * Check that a key is valid, returning 0 if the key is okay, -ENOKEY if the
  85. * key is invalidated, -EKEYREVOKED if the key's type has been removed or if
  86. * the key has been revoked or -EKEYEXPIRED if the key has expired.
  87. */
  88. int key_validate(const struct key *key)
  89. {
  90. unsigned long flags = READ_ONCE(key->flags);
  91. time64_t expiry = READ_ONCE(key->expiry);
  92. if (flags & (1 << KEY_FLAG_INVALIDATED))
  93. return -ENOKEY;
  94. /* check it's still accessible */
  95. if (flags & ((1 << KEY_FLAG_REVOKED) |
  96. (1 << KEY_FLAG_DEAD)))
  97. return -EKEYREVOKED;
  98. /* check it hasn't expired */
  99. if (expiry) {
  100. if (ktime_get_real_seconds() >= expiry)
  101. return -EKEYEXPIRED;
  102. }
  103. return 0;
  104. }
  105. EXPORT_SYMBOL(key_validate);