aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/include/file.h3
-rw-r--r--security/apparmor/include/match.h3
-rw-r--r--security/capability.c15
-rw-r--r--security/keys/Makefile4
-rw-r--r--security/keys/compat.c67
-rw-r--r--security/keys/encrypted.c (renamed from security/keys/encrypted_defined.c)5
-rw-r--r--security/keys/encrypted.h (renamed from security/keys/encrypted_defined.h)0
-rw-r--r--security/keys/gc.c14
-rw-r--r--security/keys/internal.h40
-rw-r--r--security/keys/key.c345
-rw-r--r--security/keys/keyctl.c496
-rw-r--r--security/keys/keyring.c330
-rw-r--r--security/keys/permission.c33
-rw-r--r--security/keys/proc.c17
-rw-r--r--security/keys/process_keys.c135
-rw-r--r--security/keys/request_key.c168
-rw-r--r--security/keys/request_key_auth.c62
-rw-r--r--security/keys/trusted.c (renamed from security/keys/trusted_defined.c)57
-rw-r--r--security/keys/trusted.h (renamed from security/keys/trusted_defined.h)0
-rw-r--r--security/keys/user_defined.c35
-rw-r--r--security/security.c21
-rw-r--r--security/selinux/hooks.c356
-rw-r--r--security/selinux/include/avc.h1
-rw-r--r--security/selinux/include/classmap.h7
-rw-r--r--security/selinux/include/security.h8
-rw-r--r--security/selinux/ss/avtab.h22
-rw-r--r--security/selinux/ss/conditional.c2
-rw-r--r--security/selinux/ss/mls.c5
-rw-r--r--security/selinux/ss/mls.h3
-rw-r--r--security/selinux/ss/policydb.c134
-rw-r--r--security/selinux/ss/policydb.h14
-rw-r--r--security/selinux/ss/services.c73
-rw-r--r--security/selinux/xfrm.c2
-rw-r--r--security/smack/smack_lsm.c5
34 files changed, 1575 insertions, 907 deletions
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index be36feabb16a..ab8c6d87f758 100644
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -15,12 +15,11 @@
15#ifndef __AA_FILE_H 15#ifndef __AA_FILE_H
16#define __AA_FILE_H 16#define __AA_FILE_H
17 17
18#include <linux/path.h>
19
20#include "domain.h" 18#include "domain.h"
21#include "match.h" 19#include "match.h"
22 20
23struct aa_profile; 21struct aa_profile;
22struct path;
24 23
25/* 24/*
26 * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags 25 * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags
diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index 734a6d35112c..a4a863997bd5 100644
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -15,6 +15,7 @@
15#ifndef __AA_MATCH_H 15#ifndef __AA_MATCH_H
16#define __AA_MATCH_H 16#define __AA_MATCH_H
17 17
18#include <linux/kref.h>
18#include <linux/workqueue.h> 19#include <linux/workqueue.h>
19 20
20#define DFA_NOMATCH 0 21#define DFA_NOMATCH 0
@@ -27,7 +28,7 @@
27 * The format used for transition tables is based on the GNU flex table 28 * The format used for transition tables is based on the GNU flex table
28 * file format (--tables-file option; see Table File Format in the flex 29 * file format (--tables-file option; see Table File Format in the flex
29 * info pages and the flex sources for documentation). The magic number 30 * info pages and the flex sources for documentation). The magic number
30 * used in the header is 0x1B5E783D insted of 0xF13C57B1 though, because 31 * used in the header is 0x1B5E783D instead of 0xF13C57B1 though, because
31 * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used 32 * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used
32 * slightly differently (see the apparmor-parser package). 33 * slightly differently (see the apparmor-parser package).
33 */ 34 */
diff --git a/security/capability.c b/security/capability.c
index 2a5df2b7da83..ab3d807accc3 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -12,11 +12,6 @@
12 12
13#include <linux/security.h> 13#include <linux/security.h>
14 14
15static int cap_sysctl(ctl_table *table, int op)
16{
17 return 0;
18}
19
20static int cap_syslog(int type) 15static int cap_syslog(int type)
21{ 16{
22 return 0; 17 return 0;
@@ -59,6 +54,11 @@ static int cap_sb_copy_data(char *orig, char *copy)
59 return 0; 54 return 0;
60} 55}
61 56
57static int cap_sb_remount(struct super_block *sb, void *data)
58{
59 return 0;
60}
61
62static int cap_sb_kern_mount(struct super_block *sb, int flags, void *data) 62static int cap_sb_kern_mount(struct super_block *sb, int flags, void *data)
63{ 63{
64 return 0; 64 return 0;
@@ -118,7 +118,8 @@ static void cap_inode_free_security(struct inode *inode)
118} 118}
119 119
120static int cap_inode_init_security(struct inode *inode, struct inode *dir, 120static int cap_inode_init_security(struct inode *inode, struct inode *dir,
121 char **name, void **value, size_t *len) 121 const struct qstr *qstr, char **name,
122 void **value, size_t *len)
122{ 123{
123 return -EOPNOTSUPP; 124 return -EOPNOTSUPP;
124} 125}
@@ -880,7 +881,6 @@ void __init security_fixup_ops(struct security_operations *ops)
880 set_to_cap_if_null(ops, capable); 881 set_to_cap_if_null(ops, capable);
881 set_to_cap_if_null(ops, quotactl); 882 set_to_cap_if_null(ops, quotactl);
882 set_to_cap_if_null(ops, quota_on); 883 set_to_cap_if_null(ops, quota_on);
883 set_to_cap_if_null(ops, sysctl);
884 set_to_cap_if_null(ops, syslog); 884 set_to_cap_if_null(ops, syslog);
885 set_to_cap_if_null(ops, settime); 885 set_to_cap_if_null(ops, settime);
886 set_to_cap_if_null(ops, vm_enough_memory); 886 set_to_cap_if_null(ops, vm_enough_memory);
@@ -892,6 +892,7 @@ void __init security_fixup_ops(struct security_operations *ops)
892 set_to_cap_if_null(ops, sb_alloc_security); 892 set_to_cap_if_null(ops, sb_alloc_security);
893 set_to_cap_if_null(ops, sb_free_security); 893 set_to_cap_if_null(ops, sb_free_security);
894 set_to_cap_if_null(ops, sb_copy_data); 894 set_to_cap_if_null(ops, sb_copy_data);
895 set_to_cap_if_null(ops, sb_remount);
895 set_to_cap_if_null(ops, sb_kern_mount); 896 set_to_cap_if_null(ops, sb_kern_mount);
896 set_to_cap_if_null(ops, sb_show_options); 897 set_to_cap_if_null(ops, sb_show_options);
897 set_to_cap_if_null(ops, sb_statfs); 898 set_to_cap_if_null(ops, sb_statfs);
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 6c941050f573..1bf090a885fe 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -13,8 +13,8 @@ obj-y := \
13 request_key_auth.o \ 13 request_key_auth.o \
14 user_defined.o 14 user_defined.o
15 15
16obj-$(CONFIG_TRUSTED_KEYS) += trusted_defined.o 16obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
17obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted_defined.o 17obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o
18obj-$(CONFIG_KEYS_COMPAT) += compat.o 18obj-$(CONFIG_KEYS_COMPAT) += compat.o
19obj-$(CONFIG_PROC_FS) += proc.o 19obj-$(CONFIG_PROC_FS) += proc.o
20obj-$(CONFIG_SYSCTL) += sysctl.o 20obj-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 792c0a611a6d..338b510e9027 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -1,4 +1,4 @@
1/* compat.c: 32-bit compatibility syscall for 64-bit systems 1/* 32-bit compatibility syscall for 64-bit systems
2 * 2 *
3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -12,15 +12,58 @@
12#include <linux/syscalls.h> 12#include <linux/syscalls.h>
13#include <linux/keyctl.h> 13#include <linux/keyctl.h>
14#include <linux/compat.h> 14#include <linux/compat.h>
15#include <linux/slab.h>
15#include "internal.h" 16#include "internal.h"
16 17
17/*****************************************************************************/
18/* 18/*
19 * the key control system call, 32-bit compatibility version for 64-bit archs 19 * Instantiate a key with the specified compatibility multipart payload and
20 * - this should only be called if the 64-bit arch uses weird pointers in 20 * link the key into the destination keyring if one is given.
21 * 32-bit mode or doesn't guarantee that the top 32-bits of the argument 21 *
22 * registers on taking a 32-bit syscall are zero 22 * The caller must have the appropriate instantiation permit set for this to
23 * - if you can, you should call sys_keyctl directly 23 * work (see keyctl_assume_authority). No other permissions are required.
24 *
25 * If successful, 0 will be returned.
26 */
27long compat_keyctl_instantiate_key_iov(
28 key_serial_t id,
29 const struct compat_iovec __user *_payload_iov,
30 unsigned ioc,
31 key_serial_t ringid)
32{
33 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
34 long ret;
35
36 if (_payload_iov == 0 || ioc == 0)
37 goto no_payload;
38
39 ret = compat_rw_copy_check_uvector(WRITE, _payload_iov, ioc,
40 ARRAY_SIZE(iovstack),
41 iovstack, &iov);
42 if (ret < 0)
43 return ret;
44 if (ret == 0)
45 goto no_payload_free;
46
47 ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
48
49 if (iov != iovstack)
50 kfree(iov);
51 return ret;
52
53no_payload_free:
54 if (iov != iovstack)
55 kfree(iov);
56no_payload:
57 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
58}
59
60/*
61 * The key control system call, 32-bit compatibility version for 64-bit archs
62 *
63 * This should only be called if the 64-bit arch uses weird pointers in 32-bit
64 * mode or doesn't guarantee that the top 32-bits of the argument registers on
65 * taking a 32-bit syscall are zero. If you can, you should call sys_keyctl()
66 * directly.
24 */ 67 */
25asmlinkage long compat_sys_keyctl(u32 option, 68asmlinkage long compat_sys_keyctl(u32 option,
26 u32 arg2, u32 arg3, u32 arg4, u32 arg5) 69 u32 arg2, u32 arg3, u32 arg4, u32 arg5)
@@ -85,8 +128,14 @@ asmlinkage long compat_sys_keyctl(u32 option,
85 case KEYCTL_SESSION_TO_PARENT: 128 case KEYCTL_SESSION_TO_PARENT:
86 return keyctl_session_to_parent(); 129 return keyctl_session_to_parent();
87 130
131 case KEYCTL_REJECT:
132 return keyctl_reject_key(arg2, arg3, arg4, arg5);
133
134 case KEYCTL_INSTANTIATE_IOV:
135 return compat_keyctl_instantiate_key_iov(
136 arg2, compat_ptr(arg3), arg4, arg5);
137
88 default: 138 default:
89 return -EOPNOTSUPP; 139 return -EOPNOTSUPP;
90 } 140 }
91 141}
92} /* end compat_sys_keyctl() */
diff --git a/security/keys/encrypted_defined.c b/security/keys/encrypted.c
index 32d27c858388..69907a58a683 100644
--- a/security/keys/encrypted_defined.c
+++ b/security/keys/encrypted.c
@@ -30,7 +30,7 @@
30#include <crypto/sha.h> 30#include <crypto/sha.h>
31#include <crypto/aes.h> 31#include <crypto/aes.h>
32 32
33#include "encrypted_defined.h" 33#include "encrypted.h"
34 34
35static const char KEY_TRUSTED_PREFIX[] = "trusted:"; 35static const char KEY_TRUSTED_PREFIX[] = "trusted:";
36static const char KEY_USER_PREFIX[] = "user:"; 36static const char KEY_USER_PREFIX[] = "user:";
@@ -765,8 +765,7 @@ static long encrypted_read(const struct key *key, char __user *buffer,
765 size_t asciiblob_len; 765 size_t asciiblob_len;
766 int ret; 766 int ret;
767 767
768 epayload = rcu_dereference_protected(key->payload.data, 768 epayload = rcu_dereference_key(key);
769 rwsem_is_locked(&((struct key *)key)->sem));
770 769
771 /* returns the hex encoded iv, encrypted-data, and hmac as ascii */ 770 /* returns the hex encoded iv, encrypted-data, and hmac as ascii */
772 asciiblob_len = epayload->datablob_len + ivsize + 1 771 asciiblob_len = epayload->datablob_len + ivsize + 1
diff --git a/security/keys/encrypted_defined.h b/security/keys/encrypted.h
index cef5e2f2b7d1..cef5e2f2b7d1 100644
--- a/security/keys/encrypted_defined.h
+++ b/security/keys/encrypted.h
diff --git a/security/keys/gc.c b/security/keys/gc.c
index a46e825cbf02..89df6b5f203c 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -32,8 +32,8 @@ static time_t key_gc_next_run = LONG_MAX;
32static time_t key_gc_new_timer; 32static time_t key_gc_new_timer;
33 33
34/* 34/*
35 * Schedule a garbage collection run 35 * Schedule a garbage collection run.
36 * - precision isn't particularly important 36 * - time precision isn't particularly important
37 */ 37 */
38void key_schedule_gc(time_t gc_at) 38void key_schedule_gc(time_t gc_at)
39{ 39{
@@ -61,8 +61,9 @@ static void key_gc_timer_func(unsigned long data)
61} 61}
62 62
63/* 63/*
64 * Garbage collect pointers from a keyring 64 * Garbage collect pointers from a keyring.
65 * - return true if we altered the keyring 65 *
66 * Return true if we altered the keyring.
66 */ 67 */
67static bool key_gc_keyring(struct key *keyring, time_t limit) 68static bool key_gc_keyring(struct key *keyring, time_t limit)
68 __releases(key_serial_lock) 69 __releases(key_serial_lock)
@@ -107,9 +108,8 @@ do_gc:
107} 108}
108 109
109/* 110/*
110 * Garbage collector for keys 111 * Garbage collector for keys. This involves scanning the keyrings for dead,
111 * - this involves scanning the keyrings for dead, expired and revoked keys 112 * expired and revoked keys that have overstayed their welcome
112 * that have overstayed their welcome
113 */ 113 */
114static void key_garbage_collector(struct work_struct *work) 114static void key_garbage_collector(struct work_struct *work)
115{ 115{
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 56a133d8f37d..07a025f81902 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -1,4 +1,4 @@
1/* internal.h: authentication token and access key management internal defs 1/* Authentication token and access key management internal defs
2 * 2 *
3 * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -35,10 +35,12 @@ extern struct key_type key_type_user;
35 35
36/*****************************************************************************/ 36/*****************************************************************************/
37/* 37/*
38 * keep track of keys for a user 38 * Keep track of keys for a user.
39 * - this needs to be separate to user_struct to avoid a refcount-loop 39 *
40 * (user_struct pins some keyrings which pin this struct) 40 * This needs to be separate to user_struct to avoid a refcount-loop
41 * - this also keeps track of keys under request from userspace for this UID 41 * (user_struct pins some keyrings which pin this struct).
42 *
43 * We also keep track of keys under request from userspace for this UID here.
42 */ 44 */
43struct key_user { 45struct key_user {
44 struct rb_node node; 46 struct rb_node node;
@@ -62,7 +64,7 @@ extern struct key_user *key_user_lookup(uid_t uid,
62extern void key_user_put(struct key_user *user); 64extern void key_user_put(struct key_user *user);
63 65
64/* 66/*
65 * key quota limits 67 * Key quota limits.
66 * - root has its own separate limits to everyone else 68 * - root has its own separate limits to everyone else
67 */ 69 */
68extern unsigned key_quota_root_maxkeys; 70extern unsigned key_quota_root_maxkeys;
@@ -85,13 +87,13 @@ extern void key_type_put(struct key_type *ktype);
85extern int __key_link_begin(struct key *keyring, 87extern int __key_link_begin(struct key *keyring,
86 const struct key_type *type, 88 const struct key_type *type,
87 const char *description, 89 const char *description,
88 struct keyring_list **_prealloc); 90 unsigned long *_prealloc);
89extern int __key_link_check_live_key(struct key *keyring, struct key *key); 91extern int __key_link_check_live_key(struct key *keyring, struct key *key);
90extern void __key_link(struct key *keyring, struct key *key, 92extern void __key_link(struct key *keyring, struct key *key,
91 struct keyring_list **_prealloc); 93 unsigned long *_prealloc);
92extern void __key_link_end(struct key *keyring, 94extern void __key_link_end(struct key *keyring,
93 struct key_type *type, 95 struct key_type *type,
94 struct keyring_list *prealloc); 96 unsigned long prealloc);
95 97
96extern key_ref_t __keyring_search_one(key_ref_t keyring_ref, 98extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
97 const struct key_type *type, 99 const struct key_type *type,
@@ -146,13 +148,13 @@ extern unsigned key_gc_delay;
146extern void keyring_gc(struct key *keyring, time_t limit); 148extern void keyring_gc(struct key *keyring, time_t limit);
147extern void key_schedule_gc(time_t expiry_at); 149extern void key_schedule_gc(time_t expiry_at);
148 150
149/*
150 * check to see whether permission is granted to use a key in the desired way
151 */
152extern int key_task_permission(const key_ref_t key_ref, 151extern int key_task_permission(const key_ref_t key_ref,
153 const struct cred *cred, 152 const struct cred *cred,
154 key_perm_t perm); 153 key_perm_t perm);
155 154
155/*
156 * Check to see whether permission is granted to use a key in the desired way.
157 */
156static inline int key_permission(const key_ref_t key_ref, key_perm_t perm) 158static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
157{ 159{
158 return key_task_permission(key_ref, current_cred(), perm); 160 return key_task_permission(key_ref, current_cred(), perm);
@@ -168,7 +170,7 @@ static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
168#define KEY_ALL 0x3f /* all the above permissions */ 170#define KEY_ALL 0x3f /* all the above permissions */
169 171
170/* 172/*
171 * request_key authorisation 173 * Authorisation record for request_key().
172 */ 174 */
173struct request_key_auth { 175struct request_key_auth {
174 struct key *target_key; 176 struct key *target_key;
@@ -188,7 +190,7 @@ extern struct key *request_key_auth_new(struct key *target,
188extern struct key *key_get_instantiation_authkey(key_serial_t target_id); 190extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
189 191
190/* 192/*
191 * keyctl functions 193 * keyctl() functions
192 */ 194 */
193extern long keyctl_get_keyring_ID(key_serial_t, int); 195extern long keyctl_get_keyring_ID(key_serial_t, int);
194extern long keyctl_join_session_keyring(const char __user *); 196extern long keyctl_join_session_keyring(const char __user *);
@@ -212,9 +214,17 @@ extern long keyctl_assume_authority(key_serial_t);
212extern long keyctl_get_security(key_serial_t keyid, char __user *buffer, 214extern long keyctl_get_security(key_serial_t keyid, char __user *buffer,
213 size_t buflen); 215 size_t buflen);
214extern long keyctl_session_to_parent(void); 216extern long keyctl_session_to_parent(void);
217extern long keyctl_reject_key(key_serial_t, unsigned, unsigned, key_serial_t);
218extern long keyctl_instantiate_key_iov(key_serial_t,
219 const struct iovec __user *,
220 unsigned, key_serial_t);
221
222extern long keyctl_instantiate_key_common(key_serial_t,
223 const struct iovec __user *,
224 unsigned, size_t, key_serial_t);
215 225
216/* 226/*
217 * debugging key validation 227 * Debugging key validation
218 */ 228 */
219#ifdef KEY_DEBUGGING 229#ifdef KEY_DEBUGGING
220extern void __key_check(const struct key *); 230extern void __key_check(const struct key *);
diff --git a/security/keys/key.c b/security/keys/key.c
index c1eac8084ade..f7f9d93f08d9 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -39,10 +39,10 @@ static DECLARE_RWSEM(key_types_sem);
39static void key_cleanup(struct work_struct *work); 39static void key_cleanup(struct work_struct *work);
40static DECLARE_WORK(key_cleanup_task, key_cleanup); 40static DECLARE_WORK(key_cleanup_task, key_cleanup);
41 41
42/* we serialise key instantiation and link */ 42/* We serialise key instantiation and link */
43DEFINE_MUTEX(key_construction_mutex); 43DEFINE_MUTEX(key_construction_mutex);
44 44
45/* any key who's type gets unegistered will be re-typed to this */ 45/* Any key who's type gets unegistered will be re-typed to this */
46static struct key_type key_type_dead = { 46static struct key_type key_type_dead = {
47 .name = "dead", 47 .name = "dead",
48}; 48};
@@ -56,10 +56,9 @@ void __key_check(const struct key *key)
56} 56}
57#endif 57#endif
58 58
59/*****************************************************************************/
60/* 59/*
61 * get the key quota record for a user, allocating a new record if one doesn't 60 * Get the key quota record for a user, allocating a new record if one doesn't
62 * already exist 61 * already exist.
63 */ 62 */
64struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns) 63struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
65{ 64{
@@ -67,7 +66,7 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
67 struct rb_node *parent = NULL; 66 struct rb_node *parent = NULL;
68 struct rb_node **p; 67 struct rb_node **p;
69 68
70 try_again: 69try_again:
71 p = &key_user_tree.rb_node; 70 p = &key_user_tree.rb_node;
72 spin_lock(&key_user_lock); 71 spin_lock(&key_user_lock);
73 72
@@ -124,18 +123,16 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
124 goto out; 123 goto out;
125 124
126 /* okay - we found a user record for this UID */ 125 /* okay - we found a user record for this UID */
127 found: 126found:
128 atomic_inc(&user->usage); 127 atomic_inc(&user->usage);
129 spin_unlock(&key_user_lock); 128 spin_unlock(&key_user_lock);
130 kfree(candidate); 129 kfree(candidate);
131 out: 130out:
132 return user; 131 return user;
132}
133 133
134} /* end key_user_lookup() */
135
136/*****************************************************************************/
137/* 134/*
138 * dispose of a user structure 135 * Dispose of a user structure
139 */ 136 */
140void key_user_put(struct key_user *user) 137void key_user_put(struct key_user *user)
141{ 138{
@@ -146,14 +143,11 @@ void key_user_put(struct key_user *user)
146 143
147 kfree(user); 144 kfree(user);
148 } 145 }
146}
149 147
150} /* end key_user_put() */
151
152/*****************************************************************************/
153/* 148/*
154 * assign a key the next unique serial number 149 * Allocate a serial number for a key. These are assigned randomly to avoid
155 * - these are assigned randomly to avoid security issues through covert 150 * security issues through covert channel problems.
156 * channel problems
157 */ 151 */
158static inline void key_alloc_serial(struct key *key) 152static inline void key_alloc_serial(struct key *key)
159{ 153{
@@ -211,18 +205,36 @@ serial_exists:
211 if (key->serial < xkey->serial) 205 if (key->serial < xkey->serial)
212 goto attempt_insertion; 206 goto attempt_insertion;
213 } 207 }
208}
214 209
215} /* end key_alloc_serial() */ 210/**
216 211 * key_alloc - Allocate a key of the specified type.
217/*****************************************************************************/ 212 * @type: The type of key to allocate.
218/* 213 * @desc: The key description to allow the key to be searched out.
219 * allocate a key of the specified type 214 * @uid: The owner of the new key.
220 * - update the user's quota to reflect the existence of the key 215 * @gid: The group ID for the new key's group permissions.
221 * - called from a key-type operation with key_types_sem read-locked by 216 * @cred: The credentials specifying UID namespace.
222 * key_create_or_update() 217 * @perm: The permissions mask of the new key.
223 * - this prevents unregistration of the key type 218 * @flags: Flags specifying quota properties.
224 * - upon return the key is as yet uninstantiated; the caller needs to either 219 *
225 * instantiate the key or discard it before returning 220 * Allocate a key of the specified type with the attributes given. The key is
221 * returned in an uninstantiated state and the caller needs to instantiate the
222 * key before returning.
223 *
224 * The user's key count quota is updated to reflect the creation of the key and
225 * the user's key data quota has the default for the key type reserved. The
226 * instantiation function should amend this as necessary. If insufficient
227 * quota is available, -EDQUOT will be returned.
228 *
229 * The LSM security modules can prevent a key being created, in which case
230 * -EACCES will be returned.
231 *
232 * Returns a pointer to the new key if successful and an error code otherwise.
233 *
234 * Note that the caller needs to ensure the key type isn't uninstantiated.
235 * Internally this can be done by locking key_types_sem. Externally, this can
236 * be done by either never unregistering the key type, or making sure
237 * key_alloc() calls don't race with module unloading.
226 */ 238 */
227struct key *key_alloc(struct key_type *type, const char *desc, 239struct key *key_alloc(struct key_type *type, const char *desc,
228 uid_t uid, gid_t gid, const struct cred *cred, 240 uid_t uid, gid_t gid, const struct cred *cred,
@@ -237,6 +249,14 @@ struct key *key_alloc(struct key_type *type, const char *desc,
237 if (!desc || !*desc) 249 if (!desc || !*desc)
238 goto error; 250 goto error;
239 251
252 if (type->vet_description) {
253 ret = type->vet_description(desc);
254 if (ret < 0) {
255 key = ERR_PTR(ret);
256 goto error;
257 }
258 }
259
240 desclen = strlen(desc) + 1; 260 desclen = strlen(desc) + 1;
241 quotalen = desclen + type->def_datalen; 261 quotalen = desclen + type->def_datalen;
242 262
@@ -344,14 +364,19 @@ no_quota:
344 key_user_put(user); 364 key_user_put(user);
345 key = ERR_PTR(-EDQUOT); 365 key = ERR_PTR(-EDQUOT);
346 goto error; 366 goto error;
347 367}
348} /* end key_alloc() */
349
350EXPORT_SYMBOL(key_alloc); 368EXPORT_SYMBOL(key_alloc);
351 369
352/*****************************************************************************/ 370/**
353/* 371 * key_payload_reserve - Adjust data quota reservation for the key's payload
354 * reserve an amount of quota for the key's payload 372 * @key: The key to make the reservation for.
373 * @datalen: The amount of data payload the caller now wants.
374 *
375 * Adjust the amount of the owning user's key data quota that a key reserves.
376 * If the amount is increased, then -EDQUOT may be returned if there isn't
377 * enough free quota available.
378 *
379 * If successful, 0 is returned.
355 */ 380 */
356int key_payload_reserve(struct key *key, size_t datalen) 381int key_payload_reserve(struct key *key, size_t datalen)
357{ 382{
@@ -384,22 +409,21 @@ int key_payload_reserve(struct key *key, size_t datalen)
384 key->datalen = datalen; 409 key->datalen = datalen;
385 410
386 return ret; 411 return ret;
387 412}
388} /* end key_payload_reserve() */
389
390EXPORT_SYMBOL(key_payload_reserve); 413EXPORT_SYMBOL(key_payload_reserve);
391 414
392/*****************************************************************************/
393/* 415/*
394 * instantiate a key and link it into the target keyring atomically 416 * Instantiate a key and link it into the target keyring atomically. Must be
395 * - called with the target keyring's semaphore writelocked 417 * called with the target keyring's semaphore writelocked. The target key's
418 * semaphore need not be locked as instantiation is serialised by
419 * key_construction_mutex.
396 */ 420 */
397static int __key_instantiate_and_link(struct key *key, 421static int __key_instantiate_and_link(struct key *key,
398 const void *data, 422 const void *data,
399 size_t datalen, 423 size_t datalen,
400 struct key *keyring, 424 struct key *keyring,
401 struct key *authkey, 425 struct key *authkey,
402 struct keyring_list **_prealloc) 426 unsigned long *_prealloc)
403{ 427{
404 int ret, awaken; 428 int ret, awaken;
405 429
@@ -441,12 +465,23 @@ static int __key_instantiate_and_link(struct key *key,
441 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 465 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
442 466
443 return ret; 467 return ret;
468}
444 469
445} /* end __key_instantiate_and_link() */ 470/**
446 471 * key_instantiate_and_link - Instantiate a key and link it into the keyring.
447/*****************************************************************************/ 472 * @key: The key to instantiate.
448/* 473 * @data: The data to use to instantiate the keyring.
449 * instantiate a key and link it into the target keyring atomically 474 * @datalen: The length of @data.
475 * @keyring: Keyring to create a link in on success (or NULL).
476 * @authkey: The authorisation token permitting instantiation.
477 *
478 * Instantiate a key that's in the uninstantiated state using the provided data
479 * and, if successful, link it in to the destination keyring if one is
480 * supplied.
481 *
482 * If successful, 0 is returned, the authorisation token is revoked and anyone
483 * waiting for the key is woken up. If the key was already instantiated,
484 * -EBUSY will be returned.
450 */ 485 */
451int key_instantiate_and_link(struct key *key, 486int key_instantiate_and_link(struct key *key,
452 const void *data, 487 const void *data,
@@ -454,7 +489,7 @@ int key_instantiate_and_link(struct key *key,
454 struct key *keyring, 489 struct key *keyring,
455 struct key *authkey) 490 struct key *authkey)
456{ 491{
457 struct keyring_list *prealloc; 492 unsigned long prealloc;
458 int ret; 493 int ret;
459 494
460 if (keyring) { 495 if (keyring) {
@@ -471,21 +506,38 @@ int key_instantiate_and_link(struct key *key,
471 __key_link_end(keyring, key->type, prealloc); 506 __key_link_end(keyring, key->type, prealloc);
472 507
473 return ret; 508 return ret;
474 509}
475} /* end key_instantiate_and_link() */
476 510
477EXPORT_SYMBOL(key_instantiate_and_link); 511EXPORT_SYMBOL(key_instantiate_and_link);
478 512
479/*****************************************************************************/ 513/**
480/* 514 * key_reject_and_link - Negatively instantiate a key and link it into the keyring.
481 * negatively instantiate a key and link it into the target keyring atomically 515 * @key: The key to instantiate.
516 * @timeout: The timeout on the negative key.
517 * @error: The error to return when the key is hit.
518 * @keyring: Keyring to create a link in on success (or NULL).
519 * @authkey: The authorisation token permitting instantiation.
520 *
521 * Negatively instantiate a key that's in the uninstantiated state and, if
522 * successful, set its timeout and stored error and link it in to the
523 * destination keyring if one is supplied. The key and any links to the key
524 * will be automatically garbage collected after the timeout expires.
525 *
526 * Negative keys are used to rate limit repeated request_key() calls by causing
527 * them to return the stored error code (typically ENOKEY) until the negative
528 * key expires.
529 *
530 * If successful, 0 is returned, the authorisation token is revoked and anyone
531 * waiting for the key is woken up. If the key was already instantiated,
532 * -EBUSY will be returned.
482 */ 533 */
483int key_negate_and_link(struct key *key, 534int key_reject_and_link(struct key *key,
484 unsigned timeout, 535 unsigned timeout,
536 unsigned error,
485 struct key *keyring, 537 struct key *keyring,
486 struct key *authkey) 538 struct key *authkey)
487{ 539{
488 struct keyring_list *prealloc; 540 unsigned long prealloc;
489 struct timespec now; 541 struct timespec now;
490 int ret, awaken, link_ret = 0; 542 int ret, awaken, link_ret = 0;
491 543
@@ -507,6 +559,7 @@ int key_negate_and_link(struct key *key,
507 atomic_inc(&key->user->nikeys); 559 atomic_inc(&key->user->nikeys);
508 set_bit(KEY_FLAG_NEGATIVE, &key->flags); 560 set_bit(KEY_FLAG_NEGATIVE, &key->flags);
509 set_bit(KEY_FLAG_INSTANTIATED, &key->flags); 561 set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
562 key->type_data.reject_error = -error;
510 now = current_kernel_time(); 563 now = current_kernel_time();
511 key->expiry = now.tv_sec + timeout; 564 key->expiry = now.tv_sec + timeout;
512 key_schedule_gc(key->expiry + key_gc_delay); 565 key_schedule_gc(key->expiry + key_gc_delay);
@@ -535,22 +588,22 @@ int key_negate_and_link(struct key *key,
535 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 588 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
536 589
537 return ret == 0 ? link_ret : ret; 590 return ret == 0 ? link_ret : ret;
591}
592EXPORT_SYMBOL(key_reject_and_link);
538 593
539} /* end key_negate_and_link() */
540
541EXPORT_SYMBOL(key_negate_and_link);
542
543/*****************************************************************************/
544/* 594/*
545 * do cleaning up in process context so that we don't have to disable 595 * Garbage collect keys in process context so that we don't have to disable
546 * interrupts all over the place 596 * interrupts all over the place.
597 *
598 * key_put() schedules this rather than trying to do the cleanup itself, which
599 * means key_put() doesn't have to sleep.
547 */ 600 */
548static void key_cleanup(struct work_struct *work) 601static void key_cleanup(struct work_struct *work)
549{ 602{
550 struct rb_node *_n; 603 struct rb_node *_n;
551 struct key *key; 604 struct key *key;
552 605
553 go_again: 606go_again:
554 /* look for a dead key in the tree */ 607 /* look for a dead key in the tree */
555 spin_lock(&key_serial_lock); 608 spin_lock(&key_serial_lock);
556 609
@@ -564,7 +617,7 @@ static void key_cleanup(struct work_struct *work)
564 spin_unlock(&key_serial_lock); 617 spin_unlock(&key_serial_lock);
565 return; 618 return;
566 619
567 found_dead_key: 620found_dead_key:
568 /* we found a dead key - once we've removed it from the tree, we can 621 /* we found a dead key - once we've removed it from the tree, we can
569 * drop the lock */ 622 * drop the lock */
570 rb_erase(&key->serial_node, &key_serial_tree); 623 rb_erase(&key->serial_node, &key_serial_tree);
@@ -601,14 +654,15 @@ static void key_cleanup(struct work_struct *work)
601 654
602 /* there may, of course, be more than one key to destroy */ 655 /* there may, of course, be more than one key to destroy */
603 goto go_again; 656 goto go_again;
657}
604 658
605} /* end key_cleanup() */ 659/**
606 660 * key_put - Discard a reference to a key.
607/*****************************************************************************/ 661 * @key: The key to discard a reference from.
608/* 662 *
609 * dispose of a reference to a key 663 * Discard a reference to a key, and when all the references are gone, we
610 * - when all the references are gone, we schedule the cleanup task to come and 664 * schedule the cleanup task to come and pull it out of the tree in process
611 * pull it out of the tree in definite process context 665 * context at some later time.
612 */ 666 */
613void key_put(struct key *key) 667void key_put(struct key *key)
614{ 668{
@@ -618,14 +672,11 @@ void key_put(struct key *key)
618 if (atomic_dec_and_test(&key->usage)) 672 if (atomic_dec_and_test(&key->usage))
619 schedule_work(&key_cleanup_task); 673 schedule_work(&key_cleanup_task);
620 } 674 }
621 675}
622} /* end key_put() */
623
624EXPORT_SYMBOL(key_put); 676EXPORT_SYMBOL(key_put);
625 677
626/*****************************************************************************/
627/* 678/*
628 * find a key by its serial number 679 * Find a key by its serial number.
629 */ 680 */
630struct key *key_lookup(key_serial_t id) 681struct key *key_lookup(key_serial_t id)
631{ 682{
@@ -647,11 +698,11 @@ struct key *key_lookup(key_serial_t id)
647 goto found; 698 goto found;
648 } 699 }
649 700
650 not_found: 701not_found:
651 key = ERR_PTR(-ENOKEY); 702 key = ERR_PTR(-ENOKEY);
652 goto error; 703 goto error;
653 704
654 found: 705found:
655 /* pretend it doesn't exist if it is awaiting deletion */ 706 /* pretend it doesn't exist if it is awaiting deletion */
656 if (atomic_read(&key->usage) == 0) 707 if (atomic_read(&key->usage) == 0)
657 goto not_found; 708 goto not_found;
@@ -661,16 +712,16 @@ struct key *key_lookup(key_serial_t id)
661 */ 712 */
662 atomic_inc(&key->usage); 713 atomic_inc(&key->usage);
663 714
664 error: 715error:
665 spin_unlock(&key_serial_lock); 716 spin_unlock(&key_serial_lock);
666 return key; 717 return key;
718}
667 719
668} /* end key_lookup() */
669
670/*****************************************************************************/
671/* 720/*
672 * find and lock the specified key type against removal 721 * Find and lock the specified key type against removal.
673 * - we return with the sem readlocked 722 *
723 * We return with the sem read-locked if successful. If the type wasn't
724 * available -ENOKEY is returned instead.
674 */ 725 */
675struct key_type *key_type_lookup(const char *type) 726struct key_type *key_type_lookup(const char *type)
676{ 727{
@@ -688,26 +739,23 @@ struct key_type *key_type_lookup(const char *type)
688 up_read(&key_types_sem); 739 up_read(&key_types_sem);
689 ktype = ERR_PTR(-ENOKEY); 740 ktype = ERR_PTR(-ENOKEY);
690 741
691 found_kernel_type: 742found_kernel_type:
692 return ktype; 743 return ktype;
744}
693 745
694} /* end key_type_lookup() */
695
696/*****************************************************************************/
697/* 746/*
698 * unlock a key type 747 * Unlock a key type locked by key_type_lookup().
699 */ 748 */
700void key_type_put(struct key_type *ktype) 749void key_type_put(struct key_type *ktype)
701{ 750{
702 up_read(&key_types_sem); 751 up_read(&key_types_sem);
752}
703 753
704} /* end key_type_put() */
705
706/*****************************************************************************/
707/* 754/*
708 * attempt to update an existing key 755 * Attempt to update an existing key.
709 * - the key has an incremented refcount 756 *
710 * - we need to put the key if we get an error 757 * The key is given to us with an incremented refcount that we need to discard
758 * if we get an error.
711 */ 759 */
712static inline key_ref_t __key_update(key_ref_t key_ref, 760static inline key_ref_t __key_update(key_ref_t key_ref,
713 const void *payload, size_t plen) 761 const void *payload, size_t plen)
@@ -742,13 +790,32 @@ error:
742 key_put(key); 790 key_put(key);
743 key_ref = ERR_PTR(ret); 791 key_ref = ERR_PTR(ret);
744 goto out; 792 goto out;
793}
745 794
746} /* end __key_update() */ 795/**
747 796 * key_create_or_update - Update or create and instantiate a key.
748/*****************************************************************************/ 797 * @keyring_ref: A pointer to the destination keyring with possession flag.
749/* 798 * @type: The type of key.
750 * search the specified keyring for a key of the same description; if one is 799 * @description: The searchable description for the key.
751 * found, update it, otherwise add a new one 800 * @payload: The data to use to instantiate or update the key.
801 * @plen: The length of @payload.
802 * @perm: The permissions mask for a new key.
803 * @flags: The quota flags for a new key.
804 *
805 * Search the destination keyring for a key of the same description and if one
806 * is found, update it, otherwise create and instantiate a new one and create a
807 * link to it from that keyring.
808 *
809 * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be
810 * concocted.
811 *
812 * Returns a pointer to the new key if successful, -ENODEV if the key type
813 * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the
814 * caller isn't permitted to modify the keyring or the LSM did not permit
815 * creation of the key.
816 *
817 * On success, the possession flag from the keyring ref will be tacked on to
818 * the key ref before it is returned.
752 */ 819 */
753key_ref_t key_create_or_update(key_ref_t keyring_ref, 820key_ref_t key_create_or_update(key_ref_t keyring_ref,
754 const char *type, 821 const char *type,
@@ -758,7 +825,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
758 key_perm_t perm, 825 key_perm_t perm,
759 unsigned long flags) 826 unsigned long flags)
760{ 827{
761 struct keyring_list *prealloc; 828 unsigned long prealloc;
762 const struct cred *cred = current_cred(); 829 const struct cred *cred = current_cred();
763 struct key_type *ktype; 830 struct key_type *ktype;
764 struct key *keyring, *key = NULL; 831 struct key *keyring, *key = NULL;
@@ -855,14 +922,21 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
855 922
856 key_ref = __key_update(key_ref, payload, plen); 923 key_ref = __key_update(key_ref, payload, plen);
857 goto error; 924 goto error;
858 925}
859} /* end key_create_or_update() */
860
861EXPORT_SYMBOL(key_create_or_update); 926EXPORT_SYMBOL(key_create_or_update);
862 927
863/*****************************************************************************/ 928/**
864/* 929 * key_update - Update a key's contents.
865 * update a key 930 * @key_ref: The pointer (plus possession flag) to the key.
931 * @payload: The data to be used to update the key.
932 * @plen: The length of @payload.
933 *
934 * Attempt to update the contents of a key with the given payload data. The
935 * caller must be granted Write permission on the key. Negative keys can be
936 * instantiated by this method.
937 *
938 * Returns 0 on success, -EACCES if not permitted and -EOPNOTSUPP if the key
939 * type does not support updating. The key type may return other errors.
866 */ 940 */
867int key_update(key_ref_t key_ref, const void *payload, size_t plen) 941int key_update(key_ref_t key_ref, const void *payload, size_t plen)
868{ 942{
@@ -891,14 +965,17 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
891 965
892 error: 966 error:
893 return ret; 967 return ret;
894 968}
895} /* end key_update() */
896
897EXPORT_SYMBOL(key_update); 969EXPORT_SYMBOL(key_update);
898 970
899/*****************************************************************************/ 971/**
900/* 972 * key_revoke - Revoke a key.
901 * revoke a key 973 * @key: The key to be revoked.
974 *
975 * Mark a key as being revoked and ask the type to free up its resources. The
976 * revocation timeout is set and the key and all its links will be
977 * automatically garbage collected after key_gc_delay amount of time if they
978 * are not manually dealt with first.
902 */ 979 */
903void key_revoke(struct key *key) 980void key_revoke(struct key *key)
904{ 981{
@@ -926,14 +1003,16 @@ void key_revoke(struct key *key)
926 } 1003 }
927 1004
928 up_write(&key->sem); 1005 up_write(&key->sem);
929 1006}
930} /* end key_revoke() */
931
932EXPORT_SYMBOL(key_revoke); 1007EXPORT_SYMBOL(key_revoke);
933 1008
934/*****************************************************************************/ 1009/**
935/* 1010 * register_key_type - Register a type of key.
936 * register a type of key 1011 * @ktype: The new key type.
1012 *
1013 * Register a new key type.
1014 *
1015 * Returns 0 on success or -EEXIST if a type of this name already exists.
937 */ 1016 */
938int register_key_type(struct key_type *ktype) 1017int register_key_type(struct key_type *ktype)
939{ 1018{
@@ -953,17 +1032,19 @@ int register_key_type(struct key_type *ktype)
953 list_add(&ktype->link, &key_types_list); 1032 list_add(&ktype->link, &key_types_list);
954 ret = 0; 1033 ret = 0;
955 1034
956 out: 1035out:
957 up_write(&key_types_sem); 1036 up_write(&key_types_sem);
958 return ret; 1037 return ret;
959 1038}
960} /* end register_key_type() */
961
962EXPORT_SYMBOL(register_key_type); 1039EXPORT_SYMBOL(register_key_type);
963 1040
964/*****************************************************************************/ 1041/**
965/* 1042 * unregister_key_type - Unregister a type of key.
966 * unregister a type of key 1043 * @ktype: The key type.
1044 *
1045 * Unregister a key type and mark all the extant keys of this type as dead.
1046 * Those keys of this type are then destroyed to get rid of their payloads and
1047 * they and their links will be garbage collected as soon as possible.
967 */ 1048 */
968void unregister_key_type(struct key_type *ktype) 1049void unregister_key_type(struct key_type *ktype)
969{ 1050{
@@ -1010,14 +1091,11 @@ void unregister_key_type(struct key_type *ktype)
1010 up_write(&key_types_sem); 1091 up_write(&key_types_sem);
1011 1092
1012 key_schedule_gc(0); 1093 key_schedule_gc(0);
1013 1094}
1014} /* end unregister_key_type() */
1015
1016EXPORT_SYMBOL(unregister_key_type); 1095EXPORT_SYMBOL(unregister_key_type);
1017 1096
1018/*****************************************************************************/
1019/* 1097/*
1020 * initialise the key management stuff 1098 * Initialise the key management state.
1021 */ 1099 */
1022void __init key_init(void) 1100void __init key_init(void)
1023{ 1101{
@@ -1037,5 +1115,4 @@ void __init key_init(void)
1037 1115
1038 rb_insert_color(&root_key_user.node, 1116 rb_insert_color(&root_key_user.node,
1039 &key_user_tree); 1117 &key_user_tree);
1040 1118}
1041} /* end key_init() */
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 60924f6a52db..427fddcaeb19 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1,4 +1,4 @@
1/* keyctl.c: userspace keyctl operations 1/* Userspace key control operations
2 * 2 *
3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -31,28 +31,24 @@ static int key_get_type_from_user(char *type,
31 int ret; 31 int ret;
32 32
33 ret = strncpy_from_user(type, _type, len); 33 ret = strncpy_from_user(type, _type, len);
34
35 if (ret < 0) 34 if (ret < 0)
36 return ret; 35 return ret;
37
38 if (ret == 0 || ret >= len) 36 if (ret == 0 || ret >= len)
39 return -EINVAL; 37 return -EINVAL;
40
41 if (type[0] == '.') 38 if (type[0] == '.')
42 return -EPERM; 39 return -EPERM;
43
44 type[len - 1] = '\0'; 40 type[len - 1] = '\0';
45
46 return 0; 41 return 0;
47} 42}
48 43
49/*****************************************************************************/
50/* 44/*
51 * extract the description of a new key from userspace and either add it as a 45 * Extract the description of a new key from userspace and either add it as a
52 * new key to the specified keyring or update a matching key in that keyring 46 * new key to the specified keyring or update a matching key in that keyring.
53 * - the keyring must be writable 47 *
54 * - returns the new key's serial number 48 * The keyring must be writable so that we can attach the key to it.
55 * - implements add_key() 49 *
50 * If successful, the new key's serial number is returned, otherwise an error
51 * code is returned.
56 */ 52 */
57SYSCALL_DEFINE5(add_key, const char __user *, _type, 53SYSCALL_DEFINE5(add_key, const char __user *, _type,
58 const char __user *, _description, 54 const char __user *, _description,
@@ -132,19 +128,20 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
132 kfree(description); 128 kfree(description);
133 error: 129 error:
134 return ret; 130 return ret;
131}
135 132
136} /* end sys_add_key() */
137
138/*****************************************************************************/
139/* 133/*
140 * search the process keyrings for a matching key 134 * Search the process keyrings and keyring trees linked from those for a
141 * - nested keyrings may also be searched if they have Search permission 135 * matching key. Keyrings must have appropriate Search permission to be
142 * - if a key is found, it will be attached to the destination keyring if 136 * searched.
143 * there's one specified 137 *
144 * - /sbin/request-key will be invoked if _callout_info is non-NULL 138 * If a key is found, it will be attached to the destination keyring if there's
145 * - the _callout_info string will be passed to /sbin/request-key 139 * one specified and the serial number of the key will be returned.
146 * - if the _callout_info string is empty, it will be rendered as "-" 140 *
147 * - implements request_key() 141 * If no key is found, /sbin/request-key will be invoked if _callout_info is
142 * non-NULL in an attempt to create a key. The _callout_info string will be
143 * passed to /sbin/request-key to aid with completing the request. If the
144 * _callout_info string is "" then it will be changed to "-".
148 */ 145 */
149SYSCALL_DEFINE4(request_key, const char __user *, _type, 146SYSCALL_DEFINE4(request_key, const char __user *, _type,
150 const char __user *, _description, 147 const char __user *, _description,
@@ -222,14 +219,14 @@ error2:
222 kfree(description); 219 kfree(description);
223error: 220error:
224 return ret; 221 return ret;
222}
225 223
226} /* end sys_request_key() */
227
228/*****************************************************************************/
229/* 224/*
230 * get the ID of the specified process keyring 225 * Get the ID of the specified process keyring.
231 * - the keyring must have search permission to be found 226 *
232 * - implements keyctl(KEYCTL_GET_KEYRING_ID) 227 * The requested keyring must have search permission to be found.
228 *
229 * If successful, the ID of the requested keyring will be returned.
233 */ 230 */
234long keyctl_get_keyring_ID(key_serial_t id, int create) 231long keyctl_get_keyring_ID(key_serial_t id, int create)
235{ 232{
@@ -248,13 +245,17 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
248 key_ref_put(key_ref); 245 key_ref_put(key_ref);
249error: 246error:
250 return ret; 247 return ret;
248}
251 249
252} /* end keyctl_get_keyring_ID() */
253
254/*****************************************************************************/
255/* 250/*
256 * join the session keyring 251 * Join a (named) session keyring.
257 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING) 252 *
253 * Create and join an anonymous session keyring or join a named session
254 * keyring, creating it if necessary. A named session keyring must have Search
255 * permission for it to be joined. Session keyrings without this permit will
256 * be skipped over.
257 *
258 * If successful, the ID of the joined session keyring will be returned.
258 */ 259 */
259long keyctl_join_session_keyring(const char __user *_name) 260long keyctl_join_session_keyring(const char __user *_name)
260{ 261{
@@ -277,14 +278,17 @@ long keyctl_join_session_keyring(const char __user *_name)
277 278
278error: 279error:
279 return ret; 280 return ret;
281}
280 282
281} /* end keyctl_join_session_keyring() */
282
283/*****************************************************************************/
284/* 283/*
285 * update a key's data payload 284 * Update a key's data payload from the given data.
286 * - the key must be writable 285 *
287 * - implements keyctl(KEYCTL_UPDATE) 286 * The key must grant the caller Write permission and the key type must support
287 * updating for this to work. A negative key can be positively instantiated
288 * with this call.
289 *
290 * If successful, 0 will be returned. If the key type does not support
291 * updating, then -EOPNOTSUPP will be returned.
288 */ 292 */
289long keyctl_update_key(key_serial_t id, 293long keyctl_update_key(key_serial_t id,
290 const void __user *_payload, 294 const void __user *_payload,
@@ -326,14 +330,17 @@ error2:
326 kfree(payload); 330 kfree(payload);
327error: 331error:
328 return ret; 332 return ret;
333}
329 334
330} /* end keyctl_update_key() */
331
332/*****************************************************************************/
333/* 335/*
334 * revoke a key 336 * Revoke a key.
335 * - the key must be writable 337 *
336 * - implements keyctl(KEYCTL_REVOKE) 338 * The key must be grant the caller Write or Setattr permission for this to
339 * work. The key type should give up its quota claim when revoked. The key
340 * and any links to the key will be automatically garbage collected after a
341 * certain amount of time (/proc/sys/kernel/keys/gc_delay).
342 *
343 * If successful, 0 is returned.
337 */ 344 */
338long keyctl_revoke_key(key_serial_t id) 345long keyctl_revoke_key(key_serial_t id)
339{ 346{
@@ -358,14 +365,14 @@ long keyctl_revoke_key(key_serial_t id)
358 key_ref_put(key_ref); 365 key_ref_put(key_ref);
359error: 366error:
360 return ret; 367 return ret;
368}
361 369
362} /* end keyctl_revoke_key() */
363
364/*****************************************************************************/
365/* 370/*
366 * clear the specified process keyring 371 * Clear the specified keyring, creating an empty process keyring if one of the
367 * - the keyring must be writable 372 * special keyring IDs is used.
368 * - implements keyctl(KEYCTL_CLEAR) 373 *
374 * The keyring must grant the caller Write permission for this to work. If
375 * successful, 0 will be returned.
369 */ 376 */
370long keyctl_keyring_clear(key_serial_t ringid) 377long keyctl_keyring_clear(key_serial_t ringid)
371{ 378{
@@ -383,15 +390,18 @@ long keyctl_keyring_clear(key_serial_t ringid)
383 key_ref_put(keyring_ref); 390 key_ref_put(keyring_ref);
384error: 391error:
385 return ret; 392 return ret;
393}
386 394
387} /* end keyctl_keyring_clear() */
388
389/*****************************************************************************/
390/* 395/*
391 * link a key into a keyring 396 * Create a link from a keyring to a key if there's no matching key in the
392 * - the keyring must be writable 397 * keyring, otherwise replace the link to the matching key with a link to the
393 * - the key must be linkable 398 * new key.
394 * - implements keyctl(KEYCTL_LINK) 399 *
400 * The key must grant the caller Link permission and the the keyring must grant
401 * the caller Write permission. Furthermore, if an additional link is created,
402 * the keyring's quota will be extended.
403 *
404 * If successful, 0 will be returned.
395 */ 405 */
396long keyctl_keyring_link(key_serial_t id, key_serial_t ringid) 406long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
397{ 407{
@@ -417,15 +427,16 @@ error2:
417 key_ref_put(keyring_ref); 427 key_ref_put(keyring_ref);
418error: 428error:
419 return ret; 429 return ret;
430}
420 431
421} /* end keyctl_keyring_link() */
422
423/*****************************************************************************/
424/* 432/*
425 * unlink the first attachment of a key from a keyring 433 * Unlink a key from a keyring.
426 * - the keyring must be writable 434 *
427 * - we don't need any permissions on the key 435 * The keyring must grant the caller Write permission for this to work; the key
428 * - implements keyctl(KEYCTL_UNLINK) 436 * itself need not grant the caller anything. If the last link to a key is
437 * removed then that key will be scheduled for destruction.
438 *
439 * If successful, 0 will be returned.
429 */ 440 */
430long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid) 441long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
431{ 442{
@@ -451,19 +462,20 @@ error2:
451 key_ref_put(keyring_ref); 462 key_ref_put(keyring_ref);
452error: 463error:
453 return ret; 464 return ret;
465}
454 466
455} /* end keyctl_keyring_unlink() */
456
457/*****************************************************************************/
458/* 467/*
459 * describe a user key 468 * Return a description of a key to userspace.
460 * - the key must have view permission 469 *
461 * - if there's a buffer, we place up to buflen bytes of data into it 470 * The key must grant the caller View permission for this to work.
462 * - unless there's an error, we return the amount of description available, 471 *
463 * irrespective of how much we may have copied 472 * If there's a buffer, we place up to buflen bytes of data into it formatted
464 * - the description is formatted thus: 473 * in the following way:
474 *
465 * type;uid;gid;perm;description<NUL> 475 * type;uid;gid;perm;description<NUL>
466 * - implements keyctl(KEYCTL_DESCRIBE) 476 *
477 * If successful, we return the amount of description available, irrespective
478 * of how much we may have copied into the buffer.
467 */ 479 */
468long keyctl_describe_key(key_serial_t keyid, 480long keyctl_describe_key(key_serial_t keyid,
469 char __user *buffer, 481 char __user *buffer,
@@ -531,18 +543,17 @@ error2:
531 key_ref_put(key_ref); 543 key_ref_put(key_ref);
532error: 544error:
533 return ret; 545 return ret;
546}
534 547
535} /* end keyctl_describe_key() */
536
537/*****************************************************************************/
538/* 548/*
539 * search the specified keyring for a matching key 549 * Search the specified keyring and any keyrings it links to for a matching
540 * - the start keyring must be searchable 550 * key. Only keyrings that grant the caller Search permission will be searched
541 * - nested keyrings may also be searched if they are searchable 551 * (this includes the starting keyring). Only keys with Search permission can
542 * - only keys with search permission may be found 552 * be found.
543 * - if a key is found, it will be attached to the destination keyring if 553 *
544 * there's one specified 554 * If successful, the found key will be linked to the destination keyring if
545 * - implements keyctl(KEYCTL_SEARCH) 555 * supplied and the key has Link permission, and the found key ID will be
556 * returned.
546 */ 557 */
547long keyctl_keyring_search(key_serial_t ringid, 558long keyctl_keyring_search(key_serial_t ringid,
548 const char __user *_type, 559 const char __user *_type,
@@ -626,18 +637,17 @@ error2:
626 kfree(description); 637 kfree(description);
627error: 638error:
628 return ret; 639 return ret;
640}
629 641
630} /* end keyctl_keyring_search() */
631
632/*****************************************************************************/
633/* 642/*
634 * read a user key's payload 643 * Read a key's payload.
635 * - the keyring must be readable or the key must be searchable from the 644 *
636 * process's keyrings 645 * The key must either grant the caller Read permission, or it must grant the
637 * - if there's a buffer, we place up to buflen bytes of data into it 646 * caller Search permission when searched for from the process keyrings.
638 * - unless there's an error, we return the amount of data in the key, 647 *
639 * irrespective of how much we may have copied 648 * If successful, we place up to buflen bytes of data into the buffer, if one
640 * - implements keyctl(KEYCTL_READ) 649 * is provided, and return the amount of data that is available in the key,
650 * irrespective of how much we copied into the buffer.
641 */ 651 */
642long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) 652long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
643{ 653{
@@ -688,15 +698,22 @@ error2:
688 key_put(key); 698 key_put(key);
689error: 699error:
690 return ret; 700 return ret;
701}
691 702
692} /* end keyctl_read_key() */
693
694/*****************************************************************************/
695/* 703/*
696 * change the ownership of a key 704 * Change the ownership of a key
697 * - the keyring owned by the changer 705 *
698 * - if the uid or gid is -1, then that parameter is not changed 706 * The key must grant the caller Setattr permission for this to work, though
699 * - implements keyctl(KEYCTL_CHOWN) 707 * the key need not be fully instantiated yet. For the UID to be changed, or
708 * for the GID to be changed to a group the caller is not a member of, the
709 * caller must have sysadmin capability. If either uid or gid is -1 then that
710 * attribute is not changed.
711 *
712 * If the UID is to be changed, the new user must have sufficient quota to
713 * accept the key. The quota deduction will be removed from the old user to
714 * the new user should the attribute be changed.
715 *
716 * If successful, 0 will be returned.
700 */ 717 */
701long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid) 718long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
702{ 719{
@@ -796,14 +813,14 @@ quota_overrun:
796 zapowner = newowner; 813 zapowner = newowner;
797 ret = -EDQUOT; 814 ret = -EDQUOT;
798 goto error_put; 815 goto error_put;
816}
799 817
800} /* end keyctl_chown_key() */
801
802/*****************************************************************************/
803/* 818/*
804 * change the permission mask on a key 819 * Change the permission mask on a key.
805 * - the keyring owned by the changer 820 *
806 * - implements keyctl(KEYCTL_SETPERM) 821 * The key must grant the caller Setattr permission for this to work, though
822 * the key need not be fully instantiated yet. If the caller does not have
823 * sysadmin capability, it may only change the permission on keys that it owns.
807 */ 824 */
808long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 825long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
809{ 826{
@@ -838,11 +855,11 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
838 key_put(key); 855 key_put(key);
839error: 856error:
840 return ret; 857 return ret;
841 858}
842} /* end keyctl_setperm_key() */
843 859
844/* 860/*
845 * get the destination keyring for instantiation 861 * Get the destination keyring for instantiation and check that the caller has
862 * Write permission on it.
846 */ 863 */
847static long get_instantiation_keyring(key_serial_t ringid, 864static long get_instantiation_keyring(key_serial_t ringid,
848 struct request_key_auth *rka, 865 struct request_key_auth *rka,
@@ -879,7 +896,7 @@ static long get_instantiation_keyring(key_serial_t ringid,
879} 896}
880 897
881/* 898/*
882 * change the request_key authorisation key on the current process 899 * Change the request_key authorisation key on the current process.
883 */ 900 */
884static int keyctl_change_reqkey_auth(struct key *key) 901static int keyctl_change_reqkey_auth(struct key *key)
885{ 902{
@@ -895,15 +912,35 @@ static int keyctl_change_reqkey_auth(struct key *key)
895 return commit_creds(new); 912 return commit_creds(new);
896} 913}
897 914
898/*****************************************************************************/
899/* 915/*
900 * instantiate the key with the specified payload, and, if one is given, link 916 * Copy the iovec data from userspace
901 * the key into the keyring
902 */ 917 */
903long keyctl_instantiate_key(key_serial_t id, 918static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
904 const void __user *_payload, 919 unsigned ioc)
905 size_t plen, 920{
906 key_serial_t ringid) 921 for (; ioc > 0; ioc--) {
922 if (copy_from_user(buffer, iov->iov_base, iov->iov_len) != 0)
923 return -EFAULT;
924 buffer += iov->iov_len;
925 iov++;
926 }
927 return 0;
928}
929
930/*
931 * Instantiate a key with the specified payload and link the key into the
932 * destination keyring if one is given.
933 *
934 * The caller must have the appropriate instantiation permit set for this to
935 * work (see keyctl_assume_authority). No other permissions are required.
936 *
937 * If successful, 0 will be returned.
938 */
939long keyctl_instantiate_key_common(key_serial_t id,
940 const struct iovec *payload_iov,
941 unsigned ioc,
942 size_t plen,
943 key_serial_t ringid)
907{ 944{
908 const struct cred *cred = current_cred(); 945 const struct cred *cred = current_cred();
909 struct request_key_auth *rka; 946 struct request_key_auth *rka;
@@ -932,7 +969,7 @@ long keyctl_instantiate_key(key_serial_t id,
932 /* pull the payload in if one was supplied */ 969 /* pull the payload in if one was supplied */
933 payload = NULL; 970 payload = NULL;
934 971
935 if (_payload) { 972 if (payload_iov) {
936 ret = -ENOMEM; 973 ret = -ENOMEM;
937 payload = kmalloc(plen, GFP_KERNEL); 974 payload = kmalloc(plen, GFP_KERNEL);
938 if (!payload) { 975 if (!payload) {
@@ -944,8 +981,8 @@ long keyctl_instantiate_key(key_serial_t id,
944 goto error; 981 goto error;
945 } 982 }
946 983
947 ret = -EFAULT; 984 ret = copy_from_user_iovec(payload, payload_iov, ioc);
948 if (copy_from_user(payload, _payload, plen) != 0) 985 if (ret < 0)
949 goto error2; 986 goto error2;
950 } 987 }
951 988
@@ -973,22 +1010,127 @@ error2:
973 vfree(payload); 1010 vfree(payload);
974error: 1011error:
975 return ret; 1012 return ret;
1013}
1014
1015/*
1016 * Instantiate a key with the specified payload and link the key into the
1017 * destination keyring if one is given.
1018 *
1019 * The caller must have the appropriate instantiation permit set for this to
1020 * work (see keyctl_assume_authority). No other permissions are required.
1021 *
1022 * If successful, 0 will be returned.
1023 */
1024long keyctl_instantiate_key(key_serial_t id,
1025 const void __user *_payload,
1026 size_t plen,
1027 key_serial_t ringid)
1028{
1029 if (_payload && plen) {
1030 struct iovec iov[1] = {
1031 [0].iov_base = (void __user *)_payload,
1032 [0].iov_len = plen
1033 };
1034
1035 return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
1036 }
1037
1038 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
1039}
1040
1041/*
1042 * Instantiate a key with the specified multipart payload and link the key into
1043 * the destination keyring if one is given.
1044 *
1045 * The caller must have the appropriate instantiation permit set for this to
1046 * work (see keyctl_assume_authority). No other permissions are required.
1047 *
1048 * If successful, 0 will be returned.
1049 */
1050long keyctl_instantiate_key_iov(key_serial_t id,
1051 const struct iovec __user *_payload_iov,
1052 unsigned ioc,
1053 key_serial_t ringid)
1054{
1055 struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1056 long ret;
1057
1058 if (_payload_iov == 0 || ioc == 0)
1059 goto no_payload;
1060
1061 ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
1062 ARRAY_SIZE(iovstack), iovstack, &iov);
1063 if (ret < 0)
1064 return ret;
1065 if (ret == 0)
1066 goto no_payload_free;
1067
1068 ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
1069
1070 if (iov != iovstack)
1071 kfree(iov);
1072 return ret;
976 1073
977} /* end keyctl_instantiate_key() */ 1074no_payload_free:
1075 if (iov != iovstack)
1076 kfree(iov);
1077no_payload:
1078 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
1079}
978 1080
979/*****************************************************************************/
980/* 1081/*
981 * negatively instantiate the key with the given timeout (in seconds), and, if 1082 * Negatively instantiate the key with the given timeout (in seconds) and link
982 * one is given, link the key into the keyring 1083 * the key into the destination keyring if one is given.
1084 *
1085 * The caller must have the appropriate instantiation permit set for this to
1086 * work (see keyctl_assume_authority). No other permissions are required.
1087 *
1088 * The key and any links to the key will be automatically garbage collected
1089 * after the timeout expires.
1090 *
1091 * Negative keys are used to rate limit repeated request_key() calls by causing
1092 * them to return -ENOKEY until the negative key expires.
1093 *
1094 * If successful, 0 will be returned.
983 */ 1095 */
984long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid) 1096long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
985{ 1097{
1098 return keyctl_reject_key(id, timeout, ENOKEY, ringid);
1099}
1100
1101/*
1102 * Negatively instantiate the key with the given timeout (in seconds) and error
1103 * code and link the key into the destination keyring if one is given.
1104 *
1105 * The caller must have the appropriate instantiation permit set for this to
1106 * work (see keyctl_assume_authority). No other permissions are required.
1107 *
1108 * The key and any links to the key will be automatically garbage collected
1109 * after the timeout expires.
1110 *
1111 * Negative keys are used to rate limit repeated request_key() calls by causing
1112 * them to return the specified error code until the negative key expires.
1113 *
1114 * If successful, 0 will be returned.
1115 */
1116long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
1117 key_serial_t ringid)
1118{
986 const struct cred *cred = current_cred(); 1119 const struct cred *cred = current_cred();
987 struct request_key_auth *rka; 1120 struct request_key_auth *rka;
988 struct key *instkey, *dest_keyring; 1121 struct key *instkey, *dest_keyring;
989 long ret; 1122 long ret;
990 1123
991 kenter("%d,%u,%d", id, timeout, ringid); 1124 kenter("%d,%u,%u,%d", id, timeout, error, ringid);
1125
1126 /* must be a valid error code and mustn't be a kernel special */
1127 if (error <= 0 ||
1128 error >= MAX_ERRNO ||
1129 error == ERESTARTSYS ||
1130 error == ERESTARTNOINTR ||
1131 error == ERESTARTNOHAND ||
1132 error == ERESTART_RESTARTBLOCK)
1133 return -EINVAL;
992 1134
993 /* the appropriate instantiation authorisation key must have been 1135 /* the appropriate instantiation authorisation key must have been
994 * assumed before calling this */ 1136 * assumed before calling this */
@@ -1008,7 +1150,7 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1008 goto error; 1150 goto error;
1009 1151
1010 /* instantiate the key and link it into a keyring */ 1152 /* instantiate the key and link it into a keyring */
1011 ret = key_negate_and_link(rka->target_key, timeout, 1153 ret = key_reject_and_link(rka->target_key, timeout, error,
1012 dest_keyring, instkey); 1154 dest_keyring, instkey);
1013 1155
1014 key_put(dest_keyring); 1156 key_put(dest_keyring);
@@ -1020,13 +1162,14 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1020 1162
1021error: 1163error:
1022 return ret; 1164 return ret;
1165}
1023 1166
1024} /* end keyctl_negate_key() */
1025
1026/*****************************************************************************/
1027/* 1167/*
1028 * set the default keyring in which request_key() will cache keys 1168 * Read or set the default keyring in which request_key() will cache keys and
1029 * - return the old setting 1169 * return the old setting.
1170 *
1171 * If a process keyring is specified then this will be created if it doesn't
1172 * yet exist. The old setting will be returned if successful.
1030 */ 1173 */
1031long keyctl_set_reqkey_keyring(int reqkey_defl) 1174long keyctl_set_reqkey_keyring(int reqkey_defl)
1032{ 1175{
@@ -1079,12 +1222,19 @@ set:
1079error: 1222error:
1080 abort_creds(new); 1223 abort_creds(new);
1081 return ret; 1224 return ret;
1225}
1082 1226
1083} /* end keyctl_set_reqkey_keyring() */
1084
1085/*****************************************************************************/
1086/* 1227/*
1087 * set or clear the timeout for a key 1228 * Set or clear the timeout on a key.
1229 *
1230 * Either the key must grant the caller Setattr permission or else the caller
1231 * must hold an instantiation authorisation token for the key.
1232 *
1233 * The timeout is either 0 to clear the timeout, or a number of seconds from
1234 * the current time. The key and any links to the key will be automatically
1235 * garbage collected after the timeout expires.
1236 *
1237 * If successful, 0 is returned.
1088 */ 1238 */
1089long keyctl_set_timeout(key_serial_t id, unsigned timeout) 1239long keyctl_set_timeout(key_serial_t id, unsigned timeout)
1090{ 1240{
@@ -1136,12 +1286,24 @@ okay:
1136 ret = 0; 1286 ret = 0;
1137error: 1287error:
1138 return ret; 1288 return ret;
1289}
1139 1290
1140} /* end keyctl_set_timeout() */
1141
1142/*****************************************************************************/
1143/* 1291/*
1144 * assume the authority to instantiate the specified key 1292 * Assume (or clear) the authority to instantiate the specified key.
1293 *
1294 * This sets the authoritative token currently in force for key instantiation.
1295 * This must be done for a key to be instantiated. It has the effect of making
1296 * available all the keys from the caller of the request_key() that created a
1297 * key to request_key() calls made by the caller of this function.
1298 *
1299 * The caller must have the instantiation key in their process keyrings with a
1300 * Search permission grant available to the caller.
1301 *
1302 * If the ID given is 0, then the setting will be cleared and 0 returned.
1303 *
1304 * If the ID given has a matching an authorisation key, then that key will be
1305 * set and its ID will be returned. The authorisation key can be read to get
1306 * the callout information passed to request_key().
1145 */ 1307 */
1146long keyctl_assume_authority(key_serial_t id) 1308long keyctl_assume_authority(key_serial_t id)
1147{ 1309{
@@ -1178,16 +1340,17 @@ long keyctl_assume_authority(key_serial_t id)
1178 ret = authkey->serial; 1340 ret = authkey->serial;
1179error: 1341error:
1180 return ret; 1342 return ret;
1181 1343}
1182} /* end keyctl_assume_authority() */
1183 1344
1184/* 1345/*
1185 * get the security label of a key 1346 * Get a key's the LSM security label.
1186 * - the key must grant us view permission 1347 *
1187 * - if there's a buffer, we place up to buflen bytes of data into it 1348 * The key must grant the caller View permission for this to work.
1188 * - unless there's an error, we return the amount of information available, 1349 *
1189 * irrespective of how much we may have copied (including the terminal NUL) 1350 * If there's a buffer, then up to buflen bytes of data will be placed into it.
1190 * - implements keyctl(KEYCTL_GET_SECURITY) 1351 *
1352 * If successful, the amount of information available will be returned,
1353 * irrespective of how much was copied (including the terminal NUL).
1191 */ 1354 */
1192long keyctl_get_security(key_serial_t keyid, 1355long keyctl_get_security(key_serial_t keyid,
1193 char __user *buffer, 1356 char __user *buffer,
@@ -1242,10 +1405,16 @@ long keyctl_get_security(key_serial_t keyid,
1242} 1405}
1243 1406
1244/* 1407/*
1245 * attempt to install the calling process's session keyring on the process's 1408 * Attempt to install the calling process's session keyring on the process's
1246 * parent process 1409 * parent process.
1247 * - the keyring must exist and must grant us LINK permission 1410 *
1248 * - implements keyctl(KEYCTL_SESSION_TO_PARENT) 1411 * The keyring must exist and must grant the caller LINK permission, and the
1412 * parent process must be single-threaded and must have the same effective
1413 * ownership as this process and mustn't be SUID/SGID.
1414 *
1415 * The keyring will be emplaced on the parent when it next resumes userspace.
1416 *
1417 * If successful, 0 will be returned.
1249 */ 1418 */
1250long keyctl_session_to_parent(void) 1419long keyctl_session_to_parent(void)
1251{ 1420{
@@ -1348,9 +1517,8 @@ error_keyring:
1348#endif /* !TIF_NOTIFY_RESUME */ 1517#endif /* !TIF_NOTIFY_RESUME */
1349} 1518}
1350 1519
1351/*****************************************************************************/
1352/* 1520/*
1353 * the key control system call 1521 * The key control system call
1354 */ 1522 */
1355SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3, 1523SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1356 unsigned long, arg4, unsigned long, arg5) 1524 unsigned long, arg4, unsigned long, arg5)
@@ -1436,8 +1604,20 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1436 case KEYCTL_SESSION_TO_PARENT: 1604 case KEYCTL_SESSION_TO_PARENT:
1437 return keyctl_session_to_parent(); 1605 return keyctl_session_to_parent();
1438 1606
1607 case KEYCTL_REJECT:
1608 return keyctl_reject_key((key_serial_t) arg2,
1609 (unsigned) arg3,
1610 (unsigned) arg4,
1611 (key_serial_t) arg5);
1612
1613 case KEYCTL_INSTANTIATE_IOV:
1614 return keyctl_instantiate_key_iov(
1615 (key_serial_t) arg2,
1616 (const struct iovec __user *) arg3,
1617 (unsigned) arg4,
1618 (key_serial_t) arg5);
1619
1439 default: 1620 default:
1440 return -EOPNOTSUPP; 1621 return -EOPNOTSUPP;
1441 } 1622 }
1442 1623}
1443} /* end sys_keyctl() */
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d37f713e73ce..cdd2f3f88c88 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -25,14 +25,16 @@
25 (keyring)->payload.subscriptions, \ 25 (keyring)->payload.subscriptions, \
26 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem))) 26 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
27 27
28#define KEY_LINK_FIXQUOTA 1UL
29
28/* 30/*
29 * when plumbing the depths of the key tree, this sets a hard limit set on how 31 * When plumbing the depths of the key tree, this sets a hard limit
30 * deep we're willing to go 32 * set on how deep we're willing to go.
31 */ 33 */
32#define KEYRING_SEARCH_MAX_DEPTH 6 34#define KEYRING_SEARCH_MAX_DEPTH 6
33 35
34/* 36/*
35 * we keep all named keyrings in a hash to speed looking them up 37 * We keep all named keyrings in a hash to speed looking them up.
36 */ 38 */
37#define KEYRING_NAME_HASH_SIZE (1 << 5) 39#define KEYRING_NAME_HASH_SIZE (1 << 5)
38 40
@@ -50,7 +52,9 @@ static inline unsigned keyring_hash(const char *desc)
50} 52}
51 53
52/* 54/*
53 * the keyring type definition 55 * The keyring key type definition. Keyrings are simply keys of this type and
56 * can be treated as ordinary keys in addition to having their own special
57 * operations.
54 */ 58 */
55static int keyring_instantiate(struct key *keyring, 59static int keyring_instantiate(struct key *keyring,
56 const void *data, size_t datalen); 60 const void *data, size_t datalen);
@@ -71,19 +75,17 @@ struct key_type key_type_keyring = {
71 .describe = keyring_describe, 75 .describe = keyring_describe,
72 .read = keyring_read, 76 .read = keyring_read,
73}; 77};
74
75EXPORT_SYMBOL(key_type_keyring); 78EXPORT_SYMBOL(key_type_keyring);
76 79
77/* 80/*
78 * semaphore to serialise link/link calls to prevent two link calls in parallel 81 * Semaphore to serialise link/link calls to prevent two link calls in parallel
79 * introducing a cycle 82 * introducing a cycle.
80 */ 83 */
81static DECLARE_RWSEM(keyring_serialise_link_sem); 84static DECLARE_RWSEM(keyring_serialise_link_sem);
82 85
83/*****************************************************************************/
84/* 86/*
85 * publish the name of a keyring so that it can be found by name (if it has 87 * Publish the name of a keyring so that it can be found by name (if it has
86 * one) 88 * one).
87 */ 89 */
88static void keyring_publish_name(struct key *keyring) 90static void keyring_publish_name(struct key *keyring)
89{ 91{
@@ -102,13 +104,12 @@ static void keyring_publish_name(struct key *keyring)
102 104
103 write_unlock(&keyring_name_lock); 105 write_unlock(&keyring_name_lock);
104 } 106 }
107}
105 108
106} /* end keyring_publish_name() */
107
108/*****************************************************************************/
109/* 109/*
110 * initialise a keyring 110 * Initialise a keyring.
111 * - we object if we were given any data 111 *
112 * Returns 0 on success, -EINVAL if given any data.
112 */ 113 */
113static int keyring_instantiate(struct key *keyring, 114static int keyring_instantiate(struct key *keyring,
114 const void *data, size_t datalen) 115 const void *data, size_t datalen)
@@ -123,23 +124,20 @@ static int keyring_instantiate(struct key *keyring,
123 } 124 }
124 125
125 return ret; 126 return ret;
127}
126 128
127} /* end keyring_instantiate() */
128
129/*****************************************************************************/
130/* 129/*
131 * match keyrings on their name 130 * Match keyrings on their name
132 */ 131 */
133static int keyring_match(const struct key *keyring, const void *description) 132static int keyring_match(const struct key *keyring, const void *description)
134{ 133{
135 return keyring->description && 134 return keyring->description &&
136 strcmp(keyring->description, description) == 0; 135 strcmp(keyring->description, description) == 0;
136}
137 137
138} /* end keyring_match() */
139
140/*****************************************************************************/
141/* 138/*
142 * dispose of the data dangling from the corpse of a keyring 139 * Clean up a keyring when it is destroyed. Unpublish its name if it had one
140 * and dispose of its data.
143 */ 141 */
144static void keyring_destroy(struct key *keyring) 142static void keyring_destroy(struct key *keyring)
145{ 143{
@@ -164,12 +162,10 @@ static void keyring_destroy(struct key *keyring)
164 key_put(klist->keys[loop]); 162 key_put(klist->keys[loop]);
165 kfree(klist); 163 kfree(klist);
166 } 164 }
165}
167 166
168} /* end keyring_destroy() */
169
170/*****************************************************************************/
171/* 167/*
172 * describe the keyring 168 * Describe a keyring for /proc.
173 */ 169 */
174static void keyring_describe(const struct key *keyring, struct seq_file *m) 170static void keyring_describe(const struct key *keyring, struct seq_file *m)
175{ 171{
@@ -187,13 +183,12 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
187 else 183 else
188 seq_puts(m, ": empty"); 184 seq_puts(m, ": empty");
189 rcu_read_unlock(); 185 rcu_read_unlock();
186}
190 187
191} /* end keyring_describe() */
192
193/*****************************************************************************/
194/* 188/*
195 * read a list of key IDs from the keyring's contents 189 * Read a list of key IDs from the keyring's contents in binary form
196 * - the keyring's semaphore is read-locked 190 *
191 * The keyring's semaphore is read-locked by the caller.
197 */ 192 */
198static long keyring_read(const struct key *keyring, 193static long keyring_read(const struct key *keyring,
199 char __user *buffer, size_t buflen) 194 char __user *buffer, size_t buflen)
@@ -241,12 +236,10 @@ static long keyring_read(const struct key *keyring,
241 236
242error: 237error:
243 return ret; 238 return ret;
239}
244 240
245} /* end keyring_read() */
246
247/*****************************************************************************/
248/* 241/*
249 * allocate a keyring and link into the destination keyring 242 * Allocate a keyring and link into the destination keyring.
250 */ 243 */
251struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, 244struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
252 const struct cred *cred, unsigned long flags, 245 const struct cred *cred, unsigned long flags,
@@ -269,20 +262,42 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
269 } 262 }
270 263
271 return keyring; 264 return keyring;
265}
272 266
273} /* end keyring_alloc() */ 267/**
274 268 * keyring_search_aux - Search a keyring tree for a key matching some criteria
275/*****************************************************************************/ 269 * @keyring_ref: A pointer to the keyring with possession indicator.
276/* 270 * @cred: The credentials to use for permissions checks.
277 * search the supplied keyring tree for a key that matches the criterion 271 * @type: The type of key to search for.
278 * - perform a breadth-then-depth search up to the prescribed limit 272 * @description: Parameter for @match.
279 * - we only find keys on which we have search permission 273 * @match: Function to rule on whether or not a key is the one required.
280 * - we use the supplied match function to see if the description (or other 274 *
281 * feature of interest) matches 275 * Search the supplied keyring tree for a key that matches the criteria given.
282 * - we rely on RCU to prevent the keyring lists from disappearing on us 276 * The root keyring and any linked keyrings must grant Search permission to the
283 * - we return -EAGAIN if we didn't find any matching key 277 * caller to be searchable and keys can only be found if they too grant Search
284 * - we return -ENOKEY if we only found negative matching keys 278 * to the caller. The possession flag on the root keyring pointer controls use
285 * - we propagate the possession attribute from the keyring ref to the key ref 279 * of the possessor bits in permissions checking of the entire tree. In
280 * addition, the LSM gets to forbid keyring searches and key matches.
281 *
282 * The search is performed as a breadth-then-depth search up to the prescribed
283 * limit (KEYRING_SEARCH_MAX_DEPTH).
284 *
285 * Keys are matched to the type provided and are then filtered by the match
286 * function, which is given the description to use in any way it sees fit. The
287 * match function may use any attributes of a key that it wishes to to
288 * determine the match. Normally the match function from the key type would be
289 * used.
290 *
291 * RCU is used to prevent the keyring key lists from disappearing without the
292 * need to take lots of locks.
293 *
294 * Returns a pointer to the found key and increments the key usage count if
295 * successful; -EAGAIN if no matching keys were found, or if expired or revoked
296 * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
297 * specified keyring wasn't a keyring.
298 *
299 * In the case of a successful return, the possession attribute from
300 * @keyring_ref is propagated to the returned key reference.
286 */ 301 */
287key_ref_t keyring_search_aux(key_ref_t keyring_ref, 302key_ref_t keyring_search_aux(key_ref_t keyring_ref,
288 const struct cred *cred, 303 const struct cred *cred,
@@ -337,7 +352,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
337 goto error_2; 352 goto error_2;
338 if (key->expiry && now.tv_sec >= key->expiry) 353 if (key->expiry && now.tv_sec >= key->expiry)
339 goto error_2; 354 goto error_2;
340 key_ref = ERR_PTR(-ENOKEY); 355 key_ref = ERR_PTR(key->type_data.reject_error);
341 if (kflags & (1 << KEY_FLAG_NEGATIVE)) 356 if (kflags & (1 << KEY_FLAG_NEGATIVE))
342 goto error_2; 357 goto error_2;
343 goto found; 358 goto found;
@@ -386,7 +401,7 @@ descend:
386 401
387 /* we set a different error code if we pass a negative key */ 402 /* we set a different error code if we pass a negative key */
388 if (kflags & (1 << KEY_FLAG_NEGATIVE)) { 403 if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
389 err = -ENOKEY; 404 err = key->type_data.reject_error;
390 continue; 405 continue;
391 } 406 }
392 407
@@ -444,17 +459,16 @@ error_2:
444 rcu_read_unlock(); 459 rcu_read_unlock();
445error: 460error:
446 return key_ref; 461 return key_ref;
462}
447 463
448} /* end keyring_search_aux() */ 464/**
449 465 * keyring_search - Search the supplied keyring tree for a matching key
450/*****************************************************************************/ 466 * @keyring: The root of the keyring tree to be searched.
451/* 467 * @type: The type of keyring we want to find.
452 * search the supplied keyring tree for a key that matches the criterion 468 * @description: The name of the keyring we want to find.
453 * - perform a breadth-then-depth search up to the prescribed limit 469 *
454 * - we only find keys on which we have search permission 470 * As keyring_search_aux() above, but using the current task's credentials and
455 * - we readlock the keyrings as we search down the tree 471 * type's default matching function.
456 * - we return -EAGAIN if we didn't find any matching key
457 * - we return -ENOKEY if we only found negative matching keys
458 */ 472 */
459key_ref_t keyring_search(key_ref_t keyring, 473key_ref_t keyring_search(key_ref_t keyring,
460 struct key_type *type, 474 struct key_type *type,
@@ -465,16 +479,23 @@ key_ref_t keyring_search(key_ref_t keyring,
465 479
466 return keyring_search_aux(keyring, current->cred, 480 return keyring_search_aux(keyring, current->cred,
467 type, description, type->match); 481 type, description, type->match);
468 482}
469} /* end keyring_search() */
470
471EXPORT_SYMBOL(keyring_search); 483EXPORT_SYMBOL(keyring_search);
472 484
473/*****************************************************************************/
474/* 485/*
475 * search the given keyring only (no recursion) 486 * Search the given keyring only (no recursion).
476 * - keyring must be locked by caller 487 *
477 * - caller must guarantee that the keyring is a keyring 488 * The caller must guarantee that the keyring is a keyring and that the
489 * permission is granted to search the keyring as no check is made here.
490 *
491 * RCU is used to make it unnecessary to lock the keyring key list here.
492 *
493 * Returns a pointer to the found key with usage count incremented if
494 * successful and returns -ENOKEY if not found. Revoked keys and keys not
495 * providing the requested permission are skipped over.
496 *
497 * If successful, the possession indicator is propagated from the keyring ref
498 * to the returned key reference.
478 */ 499 */
479key_ref_t __keyring_search_one(key_ref_t keyring_ref, 500key_ref_t __keyring_search_one(key_ref_t keyring_ref,
480 const struct key_type *ktype, 501 const struct key_type *ktype,
@@ -514,14 +535,18 @@ found:
514 atomic_inc(&key->usage); 535 atomic_inc(&key->usage);
515 rcu_read_unlock(); 536 rcu_read_unlock();
516 return make_key_ref(key, possessed); 537 return make_key_ref(key, possessed);
538}
517 539
518} /* end __keyring_search_one() */
519
520/*****************************************************************************/
521/* 540/*
522 * find a keyring with the specified name 541 * Find a keyring with the specified name.
523 * - all named keyrings are searched 542 *
524 * - normally only finds keyrings with search permission for the current process 543 * All named keyrings in the current user namespace are searched, provided they
544 * grant Search permission directly to the caller (unless this check is
545 * skipped). Keyrings whose usage points have reached zero or who have been
546 * revoked are skipped.
547 *
548 * Returns a pointer to the keyring with the keyring's refcount having being
549 * incremented on success. -ENOKEY is returned if a key could not be found.
525 */ 550 */
526struct key *find_keyring_by_name(const char *name, bool skip_perm_check) 551struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
527{ 552{
@@ -569,15 +594,14 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
569out: 594out:
570 read_unlock(&keyring_name_lock); 595 read_unlock(&keyring_name_lock);
571 return keyring; 596 return keyring;
597}
572 598
573} /* end find_keyring_by_name() */
574
575/*****************************************************************************/
576/* 599/*
577 * see if a cycle will will be created by inserting acyclic tree B in acyclic 600 * See if a cycle will will be created by inserting acyclic tree B in acyclic
578 * tree A at the topmost level (ie: as a direct child of A) 601 * tree A at the topmost level (ie: as a direct child of A).
579 * - since we are adding B to A at the top level, checking for cycles should 602 *
580 * just be a matter of seeing if node A is somewhere in tree B 603 * Since we are adding B to A at the top level, checking for cycles should just
604 * be a matter of seeing if node A is somewhere in tree B.
581 */ 605 */
582static int keyring_detect_cycle(struct key *A, struct key *B) 606static int keyring_detect_cycle(struct key *A, struct key *B)
583{ 607{
@@ -657,11 +681,10 @@ too_deep:
657cycle_detected: 681cycle_detected:
658 ret = -EDEADLK; 682 ret = -EDEADLK;
659 goto error; 683 goto error;
660 684}
661} /* end keyring_detect_cycle() */
662 685
663/* 686/*
664 * dispose of a keyring list after the RCU grace period, freeing the unlinked 687 * Dispose of a keyring list after the RCU grace period, freeing the unlinked
665 * key 688 * key
666 */ 689 */
667static void keyring_unlink_rcu_disposal(struct rcu_head *rcu) 690static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
@@ -675,14 +698,14 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
675} 698}
676 699
677/* 700/*
678 * preallocate memory so that a key can be linked into to a keyring 701 * Preallocate memory so that a key can be linked into to a keyring.
679 */ 702 */
680int __key_link_begin(struct key *keyring, const struct key_type *type, 703int __key_link_begin(struct key *keyring, const struct key_type *type,
681 const char *description, 704 const char *description, unsigned long *_prealloc)
682 struct keyring_list **_prealloc)
683 __acquires(&keyring->sem) 705 __acquires(&keyring->sem)
684{ 706{
685 struct keyring_list *klist, *nklist; 707 struct keyring_list *klist, *nklist;
708 unsigned long prealloc;
686 unsigned max; 709 unsigned max;
687 size_t size; 710 size_t size;
688 int loop, ret; 711 int loop, ret;
@@ -725,6 +748,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
725 748
726 /* note replacement slot */ 749 /* note replacement slot */
727 klist->delkey = nklist->delkey = loop; 750 klist->delkey = nklist->delkey = loop;
751 prealloc = (unsigned long)nklist;
728 goto done; 752 goto done;
729 } 753 }
730 } 754 }
@@ -739,6 +763,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
739 if (klist && klist->nkeys < klist->maxkeys) { 763 if (klist && klist->nkeys < klist->maxkeys) {
740 /* there's sufficient slack space to append directly */ 764 /* there's sufficient slack space to append directly */
741 nklist = NULL; 765 nklist = NULL;
766 prealloc = KEY_LINK_FIXQUOTA;
742 } else { 767 } else {
743 /* grow the key list */ 768 /* grow the key list */
744 max = 4; 769 max = 4;
@@ -773,8 +798,9 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
773 nklist->keys[nklist->delkey] = NULL; 798 nklist->keys[nklist->delkey] = NULL;
774 } 799 }
775 800
801 prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
776done: 802done:
777 *_prealloc = nklist; 803 *_prealloc = prealloc;
778 kleave(" = 0"); 804 kleave(" = 0");
779 return 0; 805 return 0;
780 806
@@ -792,10 +818,10 @@ error_krsem:
792} 818}
793 819
794/* 820/*
795 * check already instantiated keys aren't going to be a problem 821 * Check already instantiated keys aren't going to be a problem.
796 * - the caller must have called __key_link_begin() 822 *
797 * - don't need to call this for keys that were created since __key_link_begin() 823 * The caller must have called __key_link_begin(). Don't need to call this for
798 * was called 824 * keys that were created since __key_link_begin() was called.
799 */ 825 */
800int __key_link_check_live_key(struct key *keyring, struct key *key) 826int __key_link_check_live_key(struct key *keyring, struct key *key)
801{ 827{
@@ -807,17 +833,20 @@ int __key_link_check_live_key(struct key *keyring, struct key *key)
807} 833}
808 834
809/* 835/*
810 * link a key into to a keyring 836 * Link a key into to a keyring.
811 * - must be called with __key_link_begin() having being called 837 *
812 * - discard already extant link to matching key if there is one 838 * Must be called with __key_link_begin() having being called. Discards any
839 * already extant link to matching key if there is one, so that each keyring
840 * holds at most one link to any given key of a particular type+description
841 * combination.
813 */ 842 */
814void __key_link(struct key *keyring, struct key *key, 843void __key_link(struct key *keyring, struct key *key,
815 struct keyring_list **_prealloc) 844 unsigned long *_prealloc)
816{ 845{
817 struct keyring_list *klist, *nklist; 846 struct keyring_list *klist, *nklist;
818 847
819 nklist = *_prealloc; 848 nklist = (struct keyring_list *)(*_prealloc & ~KEY_LINK_FIXQUOTA);
820 *_prealloc = NULL; 849 *_prealloc = 0;
821 850
822 kenter("%d,%d,%p", keyring->serial, key->serial, nklist); 851 kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
823 852
@@ -852,34 +881,54 @@ void __key_link(struct key *keyring, struct key *key,
852} 881}
853 882
854/* 883/*
855 * finish linking a key into to a keyring 884 * Finish linking a key into to a keyring.
856 * - must be called with __key_link_begin() having being called 885 *
886 * Must be called with __key_link_begin() having being called.
857 */ 887 */
858void __key_link_end(struct key *keyring, struct key_type *type, 888void __key_link_end(struct key *keyring, struct key_type *type,
859 struct keyring_list *prealloc) 889 unsigned long prealloc)
860 __releases(&keyring->sem) 890 __releases(&keyring->sem)
861{ 891{
862 BUG_ON(type == NULL); 892 BUG_ON(type == NULL);
863 BUG_ON(type->name == NULL); 893 BUG_ON(type->name == NULL);
864 kenter("%d,%s,%p", keyring->serial, type->name, prealloc); 894 kenter("%d,%s,%lx", keyring->serial, type->name, prealloc);
865 895
866 if (type == &key_type_keyring) 896 if (type == &key_type_keyring)
867 up_write(&keyring_serialise_link_sem); 897 up_write(&keyring_serialise_link_sem);
868 898
869 if (prealloc) { 899 if (prealloc) {
870 kfree(prealloc); 900 if (prealloc & KEY_LINK_FIXQUOTA)
871 key_payload_reserve(keyring, 901 key_payload_reserve(keyring,
872 keyring->datalen - KEYQUOTA_LINK_BYTES); 902 keyring->datalen -
903 KEYQUOTA_LINK_BYTES);
904 kfree((struct keyring_list *)(prealloc & ~KEY_LINK_FIXQUOTA));
873 } 905 }
874 up_write(&keyring->sem); 906 up_write(&keyring->sem);
875} 907}
876 908
877/* 909/**
878 * link a key to a keyring 910 * key_link - Link a key to a keyring
911 * @keyring: The keyring to make the link in.
912 * @key: The key to link to.
913 *
914 * Make a link in a keyring to a key, such that the keyring holds a reference
915 * on that key and the key can potentially be found by searching that keyring.
916 *
917 * This function will write-lock the keyring's semaphore and will consume some
918 * of the user's key data quota to hold the link.
919 *
920 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring,
921 * -EKEYREVOKED if the keyring has been revoked, -ENFILE if the keyring is
922 * full, -EDQUOT if there is insufficient key data quota remaining to add
923 * another link or -ENOMEM if there's insufficient memory.
924 *
925 * It is assumed that the caller has checked that it is permitted for a link to
926 * be made (the keyring should have Write permission and the key Link
927 * permission).
879 */ 928 */
880int key_link(struct key *keyring, struct key *key) 929int key_link(struct key *keyring, struct key *key)
881{ 930{
882 struct keyring_list *prealloc; 931 unsigned long prealloc;
883 int ret; 932 int ret;
884 933
885 key_check(keyring); 934 key_check(keyring);
@@ -895,12 +944,24 @@ int key_link(struct key *keyring, struct key *key)
895 944
896 return ret; 945 return ret;
897} 946}
898
899EXPORT_SYMBOL(key_link); 947EXPORT_SYMBOL(key_link);
900 948
901/*****************************************************************************/ 949/**
902/* 950 * key_unlink - Unlink the first link to a key from a keyring.
903 * unlink the first link to a key from a keyring 951 * @keyring: The keyring to remove the link from.
952 * @key: The key the link is to.
953 *
954 * Remove a link from a keyring to a key.
955 *
956 * This function will write-lock the keyring's semaphore.
957 *
958 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring, -ENOENT if
959 * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
960 * memory.
961 *
962 * It is assumed that the caller has checked that it is permitted for a link to
963 * be removed (the keyring should have Write permission; no permissions are
964 * required on the key).
904 */ 965 */
905int key_unlink(struct key *keyring, struct key *key) 966int key_unlink(struct key *keyring, struct key *key)
906{ 967{
@@ -968,15 +1029,12 @@ nomem:
968 ret = -ENOMEM; 1029 ret = -ENOMEM;
969 up_write(&keyring->sem); 1030 up_write(&keyring->sem);
970 goto error; 1031 goto error;
971 1032}
972} /* end key_unlink() */
973
974EXPORT_SYMBOL(key_unlink); 1033EXPORT_SYMBOL(key_unlink);
975 1034
976/*****************************************************************************/
977/* 1035/*
978 * dispose of a keyring list after the RCU grace period, releasing the keys it 1036 * Dispose of a keyring list after the RCU grace period, releasing the keys it
979 * links to 1037 * links to.
980 */ 1038 */
981static void keyring_clear_rcu_disposal(struct rcu_head *rcu) 1039static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
982{ 1040{
@@ -989,13 +1047,15 @@ static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
989 key_put(klist->keys[loop]); 1047 key_put(klist->keys[loop]);
990 1048
991 kfree(klist); 1049 kfree(klist);
1050}
992 1051
993} /* end keyring_clear_rcu_disposal() */ 1052/**
994 1053 * keyring_clear - Clear a keyring
995/*****************************************************************************/ 1054 * @keyring: The keyring to clear.
996/* 1055 *
997 * clear the specified process keyring 1056 * Clear the contents of the specified keyring.
998 * - implements keyctl(KEYCTL_CLEAR) 1057 *
1058 * Returns 0 if successful or -ENOTDIR if the keyring isn't a keyring.
999 */ 1059 */
1000int keyring_clear(struct key *keyring) 1060int keyring_clear(struct key *keyring)
1001{ 1061{
@@ -1027,15 +1087,13 @@ int keyring_clear(struct key *keyring)
1027 } 1087 }
1028 1088
1029 return ret; 1089 return ret;
1030 1090}
1031} /* end keyring_clear() */
1032
1033EXPORT_SYMBOL(keyring_clear); 1091EXPORT_SYMBOL(keyring_clear);
1034 1092
1035/*****************************************************************************/
1036/* 1093/*
1037 * dispose of the links from a revoked keyring 1094 * Dispose of the links from a revoked keyring.
1038 * - called with the key sem write-locked 1095 *
1096 * This is called with the key sem write-locked.
1039 */ 1097 */
1040static void keyring_revoke(struct key *keyring) 1098static void keyring_revoke(struct key *keyring)
1041{ 1099{
@@ -1050,11 +1108,10 @@ static void keyring_revoke(struct key *keyring)
1050 rcu_assign_pointer(keyring->payload.subscriptions, NULL); 1108 rcu_assign_pointer(keyring->payload.subscriptions, NULL);
1051 call_rcu(&klist->rcu, keyring_clear_rcu_disposal); 1109 call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
1052 } 1110 }
1053 1111}
1054} /* end keyring_revoke() */
1055 1112
1056/* 1113/*
1057 * Determine whether a key is dead 1114 * Determine whether a key is dead.
1058 */ 1115 */
1059static bool key_is_dead(struct key *key, time_t limit) 1116static bool key_is_dead(struct key *key, time_t limit)
1060{ 1117{
@@ -1063,7 +1120,12 @@ static bool key_is_dead(struct key *key, time_t limit)
1063} 1120}
1064 1121
1065/* 1122/*
1066 * Collect garbage from the contents of a keyring 1123 * Collect garbage from the contents of a keyring, replacing the old list with
1124 * a new one with the pointers all shuffled down.
1125 *
1126 * Dead keys are classed as oned that are flagged as being dead or are revoked,
1127 * expired or negative keys that were revoked or expired before the specified
1128 * limit.
1067 */ 1129 */
1068void keyring_gc(struct key *keyring, time_t limit) 1130void keyring_gc(struct key *keyring, time_t limit)
1069{ 1131{
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 28645502cd0d..c35b5229e3cd 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -1,4 +1,4 @@
1/* permission.c: key permission determination 1/* Key permission checking
2 * 2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -13,18 +13,19 @@
13#include <linux/security.h> 13#include <linux/security.h>
14#include "internal.h" 14#include "internal.h"
15 15
16/*****************************************************************************/
17/** 16/**
18 * key_task_permission - Check a key can be used 17 * key_task_permission - Check a key can be used
19 * @key_ref: The key to check 18 * @key_ref: The key to check.
20 * @cred: The credentials to use 19 * @cred: The credentials to use.
21 * @perm: The permissions to check for 20 * @perm: The permissions to check for.
22 * 21 *
23 * Check to see whether permission is granted to use a key in the desired way, 22 * Check to see whether permission is granted to use a key in the desired way,
24 * but permit the security modules to override. 23 * but permit the security modules to override.
25 * 24 *
26 * The caller must hold either a ref on cred or must hold the RCU readlock or a 25 * The caller must hold either a ref on cred or must hold the RCU readlock.
27 * spinlock. 26 *
27 * Returns 0 if successful, -EACCES if access is denied based on the
28 * permissions bits or the LSM check.
28 */ 29 */
29int key_task_permission(const key_ref_t key_ref, const struct cred *cred, 30int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
30 key_perm_t perm) 31 key_perm_t perm)
@@ -79,14 +80,16 @@ use_these_perms:
79 80
80 /* let LSM be the final arbiter */ 81 /* let LSM be the final arbiter */
81 return security_key_permission(key_ref, cred, perm); 82 return security_key_permission(key_ref, cred, perm);
82 83}
83} /* end key_task_permission() */
84
85EXPORT_SYMBOL(key_task_permission); 84EXPORT_SYMBOL(key_task_permission);
86 85
87/*****************************************************************************/ 86/**
88/* 87 * key_validate - Validate a key.
89 * validate a key 88 * @key: The key to be validated.
89 *
90 * Check that a key is valid, returning 0 if the key is okay, -EKEYREVOKED if
91 * the key's type has been removed or if the key has been revoked or
92 * -EKEYEXPIRED if the key has expired.
90 */ 93 */
91int key_validate(struct key *key) 94int key_validate(struct key *key)
92{ 95{
@@ -111,7 +114,5 @@ int key_validate(struct key *key)
111 114
112error: 115error:
113 return ret; 116 return ret;
114 117}
115} /* end key_validate() */
116
117EXPORT_SYMBOL(key_validate); 118EXPORT_SYMBOL(key_validate);
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 70373966816e..525cf8a29cdd 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -1,4 +1,4 @@
1/* proc.c: proc files for key database enumeration 1/* procfs files for key database enumeration
2 * 2 *
3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -60,9 +60,8 @@ static const struct file_operations proc_key_users_fops = {
60 .release = seq_release, 60 .release = seq_release,
61}; 61};
62 62
63/*****************************************************************************/
64/* 63/*
65 * declare the /proc files 64 * Declare the /proc files.
66 */ 65 */
67static int __init key_proc_init(void) 66static int __init key_proc_init(void)
68{ 67{
@@ -79,14 +78,13 @@ static int __init key_proc_init(void)
79 panic("Cannot create /proc/key-users\n"); 78 panic("Cannot create /proc/key-users\n");
80 79
81 return 0; 80 return 0;
82 81}
83} /* end key_proc_init() */
84 82
85__initcall(key_proc_init); 83__initcall(key_proc_init);
86 84
87/*****************************************************************************/
88/* 85/*
89 * implement "/proc/keys" to provides a list of the keys on the system 86 * Implement "/proc/keys" to provide a list of the keys on the system that
87 * grant View permission to the caller.
90 */ 88 */
91#ifdef CONFIG_KEYS_DEBUG_PROC_KEYS 89#ifdef CONFIG_KEYS_DEBUG_PROC_KEYS
92 90
@@ -293,9 +291,9 @@ static struct rb_node *key_user_first(struct rb_root *r)
293 return __key_user_next(n); 291 return __key_user_next(n);
294} 292}
295 293
296/*****************************************************************************/
297/* 294/*
298 * implement "/proc/key-users" to provides a list of the key users 295 * Implement "/proc/key-users" to provides a list of the key users and their
296 * quotas.
299 */ 297 */
300static int proc_key_users_open(struct inode *inode, struct file *file) 298static int proc_key_users_open(struct inode *inode, struct file *file)
301{ 299{
@@ -351,5 +349,4 @@ static int proc_key_users_show(struct seq_file *m, void *v)
351 maxbytes); 349 maxbytes);
352 350
353 return 0; 351 return 0;
354
355} 352}
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 504bdd2452bd..930634e45149 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -1,4 +1,4 @@
1/* Management of a process's keyrings 1/* Manage a process's keyrings
2 * 2 *
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -21,13 +21,13 @@
21#include <asm/uaccess.h> 21#include <asm/uaccess.h>
22#include "internal.h" 22#include "internal.h"
23 23
24/* session keyring create vs join semaphore */ 24/* Session keyring create vs join semaphore */
25static DEFINE_MUTEX(key_session_mutex); 25static DEFINE_MUTEX(key_session_mutex);
26 26
27/* user keyring creation semaphore */ 27/* User keyring creation semaphore */
28static DEFINE_MUTEX(key_user_keyring_mutex); 28static DEFINE_MUTEX(key_user_keyring_mutex);
29 29
30/* the root user's tracking struct */ 30/* The root user's tracking struct */
31struct key_user root_key_user = { 31struct key_user root_key_user = {
32 .usage = ATOMIC_INIT(3), 32 .usage = ATOMIC_INIT(3),
33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock), 33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
@@ -38,9 +38,8 @@ struct key_user root_key_user = {
38 .user_ns = &init_user_ns, 38 .user_ns = &init_user_ns,
39}; 39};
40 40
41/*****************************************************************************/
42/* 41/*
43 * install user and user session keyrings for a particular UID 42 * Install the user and user session keyrings for the current process's UID.
44 */ 43 */
45int install_user_keyrings(void) 44int install_user_keyrings(void)
46{ 45{
@@ -122,7 +121,8 @@ error:
122} 121}
123 122
124/* 123/*
125 * install a fresh thread keyring directly to new credentials 124 * Install a fresh thread keyring directly to new credentials. This keyring is
125 * allowed to overrun the quota.
126 */ 126 */
127int install_thread_keyring_to_cred(struct cred *new) 127int install_thread_keyring_to_cred(struct cred *new)
128{ 128{
@@ -138,7 +138,7 @@ int install_thread_keyring_to_cred(struct cred *new)
138} 138}
139 139
140/* 140/*
141 * install a fresh thread keyring, discarding the old one 141 * Install a fresh thread keyring, discarding the old one.
142 */ 142 */
143static int install_thread_keyring(void) 143static int install_thread_keyring(void)
144{ 144{
@@ -161,9 +161,10 @@ static int install_thread_keyring(void)
161} 161}
162 162
163/* 163/*
164 * install a process keyring directly to a credentials struct 164 * Install a process keyring directly to a credentials struct.
165 * - returns -EEXIST if there was already a process keyring, 0 if one installed, 165 *
166 * and other -ve on any other error 166 * Returns -EEXIST if there was already a process keyring, 0 if one installed,
167 * and other value on any other error
167 */ 168 */
168int install_process_keyring_to_cred(struct cred *new) 169int install_process_keyring_to_cred(struct cred *new)
169{ 170{
@@ -192,8 +193,11 @@ int install_process_keyring_to_cred(struct cred *new)
192} 193}
193 194
194/* 195/*
195 * make sure a process keyring is installed 196 * Make sure a process keyring is installed for the current process. The
196 * - we 197 * existing process keyring is not replaced.
198 *
199 * Returns 0 if there is a process keyring by the end of this function, some
200 * error otherwise.
197 */ 201 */
198static int install_process_keyring(void) 202static int install_process_keyring(void)
199{ 203{
@@ -214,7 +218,7 @@ static int install_process_keyring(void)
214} 218}
215 219
216/* 220/*
217 * install a session keyring directly to a credentials struct 221 * Install a session keyring directly to a credentials struct.
218 */ 222 */
219int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) 223int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
220{ 224{
@@ -254,8 +258,8 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
254} 258}
255 259
256/* 260/*
257 * install a session keyring, discarding the old one 261 * Install a session keyring, discarding the old one. If a keyring is not
258 * - if a keyring is not supplied, an empty one is invented 262 * supplied, an empty one is invented.
259 */ 263 */
260static int install_session_keyring(struct key *keyring) 264static int install_session_keyring(struct key *keyring)
261{ 265{
@@ -275,9 +279,8 @@ static int install_session_keyring(struct key *keyring)
275 return commit_creds(new); 279 return commit_creds(new);
276} 280}
277 281
278/*****************************************************************************/
279/* 282/*
280 * the filesystem user ID changed 283 * Handle the fsuid changing.
281 */ 284 */
282void key_fsuid_changed(struct task_struct *tsk) 285void key_fsuid_changed(struct task_struct *tsk)
283{ 286{
@@ -288,12 +291,10 @@ void key_fsuid_changed(struct task_struct *tsk)
288 tsk->cred->thread_keyring->uid = tsk->cred->fsuid; 291 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
289 up_write(&tsk->cred->thread_keyring->sem); 292 up_write(&tsk->cred->thread_keyring->sem);
290 } 293 }
294}
291 295
292} /* end key_fsuid_changed() */
293
294/*****************************************************************************/
295/* 296/*
296 * the filesystem group ID changed 297 * Handle the fsgid changing.
297 */ 298 */
298void key_fsgid_changed(struct task_struct *tsk) 299void key_fsgid_changed(struct task_struct *tsk)
299{ 300{
@@ -304,16 +305,28 @@ void key_fsgid_changed(struct task_struct *tsk)
304 tsk->cred->thread_keyring->gid = tsk->cred->fsgid; 305 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
305 up_write(&tsk->cred->thread_keyring->sem); 306 up_write(&tsk->cred->thread_keyring->sem);
306 } 307 }
308}
307 309
308} /* end key_fsgid_changed() */
309
310/*****************************************************************************/
311/* 310/*
312 * search only my process keyrings for the first matching key 311 * Search the process keyrings attached to the supplied cred for the first
313 * - we use the supplied match function to see if the description (or other 312 * matching key.
314 * feature of interest) matches 313 *
315 * - we return -EAGAIN if we didn't find any matching key 314 * The search criteria are the type and the match function. The description is
316 * - we return -ENOKEY if we found only negative matching keys 315 * given to the match function as a parameter, but doesn't otherwise influence
316 * the search. Typically the match function will compare the description
317 * parameter to the key's description.
318 *
319 * This can only search keyrings that grant Search permission to the supplied
320 * credentials. Keyrings linked to searched keyrings will also be searched if
321 * they grant Search permission too. Keys can only be found if they grant
322 * Search permission to the credentials.
323 *
324 * Returns a pointer to the key with the key usage count incremented if
325 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
326 * matched negative keys.
327 *
328 * In the case of a successful return, the possession attribute is set on the
329 * returned key reference.
317 */ 330 */
318key_ref_t search_my_process_keyrings(struct key_type *type, 331key_ref_t search_my_process_keyrings(struct key_type *type,
319 const void *description, 332 const void *description,
@@ -428,13 +441,13 @@ found:
428 return key_ref; 441 return key_ref;
429} 442}
430 443
431/*****************************************************************************/
432/* 444/*
433 * search the process keyrings for the first matching key 445 * Search the process keyrings attached to the supplied cred for the first
434 * - we use the supplied match function to see if the description (or other 446 * matching key in the manner of search_my_process_keyrings(), but also search
435 * feature of interest) matches 447 * the keys attached to the assumed authorisation key using its credentials if
436 * - we return -EAGAIN if we didn't find any matching key 448 * one is available.
437 * - we return -ENOKEY if we found only negative matching keys 449 *
450 * Return same as search_my_process_keyrings().
438 */ 451 */
439key_ref_t search_process_keyrings(struct key_type *type, 452key_ref_t search_process_keyrings(struct key_type *type,
440 const void *description, 453 const void *description,
@@ -489,24 +502,33 @@ key_ref_t search_process_keyrings(struct key_type *type,
489 502
490found: 503found:
491 return key_ref; 504 return key_ref;
505}
492 506
493} /* end search_process_keyrings() */
494
495/*****************************************************************************/
496/* 507/*
497 * see if the key we're looking at is the target key 508 * See if the key we're looking at is the target key.
498 */ 509 */
499int lookup_user_key_possessed(const struct key *key, const void *target) 510int lookup_user_key_possessed(const struct key *key, const void *target)
500{ 511{
501 return key == target; 512 return key == target;
513}
502 514
503} /* end lookup_user_key_possessed() */
504
505/*****************************************************************************/
506/* 515/*
507 * lookup a key given a key ID from userspace with a given permissions mask 516 * Look up a key ID given us by userspace with a given permissions mask to get
508 * - don't create special keyrings unless so requested 517 * the key it refers to.
509 * - partially constructed keys aren't found unless requested 518 *
519 * Flags can be passed to request that special keyrings be created if referred
520 * to directly, to permit partially constructed keys to be found and to skip
521 * validity and permission checks on the found key.
522 *
523 * Returns a pointer to the key with an incremented usage count if successful;
524 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
525 * to a key or the best found key was a negative key; -EKEYREVOKED or
526 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
527 * found key doesn't grant the requested permit or the LSM denied access to it;
528 * or -ENOMEM if a special keyring couldn't be created.
529 *
530 * In the case of a successful return, the possession attribute is set on the
531 * returned key reference.
510 */ 532 */
511key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, 533key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
512 key_perm_t perm) 534 key_perm_t perm)
@@ -711,15 +733,18 @@ invalid_key:
711reget_creds: 733reget_creds:
712 put_cred(cred); 734 put_cred(cred);
713 goto try_again; 735 goto try_again;
736}
714 737
715} /* end lookup_user_key() */
716
717/*****************************************************************************/
718/* 738/*
719 * join the named keyring as the session keyring if possible, or attempt to 739 * Join the named keyring as the session keyring if possible else attempt to
720 * create a new one of that name if not 740 * create a new one of that name and join that.
721 * - if the name is NULL, an empty anonymous keyring is installed instead 741 *
722 * - named session keyring joining is done with a semaphore held 742 * If the name is NULL, an empty anonymous keyring will be installed as the
743 * session keyring.
744 *
745 * Named session keyrings are joined with a semaphore held to prevent the
746 * keyrings from going away whilst the attempt is made to going them and also
747 * to prevent a race in creating compatible session keyrings.
723 */ 748 */
724long join_session_keyring(const char *name) 749long join_session_keyring(const char *name)
725{ 750{
@@ -791,8 +816,8 @@ error:
791} 816}
792 817
793/* 818/*
794 * Replace a process's session keyring when that process resumes userspace on 819 * Replace a process's session keyring on behalf of one of its children when
795 * behalf of one of its children 820 * the target process is about to resume userspace execution.
796 */ 821 */
797void key_replace_session_keyring(void) 822void key_replace_session_keyring(void)
798{ 823{
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0ea52d25a6bd..df3c0417ee40 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -39,8 +39,14 @@ static int key_wait_bit_intr(void *flags)
39 return signal_pending(current) ? -ERESTARTSYS : 0; 39 return signal_pending(current) ? -ERESTARTSYS : 0;
40} 40}
41 41
42/* 42/**
43 * call to complete the construction of a key 43 * complete_request_key - Complete the construction of a key.
44 * @cons: The key construction record.
45 * @error: The success or failute of the construction.
46 *
47 * Complete the attempt to construct a key. The key will be negated
48 * if an error is indicated. The authorisation key will be revoked
49 * unconditionally.
44 */ 50 */
45void complete_request_key(struct key_construction *cons, int error) 51void complete_request_key(struct key_construction *cons, int error)
46{ 52{
@@ -58,23 +64,33 @@ void complete_request_key(struct key_construction *cons, int error)
58} 64}
59EXPORT_SYMBOL(complete_request_key); 65EXPORT_SYMBOL(complete_request_key);
60 66
67/*
68 * Initialise a usermode helper that is going to have a specific session
69 * keyring.
70 *
71 * This is called in context of freshly forked kthread before kernel_execve(),
72 * so we can simply install the desired session_keyring at this point.
73 */
61static int umh_keys_init(struct subprocess_info *info) 74static int umh_keys_init(struct subprocess_info *info)
62{ 75{
63 struct cred *cred = (struct cred*)current_cred(); 76 struct cred *cred = (struct cred*)current_cred();
64 struct key *keyring = info->data; 77 struct key *keyring = info->data;
65 /* 78
66 * This is called in context of freshly forked kthread before
67 * kernel_execve(), we can just change our ->session_keyring.
68 */
69 return install_session_keyring_to_cred(cred, keyring); 79 return install_session_keyring_to_cred(cred, keyring);
70} 80}
71 81
82/*
83 * Clean up a usermode helper with session keyring.
84 */
72static void umh_keys_cleanup(struct subprocess_info *info) 85static void umh_keys_cleanup(struct subprocess_info *info)
73{ 86{
74 struct key *keyring = info->data; 87 struct key *keyring = info->data;
75 key_put(keyring); 88 key_put(keyring);
76} 89}
77 90
91/*
92 * Call a usermode helper with a specific session keyring.
93 */
78static int call_usermodehelper_keys(char *path, char **argv, char **envp, 94static int call_usermodehelper_keys(char *path, char **argv, char **envp,
79 struct key *session_keyring, enum umh_wait wait) 95 struct key *session_keyring, enum umh_wait wait)
80{ 96{
@@ -91,7 +107,7 @@ static int call_usermodehelper_keys(char *path, char **argv, char **envp,
91} 107}
92 108
93/* 109/*
94 * request userspace finish the construction of a key 110 * Request userspace finish the construction of a key
95 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>" 111 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
96 */ 112 */
97static int call_sbin_request_key(struct key_construction *cons, 113static int call_sbin_request_key(struct key_construction *cons,
@@ -198,8 +214,9 @@ error_alloc:
198} 214}
199 215
200/* 216/*
201 * call out to userspace for key construction 217 * Call out to userspace for key construction.
202 * - we ignore program failure and go on key status instead 218 *
219 * Program failure is ignored in favour of key status.
203 */ 220 */
204static int construct_key(struct key *key, const void *callout_info, 221static int construct_key(struct key *key, const void *callout_info,
205 size_t callout_len, void *aux, 222 size_t callout_len, void *aux,
@@ -246,9 +263,10 @@ static int construct_key(struct key *key, const void *callout_info,
246} 263}
247 264
248/* 265/*
249 * get the appropriate destination keyring for the request 266 * Get the appropriate destination keyring for the request.
250 * - we return whatever keyring we select with an extra reference upon it which 267 *
251 * the caller must release 268 * The keyring selected is returned with an extra reference upon it which the
269 * caller must release.
252 */ 270 */
253static void construct_get_dest_keyring(struct key **_dest_keyring) 271static void construct_get_dest_keyring(struct key **_dest_keyring)
254{ 272{
@@ -321,9 +339,11 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
321} 339}
322 340
323/* 341/*
324 * allocate a new key in under-construction state and attempt to link it in to 342 * Allocate a new key in under-construction state and attempt to link it in to
325 * the requested place 343 * the requested keyring.
326 * - may return a key that's already under construction instead 344 *
345 * May return a key that's already under construction instead if there was a
346 * race between two thread calling request_key().
327 */ 347 */
328static int construct_alloc_key(struct key_type *type, 348static int construct_alloc_key(struct key_type *type,
329 const char *description, 349 const char *description,
@@ -332,8 +352,8 @@ static int construct_alloc_key(struct key_type *type,
332 struct key_user *user, 352 struct key_user *user,
333 struct key **_key) 353 struct key **_key)
334{ 354{
335 struct keyring_list *prealloc;
336 const struct cred *cred = current_cred(); 355 const struct cred *cred = current_cred();
356 unsigned long prealloc;
337 struct key *key; 357 struct key *key;
338 key_ref_t key_ref; 358 key_ref_t key_ref;
339 int ret; 359 int ret;
@@ -414,7 +434,7 @@ alloc_failed:
414} 434}
415 435
416/* 436/*
417 * commence key construction 437 * Commence key construction.
418 */ 438 */
419static struct key *construct_key_and_link(struct key_type *type, 439static struct key *construct_key_and_link(struct key_type *type,
420 const char *description, 440 const char *description,
@@ -465,12 +485,32 @@ construction_failed:
465 return ERR_PTR(ret); 485 return ERR_PTR(ret);
466} 486}
467 487
468/* 488/**
469 * request a key 489 * request_key_and_link - Request a key and cache it in a keyring.
470 * - search the process's keyrings 490 * @type: The type of key we want.
471 * - check the list of keys being created or updated 491 * @description: The searchable description of the key.
472 * - call out to userspace for a key if supplementary info was provided 492 * @callout_info: The data to pass to the instantiation upcall (or NULL).
473 * - cache the key in an appropriate keyring 493 * @callout_len: The length of callout_info.
494 * @aux: Auxiliary data for the upcall.
495 * @dest_keyring: Where to cache the key.
496 * @flags: Flags to key_alloc().
497 *
498 * A key matching the specified criteria is searched for in the process's
499 * keyrings and returned with its usage count incremented if found. Otherwise,
500 * if callout_info is not NULL, a key will be allocated and some service
501 * (probably in userspace) will be asked to instantiate it.
502 *
503 * If successfully found or created, the key will be linked to the destination
504 * keyring if one is provided.
505 *
506 * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
507 * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
508 * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
509 * if insufficient key quota was available to create a new key; or -ENOMEM if
510 * insufficient memory was available.
511 *
512 * If the returned key was created, then it may still be under construction,
513 * and wait_for_key_construction() should be used to wait for that to complete.
474 */ 514 */
475struct key *request_key_and_link(struct key_type *type, 515struct key *request_key_and_link(struct key_type *type,
476 const char *description, 516 const char *description,
@@ -524,8 +564,16 @@ error:
524 return key; 564 return key;
525} 565}
526 566
527/* 567/**
528 * wait for construction of a key to complete 568 * wait_for_key_construction - Wait for construction of a key to complete
569 * @key: The key being waited for.
570 * @intr: Whether to wait interruptibly.
571 *
572 * Wait for a key to finish being constructed.
573 *
574 * Returns 0 if successful; -ERESTARTSYS if the wait was interrupted; -ENOKEY
575 * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
576 * revoked or expired.
529 */ 577 */
530int wait_for_key_construction(struct key *key, bool intr) 578int wait_for_key_construction(struct key *key, bool intr)
531{ 579{
@@ -537,17 +585,24 @@ int wait_for_key_construction(struct key *key, bool intr)
537 if (ret < 0) 585 if (ret < 0)
538 return ret; 586 return ret;
539 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) 587 if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
540 return -ENOKEY; 588 return key->type_data.reject_error;
541 return key_validate(key); 589 return key_validate(key);
542} 590}
543EXPORT_SYMBOL(wait_for_key_construction); 591EXPORT_SYMBOL(wait_for_key_construction);
544 592
545/* 593/**
546 * request a key 594 * request_key - Request a key and wait for construction
547 * - search the process's keyrings 595 * @type: Type of key.
548 * - check the list of keys being created or updated 596 * @description: The searchable description of the key.
549 * - call out to userspace for a key if supplementary info was provided 597 * @callout_info: The data to pass to the instantiation upcall (or NULL).
550 * - waits uninterruptible for creation to complete 598 *
599 * As for request_key_and_link() except that it does not add the returned key
600 * to a keyring if found, new keys are always allocated in the user's quota,
601 * the callout_info must be a NUL-terminated string and no auxiliary data can
602 * be passed.
603 *
604 * Furthermore, it then works as wait_for_key_construction() to wait for the
605 * completion of keys undergoing construction with a non-interruptible wait.
551 */ 606 */
552struct key *request_key(struct key_type *type, 607struct key *request_key(struct key_type *type,
553 const char *description, 608 const char *description,
@@ -572,12 +627,19 @@ struct key *request_key(struct key_type *type,
572} 627}
573EXPORT_SYMBOL(request_key); 628EXPORT_SYMBOL(request_key);
574 629
575/* 630/**
576 * request a key with auxiliary data for the upcaller 631 * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
577 * - search the process's keyrings 632 * @type: The type of key we want.
578 * - check the list of keys being created or updated 633 * @description: The searchable description of the key.
579 * - call out to userspace for a key if supplementary info was provided 634 * @callout_info: The data to pass to the instantiation upcall (or NULL).
580 * - waits uninterruptible for creation to complete 635 * @callout_len: The length of callout_info.
636 * @aux: Auxiliary data for the upcall.
637 *
638 * As for request_key_and_link() except that it does not add the returned key
639 * to a keyring if found and new keys are always allocated in the user's quota.
640 *
641 * Furthermore, it then works as wait_for_key_construction() to wait for the
642 * completion of keys undergoing construction with a non-interruptible wait.
581 */ 643 */
582struct key *request_key_with_auxdata(struct key_type *type, 644struct key *request_key_with_auxdata(struct key_type *type,
583 const char *description, 645 const char *description,
@@ -602,10 +664,18 @@ struct key *request_key_with_auxdata(struct key_type *type,
602EXPORT_SYMBOL(request_key_with_auxdata); 664EXPORT_SYMBOL(request_key_with_auxdata);
603 665
604/* 666/*
605 * request a key (allow async construction) 667 * request_key_async - Request a key (allow async construction)
606 * - search the process's keyrings 668 * @type: Type of key.
607 * - check the list of keys being created or updated 669 * @description: The searchable description of the key.
608 * - call out to userspace for a key if supplementary info was provided 670 * @callout_info: The data to pass to the instantiation upcall (or NULL).
671 * @callout_len: The length of callout_info.
672 *
673 * As for request_key_and_link() except that it does not add the returned key
674 * to a keyring if found, new keys are always allocated in the user's quota and
675 * no auxiliary data can be passed.
676 *
677 * The caller should call wait_for_key_construction() to wait for the
678 * completion of the returned key if it is still undergoing construction.
609 */ 679 */
610struct key *request_key_async(struct key_type *type, 680struct key *request_key_async(struct key_type *type,
611 const char *description, 681 const char *description,
@@ -620,9 +690,17 @@ EXPORT_SYMBOL(request_key_async);
620 690
621/* 691/*
622 * request a key with auxiliary data for the upcaller (allow async construction) 692 * request a key with auxiliary data for the upcaller (allow async construction)
623 * - search the process's keyrings 693 * @type: Type of key.
624 * - check the list of keys being created or updated 694 * @description: The searchable description of the key.
625 * - call out to userspace for a key if supplementary info was provided 695 * @callout_info: The data to pass to the instantiation upcall (or NULL).
696 * @callout_len: The length of callout_info.
697 * @aux: Auxiliary data for the upcall.
698 *
699 * As for request_key_and_link() except that it does not add the returned key
700 * to a keyring if found and new keys are always allocated in the user's quota.
701 *
702 * The caller should call wait_for_key_construction() to wait for the
703 * completion of the returned key if it is still undergoing construction.
626 */ 704 */
627struct key *request_key_async_with_auxdata(struct key_type *type, 705struct key *request_key_async_with_auxdata(struct key_type *type,
628 const char *description, 706 const char *description,
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 86747151ee5b..68164031a74e 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -1,4 +1,4 @@
1/* request_key_auth.c: request key authorisation controlling key def 1/* Request key authorisation token key definition.
2 * 2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -26,7 +26,7 @@ static void request_key_auth_destroy(struct key *);
26static long request_key_auth_read(const struct key *, char __user *, size_t); 26static long request_key_auth_read(const struct key *, char __user *, size_t);
27 27
28/* 28/*
29 * the request-key authorisation key type definition 29 * The request-key authorisation key type definition.
30 */ 30 */
31struct key_type key_type_request_key_auth = { 31struct key_type key_type_request_key_auth = {
32 .name = ".request_key_auth", 32 .name = ".request_key_auth",
@@ -38,9 +38,8 @@ struct key_type key_type_request_key_auth = {
38 .read = request_key_auth_read, 38 .read = request_key_auth_read,
39}; 39};
40 40
41/*****************************************************************************/
42/* 41/*
43 * instantiate a request-key authorisation key 42 * Instantiate a request-key authorisation key.
44 */ 43 */
45static int request_key_auth_instantiate(struct key *key, 44static int request_key_auth_instantiate(struct key *key,
46 const void *data, 45 const void *data,
@@ -48,12 +47,10 @@ static int request_key_auth_instantiate(struct key *key,
48{ 47{
49 key->payload.data = (struct request_key_auth *) data; 48 key->payload.data = (struct request_key_auth *) data;
50 return 0; 49 return 0;
50}
51 51
52} /* end request_key_auth_instantiate() */
53
54/*****************************************************************************/
55/* 52/*
56 * reading a request-key authorisation key retrieves the callout information 53 * Describe an authorisation token.
57 */ 54 */
58static void request_key_auth_describe(const struct key *key, 55static void request_key_auth_describe(const struct key *key,
59 struct seq_file *m) 56 struct seq_file *m)
@@ -63,12 +60,10 @@ static void request_key_auth_describe(const struct key *key,
63 seq_puts(m, "key:"); 60 seq_puts(m, "key:");
64 seq_puts(m, key->description); 61 seq_puts(m, key->description);
65 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); 62 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
63}
66 64
67} /* end request_key_auth_describe() */
68
69/*****************************************************************************/
70/* 65/*
71 * read the callout_info data 66 * Read the callout_info data (retrieves the callout information).
72 * - the key's semaphore is read-locked 67 * - the key's semaphore is read-locked
73 */ 68 */
74static long request_key_auth_read(const struct key *key, 69static long request_key_auth_read(const struct key *key,
@@ -91,13 +86,12 @@ static long request_key_auth_read(const struct key *key,
91 } 86 }
92 87
93 return ret; 88 return ret;
89}
94 90
95} /* end request_key_auth_read() */
96
97/*****************************************************************************/
98/* 91/*
99 * handle revocation of an authorisation token key 92 * Handle revocation of an authorisation token key.
100 * - called with the key sem write-locked 93 *
94 * Called with the key sem write-locked.
101 */ 95 */
102static void request_key_auth_revoke(struct key *key) 96static void request_key_auth_revoke(struct key *key)
103{ 97{
@@ -109,12 +103,10 @@ static void request_key_auth_revoke(struct key *key)
109 put_cred(rka->cred); 103 put_cred(rka->cred);
110 rka->cred = NULL; 104 rka->cred = NULL;
111 } 105 }
106}
112 107
113} /* end request_key_auth_revoke() */
114
115/*****************************************************************************/
116/* 108/*
117 * destroy an instantiation authorisation token key 109 * Destroy an instantiation authorisation token key.
118 */ 110 */
119static void request_key_auth_destroy(struct key *key) 111static void request_key_auth_destroy(struct key *key)
120{ 112{
@@ -131,13 +123,11 @@ static void request_key_auth_destroy(struct key *key)
131 key_put(rka->dest_keyring); 123 key_put(rka->dest_keyring);
132 kfree(rka->callout_info); 124 kfree(rka->callout_info);
133 kfree(rka); 125 kfree(rka);
126}
134 127
135} /* end request_key_auth_destroy() */
136
137/*****************************************************************************/
138/* 128/*
139 * create an authorisation token for /sbin/request-key or whoever to gain 129 * Create an authorisation token for /sbin/request-key or whoever to gain
140 * access to the caller's security data 130 * access to the caller's security data.
141 */ 131 */
142struct key *request_key_auth_new(struct key *target, const void *callout_info, 132struct key *request_key_auth_new(struct key *target, const void *callout_info,
143 size_t callout_len, struct key *dest_keyring) 133 size_t callout_len, struct key *dest_keyring)
@@ -228,12 +218,10 @@ error_alloc:
228 kfree(rka); 218 kfree(rka);
229 kleave("= %d", ret); 219 kleave("= %d", ret);
230 return ERR_PTR(ret); 220 return ERR_PTR(ret);
221}
231 222
232} /* end request_key_auth_new() */
233
234/*****************************************************************************/
235/* 223/*
236 * see if an authorisation key is associated with a particular key 224 * See if an authorisation key is associated with a particular key.
237 */ 225 */
238static int key_get_instantiation_authkey_match(const struct key *key, 226static int key_get_instantiation_authkey_match(const struct key *key,
239 const void *_id) 227 const void *_id)
@@ -242,16 +230,11 @@ static int key_get_instantiation_authkey_match(const struct key *key,
242 key_serial_t id = (key_serial_t)(unsigned long) _id; 230 key_serial_t id = (key_serial_t)(unsigned long) _id;
243 231
244 return rka->target_key->serial == id; 232 return rka->target_key->serial == id;
233}
245 234
246} /* end key_get_instantiation_authkey_match() */
247
248/*****************************************************************************/
249/* 235/*
250 * get the authorisation key for instantiation of a specific key if attached to 236 * Search the current process's keyrings for the authorisation key for
251 * the current process's keyrings 237 * instantiation of a key.
252 * - this key is inserted into a keyring and that is set as /sbin/request-key's
253 * session keyring
254 * - a target_id of zero specifies any valid token
255 */ 238 */
256struct key *key_get_instantiation_authkey(key_serial_t target_id) 239struct key *key_get_instantiation_authkey(key_serial_t target_id)
257{ 240{
@@ -278,5 +261,4 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
278 261
279error: 262error:
280 return authkey; 263 return authkey;
281 264}
282} /* end key_get_instantiation_authkey() */
diff --git a/security/keys/trusted_defined.c b/security/keys/trusted.c
index 975e9f29a52c..c99b9368368c 100644
--- a/security/keys/trusted_defined.c
+++ b/security/keys/trusted.c
@@ -29,7 +29,7 @@
29#include <linux/tpm.h> 29#include <linux/tpm.h>
30#include <linux/tpm_command.h> 30#include <linux/tpm_command.h>
31 31
32#include "trusted_defined.h" 32#include "trusted.h"
33 33
34static const char hmac_alg[] = "hmac(sha1)"; 34static const char hmac_alg[] = "hmac(sha1)";
35static const char hash_alg[] = "sha1"; 35static const char hash_alg[] = "sha1";
@@ -101,11 +101,13 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
101 if (dlen == 0) 101 if (dlen == 0)
102 break; 102 break;
103 data = va_arg(argp, unsigned char *); 103 data = va_arg(argp, unsigned char *);
104 if (data == NULL) 104 if (data == NULL) {
105 return -EINVAL; 105 ret = -EINVAL;
106 break;
107 }
106 ret = crypto_shash_update(&sdesc->shash, data, dlen); 108 ret = crypto_shash_update(&sdesc->shash, data, dlen);
107 if (ret < 0) 109 if (ret < 0)
108 goto out; 110 break;
109 } 111 }
110 va_end(argp); 112 va_end(argp);
111 if (!ret) 113 if (!ret)
@@ -146,14 +148,17 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
146 if (dlen == 0) 148 if (dlen == 0)
147 break; 149 break;
148 data = va_arg(argp, unsigned char *); 150 data = va_arg(argp, unsigned char *);
149 ret = crypto_shash_update(&sdesc->shash, data, dlen); 151 if (!data) {
150 if (ret < 0) { 152 ret = -EINVAL;
151 va_end(argp); 153 break;
152 goto out;
153 } 154 }
155 ret = crypto_shash_update(&sdesc->shash, data, dlen);
156 if (ret < 0)
157 break;
154 } 158 }
155 va_end(argp); 159 va_end(argp);
156 ret = crypto_shash_final(&sdesc->shash, paramdigest); 160 if (!ret)
161 ret = crypto_shash_final(&sdesc->shash, paramdigest);
157 if (!ret) 162 if (!ret)
158 ret = TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE, 163 ret = TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE,
159 paramdigest, TPM_NONCE_SIZE, h1, 164 paramdigest, TPM_NONCE_SIZE, h1,
@@ -222,13 +227,12 @@ static int TSS_checkhmac1(unsigned char *buffer,
222 break; 227 break;
223 dpos = va_arg(argp, unsigned int); 228 dpos = va_arg(argp, unsigned int);
224 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen); 229 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
225 if (ret < 0) { 230 if (ret < 0)
226 va_end(argp); 231 break;
227 goto out;
228 }
229 } 232 }
230 va_end(argp); 233 va_end(argp);
231 ret = crypto_shash_final(&sdesc->shash, paramdigest); 234 if (!ret)
235 ret = crypto_shash_final(&sdesc->shash, paramdigest);
232 if (ret < 0) 236 if (ret < 0)
233 goto out; 237 goto out;
234 238
@@ -316,13 +320,12 @@ static int TSS_checkhmac2(unsigned char *buffer,
316 break; 320 break;
317 dpos = va_arg(argp, unsigned int); 321 dpos = va_arg(argp, unsigned int);
318 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen); 322 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
319 if (ret < 0) { 323 if (ret < 0)
320 va_end(argp); 324 break;
321 goto out;
322 }
323 } 325 }
324 va_end(argp); 326 va_end(argp);
325 ret = crypto_shash_final(&sdesc->shash, paramdigest); 327 if (!ret)
328 ret = crypto_shash_final(&sdesc->shash, paramdigest);
326 if (ret < 0) 329 if (ret < 0)
327 goto out; 330 goto out;
328 331
@@ -511,7 +514,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
511 /* get session for sealing key */ 514 /* get session for sealing key */
512 ret = osap(tb, &sess, keyauth, keytype, keyhandle); 515 ret = osap(tb, &sess, keyauth, keytype, keyhandle);
513 if (ret < 0) 516 if (ret < 0)
514 return ret; 517 goto out;
515 dump_sess(&sess); 518 dump_sess(&sess);
516 519
517 /* calculate encrypted authorization value */ 520 /* calculate encrypted authorization value */
@@ -519,11 +522,11 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
519 memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE); 522 memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE);
520 ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash); 523 ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash);
521 if (ret < 0) 524 if (ret < 0)
522 return ret; 525 goto out;
523 526
524 ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE); 527 ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE);
525 if (ret < 0) 528 if (ret < 0)
526 return ret; 529 goto out;
527 ordinal = htonl(TPM_ORD_SEAL); 530 ordinal = htonl(TPM_ORD_SEAL);
528 datsize = htonl(datalen); 531 datsize = htonl(datalen);
529 pcrsize = htonl(pcrinfosize); 532 pcrsize = htonl(pcrinfosize);
@@ -552,7 +555,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
552 &datsize, datalen, data, 0, 0); 555 &datsize, datalen, data, 0, 0);
553 } 556 }
554 if (ret < 0) 557 if (ret < 0)
555 return ret; 558 goto out;
556 559
557 /* build and send the TPM request packet */ 560 /* build and send the TPM request packet */
558 INIT_BUF(tb); 561 INIT_BUF(tb);
@@ -572,7 +575,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
572 575
573 ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE); 576 ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE);
574 if (ret < 0) 577 if (ret < 0)
575 return ret; 578 goto out;
576 579
577 /* calculate the size of the returned Blob */ 580 /* calculate the size of the returned Blob */
578 sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t)); 581 sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t));
@@ -591,6 +594,8 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
591 memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize); 594 memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
592 *bloblen = storedsize; 595 *bloblen = storedsize;
593 } 596 }
597out:
598 kfree(td);
594 return ret; 599 return ret;
595} 600}
596 601
@@ -1027,6 +1032,7 @@ static int trusted_update(struct key *key, const void *data, size_t datalen)
1027 ret = datablob_parse(datablob, new_p, new_o); 1032 ret = datablob_parse(datablob, new_p, new_o);
1028 if (ret != Opt_update) { 1033 if (ret != Opt_update) {
1029 ret = -EINVAL; 1034 ret = -EINVAL;
1035 kfree(new_p);
1030 goto out; 1036 goto out;
1031 } 1037 }
1032 /* copy old key values, and reseal with new pcrs */ 1038 /* copy old key values, and reseal with new pcrs */
@@ -1070,8 +1076,7 @@ static long trusted_read(const struct key *key, char __user *buffer,
1070 char *bufp; 1076 char *bufp;
1071 int i; 1077 int i;
1072 1078
1073 p = rcu_dereference_protected(key->payload.data, 1079 p = rcu_dereference_key(key);
1074 rwsem_is_locked(&((struct key *)key)->sem));
1075 if (!p) 1080 if (!p)
1076 return -EINVAL; 1081 return -EINVAL;
1077 if (!buffer || buflen <= 0) 1082 if (!buffer || buflen <= 0)
diff --git a/security/keys/trusted_defined.h b/security/keys/trusted.h
index 3249fbd2b653..3249fbd2b653 100644
--- a/security/keys/trusted_defined.h
+++ b/security/keys/trusted.h
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index e9aa07929656..c6ca8662a468 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -35,7 +35,6 @@ struct key_type key_type_user = {
35 35
36EXPORT_SYMBOL_GPL(key_type_user); 36EXPORT_SYMBOL_GPL(key_type_user);
37 37
38/*****************************************************************************/
39/* 38/*
40 * instantiate a user defined key 39 * instantiate a user defined key
41 */ 40 */
@@ -65,12 +64,10 @@ int user_instantiate(struct key *key, const void *data, size_t datalen)
65 64
66error: 65error:
67 return ret; 66 return ret;
68 67}
69} /* end user_instantiate() */
70 68
71EXPORT_SYMBOL_GPL(user_instantiate); 69EXPORT_SYMBOL_GPL(user_instantiate);
72 70
73/*****************************************************************************/
74/* 71/*
75 * dispose of the old data from an updated user defined key 72 * dispose of the old data from an updated user defined key
76 */ 73 */
@@ -81,10 +78,8 @@ static void user_update_rcu_disposal(struct rcu_head *rcu)
81 upayload = container_of(rcu, struct user_key_payload, rcu); 78 upayload = container_of(rcu, struct user_key_payload, rcu);
82 79
83 kfree(upayload); 80 kfree(upayload);
81}
84 82
85} /* end user_update_rcu_disposal() */
86
87/*****************************************************************************/
88/* 83/*
89 * update a user defined key 84 * update a user defined key
90 * - the key's semaphore is write-locked 85 * - the key's semaphore is write-locked
@@ -123,24 +118,20 @@ int user_update(struct key *key, const void *data, size_t datalen)
123 118
124error: 119error:
125 return ret; 120 return ret;
126 121}
127} /* end user_update() */
128 122
129EXPORT_SYMBOL_GPL(user_update); 123EXPORT_SYMBOL_GPL(user_update);
130 124
131/*****************************************************************************/
132/* 125/*
133 * match users on their name 126 * match users on their name
134 */ 127 */
135int user_match(const struct key *key, const void *description) 128int user_match(const struct key *key, const void *description)
136{ 129{
137 return strcmp(key->description, description) == 0; 130 return strcmp(key->description, description) == 0;
138 131}
139} /* end user_match() */
140 132
141EXPORT_SYMBOL_GPL(user_match); 133EXPORT_SYMBOL_GPL(user_match);
142 134
143/*****************************************************************************/
144/* 135/*
145 * dispose of the links from a revoked keyring 136 * dispose of the links from a revoked keyring
146 * - called with the key sem write-locked 137 * - called with the key sem write-locked
@@ -156,12 +147,10 @@ void user_revoke(struct key *key)
156 rcu_assign_pointer(key->payload.data, NULL); 147 rcu_assign_pointer(key->payload.data, NULL);
157 call_rcu(&upayload->rcu, user_update_rcu_disposal); 148 call_rcu(&upayload->rcu, user_update_rcu_disposal);
158 } 149 }
159 150}
160} /* end user_revoke() */
161 151
162EXPORT_SYMBOL(user_revoke); 152EXPORT_SYMBOL(user_revoke);
163 153
164/*****************************************************************************/
165/* 154/*
166 * dispose of the data dangling from the corpse of a user key 155 * dispose of the data dangling from the corpse of a user key
167 */ 156 */
@@ -170,12 +159,10 @@ void user_destroy(struct key *key)
170 struct user_key_payload *upayload = key->payload.data; 159 struct user_key_payload *upayload = key->payload.data;
171 160
172 kfree(upayload); 161 kfree(upayload);
173 162}
174} /* end user_destroy() */
175 163
176EXPORT_SYMBOL_GPL(user_destroy); 164EXPORT_SYMBOL_GPL(user_destroy);
177 165
178/*****************************************************************************/
179/* 166/*
180 * describe the user key 167 * describe the user key
181 */ 168 */
@@ -184,12 +171,10 @@ void user_describe(const struct key *key, struct seq_file *m)
184 seq_puts(m, key->description); 171 seq_puts(m, key->description);
185 172
186 seq_printf(m, ": %u", key->datalen); 173 seq_printf(m, ": %u", key->datalen);
187 174}
188} /* end user_describe() */
189 175
190EXPORT_SYMBOL_GPL(user_describe); 176EXPORT_SYMBOL_GPL(user_describe);
191 177
192/*****************************************************************************/
193/* 178/*
194 * read the key data 179 * read the key data
195 * - the key's semaphore is read-locked 180 * - the key's semaphore is read-locked
@@ -199,8 +184,7 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
199 struct user_key_payload *upayload; 184 struct user_key_payload *upayload;
200 long ret; 185 long ret;
201 186
202 upayload = rcu_dereference_protected( 187 upayload = rcu_dereference_key(key);
203 key->payload.data, rwsem_is_locked(&((struct key *)key)->sem));
204 ret = upayload->datalen; 188 ret = upayload->datalen;
205 189
206 /* we can return the data as is */ 190 /* we can return the data as is */
@@ -213,7 +197,6 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
213 } 197 }
214 198
215 return ret; 199 return ret;
216 200}
217} /* end user_read() */
218 201
219EXPORT_SYMBOL_GPL(user_read); 202EXPORT_SYMBOL_GPL(user_read);
diff --git a/security/security.c b/security/security.c
index b84a89dd59c6..47b8a447118f 100644
--- a/security/security.c
+++ b/security/security.c
@@ -154,10 +154,9 @@ int security_capset(struct cred *new, const struct cred *old,
154 effective, inheritable, permitted); 154 effective, inheritable, permitted);
155} 155}
156 156
157int security_capable(int cap) 157int security_capable(const struct cred *cred, int cap)
158{ 158{
159 return security_ops->capable(current, current_cred(), cap, 159 return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
160 SECURITY_CAP_AUDIT);
161} 160}
162 161
163int security_real_capable(struct task_struct *tsk, int cap) 162int security_real_capable(struct task_struct *tsk, int cap)
@@ -182,11 +181,6 @@ int security_real_capable_noaudit(struct task_struct *tsk, int cap)
182 return ret; 181 return ret;
183} 182}
184 183
185int security_sysctl(struct ctl_table *table, int op)
186{
187 return security_ops->sysctl(table, op);
188}
189
190int security_quotactl(int cmds, int type, int id, struct super_block *sb) 184int security_quotactl(int cmds, int type, int id, struct super_block *sb)
191{ 185{
192 return security_ops->quotactl(cmds, type, id, sb); 186 return security_ops->quotactl(cmds, type, id, sb);
@@ -272,6 +266,11 @@ int security_sb_copy_data(char *orig, char *copy)
272} 266}
273EXPORT_SYMBOL(security_sb_copy_data); 267EXPORT_SYMBOL(security_sb_copy_data);
274 268
269int security_sb_remount(struct super_block *sb, void *data)
270{
271 return security_ops->sb_remount(sb, data);
272}
273
275int security_sb_kern_mount(struct super_block *sb, int flags, void *data) 274int security_sb_kern_mount(struct super_block *sb, int flags, void *data)
276{ 275{
277 return security_ops->sb_kern_mount(sb, flags, data); 276 return security_ops->sb_kern_mount(sb, flags, data);
@@ -336,11 +335,13 @@ void security_inode_free(struct inode *inode)
336} 335}
337 336
338int security_inode_init_security(struct inode *inode, struct inode *dir, 337int security_inode_init_security(struct inode *inode, struct inode *dir,
339 char **name, void **value, size_t *len) 338 const struct qstr *qstr, char **name,
339 void **value, size_t *len)
340{ 340{
341 if (unlikely(IS_PRIVATE(inode))) 341 if (unlikely(IS_PRIVATE(inode)))
342 return -EOPNOTSUPP; 342 return -EOPNOTSUPP;
343 return security_ops->inode_init_security(inode, dir, name, value, len); 343 return security_ops->inode_init_security(inode, dir, qstr, name, value,
344 len);
344} 345}
345EXPORT_SYMBOL(security_inode_init_security); 346EXPORT_SYMBOL(security_inode_init_security);
346 347
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e276eb468536..d52a92507412 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -24,9 +24,11 @@
24 */ 24 */
25 25
26#include <linux/init.h> 26#include <linux/init.h>
27#include <linux/kd.h>
27#include <linux/kernel.h> 28#include <linux/kernel.h>
28#include <linux/tracehook.h> 29#include <linux/tracehook.h>
29#include <linux/errno.h> 30#include <linux/errno.h>
31#include <linux/ext2_fs.h>
30#include <linux/sched.h> 32#include <linux/sched.h>
31#include <linux/security.h> 33#include <linux/security.h>
32#include <linux/xattr.h> 34#include <linux/xattr.h>
@@ -36,14 +38,15 @@
36#include <linux/mman.h> 38#include <linux/mman.h>
37#include <linux/slab.h> 39#include <linux/slab.h>
38#include <linux/pagemap.h> 40#include <linux/pagemap.h>
41#include <linux/proc_fs.h>
39#include <linux/swap.h> 42#include <linux/swap.h>
40#include <linux/spinlock.h> 43#include <linux/spinlock.h>
41#include <linux/syscalls.h> 44#include <linux/syscalls.h>
45#include <linux/dcache.h>
42#include <linux/file.h> 46#include <linux/file.h>
43#include <linux/fdtable.h> 47#include <linux/fdtable.h>
44#include <linux/namei.h> 48#include <linux/namei.h>
45#include <linux/mount.h> 49#include <linux/mount.h>
46#include <linux/proc_fs.h>
47#include <linux/netfilter_ipv4.h> 50#include <linux/netfilter_ipv4.h>
48#include <linux/netfilter_ipv6.h> 51#include <linux/netfilter_ipv6.h>
49#include <linux/tty.h> 52#include <linux/tty.h>
@@ -70,7 +73,6 @@
70#include <net/ipv6.h> 73#include <net/ipv6.h>
71#include <linux/hugetlb.h> 74#include <linux/hugetlb.h>
72#include <linux/personality.h> 75#include <linux/personality.h>
73#include <linux/sysctl.h>
74#include <linux/audit.h> 76#include <linux/audit.h>
75#include <linux/string.h> 77#include <linux/string.h>
76#include <linux/selinux.h> 78#include <linux/selinux.h>
@@ -1120,39 +1122,35 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
1120} 1122}
1121 1123
1122#ifdef CONFIG_PROC_FS 1124#ifdef CONFIG_PROC_FS
1123static int selinux_proc_get_sid(struct proc_dir_entry *de, 1125static int selinux_proc_get_sid(struct dentry *dentry,
1124 u16 tclass, 1126 u16 tclass,
1125 u32 *sid) 1127 u32 *sid)
1126{ 1128{
1127 int buflen, rc; 1129 int rc;
1128 char *buffer, *path, *end; 1130 char *buffer, *path;
1129 1131
1130 buffer = (char *)__get_free_page(GFP_KERNEL); 1132 buffer = (char *)__get_free_page(GFP_KERNEL);
1131 if (!buffer) 1133 if (!buffer)
1132 return -ENOMEM; 1134 return -ENOMEM;
1133 1135
1134 buflen = PAGE_SIZE; 1136 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1135 end = buffer+buflen; 1137 if (IS_ERR(path))
1136 *--end = '\0'; 1138 rc = PTR_ERR(path);
1137 buflen--; 1139 else {
1138 path = end-1; 1140 /* each process gets a /proc/PID/ entry. Strip off the
1139 *path = '/'; 1141 * PID part to get a valid selinux labeling.
1140 while (de && de != de->parent) { 1142 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1141 buflen -= de->namelen + 1; 1143 while (path[1] >= '0' && path[1] <= '9') {
1142 if (buflen < 0) 1144 path[1] = '/';
1143 break; 1145 path++;
1144 end -= de->namelen; 1146 }
1145 memcpy(end, de->name, de->namelen); 1147 rc = security_genfs_sid("proc", path, tclass, sid);
1146 *--end = '/';
1147 path = end;
1148 de = de->parent;
1149 } 1148 }
1150 rc = security_genfs_sid("proc", path, tclass, sid);
1151 free_page((unsigned long)buffer); 1149 free_page((unsigned long)buffer);
1152 return rc; 1150 return rc;
1153} 1151}
1154#else 1152#else
1155static int selinux_proc_get_sid(struct proc_dir_entry *de, 1153static int selinux_proc_get_sid(struct dentry *dentry,
1156 u16 tclass, 1154 u16 tclass,
1157 u32 *sid) 1155 u32 *sid)
1158{ 1156{
@@ -1300,10 +1298,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
1300 1298
1301 /* Try to obtain a transition SID. */ 1299 /* Try to obtain a transition SID. */
1302 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1300 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1303 rc = security_transition_sid(isec->task_sid, 1301 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1304 sbsec->sid, 1302 isec->sclass, NULL, &sid);
1305 isec->sclass,
1306 &sid);
1307 if (rc) 1303 if (rc)
1308 goto out_unlock; 1304 goto out_unlock;
1309 isec->sid = sid; 1305 isec->sid = sid;
@@ -1316,10 +1312,9 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
1316 isec->sid = sbsec->sid; 1312 isec->sid = sbsec->sid;
1317 1313
1318 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) { 1314 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1319 struct proc_inode *proci = PROC_I(inode); 1315 if (opt_dentry) {
1320 if (proci->pde) {
1321 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1316 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1322 rc = selinux_proc_get_sid(proci->pde, 1317 rc = selinux_proc_get_sid(opt_dentry,
1323 isec->sclass, 1318 isec->sclass,
1324 &sid); 1319 &sid);
1325 if (rc) 1320 if (rc)
@@ -1578,7 +1573,7 @@ static int may_create(struct inode *dir,
1578 return rc; 1573 return rc;
1579 1574
1580 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) { 1575 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1581 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid); 1576 rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
1582 if (rc) 1577 if (rc)
1583 return rc; 1578 return rc;
1584 } 1579 }
@@ -1862,82 +1857,6 @@ static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1862 return task_has_capability(tsk, cred, cap, audit); 1857 return task_has_capability(tsk, cred, cap, audit);
1863} 1858}
1864 1859
1865static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1866{
1867 int buflen, rc;
1868 char *buffer, *path, *end;
1869
1870 rc = -ENOMEM;
1871 buffer = (char *)__get_free_page(GFP_KERNEL);
1872 if (!buffer)
1873 goto out;
1874
1875 buflen = PAGE_SIZE;
1876 end = buffer+buflen;
1877 *--end = '\0';
1878 buflen--;
1879 path = end-1;
1880 *path = '/';
1881 while (table) {
1882 const char *name = table->procname;
1883 size_t namelen = strlen(name);
1884 buflen -= namelen + 1;
1885 if (buflen < 0)
1886 goto out_free;
1887 end -= namelen;
1888 memcpy(end, name, namelen);
1889 *--end = '/';
1890 path = end;
1891 table = table->parent;
1892 }
1893 buflen -= 4;
1894 if (buflen < 0)
1895 goto out_free;
1896 end -= 4;
1897 memcpy(end, "/sys", 4);
1898 path = end;
1899 rc = security_genfs_sid("proc", path, tclass, sid);
1900out_free:
1901 free_page((unsigned long)buffer);
1902out:
1903 return rc;
1904}
1905
1906static int selinux_sysctl(ctl_table *table, int op)
1907{
1908 int error = 0;
1909 u32 av;
1910 u32 tsid, sid;
1911 int rc;
1912
1913 sid = current_sid();
1914
1915 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1916 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1917 if (rc) {
1918 /* Default to the well-defined sysctl SID. */
1919 tsid = SECINITSID_SYSCTL;
1920 }
1921
1922 /* The op values are "defined" in sysctl.c, thereby creating
1923 * a bad coupling between this module and sysctl.c */
1924 if (op == 001) {
1925 error = avc_has_perm(sid, tsid,
1926 SECCLASS_DIR, DIR__SEARCH, NULL);
1927 } else {
1928 av = 0;
1929 if (op & 004)
1930 av |= FILE__READ;
1931 if (op & 002)
1932 av |= FILE__WRITE;
1933 if (av)
1934 error = avc_has_perm(sid, tsid,
1935 SECCLASS_FILE, av, NULL);
1936 }
1937
1938 return error;
1939}
1940
1941static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb) 1860static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1942{ 1861{
1943 const struct cred *cred = current_cred(); 1862 const struct cred *cred = current_cred();
@@ -2060,7 +1979,8 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2060 } else { 1979 } else {
2061 /* Check for a default transition on this program. */ 1980 /* Check for a default transition on this program. */
2062 rc = security_transition_sid(old_tsec->sid, isec->sid, 1981 rc = security_transition_sid(old_tsec->sid, isec->sid,
2063 SECCLASS_PROCESS, &new_tsec->sid); 1982 SECCLASS_PROCESS, NULL,
1983 &new_tsec->sid);
2064 if (rc) 1984 if (rc)
2065 return rc; 1985 return rc;
2066 } 1986 }
@@ -2443,6 +2363,91 @@ out:
2443 return rc; 2363 return rc;
2444} 2364}
2445 2365
2366static int selinux_sb_remount(struct super_block *sb, void *data)
2367{
2368 int rc, i, *flags;
2369 struct security_mnt_opts opts;
2370 char *secdata, **mount_options;
2371 struct superblock_security_struct *sbsec = sb->s_security;
2372
2373 if (!(sbsec->flags & SE_SBINITIALIZED))
2374 return 0;
2375
2376 if (!data)
2377 return 0;
2378
2379 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2380 return 0;
2381
2382 security_init_mnt_opts(&opts);
2383 secdata = alloc_secdata();
2384 if (!secdata)
2385 return -ENOMEM;
2386 rc = selinux_sb_copy_data(data, secdata);
2387 if (rc)
2388 goto out_free_secdata;
2389
2390 rc = selinux_parse_opts_str(secdata, &opts);
2391 if (rc)
2392 goto out_free_secdata;
2393
2394 mount_options = opts.mnt_opts;
2395 flags = opts.mnt_opts_flags;
2396
2397 for (i = 0; i < opts.num_mnt_opts; i++) {
2398 u32 sid;
2399 size_t len;
2400
2401 if (flags[i] == SE_SBLABELSUPP)
2402 continue;
2403 len = strlen(mount_options[i]);
2404 rc = security_context_to_sid(mount_options[i], len, &sid);
2405 if (rc) {
2406 printk(KERN_WARNING "SELinux: security_context_to_sid"
2407 "(%s) failed for (dev %s, type %s) errno=%d\n",
2408 mount_options[i], sb->s_id, sb->s_type->name, rc);
2409 goto out_free_opts;
2410 }
2411 rc = -EINVAL;
2412 switch (flags[i]) {
2413 case FSCONTEXT_MNT:
2414 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2415 goto out_bad_option;
2416 break;
2417 case CONTEXT_MNT:
2418 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2419 goto out_bad_option;
2420 break;
2421 case ROOTCONTEXT_MNT: {
2422 struct inode_security_struct *root_isec;
2423 root_isec = sb->s_root->d_inode->i_security;
2424
2425 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2426 goto out_bad_option;
2427 break;
2428 }
2429 case DEFCONTEXT_MNT:
2430 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2431 goto out_bad_option;
2432 break;
2433 default:
2434 goto out_free_opts;
2435 }
2436 }
2437
2438 rc = 0;
2439out_free_opts:
2440 security_free_mnt_opts(&opts);
2441out_free_secdata:
2442 free_secdata(secdata);
2443 return rc;
2444out_bad_option:
2445 printk(KERN_WARNING "SELinux: unable to change security options "
2446 "during remount (dev %s, type=%s)\n", sb->s_id,
2447 sb->s_type->name);
2448 goto out_free_opts;
2449}
2450
2446static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data) 2451static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2447{ 2452{
2448 const struct cred *cred = current_cred(); 2453 const struct cred *cred = current_cred();
@@ -2509,8 +2514,8 @@ static void selinux_inode_free_security(struct inode *inode)
2509} 2514}
2510 2515
2511static int selinux_inode_init_security(struct inode *inode, struct inode *dir, 2516static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2512 char **name, void **value, 2517 const struct qstr *qstr, char **name,
2513 size_t *len) 2518 void **value, size_t *len)
2514{ 2519{
2515 const struct task_security_struct *tsec = current_security(); 2520 const struct task_security_struct *tsec = current_security();
2516 struct inode_security_struct *dsec; 2521 struct inode_security_struct *dsec;
@@ -2531,7 +2536,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2531 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) { 2536 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2532 rc = security_transition_sid(sid, dsec->sid, 2537 rc = security_transition_sid(sid, dsec->sid,
2533 inode_mode_to_security_class(inode->i_mode), 2538 inode_mode_to_security_class(inode->i_mode),
2534 &newsid); 2539 qstr, &newsid);
2535 if (rc) { 2540 if (rc) {
2536 printk(KERN_WARNING "%s: " 2541 printk(KERN_WARNING "%s: "
2537 "security_transition_sid failed, rc=%d (dev=%s " 2542 "security_transition_sid failed, rc=%d (dev=%s "
@@ -2932,16 +2937,47 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2932 unsigned long arg) 2937 unsigned long arg)
2933{ 2938{
2934 const struct cred *cred = current_cred(); 2939 const struct cred *cred = current_cred();
2935 u32 av = 0; 2940 int error = 0;
2936 2941
2937 if (_IOC_DIR(cmd) & _IOC_WRITE) 2942 switch (cmd) {
2938 av |= FILE__WRITE; 2943 case FIONREAD:
2939 if (_IOC_DIR(cmd) & _IOC_READ) 2944 /* fall through */
2940 av |= FILE__READ; 2945 case FIBMAP:
2941 if (!av) 2946 /* fall through */
2942 av = FILE__IOCTL; 2947 case FIGETBSZ:
2948 /* fall through */
2949 case EXT2_IOC_GETFLAGS:
2950 /* fall through */
2951 case EXT2_IOC_GETVERSION:
2952 error = file_has_perm(cred, file, FILE__GETATTR);
2953 break;
2954
2955 case EXT2_IOC_SETFLAGS:
2956 /* fall through */
2957 case EXT2_IOC_SETVERSION:
2958 error = file_has_perm(cred, file, FILE__SETATTR);
2959 break;
2960
2961 /* sys_ioctl() checks */
2962 case FIONBIO:
2963 /* fall through */
2964 case FIOASYNC:
2965 error = file_has_perm(cred, file, 0);
2966 break;
2967
2968 case KDSKBENT:
2969 case KDSKBSENT:
2970 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
2971 SECURITY_CAP_AUDIT);
2972 break;
2943 2973
2944 return file_has_perm(cred, file, av); 2974 /* default case assumes that the command will go
2975 * to the file's ioctl() function.
2976 */
2977 default:
2978 error = file_has_perm(cred, file, FILE__IOCTL);
2979 }
2980 return error;
2945} 2981}
2946 2982
2947static int default_noexec; 2983static int default_noexec;
@@ -3198,7 +3234,11 @@ static void selinux_cred_free(struct cred *cred)
3198{ 3234{
3199 struct task_security_struct *tsec = cred->security; 3235 struct task_security_struct *tsec = cred->security;
3200 3236
3201 BUG_ON((unsigned long) cred->security < PAGE_SIZE); 3237 /*
3238 * cred->security == NULL if security_cred_alloc_blank() or
3239 * security_prepare_creds() returned an error.
3240 */
3241 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3202 cred->security = (void *) 0x7UL; 3242 cred->security = (void *) 0x7UL;
3203 kfree(tsec); 3243 kfree(tsec);
3204} 3244}
@@ -3640,9 +3680,16 @@ static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3640 3680
3641/* socket security operations */ 3681/* socket security operations */
3642 3682
3643static u32 socket_sockcreate_sid(const struct task_security_struct *tsec) 3683static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3684 u16 secclass, u32 *socksid)
3644{ 3685{
3645 return tsec->sockcreate_sid ? : tsec->sid; 3686 if (tsec->sockcreate_sid > SECSID_NULL) {
3687 *socksid = tsec->sockcreate_sid;
3688 return 0;
3689 }
3690
3691 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3692 socksid);
3646} 3693}
3647 3694
3648static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms) 3695static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
@@ -3666,12 +3713,16 @@ static int selinux_socket_create(int family, int type,
3666 const struct task_security_struct *tsec = current_security(); 3713 const struct task_security_struct *tsec = current_security();
3667 u32 newsid; 3714 u32 newsid;
3668 u16 secclass; 3715 u16 secclass;
3716 int rc;
3669 3717
3670 if (kern) 3718 if (kern)
3671 return 0; 3719 return 0;
3672 3720
3673 newsid = socket_sockcreate_sid(tsec);
3674 secclass = socket_type_to_security_class(family, type, protocol); 3721 secclass = socket_type_to_security_class(family, type, protocol);
3722 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3723 if (rc)
3724 return rc;
3725
3675 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL); 3726 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3676} 3727}
3677 3728
@@ -3683,12 +3734,16 @@ static int selinux_socket_post_create(struct socket *sock, int family,
3683 struct sk_security_struct *sksec; 3734 struct sk_security_struct *sksec;
3684 int err = 0; 3735 int err = 0;
3685 3736
3737 isec->sclass = socket_type_to_security_class(family, type, protocol);
3738
3686 if (kern) 3739 if (kern)
3687 isec->sid = SECINITSID_KERNEL; 3740 isec->sid = SECINITSID_KERNEL;
3688 else 3741 else {
3689 isec->sid = socket_sockcreate_sid(tsec); 3742 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3743 if (err)
3744 return err;
3745 }
3690 3746
3691 isec->sclass = socket_type_to_security_class(family, type, protocol);
3692 isec->initialized = 1; 3747 isec->initialized = 1;
3693 3748
3694 if (sock->sk) { 3749 if (sock->sk) {
@@ -3998,7 +4053,6 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3998{ 4053{
3999 int err = 0; 4054 int err = 0;
4000 struct sk_security_struct *sksec = sk->sk_security; 4055 struct sk_security_struct *sksec = sk->sk_security;
4001 u32 peer_sid;
4002 u32 sk_sid = sksec->sid; 4056 u32 sk_sid = sksec->sid;
4003 struct common_audit_data ad; 4057 struct common_audit_data ad;
4004 char *addrp; 4058 char *addrp;
@@ -4017,20 +4071,10 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4017 return err; 4071 return err;
4018 } 4072 }
4019 4073
4020 if (selinux_policycap_netpeer) { 4074 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4021 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid); 4075 if (err)
4022 if (err) 4076 return err;
4023 return err; 4077 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4024 err = avc_has_perm(sk_sid, peer_sid,
4025 SECCLASS_PEER, PEER__RECV, &ad);
4026 if (err)
4027 selinux_netlbl_err(skb, err, 0);
4028 } else {
4029 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4030 if (err)
4031 return err;
4032 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4033 }
4034 4078
4035 return err; 4079 return err;
4036} 4080}
@@ -4525,9 +4569,8 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4525 SECCLASS_PACKET, PACKET__SEND, &ad)) 4569 SECCLASS_PACKET, PACKET__SEND, &ad))
4526 return NF_DROP_ERR(-ECONNREFUSED); 4570 return NF_DROP_ERR(-ECONNREFUSED);
4527 4571
4528 if (selinux_policycap_netpeer) 4572 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4529 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) 4573 return NF_DROP_ERR(-ECONNREFUSED);
4530 return NF_DROP_ERR(-ECONNREFUSED);
4531 4574
4532 return NF_ACCEPT; 4575 return NF_ACCEPT;
4533} 4576}
@@ -4570,27 +4613,14 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4570 * from the sending socket, otherwise use the kernel's sid */ 4613 * from the sending socket, otherwise use the kernel's sid */
4571 sk = skb->sk; 4614 sk = skb->sk;
4572 if (sk == NULL) { 4615 if (sk == NULL) {
4573 switch (family) { 4616 if (skb->skb_iif) {
4574 case PF_INET: 4617 secmark_perm = PACKET__FORWARD_OUT;
4575 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4576 secmark_perm = PACKET__FORWARD_OUT;
4577 else
4578 secmark_perm = PACKET__SEND;
4579 break;
4580 case PF_INET6:
4581 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4582 secmark_perm = PACKET__FORWARD_OUT;
4583 else
4584 secmark_perm = PACKET__SEND;
4585 break;
4586 default:
4587 return NF_DROP_ERR(-ECONNREFUSED);
4588 }
4589 if (secmark_perm == PACKET__FORWARD_OUT) {
4590 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) 4618 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4591 return NF_DROP; 4619 return NF_DROP;
4592 } else 4620 } else {
4621 secmark_perm = PACKET__SEND;
4593 peer_sid = SECINITSID_KERNEL; 4622 peer_sid = SECINITSID_KERNEL;
4623 }
4594 } else { 4624 } else {
4595 struct sk_security_struct *sksec = sk->sk_security; 4625 struct sk_security_struct *sksec = sk->sk_security;
4596 peer_sid = sksec->sid; 4626 peer_sid = sksec->sid;
@@ -4844,7 +4874,7 @@ static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
4844 * message queue this message will be stored in 4874 * message queue this message will be stored in
4845 */ 4875 */
4846 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG, 4876 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4847 &msec->sid); 4877 NULL, &msec->sid);
4848 if (rc) 4878 if (rc)
4849 return rc; 4879 return rc;
4850 } 4880 }
@@ -5398,7 +5428,6 @@ static struct security_operations selinux_ops = {
5398 .ptrace_traceme = selinux_ptrace_traceme, 5428 .ptrace_traceme = selinux_ptrace_traceme,
5399 .capget = selinux_capget, 5429 .capget = selinux_capget,
5400 .capset = selinux_capset, 5430 .capset = selinux_capset,
5401 .sysctl = selinux_sysctl,
5402 .capable = selinux_capable, 5431 .capable = selinux_capable,
5403 .quotactl = selinux_quotactl, 5432 .quotactl = selinux_quotactl,
5404 .quota_on = selinux_quota_on, 5433 .quota_on = selinux_quota_on,
@@ -5416,6 +5445,7 @@ static struct security_operations selinux_ops = {
5416 .sb_alloc_security = selinux_sb_alloc_security, 5445 .sb_alloc_security = selinux_sb_alloc_security,
5417 .sb_free_security = selinux_sb_free_security, 5446 .sb_free_security = selinux_sb_free_security,
5418 .sb_copy_data = selinux_sb_copy_data, 5447 .sb_copy_data = selinux_sb_copy_data,
5448 .sb_remount = selinux_sb_remount,
5419 .sb_kern_mount = selinux_sb_kern_mount, 5449 .sb_kern_mount = selinux_sb_kern_mount,
5420 .sb_show_options = selinux_sb_show_options, 5450 .sb_show_options = selinux_sb_show_options,
5421 .sb_statfs = selinux_sb_statfs, 5451 .sb_statfs = selinux_sb_statfs,
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index e94e82f73818..5615081b73ec 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -15,7 +15,6 @@
15#include <linux/audit.h> 15#include <linux/audit.h>
16#include <linux/lsm_audit.h> 16#include <linux/lsm_audit.h>
17#include <linux/in6.h> 17#include <linux/in6.h>
18#include <linux/path.h>
19#include <asm/system.h> 18#include <asm/system.h>
20#include "flask.h" 19#include "flask.h"
21#include "av_permissions.h" 20#include "av_permissions.h"
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 7ed3663332ec..b8c53723e09b 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -12,6 +12,10 @@
12#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \ 12#define COMMON_IPC_PERMS "create", "destroy", "getattr", "setattr", "read", \
13 "write", "associate", "unix_read", "unix_write" 13 "write", "associate", "unix_read", "unix_write"
14 14
15/*
16 * Note: The name for any socket class should be suffixed by "socket",
17 * and doesn't contain more than one substr of "socket".
18 */
15struct security_class_mapping secclass_map[] = { 19struct security_class_mapping secclass_map[] = {
16 { "security", 20 { "security",
17 { "compute_av", "compute_create", "compute_member", 21 { "compute_av", "compute_create", "compute_member",
@@ -132,8 +136,7 @@ struct security_class_mapping secclass_map[] = {
132 { "appletalk_socket", 136 { "appletalk_socket",
133 { COMMON_SOCK_PERMS, NULL } }, 137 { COMMON_SOCK_PERMS, NULL } },
134 { "packet", 138 { "packet",
135 { "send", "recv", "relabelto", "flow_in", "flow_out", 139 { "send", "recv", "relabelto", "forward_in", "forward_out", NULL } },
136 "forward_in", "forward_out", NULL } },
137 { "key", 140 { "key",
138 { "view", "read", "write", "search", "link", "setattr", "create", 141 { "view", "read", "write", "search", "link", "setattr", "create",
139 NULL } }, 142 NULL } },
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index 671273eb1115..348eb00cb668 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -8,6 +8,7 @@
8#ifndef _SELINUX_SECURITY_H_ 8#ifndef _SELINUX_SECURITY_H_
9#define _SELINUX_SECURITY_H_ 9#define _SELINUX_SECURITY_H_
10 10
11#include <linux/dcache.h>
11#include <linux/magic.h> 12#include <linux/magic.h>
12#include <linux/types.h> 13#include <linux/types.h>
13#include "flask.h" 14#include "flask.h"
@@ -28,13 +29,14 @@
28#define POLICYDB_VERSION_POLCAP 22 29#define POLICYDB_VERSION_POLCAP 22
29#define POLICYDB_VERSION_PERMISSIVE 23 30#define POLICYDB_VERSION_PERMISSIVE 23
30#define POLICYDB_VERSION_BOUNDARY 24 31#define POLICYDB_VERSION_BOUNDARY 24
32#define POLICYDB_VERSION_FILENAME_TRANS 25
31 33
32/* Range of policy versions we understand*/ 34/* Range of policy versions we understand*/
33#define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE 35#define POLICYDB_VERSION_MIN POLICYDB_VERSION_BASE
34#ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX 36#ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
35#define POLICYDB_VERSION_MAX CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE 37#define POLICYDB_VERSION_MAX CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE
36#else 38#else
37#define POLICYDB_VERSION_MAX POLICYDB_VERSION_BOUNDARY 39#define POLICYDB_VERSION_MAX POLICYDB_VERSION_FILENAME_TRANS
38#endif 40#endif
39 41
40/* Mask for just the mount related flags */ 42/* Mask for just the mount related flags */
@@ -106,8 +108,8 @@ void security_compute_av(u32 ssid, u32 tsid,
106void security_compute_av_user(u32 ssid, u32 tsid, 108void security_compute_av_user(u32 ssid, u32 tsid,
107 u16 tclass, struct av_decision *avd); 109 u16 tclass, struct av_decision *avd);
108 110
109int security_transition_sid(u32 ssid, u32 tsid, 111int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
110 u16 tclass, u32 *out_sid); 112 const struct qstr *qstr, u32 *out_sid);
111 113
112int security_transition_sid_user(u32 ssid, u32 tsid, 114int security_transition_sid_user(u32 ssid, u32 tsid,
113 u16 tclass, u32 *out_sid); 115 u16 tclass, u32 *out_sid);
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index 3417f9cc1cbd..63ce2f9e441d 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -14,7 +14,7 @@
14 * 14 *
15 * Copyright (C) 2003 Tresys Technology, LLC 15 * Copyright (C) 2003 Tresys Technology, LLC
16 * This program is free software; you can redistribute it and/or modify 16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by 17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation, version 2. 18 * the Free Software Foundation, version 2.
19 * 19 *
20 * Updated: Yuichi Nakamura <ynakam@hitachisoft.jp> 20 * Updated: Yuichi Nakamura <ynakam@hitachisoft.jp>
@@ -27,16 +27,16 @@ struct avtab_key {
27 u16 source_type; /* source type */ 27 u16 source_type; /* source type */
28 u16 target_type; /* target type */ 28 u16 target_type; /* target type */
29 u16 target_class; /* target object class */ 29 u16 target_class; /* target object class */
30#define AVTAB_ALLOWED 1 30#define AVTAB_ALLOWED 0x0001
31#define AVTAB_AUDITALLOW 2 31#define AVTAB_AUDITALLOW 0x0002
32#define AVTAB_AUDITDENY 4 32#define AVTAB_AUDITDENY 0x0004
33#define AVTAB_AV (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY) 33#define AVTAB_AV (AVTAB_ALLOWED | AVTAB_AUDITALLOW | AVTAB_AUDITDENY)
34#define AVTAB_TRANSITION 16 34#define AVTAB_TRANSITION 0x0010
35#define AVTAB_MEMBER 32 35#define AVTAB_MEMBER 0x0020
36#define AVTAB_CHANGE 64 36#define AVTAB_CHANGE 0x0040
37#define AVTAB_TYPE (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE) 37#define AVTAB_TYPE (AVTAB_TRANSITION | AVTAB_MEMBER | AVTAB_CHANGE)
38#define AVTAB_ENABLED_OLD 0x80000000 /* reserved for used in cond_avtab */ 38#define AVTAB_ENABLED_OLD 0x80000000 /* reserved for used in cond_avtab */
39#define AVTAB_ENABLED 0x8000 /* reserved for used in cond_avtab */ 39#define AVTAB_ENABLED 0x8000 /* reserved for used in cond_avtab */
40 u16 specified; /* what field is specified */ 40 u16 specified; /* what field is specified */
41}; 41};
42 42
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index c3f845cbcd48..a53373207fb4 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -178,7 +178,7 @@ int cond_init_bool_indexes(struct policydb *p)
178 p->bool_val_to_struct = (struct cond_bool_datum **) 178 p->bool_val_to_struct = (struct cond_bool_datum **)
179 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL); 179 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
180 if (!p->bool_val_to_struct) 180 if (!p->bool_val_to_struct)
181 return -1; 181 return -ENOMEM;
182 return 0; 182 return 0;
183} 183}
184 184
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index 1ef8e4e89880..e96174216bc9 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -512,7 +512,8 @@ int mls_compute_sid(struct context *scontext,
512 struct context *tcontext, 512 struct context *tcontext,
513 u16 tclass, 513 u16 tclass,
514 u32 specified, 514 u32 specified,
515 struct context *newcontext) 515 struct context *newcontext,
516 bool sock)
516{ 517{
517 struct range_trans rtr; 518 struct range_trans rtr;
518 struct mls_range *r; 519 struct mls_range *r;
@@ -531,7 +532,7 @@ int mls_compute_sid(struct context *scontext,
531 return mls_range_set(newcontext, r); 532 return mls_range_set(newcontext, r);
532 /* Fallthrough */ 533 /* Fallthrough */
533 case AVTAB_CHANGE: 534 case AVTAB_CHANGE:
534 if (tclass == policydb.process_class) 535 if ((tclass == policydb.process_class) || (sock == true))
535 /* Use the process MLS attributes. */ 536 /* Use the process MLS attributes. */
536 return mls_context_cpy(newcontext, scontext); 537 return mls_context_cpy(newcontext, scontext);
537 else 538 else
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index cd9152632e54..037bf9d82d41 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -49,7 +49,8 @@ int mls_compute_sid(struct context *scontext,
49 struct context *tcontext, 49 struct context *tcontext,
50 u16 tclass, 50 u16 tclass,
51 u32 specified, 51 u32 specified,
52 struct context *newcontext); 52 struct context *newcontext,
53 bool sock);
53 54
54int mls_setup_user_range(struct context *fromcon, struct user_datum *user, 55int mls_setup_user_range(struct context *fromcon, struct user_datum *user,
55 struct context *usercon); 56 struct context *usercon);
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index be9de3872837..e7b850ad57ee 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -123,6 +123,11 @@ static struct policydb_compat_info policydb_compat[] = {
123 .sym_num = SYM_NUM, 123 .sym_num = SYM_NUM,
124 .ocon_num = OCON_NUM, 124 .ocon_num = OCON_NUM,
125 }, 125 },
126 {
127 .version = POLICYDB_VERSION_FILENAME_TRANS,
128 .sym_num = SYM_NUM,
129 .ocon_num = OCON_NUM,
130 },
126}; 131};
127 132
128static struct policydb_compat_info *policydb_lookup_compat(int version) 133static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -501,8 +506,8 @@ static int policydb_index(struct policydb *p)
501 if (rc) 506 if (rc)
502 goto out; 507 goto out;
503 508
504 rc = -ENOMEM; 509 rc = cond_init_bool_indexes(p);
505 if (cond_init_bool_indexes(p)) 510 if (rc)
506 goto out; 511 goto out;
507 512
508 for (i = 0; i < SYM_NUM; i++) { 513 for (i = 0; i < SYM_NUM; i++) {
@@ -704,6 +709,7 @@ void policydb_destroy(struct policydb *p)
704 int i; 709 int i;
705 struct role_allow *ra, *lra = NULL; 710 struct role_allow *ra, *lra = NULL;
706 struct role_trans *tr, *ltr = NULL; 711 struct role_trans *tr, *ltr = NULL;
712 struct filename_trans *ft, *nft;
707 713
708 for (i = 0; i < SYM_NUM; i++) { 714 for (i = 0; i < SYM_NUM; i++) {
709 cond_resched(); 715 cond_resched();
@@ -781,6 +787,15 @@ void policydb_destroy(struct policydb *p)
781 } 787 }
782 flex_array_free(p->type_attr_map_array); 788 flex_array_free(p->type_attr_map_array);
783 } 789 }
790
791 ft = p->filename_trans;
792 while (ft) {
793 nft = ft->next;
794 kfree(ft->name);
795 kfree(ft);
796 ft = nft;
797 }
798
784 ebitmap_destroy(&p->policycaps); 799 ebitmap_destroy(&p->policycaps);
785 ebitmap_destroy(&p->permissive_map); 800 ebitmap_destroy(&p->permissive_map);
786 801
@@ -1788,6 +1803,76 @@ out:
1788 return rc; 1803 return rc;
1789} 1804}
1790 1805
1806static int filename_trans_read(struct policydb *p, void *fp)
1807{
1808 struct filename_trans *ft, *last;
1809 u32 nel, len;
1810 char *name;
1811 __le32 buf[4];
1812 int rc, i;
1813
1814 if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
1815 return 0;
1816
1817 rc = next_entry(buf, fp, sizeof(u32));
1818 if (rc)
1819 goto out;
1820 nel = le32_to_cpu(buf[0]);
1821
1822 printk(KERN_ERR "%s: nel=%d\n", __func__, nel);
1823
1824 last = p->filename_trans;
1825 while (last && last->next)
1826 last = last->next;
1827
1828 for (i = 0; i < nel; i++) {
1829 rc = -ENOMEM;
1830 ft = kzalloc(sizeof(*ft), GFP_KERNEL);
1831 if (!ft)
1832 goto out;
1833
1834 /* add it to the tail of the list */
1835 if (!last)
1836 p->filename_trans = ft;
1837 else
1838 last->next = ft;
1839 last = ft;
1840
1841 /* length of the path component string */
1842 rc = next_entry(buf, fp, sizeof(u32));
1843 if (rc)
1844 goto out;
1845 len = le32_to_cpu(buf[0]);
1846
1847 rc = -ENOMEM;
1848 name = kmalloc(len + 1, GFP_KERNEL);
1849 if (!name)
1850 goto out;
1851
1852 ft->name = name;
1853
1854 /* path component string */
1855 rc = next_entry(name, fp, len);
1856 if (rc)
1857 goto out;
1858 name[len] = 0;
1859
1860 printk(KERN_ERR "%s: ft=%p ft->name=%p ft->name=%s\n", __func__, ft, ft->name, ft->name);
1861
1862 rc = next_entry(buf, fp, sizeof(u32) * 4);
1863 if (rc)
1864 goto out;
1865
1866 ft->stype = le32_to_cpu(buf[0]);
1867 ft->ttype = le32_to_cpu(buf[1]);
1868 ft->tclass = le32_to_cpu(buf[2]);
1869 ft->otype = le32_to_cpu(buf[3]);
1870 }
1871 rc = 0;
1872out:
1873 return rc;
1874}
1875
1791static int genfs_read(struct policydb *p, void *fp) 1876static int genfs_read(struct policydb *p, void *fp)
1792{ 1877{
1793 int i, j, rc; 1878 int i, j, rc;
@@ -2251,6 +2336,10 @@ int policydb_read(struct policydb *p, void *fp)
2251 lra = ra; 2336 lra = ra;
2252 } 2337 }
2253 2338
2339 rc = filename_trans_read(p, fp);
2340 if (rc)
2341 goto bad;
2342
2254 rc = policydb_index(p); 2343 rc = policydb_index(p);
2255 if (rc) 2344 if (rc)
2256 goto bad; 2345 goto bad;
@@ -3025,6 +3114,43 @@ static int range_write(struct policydb *p, void *fp)
3025 return 0; 3114 return 0;
3026} 3115}
3027 3116
3117static int filename_trans_write(struct policydb *p, void *fp)
3118{
3119 struct filename_trans *ft;
3120 u32 len, nel = 0;
3121 __le32 buf[4];
3122 int rc;
3123
3124 for (ft = p->filename_trans; ft; ft = ft->next)
3125 nel++;
3126
3127 buf[0] = cpu_to_le32(nel);
3128 rc = put_entry(buf, sizeof(u32), 1, fp);
3129 if (rc)
3130 return rc;
3131
3132 for (ft = p->filename_trans; ft; ft = ft->next) {
3133 len = strlen(ft->name);
3134 buf[0] = cpu_to_le32(len);
3135 rc = put_entry(buf, sizeof(u32), 1, fp);
3136 if (rc)
3137 return rc;
3138
3139 rc = put_entry(ft->name, sizeof(char), len, fp);
3140 if (rc)
3141 return rc;
3142
3143 buf[0] = ft->stype;
3144 buf[1] = ft->ttype;
3145 buf[2] = ft->tclass;
3146 buf[3] = ft->otype;
3147
3148 rc = put_entry(buf, sizeof(u32), 4, fp);
3149 if (rc)
3150 return rc;
3151 }
3152 return 0;
3153}
3028/* 3154/*
3029 * Write the configuration data in a policy database 3155 * Write the configuration data in a policy database
3030 * structure to a policy database binary representation 3156 * structure to a policy database binary representation
@@ -3135,6 +3261,10 @@ int policydb_write(struct policydb *p, void *fp)
3135 if (rc) 3261 if (rc)
3136 return rc; 3262 return rc;
3137 3263
3264 rc = filename_trans_write(p, fp);
3265 if (rc)
3266 return rc;
3267
3138 rc = ocontext_write(p, info, fp); 3268 rc = ocontext_write(p, info, fp);
3139 if (rc) 3269 if (rc)
3140 return rc; 3270 return rc;
diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h
index 4e3ab9d0b315..732ea4a68682 100644
--- a/security/selinux/ss/policydb.h
+++ b/security/selinux/ss/policydb.h
@@ -77,6 +77,15 @@ struct role_trans {
77 struct role_trans *next; 77 struct role_trans *next;
78}; 78};
79 79
80struct filename_trans {
81 struct filename_trans *next;
82 u32 stype; /* current process */
83 u32 ttype; /* parent dir context */
84 u16 tclass; /* class of new object */
85 const char *name; /* last path component */
86 u32 otype; /* expected of new object */
87};
88
80struct role_allow { 89struct role_allow {
81 u32 role; /* current role */ 90 u32 role; /* current role */
82 u32 new_role; /* new role */ 91 u32 new_role; /* new role */
@@ -217,6 +226,9 @@ struct policydb {
217 /* role transitions */ 226 /* role transitions */
218 struct role_trans *role_tr; 227 struct role_trans *role_tr;
219 228
229 /* file transitions with the last path component */
230 struct filename_trans *filename_trans;
231
220 /* bools indexed by (value - 1) */ 232 /* bools indexed by (value - 1) */
221 struct cond_bool_datum **bool_val_to_struct; 233 struct cond_bool_datum **bool_val_to_struct;
222 /* type enforcement conditional access vectors and transitions */ 234 /* type enforcement conditional access vectors and transitions */
@@ -302,7 +314,7 @@ static inline int next_entry(void *buf, struct policy_file *fp, size_t bytes)
302 return 0; 314 return 0;
303} 315}
304 316
305static inline int put_entry(void *buf, size_t bytes, int num, struct policy_file *fp) 317static inline int put_entry(const void *buf, size_t bytes, int num, struct policy_file *fp)
306{ 318{
307 size_t len = bytes * num; 319 size_t len = bytes * num;
308 320
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index a03cfaf0ee07..3e7544d2a07b 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -201,6 +201,21 @@ static u16 unmap_class(u16 tclass)
201 return tclass; 201 return tclass;
202} 202}
203 203
204/*
205 * Get kernel value for class from its policy value
206 */
207static u16 map_class(u16 pol_value)
208{
209 u16 i;
210
211 for (i = 1; i < current_mapping_size; i++) {
212 if (current_mapping[i].value == pol_value)
213 return i;
214 }
215
216 return pol_value;
217}
218
204static void map_decision(u16 tclass, struct av_decision *avd, 219static void map_decision(u16 tclass, struct av_decision *avd,
205 int allow_unknown) 220 int allow_unknown)
206{ 221{
@@ -1343,10 +1358,27 @@ out:
1343 return -EACCES; 1358 return -EACCES;
1344} 1359}
1345 1360
1361static void filename_compute_type(struct policydb *p, struct context *newcontext,
1362 u32 scon, u32 tcon, u16 tclass,
1363 const struct qstr *qstr)
1364{
1365 struct filename_trans *ft;
1366 for (ft = p->filename_trans; ft; ft = ft->next) {
1367 if (ft->stype == scon &&
1368 ft->ttype == tcon &&
1369 ft->tclass == tclass &&
1370 !strcmp(ft->name, qstr->name)) {
1371 newcontext->type = ft->otype;
1372 return;
1373 }
1374 }
1375}
1376
1346static int security_compute_sid(u32 ssid, 1377static int security_compute_sid(u32 ssid,
1347 u32 tsid, 1378 u32 tsid,
1348 u16 orig_tclass, 1379 u16 orig_tclass,
1349 u32 specified, 1380 u32 specified,
1381 const struct qstr *qstr,
1350 u32 *out_sid, 1382 u32 *out_sid,
1351 bool kern) 1383 bool kern)
1352{ 1384{
@@ -1357,6 +1389,7 @@ static int security_compute_sid(u32 ssid,
1357 struct avtab_node *node; 1389 struct avtab_node *node;
1358 u16 tclass; 1390 u16 tclass;
1359 int rc = 0; 1391 int rc = 0;
1392 bool sock;
1360 1393
1361 if (!ss_initialized) { 1394 if (!ss_initialized) {
1362 switch (orig_tclass) { 1395 switch (orig_tclass) {
@@ -1374,10 +1407,13 @@ static int security_compute_sid(u32 ssid,
1374 1407
1375 read_lock(&policy_rwlock); 1408 read_lock(&policy_rwlock);
1376 1409
1377 if (kern) 1410 if (kern) {
1378 tclass = unmap_class(orig_tclass); 1411 tclass = unmap_class(orig_tclass);
1379 else 1412 sock = security_is_socket_class(orig_tclass);
1413 } else {
1380 tclass = orig_tclass; 1414 tclass = orig_tclass;
1415 sock = security_is_socket_class(map_class(tclass));
1416 }
1381 1417
1382 scontext = sidtab_search(&sidtab, ssid); 1418 scontext = sidtab_search(&sidtab, ssid);
1383 if (!scontext) { 1419 if (!scontext) {
@@ -1408,7 +1444,7 @@ static int security_compute_sid(u32 ssid,
1408 } 1444 }
1409 1445
1410 /* Set the role and type to default values. */ 1446 /* Set the role and type to default values. */
1411 if (tclass == policydb.process_class) { 1447 if ((tclass == policydb.process_class) || (sock == true)) {
1412 /* Use the current role and type of process. */ 1448 /* Use the current role and type of process. */
1413 newcontext.role = scontext->role; 1449 newcontext.role = scontext->role;
1414 newcontext.type = scontext->type; 1450 newcontext.type = scontext->type;
@@ -1442,6 +1478,11 @@ static int security_compute_sid(u32 ssid,
1442 newcontext.type = avdatum->data; 1478 newcontext.type = avdatum->data;
1443 } 1479 }
1444 1480
1481 /* if we have a qstr this is a file trans check so check those rules */
1482 if (qstr)
1483 filename_compute_type(&policydb, &newcontext, scontext->type,
1484 tcontext->type, tclass, qstr);
1485
1445 /* Check for class-specific changes. */ 1486 /* Check for class-specific changes. */
1446 if (tclass == policydb.process_class) { 1487 if (tclass == policydb.process_class) {
1447 if (specified & AVTAB_TRANSITION) { 1488 if (specified & AVTAB_TRANSITION) {
@@ -1460,7 +1501,8 @@ static int security_compute_sid(u32 ssid,
1460 1501
1461 /* Set the MLS attributes. 1502 /* Set the MLS attributes.
1462 This is done last because it may allocate memory. */ 1503 This is done last because it may allocate memory. */
1463 rc = mls_compute_sid(scontext, tcontext, tclass, specified, &newcontext); 1504 rc = mls_compute_sid(scontext, tcontext, tclass, specified,
1505 &newcontext, sock);
1464 if (rc) 1506 if (rc)
1465 goto out_unlock; 1507 goto out_unlock;
1466 1508
@@ -1495,22 +1537,17 @@ out:
1495 * if insufficient memory is available, or %0 if the new SID was 1537 * if insufficient memory is available, or %0 if the new SID was
1496 * computed successfully. 1538 * computed successfully.
1497 */ 1539 */
1498int security_transition_sid(u32 ssid, 1540int security_transition_sid(u32 ssid, u32 tsid, u16 tclass,
1499 u32 tsid, 1541 const struct qstr *qstr, u32 *out_sid)
1500 u16 tclass,
1501 u32 *out_sid)
1502{ 1542{
1503 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1543 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
1504 out_sid, true); 1544 qstr, out_sid, true);
1505} 1545}
1506 1546
1507int security_transition_sid_user(u32 ssid, 1547int security_transition_sid_user(u32 ssid, u32 tsid, u16 tclass, u32 *out_sid)
1508 u32 tsid,
1509 u16 tclass,
1510 u32 *out_sid)
1511{ 1548{
1512 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION, 1549 return security_compute_sid(ssid, tsid, tclass, AVTAB_TRANSITION,
1513 out_sid, false); 1550 NULL, out_sid, false);
1514} 1551}
1515 1552
1516/** 1553/**
@@ -1531,8 +1568,8 @@ int security_member_sid(u32 ssid,
1531 u16 tclass, 1568 u16 tclass,
1532 u32 *out_sid) 1569 u32 *out_sid)
1533{ 1570{
1534 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, out_sid, 1571 return security_compute_sid(ssid, tsid, tclass, AVTAB_MEMBER, NULL,
1535 false); 1572 out_sid, false);
1536} 1573}
1537 1574
1538/** 1575/**
@@ -1553,8 +1590,8 @@ int security_change_sid(u32 ssid,
1553 u16 tclass, 1590 u16 tclass,
1554 u32 *out_sid) 1591 u32 *out_sid)
1555{ 1592{
1556 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, out_sid, 1593 return security_compute_sid(ssid, tsid, tclass, AVTAB_CHANGE, NULL,
1557 false); 1594 out_sid, false);
1558} 1595}
1559 1596
1560/* Clone the SID into the new SID table. */ 1597/* Clone the SID into the new SID table. */
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index fff78d3b51a2..728c57e3d65d 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -208,7 +208,7 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
208 if (!uctx) 208 if (!uctx)
209 goto not_from_user; 209 goto not_from_user;
210 210
211 if (uctx->ctx_doi != XFRM_SC_ALG_SELINUX) 211 if (uctx->ctx_alg != XFRM_SC_ALG_SELINUX)
212 return -EINVAL; 212 return -EINVAL;
213 213
214 str_len = uctx->ctx_len; 214 str_len = uctx->ctx_len;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 5ab3f39442f2..23c7a6d0c80c 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -33,6 +33,7 @@
33#include <net/cipso_ipv4.h> 33#include <net/cipso_ipv4.h>
34#include <linux/audit.h> 34#include <linux/audit.h>
35#include <linux/magic.h> 35#include <linux/magic.h>
36#include <linux/dcache.h>
36#include "smack.h" 37#include "smack.h"
37 38
38#define task_security(task) (task_cred_xxx((task), security)) 39#define task_security(task) (task_cred_xxx((task), security))
@@ -501,6 +502,7 @@ static void smack_inode_free_security(struct inode *inode)
501 * smack_inode_init_security - copy out the smack from an inode 502 * smack_inode_init_security - copy out the smack from an inode
502 * @inode: the inode 503 * @inode: the inode
503 * @dir: unused 504 * @dir: unused
505 * @qstr: unused
504 * @name: where to put the attribute name 506 * @name: where to put the attribute name
505 * @value: where to put the attribute value 507 * @value: where to put the attribute value
506 * @len: where to put the length of the attribute 508 * @len: where to put the length of the attribute
@@ -508,7 +510,8 @@ static void smack_inode_free_security(struct inode *inode)
508 * Returns 0 if it all works out, -ENOMEM if there's no memory 510 * Returns 0 if it all works out, -ENOMEM if there's no memory
509 */ 511 */
510static int smack_inode_init_security(struct inode *inode, struct inode *dir, 512static int smack_inode_init_security(struct inode *inode, struct inode *dir,
511 char **name, void **value, size_t *len) 513 const struct qstr *qstr, char **name,
514 void **value, size_t *len)
512{ 515{
513 char *isp = smk_of_inode(inode); 516 char *isp = smk_of_inode(inode);
514 char *dsp = smk_of_inode(dir); 517 char *dsp = smk_of_inode(dir);
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-15 11:49:45 -0500