aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorJames Morris <jmorris@namei.org>2011-03-07 18:55:06 -0500
committerJames Morris <jmorris@namei.org>2011-03-07 18:55:06 -0500
commit1cc26bada9f6807814806db2f0d78792eecdac71 (patch)
tree5509b5139db04af6c13db0a580c84116a4a54039 /security
parenteae61f3c829439f8f9121b5cd48a14be04df451f (diff)
parent214d93b02c4fe93638ad268613c9702a81ed9192 (diff)
Merge branch 'master'; commit 'v2.6.38-rc7' into next
Diffstat (limited to 'security')
-rw-r--r--security/apparmor/include/file.h3
-rw-r--r--security/apparmor/include/match.h3
-rw-r--r--security/keys/Makefile4
-rw-r--r--security/keys/compat.c17
-rw-r--r--security/keys/encrypted.c (renamed from security/keys/encrypted_defined.c)2
-rw-r--r--security/keys/encrypted.h (renamed from security/keys/encrypted_defined.h)0
-rw-r--r--security/keys/gc.c14
-rw-r--r--security/keys/internal.h32
-rw-r--r--security/keys/key.c328
-rw-r--r--security/keys/keyctl.c355
-rw-r--r--security/keys/keyring.c326
-rw-r--r--security/keys/permission.c33
-rw-r--r--security/keys/proc.c17
-rw-r--r--security/keys/process_keys.c135
-rw-r--r--security/keys/request_key.c166
-rw-r--r--security/keys/request_key_auth.c62
-rw-r--r--security/keys/trusted.c (renamed from security/keys/trusted_defined.c)54
-rw-r--r--security/keys/trusted.h (renamed from security/keys/trusted_defined.h)0
-rw-r--r--security/keys/user_defined.c32
-rw-r--r--security/security.c5
-rw-r--r--security/selinux/hooks.c6
-rw-r--r--security/selinux/include/avc.h1
-rw-r--r--security/selinux/ss/conditional.c2
-rw-r--r--security/selinux/ss/policydb.c4
24 files changed, 930 insertions, 671 deletions
diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index be36feabb16..ab8c6d87f75 100644
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -15,12 +15,11 @@
15#ifndef __AA_FILE_H 15#ifndef __AA_FILE_H
16#define __AA_FILE_H 16#define __AA_FILE_H
17 17
18#include <linux/path.h>
19
20#include "domain.h" 18#include "domain.h"
21#include "match.h" 19#include "match.h"
22 20
23struct aa_profile; 21struct aa_profile;
22struct path;
24 23
25/* 24/*
26 * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags 25 * We use MAY_EXEC, MAY_WRITE, MAY_READ, MAY_APPEND and the following flags
diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h
index 734a6d35112..a4a863997bd 100644
--- a/security/apparmor/include/match.h
+++ b/security/apparmor/include/match.h
@@ -15,6 +15,7 @@
15#ifndef __AA_MATCH_H 15#ifndef __AA_MATCH_H
16#define __AA_MATCH_H 16#define __AA_MATCH_H
17 17
18#include <linux/kref.h>
18#include <linux/workqueue.h> 19#include <linux/workqueue.h>
19 20
20#define DFA_NOMATCH 0 21#define DFA_NOMATCH 0
@@ -27,7 +28,7 @@
27 * The format used for transition tables is based on the GNU flex table 28 * The format used for transition tables is based on the GNU flex table
28 * file format (--tables-file option; see Table File Format in the flex 29 * file format (--tables-file option; see Table File Format in the flex
29 * info pages and the flex sources for documentation). The magic number 30 * info pages and the flex sources for documentation). The magic number
30 * used in the header is 0x1B5E783D insted of 0xF13C57B1 though, because 31 * used in the header is 0x1B5E783D instead of 0xF13C57B1 though, because
31 * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used 32 * the YY_ID_CHK (check) and YY_ID_DEF (default) tables are used
32 * slightly differently (see the apparmor-parser package). 33 * slightly differently (see the apparmor-parser package).
33 */ 34 */
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 6c941050f57..1bf090a885f 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -13,8 +13,8 @@ obj-y := \
13 request_key_auth.o \ 13 request_key_auth.o \
14 user_defined.o 14 user_defined.o
15 15
16obj-$(CONFIG_TRUSTED_KEYS) += trusted_defined.o 16obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
17obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted_defined.o 17obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o
18obj-$(CONFIG_KEYS_COMPAT) += compat.o 18obj-$(CONFIG_KEYS_COMPAT) += compat.o
19obj-$(CONFIG_PROC_FS) += proc.o 19obj-$(CONFIG_PROC_FS) += proc.o
20obj-$(CONFIG_SYSCTL) += sysctl.o 20obj-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 792c0a611a6..07a5f35e397 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -1,4 +1,4 @@
1/* compat.c: 32-bit compatibility syscall for 64-bit systems 1/* 32-bit compatibility syscall for 64-bit systems
2 * 2 *
3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -14,13 +14,13 @@
14#include <linux/compat.h> 14#include <linux/compat.h>
15#include "internal.h" 15#include "internal.h"
16 16
17/*****************************************************************************/
18/* 17/*
19 * the key control system call, 32-bit compatibility version for 64-bit archs 18 * The key control system call, 32-bit compatibility version for 64-bit archs
20 * - this should only be called if the 64-bit arch uses weird pointers in 19 *
21 * 32-bit mode or doesn't guarantee that the top 32-bits of the argument 20 * This should only be called if the 64-bit arch uses weird pointers in 32-bit
22 * registers on taking a 32-bit syscall are zero 21 * mode or doesn't guarantee that the top 32-bits of the argument registers on
23 * - if you can, you should call sys_keyctl directly 22 * taking a 32-bit syscall are zero. If you can, you should call sys_keyctl()
23 * directly.
24 */ 24 */
25asmlinkage long compat_sys_keyctl(u32 option, 25asmlinkage long compat_sys_keyctl(u32 option,
26 u32 arg2, u32 arg3, u32 arg4, u32 arg5) 26 u32 arg2, u32 arg3, u32 arg4, u32 arg5)
@@ -88,5 +88,4 @@ asmlinkage long compat_sys_keyctl(u32 option,
88 default: 88 default:
89 return -EOPNOTSUPP; 89 return -EOPNOTSUPP;
90 } 90 }
91 91}
92} /* end compat_sys_keyctl() */
diff --git a/security/keys/encrypted_defined.c b/security/keys/encrypted.c
index 32d27c85838..9e7e4ce3fae 100644
--- a/security/keys/encrypted_defined.c
+++ b/security/keys/encrypted.c
@@ -30,7 +30,7 @@
30#include <crypto/sha.h> 30#include <crypto/sha.h>
31#include <crypto/aes.h> 31#include <crypto/aes.h>
32 32
33#include "encrypted_defined.h" 33#include "encrypted.h"
34 34
35static const char KEY_TRUSTED_PREFIX[] = "trusted:"; 35static const char KEY_TRUSTED_PREFIX[] = "trusted:";
36static const char KEY_USER_PREFIX[] = "user:"; 36static const char KEY_USER_PREFIX[] = "user:";
diff --git a/security/keys/encrypted_defined.h b/security/keys/encrypted.h
index cef5e2f2b7d..cef5e2f2b7d 100644
--- a/security/keys/encrypted_defined.h
+++ b/security/keys/encrypted.h
diff --git a/security/keys/gc.c b/security/keys/gc.c
index a46e825cbf0..89df6b5f203 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -32,8 +32,8 @@ static time_t key_gc_next_run = LONG_MAX;
32static time_t key_gc_new_timer; 32static time_t key_gc_new_timer;
33 33
34/* 34/*
35 * Schedule a garbage collection run 35 * Schedule a garbage collection run.
36 * - precision isn't particularly important 36 * - time precision isn't particularly important
37 */ 37 */
38void key_schedule_gc(time_t gc_at) 38void key_schedule_gc(time_t gc_at)
39{ 39{
@@ -61,8 +61,9 @@ static void key_gc_timer_func(unsigned long data)
61} 61}
62 62
63/* 63/*
64 * Garbage collect pointers from a keyring 64 * Garbage collect pointers from a keyring.
65 * - return true if we altered the keyring 65 *
66 * Return true if we altered the keyring.
66 */ 67 */
67static bool key_gc_keyring(struct key *keyring, time_t limit) 68static bool key_gc_keyring(struct key *keyring, time_t limit)
68 __releases(key_serial_lock) 69 __releases(key_serial_lock)
@@ -107,9 +108,8 @@ do_gc:
107} 108}
108 109
109/* 110/*
110 * Garbage collector for keys 111 * Garbage collector for keys. This involves scanning the keyrings for dead,
111 * - this involves scanning the keyrings for dead, expired and revoked keys 112 * expired and revoked keys that have overstayed their welcome
112 * that have overstayed their welcome
113 */ 113 */
114static void key_garbage_collector(struct work_struct *work) 114static void key_garbage_collector(struct work_struct *work)
115{ 115{
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 56a133d8f37..a52aa7c88b4 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -1,4 +1,4 @@
1/* internal.h: authentication token and access key management internal defs 1/* Authentication token and access key management internal defs
2 * 2 *
3 * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -35,10 +35,12 @@ extern struct key_type key_type_user;
35 35
36/*****************************************************************************/ 36/*****************************************************************************/
37/* 37/*
38 * keep track of keys for a user 38 * Keep track of keys for a user.
39 * - this needs to be separate to user_struct to avoid a refcount-loop 39 *
40 * (user_struct pins some keyrings which pin this struct) 40 * This needs to be separate to user_struct to avoid a refcount-loop
41 * - this also keeps track of keys under request from userspace for this UID 41 * (user_struct pins some keyrings which pin this struct).
42 *
43 * We also keep track of keys under request from userspace for this UID here.
42 */ 44 */
43struct key_user { 45struct key_user {
44 struct rb_node node; 46 struct rb_node node;
@@ -62,7 +64,7 @@ extern struct key_user *key_user_lookup(uid_t uid,
62extern void key_user_put(struct key_user *user); 64extern void key_user_put(struct key_user *user);
63 65
64/* 66/*
65 * key quota limits 67 * Key quota limits.
66 * - root has its own separate limits to everyone else 68 * - root has its own separate limits to everyone else
67 */ 69 */
68extern unsigned key_quota_root_maxkeys; 70extern unsigned key_quota_root_maxkeys;
@@ -85,13 +87,13 @@ extern void key_type_put(struct key_type *ktype);
85extern int __key_link_begin(struct key *keyring, 87extern int __key_link_begin(struct key *keyring,
86 const struct key_type *type, 88 const struct key_type *type,
87 const char *description, 89 const char *description,
88 struct keyring_list **_prealloc); 90 unsigned long *_prealloc);
89extern int __key_link_check_live_key(struct key *keyring, struct key *key); 91extern int __key_link_check_live_key(struct key *keyring, struct key *key);
90extern void __key_link(struct key *keyring, struct key *key, 92extern void __key_link(struct key *keyring, struct key *key,
91 struct keyring_list **_prealloc); 93 unsigned long *_prealloc);
92extern void __key_link_end(struct key *keyring, 94extern void __key_link_end(struct key *keyring,
93 struct key_type *type, 95 struct key_type *type,
94 struct keyring_list *prealloc); 96 unsigned long prealloc);
95 97
96extern key_ref_t __keyring_search_one(key_ref_t keyring_ref, 98extern key_ref_t __keyring_search_one(key_ref_t keyring_ref,
97 const struct key_type *type, 99 const struct key_type *type,
@@ -146,13 +148,13 @@ extern unsigned key_gc_delay;
146extern void keyring_gc(struct key *keyring, time_t limit); 148extern void keyring_gc(struct key *keyring, time_t limit);
147extern void key_schedule_gc(time_t expiry_at); 149extern void key_schedule_gc(time_t expiry_at);
148 150
149/*
150 * check to see whether permission is granted to use a key in the desired way
151 */
152extern int key_task_permission(const key_ref_t key_ref, 151extern int key_task_permission(const key_ref_t key_ref,
153 const struct cred *cred, 152 const struct cred *cred,
154 key_perm_t perm); 153 key_perm_t perm);
155 154
155/*
156 * Check to see whether permission is granted to use a key in the desired way.
157 */
156static inline int key_permission(const key_ref_t key_ref, key_perm_t perm) 158static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
157{ 159{
158 return key_task_permission(key_ref, current_cred(), perm); 160 return key_task_permission(key_ref, current_cred(), perm);
@@ -168,7 +170,7 @@ static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
168#define KEY_ALL 0x3f /* all the above permissions */ 170#define KEY_ALL 0x3f /* all the above permissions */
169 171
170/* 172/*
171 * request_key authorisation 173 * Authorisation record for request_key().
172 */ 174 */
173struct request_key_auth { 175struct request_key_auth {
174 struct key *target_key; 176 struct key *target_key;
@@ -188,7 +190,7 @@ extern struct key *request_key_auth_new(struct key *target,
188extern struct key *key_get_instantiation_authkey(key_serial_t target_id); 190extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
189 191
190/* 192/*
191 * keyctl functions 193 * keyctl() functions
192 */ 194 */
193extern long keyctl_get_keyring_ID(key_serial_t, int); 195extern long keyctl_get_keyring_ID(key_serial_t, int);
194extern long keyctl_join_session_keyring(const char __user *); 196extern long keyctl_join_session_keyring(const char __user *);
@@ -214,7 +216,7 @@ extern long keyctl_get_security(key_serial_t keyid, char __user *buffer,
214extern long keyctl_session_to_parent(void); 216extern long keyctl_session_to_parent(void);
215 217
216/* 218/*
217 * debugging key validation 219 * Debugging key validation
218 */ 220 */
219#ifdef KEY_DEBUGGING 221#ifdef KEY_DEBUGGING
220extern void __key_check(const struct key *); 222extern void __key_check(const struct key *);
diff --git a/security/keys/key.c b/security/keys/key.c
index c1eac8084ad..1c2d43dc510 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -39,10 +39,10 @@ static DECLARE_RWSEM(key_types_sem);
39static void key_cleanup(struct work_struct *work); 39static void key_cleanup(struct work_struct *work);
40static DECLARE_WORK(key_cleanup_task, key_cleanup); 40static DECLARE_WORK(key_cleanup_task, key_cleanup);
41 41
42/* we serialise key instantiation and link */ 42/* We serialise key instantiation and link */
43DEFINE_MUTEX(key_construction_mutex); 43DEFINE_MUTEX(key_construction_mutex);
44 44
45/* any key who's type gets unegistered will be re-typed to this */ 45/* Any key who's type gets unegistered will be re-typed to this */
46static struct key_type key_type_dead = { 46static struct key_type key_type_dead = {
47 .name = "dead", 47 .name = "dead",
48}; 48};
@@ -56,10 +56,9 @@ void __key_check(const struct key *key)
56} 56}
57#endif 57#endif
58 58
59/*****************************************************************************/
60/* 59/*
61 * get the key quota record for a user, allocating a new record if one doesn't 60 * Get the key quota record for a user, allocating a new record if one doesn't
62 * already exist 61 * already exist.
63 */ 62 */
64struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns) 63struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
65{ 64{
@@ -67,7 +66,7 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
67 struct rb_node *parent = NULL; 66 struct rb_node *parent = NULL;
68 struct rb_node **p; 67 struct rb_node **p;
69 68
70 try_again: 69try_again:
71 p = &key_user_tree.rb_node; 70 p = &key_user_tree.rb_node;
72 spin_lock(&key_user_lock); 71 spin_lock(&key_user_lock);
73 72
@@ -124,18 +123,16 @@ struct key_user *key_user_lookup(uid_t uid, struct user_namespace *user_ns)
124 goto out; 123 goto out;
125 124
126 /* okay - we found a user record for this UID */ 125 /* okay - we found a user record for this UID */
127 found: 126found:
128 atomic_inc(&user->usage); 127 atomic_inc(&user->usage);
129 spin_unlock(&key_user_lock); 128 spin_unlock(&key_user_lock);
130 kfree(candidate); 129 kfree(candidate);
131 out: 130out:
132 return user; 131 return user;
132}
133 133
134} /* end key_user_lookup() */
135
136/*****************************************************************************/
137/* 134/*
138 * dispose of a user structure 135 * Dispose of a user structure
139 */ 136 */
140void key_user_put(struct key_user *user) 137void key_user_put(struct key_user *user)
141{ 138{
@@ -146,14 +143,11 @@ void key_user_put(struct key_user *user)
146 143
147 kfree(user); 144 kfree(user);
148 } 145 }
146}
149 147
150} /* end key_user_put() */
151
152/*****************************************************************************/
153/* 148/*
154 * assign a key the next unique serial number 149 * Allocate a serial number for a key. These are assigned randomly to avoid
155 * - these are assigned randomly to avoid security issues through covert 150 * security issues through covert channel problems.
156 * channel problems
157 */ 151 */
158static inline void key_alloc_serial(struct key *key) 152static inline void key_alloc_serial(struct key *key)
159{ 153{
@@ -211,18 +205,36 @@ serial_exists:
211 if (key->serial < xkey->serial) 205 if (key->serial < xkey->serial)
212 goto attempt_insertion; 206 goto attempt_insertion;
213 } 207 }
208}
214 209
215} /* end key_alloc_serial() */ 210/**
216 211 * key_alloc - Allocate a key of the specified type.
217/*****************************************************************************/ 212 * @type: The type of key to allocate.
218/* 213 * @desc: The key description to allow the key to be searched out.
219 * allocate a key of the specified type 214 * @uid: The owner of the new key.
220 * - update the user's quota to reflect the existence of the key 215 * @gid: The group ID for the new key's group permissions.
221 * - called from a key-type operation with key_types_sem read-locked by 216 * @cred: The credentials specifying UID namespace.
222 * key_create_or_update() 217 * @perm: The permissions mask of the new key.
223 * - this prevents unregistration of the key type 218 * @flags: Flags specifying quota properties.
224 * - upon return the key is as yet uninstantiated; the caller needs to either 219 *
225 * instantiate the key or discard it before returning 220 * Allocate a key of the specified type with the attributes given. The key is
221 * returned in an uninstantiated state and the caller needs to instantiate the
222 * key before returning.
223 *
224 * The user's key count quota is updated to reflect the creation of the key and
225 * the user's key data quota has the default for the key type reserved. The
226 * instantiation function should amend this as necessary. If insufficient
227 * quota is available, -EDQUOT will be returned.
228 *
229 * The LSM security modules can prevent a key being created, in which case
230 * -EACCES will be returned.
231 *
232 * Returns a pointer to the new key if successful and an error code otherwise.
233 *
234 * Note that the caller needs to ensure the key type isn't uninstantiated.
235 * Internally this can be done by locking key_types_sem. Externally, this can
236 * be done by either never unregistering the key type, or making sure
237 * key_alloc() calls don't race with module unloading.
226 */ 238 */
227struct key *key_alloc(struct key_type *type, const char *desc, 239struct key *key_alloc(struct key_type *type, const char *desc,
228 uid_t uid, gid_t gid, const struct cred *cred, 240 uid_t uid, gid_t gid, const struct cred *cred,
@@ -344,14 +356,19 @@ no_quota:
344 key_user_put(user); 356 key_user_put(user);
345 key = ERR_PTR(-EDQUOT); 357 key = ERR_PTR(-EDQUOT);
346 goto error; 358 goto error;
347 359}
348} /* end key_alloc() */
349
350EXPORT_SYMBOL(key_alloc); 360EXPORT_SYMBOL(key_alloc);
351 361
352/*****************************************************************************/ 362/**
353/* 363 * key_payload_reserve - Adjust data quota reservation for the key's payload
354 * reserve an amount of quota for the key's payload 364 * @key: The key to make the reservation for.
365 * @datalen: The amount of data payload the caller now wants.
366 *
367 * Adjust the amount of the owning user's key data quota that a key reserves.
368 * If the amount is increased, then -EDQUOT may be returned if there isn't
369 * enough free quota available.
370 *
371 * If successful, 0 is returned.
355 */ 372 */
356int key_payload_reserve(struct key *key, size_t datalen) 373int key_payload_reserve(struct key *key, size_t datalen)
357{ 374{
@@ -384,22 +401,21 @@ int key_payload_reserve(struct key *key, size_t datalen)
384 key->datalen = datalen; 401 key->datalen = datalen;
385 402
386 return ret; 403 return ret;
387 404}
388} /* end key_payload_reserve() */
389
390EXPORT_SYMBOL(key_payload_reserve); 405EXPORT_SYMBOL(key_payload_reserve);
391 406
392/*****************************************************************************/
393/* 407/*
394 * instantiate a key and link it into the target keyring atomically 408 * Instantiate a key and link it into the target keyring atomically. Must be
395 * - called with the target keyring's semaphore writelocked 409 * called with the target keyring's semaphore writelocked. The target key's
410 * semaphore need not be locked as instantiation is serialised by
411 * key_construction_mutex.
396 */ 412 */
397static int __key_instantiate_and_link(struct key *key, 413static int __key_instantiate_and_link(struct key *key,
398 const void *data, 414 const void *data,
399 size_t datalen, 415 size_t datalen,
400 struct key *keyring, 416 struct key *keyring,
401 struct key *authkey, 417 struct key *authkey,
402 struct keyring_list **_prealloc) 418 unsigned long *_prealloc)
403{ 419{
404 int ret, awaken; 420 int ret, awaken;
405 421
@@ -441,12 +457,23 @@ static int __key_instantiate_and_link(struct key *key,
441 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 457 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
442 458
443 return ret; 459 return ret;
460}
444 461
445} /* end __key_instantiate_and_link() */ 462/**
446 463 * key_instantiate_and_link - Instantiate a key and link it into the keyring.
447/*****************************************************************************/ 464 * @key: The key to instantiate.
448/* 465 * @data: The data to use to instantiate the keyring.
449 * instantiate a key and link it into the target keyring atomically 466 * @datalen: The length of @data.
467 * @keyring: Keyring to create a link in on success (or NULL).
468 * @authkey: The authorisation token permitting instantiation.
469 *
470 * Instantiate a key that's in the uninstantiated state using the provided data
471 * and, if successful, link it in to the destination keyring if one is
472 * supplied.
473 *
474 * If successful, 0 is returned, the authorisation token is revoked and anyone
475 * waiting for the key is woken up. If the key was already instantiated,
476 * -EBUSY will be returned.
450 */ 477 */
451int key_instantiate_and_link(struct key *key, 478int key_instantiate_and_link(struct key *key,
452 const void *data, 479 const void *data,
@@ -454,7 +481,7 @@ int key_instantiate_and_link(struct key *key,
454 struct key *keyring, 481 struct key *keyring,
455 struct key *authkey) 482 struct key *authkey)
456{ 483{
457 struct keyring_list *prealloc; 484 unsigned long prealloc;
458 int ret; 485 int ret;
459 486
460 if (keyring) { 487 if (keyring) {
@@ -471,21 +498,35 @@ int key_instantiate_and_link(struct key *key,
471 __key_link_end(keyring, key->type, prealloc); 498 __key_link_end(keyring, key->type, prealloc);
472 499
473 return ret; 500 return ret;
474 501}
475} /* end key_instantiate_and_link() */
476 502
477EXPORT_SYMBOL(key_instantiate_and_link); 503EXPORT_SYMBOL(key_instantiate_and_link);
478 504
479/*****************************************************************************/ 505/**
480/* 506 * key_negate_and_link - Negatively instantiate a key and link it into the keyring.
481 * negatively instantiate a key and link it into the target keyring atomically 507 * @key: The key to instantiate.
508 * @timeout: The timeout on the negative key.
509 * @keyring: Keyring to create a link in on success (or NULL).
510 * @authkey: The authorisation token permitting instantiation.
511 *
512 * Negatively instantiate a key that's in the uninstantiated state and, if
513 * successful, set its timeout and link it in to the destination keyring if one
514 * is supplied. The key and any links to the key will be automatically garbage
515 * collected after the timeout expires.
516 *
517 * Negative keys are used to rate limit repeated request_key() calls by causing
518 * them to return -ENOKEY until the negative key expires.
519 *
520 * If successful, 0 is returned, the authorisation token is revoked and anyone
521 * waiting for the key is woken up. If the key was already instantiated,
522 * -EBUSY will be returned.
482 */ 523 */
483int key_negate_and_link(struct key *key, 524int key_negate_and_link(struct key *key,
484 unsigned timeout, 525 unsigned timeout,
485 struct key *keyring, 526 struct key *keyring,
486 struct key *authkey) 527 struct key *authkey)
487{ 528{
488 struct keyring_list *prealloc; 529 unsigned long prealloc;
489 struct timespec now; 530 struct timespec now;
490 int ret, awaken, link_ret = 0; 531 int ret, awaken, link_ret = 0;
491 532
@@ -535,22 +576,23 @@ int key_negate_and_link(struct key *key,
535 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT); 576 wake_up_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT);
536 577
537 return ret == 0 ? link_ret : ret; 578 return ret == 0 ? link_ret : ret;
538 579}
539} /* end key_negate_and_link() */
540 580
541EXPORT_SYMBOL(key_negate_and_link); 581EXPORT_SYMBOL(key_negate_and_link);
542 582
543/*****************************************************************************/
544/* 583/*
545 * do cleaning up in process context so that we don't have to disable 584 * Garbage collect keys in process context so that we don't have to disable
546 * interrupts all over the place 585 * interrupts all over the place.
586 *
587 * key_put() schedules this rather than trying to do the cleanup itself, which
588 * means key_put() doesn't have to sleep.
547 */ 589 */
548static void key_cleanup(struct work_struct *work) 590static void key_cleanup(struct work_struct *work)
549{ 591{
550 struct rb_node *_n; 592 struct rb_node *_n;
551 struct key *key; 593 struct key *key;
552 594
553 go_again: 595go_again:
554 /* look for a dead key in the tree */ 596 /* look for a dead key in the tree */
555 spin_lock(&key_serial_lock); 597 spin_lock(&key_serial_lock);
556 598
@@ -564,7 +606,7 @@ static void key_cleanup(struct work_struct *work)
564 spin_unlock(&key_serial_lock); 606 spin_unlock(&key_serial_lock);
565 return; 607 return;
566 608
567 found_dead_key: 609found_dead_key:
568 /* we found a dead key - once we've removed it from the tree, we can 610 /* we found a dead key - once we've removed it from the tree, we can
569 * drop the lock */ 611 * drop the lock */
570 rb_erase(&key->serial_node, &key_serial_tree); 612 rb_erase(&key->serial_node, &key_serial_tree);
@@ -601,14 +643,15 @@ static void key_cleanup(struct work_struct *work)
601 643
602 /* there may, of course, be more than one key to destroy */ 644 /* there may, of course, be more than one key to destroy */
603 goto go_again; 645 goto go_again;
646}
604 647
605} /* end key_cleanup() */ 648/**
606 649 * key_put - Discard a reference to a key.
607/*****************************************************************************/ 650 * @key: The key to discard a reference from.
608/* 651 *
609 * dispose of a reference to a key 652 * Discard a reference to a key, and when all the references are gone, we
610 * - when all the references are gone, we schedule the cleanup task to come and 653 * schedule the cleanup task to come and pull it out of the tree in process
611 * pull it out of the tree in definite process context 654 * context at some later time.
612 */ 655 */
613void key_put(struct key *key) 656void key_put(struct key *key)
614{ 657{
@@ -618,14 +661,11 @@ void key_put(struct key *key)
618 if (atomic_dec_and_test(&key->usage)) 661 if (atomic_dec_and_test(&key->usage))
619 schedule_work(&key_cleanup_task); 662 schedule_work(&key_cleanup_task);
620 } 663 }
621 664}
622} /* end key_put() */
623
624EXPORT_SYMBOL(key_put); 665EXPORT_SYMBOL(key_put);
625 666
626/*****************************************************************************/
627/* 667/*
628 * find a key by its serial number 668 * Find a key by its serial number.
629 */ 669 */
630struct key *key_lookup(key_serial_t id) 670struct key *key_lookup(key_serial_t id)
631{ 671{
@@ -647,11 +687,11 @@ struct key *key_lookup(key_serial_t id)
647 goto found; 687 goto found;
648 } 688 }
649 689
650 not_found: 690not_found:
651 key = ERR_PTR(-ENOKEY); 691 key = ERR_PTR(-ENOKEY);
652 goto error; 692 goto error;
653 693
654 found: 694found:
655 /* pretend it doesn't exist if it is awaiting deletion */ 695 /* pretend it doesn't exist if it is awaiting deletion */
656 if (atomic_read(&key->usage) == 0) 696 if (atomic_read(&key->usage) == 0)
657 goto not_found; 697 goto not_found;
@@ -661,16 +701,16 @@ struct key *key_lookup(key_serial_t id)
661 */ 701 */
662 atomic_inc(&key->usage); 702 atomic_inc(&key->usage);
663 703
664 error: 704error:
665 spin_unlock(&key_serial_lock); 705 spin_unlock(&key_serial_lock);
666 return key; 706 return key;
707}
667 708
668} /* end key_lookup() */
669
670/*****************************************************************************/
671/* 709/*
672 * find and lock the specified key type against removal 710 * Find and lock the specified key type against removal.
673 * - we return with the sem readlocked 711 *
712 * We return with the sem read-locked if successful. If the type wasn't
713 * available -ENOKEY is returned instead.
674 */ 714 */
675struct key_type *key_type_lookup(const char *type) 715struct key_type *key_type_lookup(const char *type)
676{ 716{
@@ -688,26 +728,23 @@ struct key_type *key_type_lookup(const char *type)
688 up_read(&key_types_sem); 728 up_read(&key_types_sem);
689 ktype = ERR_PTR(-ENOKEY); 729 ktype = ERR_PTR(-ENOKEY);
690 730
691 found_kernel_type: 731found_kernel_type:
692 return ktype; 732 return ktype;
733}
693 734
694} /* end key_type_lookup() */
695
696/*****************************************************************************/
697/* 735/*
698 * unlock a key type 736 * Unlock a key type locked by key_type_lookup().
699 */ 737 */
700void key_type_put(struct key_type *ktype) 738void key_type_put(struct key_type *ktype)
701{ 739{
702 up_read(&key_types_sem); 740 up_read(&key_types_sem);
741}
703 742
704} /* end key_type_put() */
705
706/*****************************************************************************/
707/* 743/*
708 * attempt to update an existing key 744 * Attempt to update an existing key.
709 * - the key has an incremented refcount 745 *
710 * - we need to put the key if we get an error 746 * The key is given to us with an incremented refcount that we need to discard
747 * if we get an error.
711 */ 748 */
712static inline key_ref_t __key_update(key_ref_t key_ref, 749static inline key_ref_t __key_update(key_ref_t key_ref,
713 const void *payload, size_t plen) 750 const void *payload, size_t plen)
@@ -742,13 +779,32 @@ error:
742 key_put(key); 779 key_put(key);
743 key_ref = ERR_PTR(ret); 780 key_ref = ERR_PTR(ret);
744 goto out; 781 goto out;
782}
745 783
746} /* end __key_update() */ 784/**
747 785 * key_create_or_update - Update or create and instantiate a key.
748/*****************************************************************************/ 786 * @keyring_ref: A pointer to the destination keyring with possession flag.
749/* 787 * @type: The type of key.
750 * search the specified keyring for a key of the same description; if one is 788 * @description: The searchable description for the key.
751 * found, update it, otherwise add a new one 789 * @payload: The data to use to instantiate or update the key.
790 * @plen: The length of @payload.
791 * @perm: The permissions mask for a new key.
792 * @flags: The quota flags for a new key.
793 *
794 * Search the destination keyring for a key of the same description and if one
795 * is found, update it, otherwise create and instantiate a new one and create a
796 * link to it from that keyring.
797 *
798 * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be
799 * concocted.
800 *
801 * Returns a pointer to the new key if successful, -ENODEV if the key type
802 * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the
803 * caller isn't permitted to modify the keyring or the LSM did not permit
804 * creation of the key.
805 *
806 * On success, the possession flag from the keyring ref will be tacked on to
807 * the key ref before it is returned.
752 */ 808 */
753key_ref_t key_create_or_update(key_ref_t keyring_ref, 809key_ref_t key_create_or_update(key_ref_t keyring_ref,
754 const char *type, 810 const char *type,
@@ -758,7 +814,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
758 key_perm_t perm, 814 key_perm_t perm,
759 unsigned long flags) 815 unsigned long flags)
760{ 816{
761 struct keyring_list *prealloc; 817 unsigned long prealloc;
762 const struct cred *cred = current_cred(); 818 const struct cred *cred = current_cred();
763 struct key_type *ktype; 819 struct key_type *ktype;
764 struct key *keyring, *key = NULL; 820 struct key *keyring, *key = NULL;
@@ -855,14 +911,21 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
855 911
856 key_ref = __key_update(key_ref, payload, plen); 912 key_ref = __key_update(key_ref, payload, plen);
857 goto error; 913 goto error;
858 914}
859} /* end key_create_or_update() */
860
861EXPORT_SYMBOL(key_create_or_update); 915EXPORT_SYMBOL(key_create_or_update);
862 916
863/*****************************************************************************/ 917/**
864/* 918 * key_update - Update a key's contents.
865 * update a key 919 * @key_ref: The pointer (plus possession flag) to the key.
920 * @payload: The data to be used to update the key.
921 * @plen: The length of @payload.
922 *
923 * Attempt to update the contents of a key with the given payload data. The
924 * caller must be granted Write permission on the key. Negative keys can be
925 * instantiated by this method.
926 *
927 * Returns 0 on success, -EACCES if not permitted and -EOPNOTSUPP if the key
928 * type does not support updating. The key type may return other errors.
866 */ 929 */
867int key_update(key_ref_t key_ref, const void *payload, size_t plen) 930int key_update(key_ref_t key_ref, const void *payload, size_t plen)
868{ 931{
@@ -891,14 +954,17 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen)
891 954
892 error: 955 error:
893 return ret; 956 return ret;
894 957}
895} /* end key_update() */
896
897EXPORT_SYMBOL(key_update); 958EXPORT_SYMBOL(key_update);
898 959
899/*****************************************************************************/ 960/**
900/* 961 * key_revoke - Revoke a key.
901 * revoke a key 962 * @key: The key to be revoked.
963 *
964 * Mark a key as being revoked and ask the type to free up its resources. The
965 * revocation timeout is set and the key and all its links will be
966 * automatically garbage collected after key_gc_delay amount of time if they
967 * are not manually dealt with first.
902 */ 968 */
903void key_revoke(struct key *key) 969void key_revoke(struct key *key)
904{ 970{
@@ -926,14 +992,16 @@ void key_revoke(struct key *key)
926 } 992 }
927 993
928 up_write(&key->sem); 994 up_write(&key->sem);
929 995}
930} /* end key_revoke() */
931
932EXPORT_SYMBOL(key_revoke); 996EXPORT_SYMBOL(key_revoke);
933 997
934/*****************************************************************************/ 998/**
935/* 999 * register_key_type - Register a type of key.
936 * register a type of key 1000 * @ktype: The new key type.
1001 *
1002 * Register a new key type.
1003 *
1004 * Returns 0 on success or -EEXIST if a type of this name already exists.
937 */ 1005 */
938int register_key_type(struct key_type *ktype) 1006int register_key_type(struct key_type *ktype)
939{ 1007{
@@ -953,17 +1021,19 @@ int register_key_type(struct key_type *ktype)
953 list_add(&ktype->link, &key_types_list); 1021 list_add(&ktype->link, &key_types_list);
954 ret = 0; 1022 ret = 0;
955 1023
956 out: 1024out:
957 up_write(&key_types_sem); 1025 up_write(&key_types_sem);
958 return ret; 1026 return ret;
959 1027}
960} /* end register_key_type() */
961
962EXPORT_SYMBOL(register_key_type); 1028EXPORT_SYMBOL(register_key_type);
963 1029
964/*****************************************************************************/ 1030/**
965/* 1031 * unregister_key_type - Unregister a type of key.
966 * unregister a type of key 1032 * @ktype: The key type.
1033 *
1034 * Unregister a key type and mark all the extant keys of this type as dead.
1035 * Those keys of this type are then destroyed to get rid of their payloads and
1036 * they and their links will be garbage collected as soon as possible.
967 */ 1037 */
968void unregister_key_type(struct key_type *ktype) 1038void unregister_key_type(struct key_type *ktype)
969{ 1039{
@@ -1010,14 +1080,11 @@ void unregister_key_type(struct key_type *ktype)
1010 up_write(&key_types_sem); 1080 up_write(&key_types_sem);
1011 1081
1012 key_schedule_gc(0); 1082 key_schedule_gc(0);
1013 1083}
1014} /* end unregister_key_type() */
1015
1016EXPORT_SYMBOL(unregister_key_type); 1084EXPORT_SYMBOL(unregister_key_type);
1017 1085
1018/*****************************************************************************/
1019/* 1086/*
1020 * initialise the key management stuff 1087 * Initialise the key management state.
1021 */ 1088 */
1022void __init key_init(void) 1089void __init key_init(void)
1023{ 1090{
@@ -1037,5 +1104,4 @@ void __init key_init(void)
1037 1104
1038 rb_insert_color(&root_key_user.node, 1105 rb_insert_color(&root_key_user.node,
1039 &key_user_tree); 1106 &key_user_tree);
1040 1107}
1041} /* end key_init() */
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 60924f6a52d..31a0fd8189f 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1,4 +1,4 @@
1/* keyctl.c: userspace keyctl operations 1/* Userspace key control operations
2 * 2 *
3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -31,28 +31,24 @@ static int key_get_type_from_user(char *type,
31 int ret; 31 int ret;
32 32
33 ret = strncpy_from_user(type, _type, len); 33 ret = strncpy_from_user(type, _type, len);
34
35 if (ret < 0) 34 if (ret < 0)
36 return ret; 35 return ret;
37
38 if (ret == 0 || ret >= len) 36 if (ret == 0 || ret >= len)
39 return -EINVAL; 37 return -EINVAL;
40
41 if (type[0] == '.') 38 if (type[0] == '.')
42 return -EPERM; 39 return -EPERM;
43
44 type[len - 1] = '\0'; 40 type[len - 1] = '\0';
45
46 return 0; 41 return 0;
47} 42}
48 43
49/*****************************************************************************/
50/* 44/*
51 * extract the description of a new key from userspace and either add it as a 45 * Extract the description of a new key from userspace and either add it as a
52 * new key to the specified keyring or update a matching key in that keyring 46 * new key to the specified keyring or update a matching key in that keyring.
53 * - the keyring must be writable 47 *
54 * - returns the new key's serial number 48 * The keyring must be writable so that we can attach the key to it.
55 * - implements add_key() 49 *
50 * If successful, the new key's serial number is returned, otherwise an error
51 * code is returned.
56 */ 52 */
57SYSCALL_DEFINE5(add_key, const char __user *, _type, 53SYSCALL_DEFINE5(add_key, const char __user *, _type,
58 const char __user *, _description, 54 const char __user *, _description,
@@ -132,19 +128,20 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
132 kfree(description); 128 kfree(description);
133 error: 129 error:
134 return ret; 130 return ret;
131}
135 132
136} /* end sys_add_key() */
137
138/*****************************************************************************/
139/* 133/*
140 * search the process keyrings for a matching key 134 * Search the process keyrings and keyring trees linked from those for a
141 * - nested keyrings may also be searched if they have Search permission 135 * matching key. Keyrings must have appropriate Search permission to be
142 * - if a key is found, it will be attached to the destination keyring if 136 * searched.
143 * there's one specified 137 *
144 * - /sbin/request-key will be invoked if _callout_info is non-NULL 138 * If a key is found, it will be attached to the destination keyring if there's
145 * - the _callout_info string will be passed to /sbin/request-key 139 * one specified and the serial number of the key will be returned.
146 * - if the _callout_info string is empty, it will be rendered as "-" 140 *
147 * - implements request_key() 141 * If no key is found, /sbin/request-key will be invoked if _callout_info is
142 * non-NULL in an attempt to create a key. The _callout_info string will be
143 * passed to /sbin/request-key to aid with completing the request. If the
144 * _callout_info string is "" then it will be changed to "-".
148 */ 145 */
149SYSCALL_DEFINE4(request_key, const char __user *, _type, 146SYSCALL_DEFINE4(request_key, const char __user *, _type,
150 const char __user *, _description, 147 const char __user *, _description,
@@ -222,14 +219,14 @@ error2:
222 kfree(description); 219 kfree(description);
223error: 220error:
224 return ret; 221 return ret;
222}
225 223
226} /* end sys_request_key() */
227
228/*****************************************************************************/
229/* 224/*
230 * get the ID of the specified process keyring 225 * Get the ID of the specified process keyring.
231 * - the keyring must have search permission to be found 226 *
232 * - implements keyctl(KEYCTL_GET_KEYRING_ID) 227 * The requested keyring must have search permission to be found.
228 *
229 * If successful, the ID of the requested keyring will be returned.
233 */ 230 */
234long keyctl_get_keyring_ID(key_serial_t id, int create) 231long keyctl_get_keyring_ID(key_serial_t id, int create)
235{ 232{
@@ -248,13 +245,17 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
248 key_ref_put(key_ref); 245 key_ref_put(key_ref);
249error: 246error:
250 return ret; 247 return ret;
248}
251 249
252} /* end keyctl_get_keyring_ID() */
253
254/*****************************************************************************/
255/* 250/*
256 * join the session keyring 251 * Join a (named) session keyring.
257 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING) 252 *
253 * Create and join an anonymous session keyring or join a named session
254 * keyring, creating it if necessary. A named session keyring must have Search
255 * permission for it to be joined. Session keyrings without this permit will
256 * be skipped over.
257 *
258 * If successful, the ID of the joined session keyring will be returned.
258 */ 259 */
259long keyctl_join_session_keyring(const char __user *_name) 260long keyctl_join_session_keyring(const char __user *_name)
260{ 261{
@@ -277,14 +278,17 @@ long keyctl_join_session_keyring(const char __user *_name)
277 278
278error: 279error:
279 return ret; 280 return ret;
281}
280 282
281} /* end keyctl_join_session_keyring() */
282
283/*****************************************************************************/
284/* 283/*
285 * update a key's data payload 284 * Update a key's data payload from the given data.
286 * - the key must be writable 285 *
287 * - implements keyctl(KEYCTL_UPDATE) 286 * The key must grant the caller Write permission and the key type must support
287 * updating for this to work. A negative key can be positively instantiated
288 * with this call.
289 *
290 * If successful, 0 will be returned. If the key type does not support
291 * updating, then -EOPNOTSUPP will be returned.
288 */ 292 */
289long keyctl_update_key(key_serial_t id, 293long keyctl_update_key(key_serial_t id,
290 const void __user *_payload, 294 const void __user *_payload,
@@ -326,14 +330,17 @@ error2:
326 kfree(payload); 330 kfree(payload);
327error: 331error:
328 return ret; 332 return ret;
333}
329 334
330} /* end keyctl_update_key() */
331
332/*****************************************************************************/
333/* 335/*
334 * revoke a key 336 * Revoke a key.
335 * - the key must be writable 337 *
336 * - implements keyctl(KEYCTL_REVOKE) 338 * The key must be grant the caller Write or Setattr permission for this to
339 * work. The key type should give up its quota claim when revoked. The key
340 * and any links to the key will be automatically garbage collected after a
341 * certain amount of time (/proc/sys/kernel/keys/gc_delay).
342 *
343 * If successful, 0 is returned.
337 */ 344 */
338long keyctl_revoke_key(key_serial_t id) 345long keyctl_revoke_key(key_serial_t id)
339{ 346{
@@ -358,14 +365,14 @@ long keyctl_revoke_key(key_serial_t id)
358 key_ref_put(key_ref); 365 key_ref_put(key_ref);
359error: 366error:
360 return ret; 367 return ret;
368}
361 369
362} /* end keyctl_revoke_key() */
363
364/*****************************************************************************/
365/* 370/*
366 * clear the specified process keyring 371 * Clear the specified keyring, creating an empty process keyring if one of the
367 * - the keyring must be writable 372 * special keyring IDs is used.
368 * - implements keyctl(KEYCTL_CLEAR) 373 *
374 * The keyring must grant the caller Write permission for this to work. If
375 * successful, 0 will be returned.
369 */ 376 */
370long keyctl_keyring_clear(key_serial_t ringid) 377long keyctl_keyring_clear(key_serial_t ringid)
371{ 378{
@@ -383,15 +390,18 @@ long keyctl_keyring_clear(key_serial_t ringid)
383 key_ref_put(keyring_ref); 390 key_ref_put(keyring_ref);
384error: 391error:
385 return ret; 392 return ret;
393}
386 394
387} /* end keyctl_keyring_clear() */
388
389/*****************************************************************************/
390/* 395/*
391 * link a key into a keyring 396 * Create a link from a keyring to a key if there's no matching key in the
392 * - the keyring must be writable 397 * keyring, otherwise replace the link to the matching key with a link to the
393 * - the key must be linkable 398 * new key.
394 * - implements keyctl(KEYCTL_LINK) 399 *
400 * The key must grant the caller Link permission and the the keyring must grant
401 * the caller Write permission. Furthermore, if an additional link is created,
402 * the keyring's quota will be extended.
403 *
404 * If successful, 0 will be returned.
395 */ 405 */
396long keyctl_keyring_link(key_serial_t id, key_serial_t ringid) 406long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
397{ 407{
@@ -417,15 +427,16 @@ error2:
417 key_ref_put(keyring_ref); 427 key_ref_put(keyring_ref);
418error: 428error:
419 return ret; 429 return ret;
430}
420 431
421} /* end keyctl_keyring_link() */
422
423/*****************************************************************************/
424/* 432/*
425 * unlink the first attachment of a key from a keyring 433 * Unlink a key from a keyring.
426 * - the keyring must be writable 434 *
427 * - we don't need any permissions on the key 435 * The keyring must grant the caller Write permission for this to work; the key
428 * - implements keyctl(KEYCTL_UNLINK) 436 * itself need not grant the caller anything. If the last link to a key is
437 * removed then that key will be scheduled for destruction.
438 *
439 * If successful, 0 will be returned.
429 */ 440 */
430long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid) 441long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
431{ 442{
@@ -451,19 +462,20 @@ error2:
451 key_ref_put(keyring_ref); 462 key_ref_put(keyring_ref);
452error: 463error:
453 return ret; 464 return ret;
465}
454 466
455} /* end keyctl_keyring_unlink() */
456
457/*****************************************************************************/
458/* 467/*
459 * describe a user key 468 * Return a description of a key to userspace.
460 * - the key must have view permission 469 *
461 * - if there's a buffer, we place up to buflen bytes of data into it 470 * The key must grant the caller View permission for this to work.
462 * - unless there's an error, we return the amount of description available, 471 *
463 * irrespective of how much we may have copied 472 * If there's a buffer, we place up to buflen bytes of data into it formatted
464 * - the description is formatted thus: 473 * in the following way:
474 *
465 * type;uid;gid;perm;description<NUL> 475 * type;uid;gid;perm;description<NUL>
466 * - implements keyctl(KEYCTL_DESCRIBE) 476 *
477 * If successful, we return the amount of description available, irrespective
478 * of how much we may have copied into the buffer.
467 */ 479 */
468long keyctl_describe_key(key_serial_t keyid, 480long keyctl_describe_key(key_serial_t keyid,
469 char __user *buffer, 481 char __user *buffer,
@@ -531,18 +543,17 @@ error2:
531 key_ref_put(key_ref); 543 key_ref_put(key_ref);
532error: 544error:
533 return ret; 545 return ret;
546}
534 547
535} /* end keyctl_describe_key() */
536
537/*****************************************************************************/
538/* 548/*
539 * search the specified keyring for a matching key 549 * Search the specified keyring and any keyrings it links to for a matching
540 * - the start keyring must be searchable 550 * key. Only keyrings that grant the caller Search permission will be searched
541 * - nested keyrings may also be searched if they are searchable 551 * (this includes the starting keyring). Only keys with Search permission can
542 * - only keys with search permission may be found 552 * be found.
543 * - if a key is found, it will be attached to the destination keyring if 553 *
544 * there's one specified 554 * If successful, the found key will be linked to the destination keyring if
545 * - implements keyctl(KEYCTL_SEARCH) 555 * supplied and the key has Link permission, and the found key ID will be
556 * returned.
546 */ 557 */
547long keyctl_keyring_search(key_serial_t ringid, 558long keyctl_keyring_search(key_serial_t ringid,
548 const char __user *_type, 559 const char __user *_type,
@@ -626,18 +637,17 @@ error2:
626 kfree(description); 637 kfree(description);
627error: 638error:
628 return ret; 639 return ret;
640}
629 641
630} /* end keyctl_keyring_search() */
631
632/*****************************************************************************/
633/* 642/*
634 * read a user key's payload 643 * Read a key's payload.
635 * - the keyring must be readable or the key must be searchable from the 644 *
636 * process's keyrings 645 * The key must either grant the caller Read permission, or it must grant the
637 * - if there's a buffer, we place up to buflen bytes of data into it 646 * caller Search permission when searched for from the process keyrings.
638 * - unless there's an error, we return the amount of data in the key, 647 *
639 * irrespective of how much we may have copied 648 * If successful, we place up to buflen bytes of data into the buffer, if one
640 * - implements keyctl(KEYCTL_READ) 649 * is provided, and return the amount of data that is available in the key,
650 * irrespective of how much we copied into the buffer.
641 */ 651 */
642long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) 652long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
643{ 653{
@@ -688,15 +698,22 @@ error2:
688 key_put(key); 698 key_put(key);
689error: 699error:
690 return ret; 700 return ret;
701}
691 702
692} /* end keyctl_read_key() */
693
694/*****************************************************************************/
695/* 703/*
696 * change the ownership of a key 704 * Change the ownership of a key
697 * - the keyring owned by the changer 705 *
698 * - if the uid or gid is -1, then that parameter is not changed 706 * The key must grant the caller Setattr permission for this to work, though
699 * - implements keyctl(KEYCTL_CHOWN) 707 * the key need not be fully instantiated yet. For the UID to be changed, or
708 * for the GID to be changed to a group the caller is not a member of, the
709 * caller must have sysadmin capability. If either uid or gid is -1 then that
710 * attribute is not changed.
711 *
712 * If the UID is to be changed, the new user must have sufficient quota to
713 * accept the key. The quota deduction will be removed from the old user to
714 * the new user should the attribute be changed.
715 *
716 * If successful, 0 will be returned.
700 */ 717 */
701long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid) 718long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
702{ 719{
@@ -796,14 +813,14 @@ quota_overrun:
796 zapowner = newowner; 813 zapowner = newowner;
797 ret = -EDQUOT; 814 ret = -EDQUOT;
798 goto error_put; 815 goto error_put;
816}
799 817
800} /* end keyctl_chown_key() */
801
802/*****************************************************************************/
803/* 818/*
804 * change the permission mask on a key 819 * Change the permission mask on a key.
805 * - the keyring owned by the changer 820 *
806 * - implements keyctl(KEYCTL_SETPERM) 821 * The key must grant the caller Setattr permission for this to work, though
822 * the key need not be fully instantiated yet. If the caller does not have
823 * sysadmin capability, it may only change the permission on keys that it owns.
807 */ 824 */
808long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 825long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
809{ 826{
@@ -838,11 +855,11 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
838 key_put(key); 855 key_put(key);
839error: 856error:
840 return ret; 857 return ret;
841 858}
842} /* end keyctl_setperm_key() */
843 859
844/* 860/*
845 * get the destination keyring for instantiation 861 * Get the destination keyring for instantiation and check that the caller has
862 * Write permission on it.
846 */ 863 */
847static long get_instantiation_keyring(key_serial_t ringid, 864static long get_instantiation_keyring(key_serial_t ringid,
848 struct request_key_auth *rka, 865 struct request_key_auth *rka,
@@ -879,7 +896,7 @@ static long get_instantiation_keyring(key_serial_t ringid,
879} 896}
880 897
881/* 898/*
882 * change the request_key authorisation key on the current process 899 * Change the request_key authorisation key on the current process.
883 */ 900 */
884static int keyctl_change_reqkey_auth(struct key *key) 901static int keyctl_change_reqkey_auth(struct key *key)
885{ 902{
@@ -895,10 +912,14 @@ static int keyctl_change_reqkey_auth(struct key *key)
895 return commit_creds(new); 912 return commit_creds(new);
896} 913}
897 914
898/*****************************************************************************/
899/* 915/*
900 * instantiate the key with the specified payload, and, if one is given, link 916 * Instantiate a key with the specified payload and link the key into the
901 * the key into the keyring 917 * destination keyring if one is given.
918 *
919 * The caller must have the appropriate instantiation permit set for this to
920 * work (see keyctl_assume_authority). No other permissions are required.
921 *
922 * If successful, 0 will be returned.
902 */ 923 */
903long keyctl_instantiate_key(key_serial_t id, 924long keyctl_instantiate_key(key_serial_t id,
904 const void __user *_payload, 925 const void __user *_payload,
@@ -973,13 +994,22 @@ error2:
973 vfree(payload); 994 vfree(payload);
974error: 995error:
975 return ret; 996 return ret;
997}
976 998
977} /* end keyctl_instantiate_key() */
978
979/*****************************************************************************/
980/* 999/*
981 * negatively instantiate the key with the given timeout (in seconds), and, if 1000 * Negatively instantiate the key with the given timeout (in seconds) and link
982 * one is given, link the key into the keyring 1001 * the key into the destination keyring if one is given.
1002 *
1003 * The caller must have the appropriate instantiation permit set for this to
1004 * work (see keyctl_assume_authority). No other permissions are required.
1005 *
1006 * The key and any links to the key will be automatically garbage collected
1007 * after the timeout expires.
1008 *
1009 * Negative keys are used to rate limit repeated request_key() calls by causing
1010 * them to return -ENOKEY until the negative key expires.
1011 *
1012 * If successful, 0 will be returned.
983 */ 1013 */
984long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid) 1014long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
985{ 1015{
@@ -1020,13 +1050,14 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1020 1050
1021error: 1051error:
1022 return ret; 1052 return ret;
1053}
1023 1054
1024} /* end keyctl_negate_key() */
1025
1026/*****************************************************************************/
1027/* 1055/*
1028 * set the default keyring in which request_key() will cache keys 1056 * Read or set the default keyring in which request_key() will cache keys and
1029 * - return the old setting 1057 * return the old setting.
1058 *
1059 * If a process keyring is specified then this will be created if it doesn't
1060 * yet exist. The old setting will be returned if successful.
1030 */ 1061 */
1031long keyctl_set_reqkey_keyring(int reqkey_defl) 1062long keyctl_set_reqkey_keyring(int reqkey_defl)
1032{ 1063{
@@ -1079,12 +1110,19 @@ set:
1079error: 1110error:
1080 abort_creds(new); 1111 abort_creds(new);
1081 return ret; 1112 return ret;
1113}
1082 1114
1083} /* end keyctl_set_reqkey_keyring() */
1084
1085/*****************************************************************************/
1086/* 1115/*
1087 * set or clear the timeout for a key 1116 * Set or clear the timeout on a key.
1117 *
1118 * Either the key must grant the caller Setattr permission or else the caller
1119 * must hold an instantiation authorisation token for the key.
1120 *
1121 * The timeout is either 0 to clear the timeout, or a number of seconds from
1122 * the current time. The key and any links to the key will be automatically
1123 * garbage collected after the timeout expires.
1124 *
1125 * If successful, 0 is returned.
1088 */ 1126 */
1089long keyctl_set_timeout(key_serial_t id, unsigned timeout) 1127long keyctl_set_timeout(key_serial_t id, unsigned timeout)
1090{ 1128{
@@ -1136,12 +1174,24 @@ okay:
1136 ret = 0; 1174 ret = 0;
1137error: 1175error:
1138 return ret; 1176 return ret;
1177}
1139 1178
1140} /* end keyctl_set_timeout() */
1141
1142/*****************************************************************************/
1143/* 1179/*
1144 * assume the authority to instantiate the specified key 1180 * Assume (or clear) the authority to instantiate the specified key.
1181 *
1182 * This sets the authoritative token currently in force for key instantiation.
1183 * This must be done for a key to be instantiated. It has the effect of making
1184 * available all the keys from the caller of the request_key() that created a
1185 * key to request_key() calls made by the caller of this function.
1186 *
1187 * The caller must have the instantiation key in their process keyrings with a
1188 * Search permission grant available to the caller.
1189 *
1190 * If the ID given is 0, then the setting will be cleared and 0 returned.
1191 *
1192 * If the ID given has a matching an authorisation key, then that key will be
1193 * set and its ID will be returned. The authorisation key can be read to get
1194 * the callout information passed to request_key().
1145 */ 1195 */
1146long keyctl_assume_authority(key_serial_t id) 1196long keyctl_assume_authority(key_serial_t id)
1147{ 1197{
@@ -1178,16 +1228,17 @@ long keyctl_assume_authority(key_serial_t id)
1178 ret = authkey->serial; 1228 ret = authkey->serial;
1179error: 1229error:
1180 return ret; 1230 return ret;
1181 1231}
1182} /* end keyctl_assume_authority() */
1183 1232
1184/* 1233/*
1185 * get the security label of a key 1234 * Get a key's the LSM security label.
1186 * - the key must grant us view permission 1235 *
1187 * - if there's a buffer, we place up to buflen bytes of data into it 1236 * The key must grant the caller View permission for this to work.
1188 * - unless there's an error, we return the amount of information available, 1237 *
1189 * irrespective of how much we may have copied (including the terminal NUL) 1238 * If there's a buffer, then up to buflen bytes of data will be placed into it.
1190 * - implements keyctl(KEYCTL_GET_SECURITY) 1239 *
1240 * If successful, the amount of information available will be returned,
1241 * irrespective of how much was copied (including the terminal NUL).
1191 */ 1242 */
1192long keyctl_get_security(key_serial_t keyid, 1243long keyctl_get_security(key_serial_t keyid,
1193 char __user *buffer, 1244 char __user *buffer,
@@ -1242,10 +1293,16 @@ long keyctl_get_security(key_serial_t keyid,
1242} 1293}
1243 1294
1244/* 1295/*
1245 * attempt to install the calling process's session keyring on the process's 1296 * Attempt to install the calling process's session keyring on the process's
1246 * parent process 1297 * parent process.
1247 * - the keyring must exist and must grant us LINK permission 1298 *
1248 * - implements keyctl(KEYCTL_SESSION_TO_PARENT) 1299 * The keyring must exist and must grant the caller LINK permission, and the
1300 * parent process must be single-threaded and must have the same effective
1301 * ownership as this process and mustn't be SUID/SGID.
1302 *
1303 * The keyring will be emplaced on the parent when it next resumes userspace.
1304 *
1305 * If successful, 0 will be returned.
1249 */ 1306 */
1250long keyctl_session_to_parent(void) 1307long keyctl_session_to_parent(void)
1251{ 1308{
@@ -1348,9 +1405,8 @@ error_keyring:
1348#endif /* !TIF_NOTIFY_RESUME */ 1405#endif /* !TIF_NOTIFY_RESUME */
1349} 1406}
1350 1407
1351/*****************************************************************************/
1352/* 1408/*
1353 * the key control system call 1409 * The key control system call
1354 */ 1410 */
1355SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3, 1411SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1356 unsigned long, arg4, unsigned long, arg5) 1412 unsigned long, arg4, unsigned long, arg5)
@@ -1439,5 +1495,4 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1439 default: 1495 default:
1440 return -EOPNOTSUPP; 1496 return -EOPNOTSUPP;
1441 } 1497 }
1442 1498}
1443} /* end sys_keyctl() */
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d37f713e73c..5620f084ded 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -25,14 +25,16 @@
25 (keyring)->payload.subscriptions, \ 25 (keyring)->payload.subscriptions, \
26 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem))) 26 rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
27 27
28#define KEY_LINK_FIXQUOTA 1UL
29
28/* 30/*
29 * when plumbing the depths of the key tree, this sets a hard limit set on how 31 * When plumbing the depths of the key tree, this sets a hard limit
30 * deep we're willing to go 32 * set on how deep we're willing to go.
31 */ 33 */
32#define KEYRING_SEARCH_MAX_DEPTH 6 34#define KEYRING_SEARCH_MAX_DEPTH 6
33 35
34/* 36/*
35 * we keep all named keyrings in a hash to speed looking them up 37 * We keep all named keyrings in a hash to speed looking them up.
36 */ 38 */
37#define KEYRING_NAME_HASH_SIZE (1 << 5) 39#define KEYRING_NAME_HASH_SIZE (1 << 5)
38 40
@@ -50,7 +52,9 @@ static inline unsigned keyring_hash(const char *desc)
50} 52}
51 53
52/* 54/*
53 * the keyring type definition 55 * The keyring key type definition. Keyrings are simply keys of this type and
56 * can be treated as ordinary keys in addition to having their own special
57 * operations.
54 */ 58 */
55static int keyring_instantiate(struct key *keyring, 59static int keyring_instantiate(struct key *keyring,
56 const void *data, size_t datalen); 60 const void *data, size_t datalen);
@@ -71,19 +75,17 @@ struct key_type key_type_keyring = {
71 .describe = keyring_describe, 75 .describe = keyring_describe,
72 .read = keyring_read, 76 .read = keyring_read,
73}; 77};
74
75EXPORT_SYMBOL(key_type_keyring); 78EXPORT_SYMBOL(key_type_keyring);
76 79
77/* 80/*
78 * semaphore to serialise link/link calls to prevent two link calls in parallel 81 * Semaphore to serialise link/link calls to prevent two link calls in parallel
79 * introducing a cycle 82 * introducing a cycle.
80 */ 83 */
81static DECLARE_RWSEM(keyring_serialise_link_sem); 84static DECLARE_RWSEM(keyring_serialise_link_sem);
82 85
83/*****************************************************************************/
84/* 86/*
85 * publish the name of a keyring so that it can be found by name (if it has 87 * Publish the name of a keyring so that it can be found by name (if it has
86 * one) 88 * one).
87 */ 89 */
88static void keyring_publish_name(struct key *keyring) 90static void keyring_publish_name(struct key *keyring)
89{ 91{
@@ -102,13 +104,12 @@ static void keyring_publish_name(struct key *keyring)
102 104
103 write_unlock(&keyring_name_lock); 105 write_unlock(&keyring_name_lock);
104 } 106 }
107}
105 108
106} /* end keyring_publish_name() */
107
108/*****************************************************************************/
109/* 109/*
110 * initialise a keyring 110 * Initialise a keyring.
111 * - we object if we were given any data 111 *
112 * Returns 0 on success, -EINVAL if given any data.
112 */ 113 */
113static int keyring_instantiate(struct key *keyring, 114static int keyring_instantiate(struct key *keyring,
114 const void *data, size_t datalen) 115 const void *data, size_t datalen)
@@ -123,23 +124,20 @@ static int keyring_instantiate(struct key *keyring,
123 } 124 }
124 125
125 return ret; 126 return ret;
127}
126 128
127} /* end keyring_instantiate() */
128
129/*****************************************************************************/
130/* 129/*
131 * match keyrings on their name 130 * Match keyrings on their name
132 */ 131 */
133static int keyring_match(const struct key *keyring, const void *description) 132static int keyring_match(const struct key *keyring, const void *description)
134{ 133{
135 return keyring->description && 134 return keyring->description &&
136 strcmp(keyring->description, description) == 0; 135 strcmp(keyring->description, description) == 0;
136}
137 137
138} /* end keyring_match() */
139
140/*****************************************************************************/
141/* 138/*
142 * dispose of the data dangling from the corpse of a keyring 139 * Clean up a keyring when it is destroyed. Unpublish its name if it had one
140 * and dispose of its data.
143 */ 141 */
144static void keyring_destroy(struct key *keyring) 142static void keyring_destroy(struct key *keyring)
145{ 143{
@@ -164,12 +162,10 @@ static void keyring_destroy(struct key *keyring)
164 key_put(klist->keys[loop]); 162 key_put(klist->keys[loop]);
165 kfree(klist); 163 kfree(klist);
166 } 164 }
165}
167 166
168} /* end keyring_destroy() */
169
170/*****************************************************************************/
171/* 167/*
172 * describe the keyring 168 * Describe a keyring for /proc.
173 */ 169 */
174static void keyring_describe(const struct key *keyring, struct seq_file *m) 170static void keyring_describe(const struct key *keyring, struct seq_file *m)
175{ 171{
@@ -187,13 +183,12 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
187 else 183 else
188 seq_puts(m, ": empty"); 184 seq_puts(m, ": empty");
189 rcu_read_unlock(); 185 rcu_read_unlock();
186}
190 187
191} /* end keyring_describe() */
192
193/*****************************************************************************/
194/* 188/*
195 * read a list of key IDs from the keyring's contents 189 * Read a list of key IDs from the keyring's contents in binary form
196 * - the keyring's semaphore is read-locked 190 *
191 * The keyring's semaphore is read-locked by the caller.
197 */ 192 */
198static long keyring_read(const struct key *keyring, 193static long keyring_read(const struct key *keyring,
199 char __user *buffer, size_t buflen) 194 char __user *buffer, size_t buflen)
@@ -241,12 +236,10 @@ static long keyring_read(const struct key *keyring,
241 236
242error: 237error:
243 return ret; 238 return ret;
239}
244 240
245} /* end keyring_read() */
246
247/*****************************************************************************/
248/* 241/*
249 * allocate a keyring and link into the destination keyring 242 * Allocate a keyring and link into the destination keyring.
250 */ 243 */
251struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, 244struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
252 const struct cred *cred, unsigned long flags, 245 const struct cred *cred, unsigned long flags,
@@ -269,20 +262,42 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
269 } 262 }
270 263
271 return keyring; 264 return keyring;
265}
272 266
273} /* end keyring_alloc() */ 267/**
274 268 * keyring_search_aux - Search a keyring tree for a key matching some criteria
275/*****************************************************************************/ 269 * @keyring_ref: A pointer to the keyring with possession indicator.
276/* 270 * @cred: The credentials to use for permissions checks.
277 * search the supplied keyring tree for a key that matches the criterion 271 * @type: The type of key to search for.
278 * - perform a breadth-then-depth search up to the prescribed limit 272 * @description: Parameter for @match.
279 * - we only find keys on which we have search permission 273 * @match: Function to rule on whether or not a key is the one required.
280 * - we use the supplied match function to see if the description (or other 274 *
281 * feature of interest) matches 275 * Search the supplied keyring tree for a key that matches the criteria given.
282 * - we rely on RCU to prevent the keyring lists from disappearing on us 276 * The root keyring and any linked keyrings must grant Search permission to the
283 * - we return -EAGAIN if we didn't find any matching key 277 * caller to be searchable and keys can only be found if they too grant Search
284 * - we return -ENOKEY if we only found negative matching keys 278 * to the caller. The possession flag on the root keyring pointer controls use
285 * - we propagate the possession attribute from the keyring ref to the key ref 279 * of the possessor bits in permissions checking of the entire tree. In
280 * addition, the LSM gets to forbid keyring searches and key matches.
281 *
282 * The search is performed as a breadth-then-depth search up to the prescribed
283 * limit (KEYRING_SEARCH_MAX_DEPTH).
284 *
285 * Keys are matched to the type provided and are then filtered by the match
286 * function, which is given the description to use in any way it sees fit. The
287 * match function may use any attributes of a key that it wishes to to
288 * determine the match. Normally the match function from the key type would be
289 * used.
290 *
291 * RCU is used to prevent the keyring key lists from disappearing without the
292 * need to take lots of locks.
293 *
294 * Returns a pointer to the found key and increments the key usage count if
295 * successful; -EAGAIN if no matching keys were found, or if expired or revoked
296 * keys were found; -ENOKEY if only negative keys were found; -ENOTDIR if the
297 * specified keyring wasn't a keyring.
298 *
299 * In the case of a successful return, the possession attribute from
300 * @keyring_ref is propagated to the returned key reference.
286 */ 301 */
287key_ref_t keyring_search_aux(key_ref_t keyring_ref, 302key_ref_t keyring_search_aux(key_ref_t keyring_ref,
288 const struct cred *cred, 303 const struct cred *cred,
@@ -444,17 +459,16 @@ error_2:
444 rcu_read_unlock(); 459 rcu_read_unlock();
445error: 460error:
446 return key_ref; 461 return key_ref;
462}
447 463
448} /* end keyring_search_aux() */ 464/**
449 465 * keyring_search - Search the supplied keyring tree for a matching key
450/*****************************************************************************/ 466 * @keyring: The root of the keyring tree to be searched.
451/* 467 * @type: The type of keyring we want to find.
452 * search the supplied keyring tree for a key that matches the criterion 468 * @description: The name of the keyring we want to find.
453 * - perform a breadth-then-depth search up to the prescribed limit 469 *
454 * - we only find keys on which we have search permission 470 * As keyring_search_aux() above, but using the current task's credentials and
455 * - we readlock the keyrings as we search down the tree 471 * type's default matching function.
456 * - we return -EAGAIN if we didn't find any matching key
457 * - we return -ENOKEY if we only found negative matching keys
458 */ 472 */
459key_ref_t keyring_search(key_ref_t keyring, 473key_ref_t keyring_search(key_ref_t keyring,
460 struct key_type *type, 474 struct key_type *type,
@@ -465,16 +479,23 @@ key_ref_t keyring_search(key_ref_t keyring,
465 479
466 return keyring_search_aux(keyring, current->cred, 480 return keyring_search_aux(keyring, current->cred,
467 type, description, type->match); 481 type, description, type->match);
468 482}
469} /* end keyring_search() */
470
471EXPORT_SYMBOL(keyring_search); 483EXPORT_SYMBOL(keyring_search);
472 484
473/*****************************************************************************/
474/* 485/*
475 * search the given keyring only (no recursion) 486 * Search the given keyring only (no recursion).
476 * - keyring must be locked by caller 487 *
477 * - caller must guarantee that the keyring is a keyring 488 * The caller must guarantee that the keyring is a keyring and that the
489 * permission is granted to search the keyring as no check is made here.
490 *
491 * RCU is used to make it unnecessary to lock the keyring key list here.
492 *
493 * Returns a pointer to the found key with usage count incremented if
494 * successful and returns -ENOKEY if not found. Revoked keys and keys not
495 * providing the requested permission are skipped over.
496 *
497 * If successful, the possession indicator is propagated from the keyring ref
498 * to the returned key reference.
478 */ 499 */
479key_ref_t __keyring_search_one(key_ref_t keyring_ref, 500key_ref_t __keyring_search_one(key_ref_t keyring_ref,
480 const struct key_type *ktype, 501 const struct key_type *ktype,
@@ -514,14 +535,18 @@ found:
514 atomic_inc(&key->usage); 535 atomic_inc(&key->usage);
515 rcu_read_unlock(); 536 rcu_read_unlock();
516 return make_key_ref(key, possessed); 537 return make_key_ref(key, possessed);
538}
517 539
518} /* end __keyring_search_one() */
519
520/*****************************************************************************/
521/* 540/*
522 * find a keyring with the specified name 541 * Find a keyring with the specified name.
523 * - all named keyrings are searched 542 *
524 * - normally only finds keyrings with search permission for the current process 543 * All named keyrings in the current user namespace are searched, provided they
544 * grant Search permission directly to the caller (unless this check is
545 * skipped). Keyrings whose usage points have reached zero or who have been
546 * revoked are skipped.
547 *
548 * Returns a pointer to the keyring with the keyring's refcount having being
549 * incremented on success. -ENOKEY is returned if a key could not be found.
525 */ 550 */
526struct key *find_keyring_by_name(const char *name, bool skip_perm_check) 551struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
527{ 552{
@@ -569,15 +594,14 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
569out: 594out:
570 read_unlock(&keyring_name_lock); 595 read_unlock(&keyring_name_lock);
571 return keyring; 596 return keyring;
597}
572 598
573} /* end find_keyring_by_name() */
574
575/*****************************************************************************/
576/* 599/*
577 * see if a cycle will will be created by inserting acyclic tree B in acyclic 600 * See if a cycle will will be created by inserting acyclic tree B in acyclic
578 * tree A at the topmost level (ie: as a direct child of A) 601 * tree A at the topmost level (ie: as a direct child of A).
579 * - since we are adding B to A at the top level, checking for cycles should 602 *
580 * just be a matter of seeing if node A is somewhere in tree B 603 * Since we are adding B to A at the top level, checking for cycles should just
604 * be a matter of seeing if node A is somewhere in tree B.
581 */ 605 */
582static int keyring_detect_cycle(struct key *A, struct key *B) 606static int keyring_detect_cycle(struct key *A, struct key *B)
583{ 607{
@@ -657,11 +681,10 @@ too_deep:
657cycle_detected: 681cycle_detected:
658 ret = -EDEADLK; 682 ret = -EDEADLK;
659 goto error; 683 goto error;
660 684}
661} /* end keyring_detect_cycle() */
662 685
663/* 686/*
664 * dispose of a keyring list after the RCU grace period, freeing the unlinked 687 * Dispose of a keyring list after the RCU grace period, freeing the unlinked
665 * key 688 * key
666 */ 689 */
667static void keyring_unlink_rcu_disposal(struct rcu_head *rcu) 690static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
@@ -675,14 +698,14 @@ static void keyring_unlink_rcu_disposal(struct rcu_head *rcu)
675} 698}
676 699
677/* 700/*
678 * preallocate memory so that a key can be linked into to a keyring 701 * Preallocate memory so that a key can be linked into to a keyring.
679 */ 702 */
680int __key_link_begin(struct key *keyring, const struct key_type *type, 703int __key_link_begin(struct key *keyring, const struct key_type *type,
681 const char *description, 704 const char *description, unsigned long *_prealloc)
682 struct keyring_list **_prealloc)
683 __acquires(&keyring->sem) 705 __acquires(&keyring->sem)
684{ 706{
685 struct keyring_list *klist, *nklist; 707 struct keyring_list *klist, *nklist;
708 unsigned long prealloc;
686 unsigned max; 709 unsigned max;
687 size_t size; 710 size_t size;
688 int loop, ret; 711 int loop, ret;
@@ -725,6 +748,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
725 748
726 /* note replacement slot */ 749 /* note replacement slot */
727 klist->delkey = nklist->delkey = loop; 750 klist->delkey = nklist->delkey = loop;
751 prealloc = (unsigned long)nklist;
728 goto done; 752 goto done;
729 } 753 }
730 } 754 }
@@ -739,6 +763,7 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
739 if (klist && klist->nkeys < klist->maxkeys) { 763 if (klist && klist->nkeys < klist->maxkeys) {
740 /* there's sufficient slack space to append directly */ 764 /* there's sufficient slack space to append directly */
741 nklist = NULL; 765 nklist = NULL;
766 prealloc = KEY_LINK_FIXQUOTA;
742 } else { 767 } else {
743 /* grow the key list */ 768 /* grow the key list */
744 max = 4; 769 max = 4;
@@ -773,8 +798,9 @@ int __key_link_begin(struct key *keyring, const struct key_type *type,
773 nklist->keys[nklist->delkey] = NULL; 798 nklist->keys[nklist->delkey] = NULL;
774 } 799 }
775 800
801 prealloc = (unsigned long)nklist | KEY_LINK_FIXQUOTA;
776done: 802done:
777 *_prealloc = nklist; 803 *_prealloc = prealloc;
778 kleave(" = 0"); 804 kleave(" = 0");
779 return 0; 805 return 0;
780 806
@@ -792,10 +818,10 @@ error_krsem:
792} 818}
793 819
794/* 820/*
795 * check already instantiated keys aren't going to be a problem 821 * Check already instantiated keys aren't going to be a problem.
796 * - the caller must have called __key_link_begin() 822 *
797 * - don't need to call this for keys that were created since __key_link_begin() 823 * The caller must have called __key_link_begin(). Don't need to call this for
798 * was called 824 * keys that were created since __key_link_begin() was called.
799 */ 825 */
800int __key_link_check_live_key(struct key *keyring, struct key *key) 826int __key_link_check_live_key(struct key *keyring, struct key *key)
801{ 827{
@@ -807,17 +833,20 @@ int __key_link_check_live_key(struct key *keyring, struct key *key)
807} 833}
808 834
809/* 835/*
810 * link a key into to a keyring 836 * Link a key into to a keyring.
811 * - must be called with __key_link_begin() having being called 837 *
812 * - discard already extant link to matching key if there is one 838 * Must be called with __key_link_begin() having being called. Discards any
839 * already extant link to matching key if there is one, so that each keyring
840 * holds at most one link to any given key of a particular type+description
841 * combination.
813 */ 842 */
814void __key_link(struct key *keyring, struct key *key, 843void __key_link(struct key *keyring, struct key *key,
815 struct keyring_list **_prealloc) 844 unsigned long *_prealloc)
816{ 845{
817 struct keyring_list *klist, *nklist; 846 struct keyring_list *klist, *nklist;
818 847
819 nklist = *_prealloc; 848 nklist = (struct keyring_list *)(*_prealloc & ~KEY_LINK_FIXQUOTA);
820 *_prealloc = NULL; 849 *_prealloc = 0;
821 850
822 kenter("%d,%d,%p", keyring->serial, key->serial, nklist); 851 kenter("%d,%d,%p", keyring->serial, key->serial, nklist);
823 852
@@ -852,34 +881,54 @@ void __key_link(struct key *keyring, struct key *key,
852} 881}
853 882
854/* 883/*
855 * finish linking a key into to a keyring 884 * Finish linking a key into to a keyring.
856 * - must be called with __key_link_begin() having being called 885 *
886 * Must be called with __key_link_begin() having being called.
857 */ 887 */
858void __key_link_end(struct key *keyring, struct key_type *type, 888void __key_link_end(struct key *keyring, struct key_type *type,
859 struct keyring_list *prealloc) 889 unsigned long prealloc)
860 __releases(&keyring->sem) 890 __releases(&keyring->sem)
861{ 891{
862 BUG_ON(type == NULL); 892 BUG_ON(type == NULL);
863 BUG_ON(type->name == NULL); 893 BUG_ON(type->name == NULL);
864 kenter("%d,%s,%p", keyring->serial, type->name, prealloc); 894 kenter("%d,%s,%lx", keyring->serial, type->name, prealloc);
865 895
866 if (type == &key_type_keyring) 896 if (type == &key_type_keyring)
867 up_write(&keyring_serialise_link_sem); 897 up_write(&keyring_serialise_link_sem);
868 898
869 if (prealloc) { 899 if (prealloc) {
870 kfree(prealloc); 900 if (prealloc & KEY_LINK_FIXQUOTA)
871 key_payload_reserve(keyring, 901 key_payload_reserve(keyring,
872 keyring->datalen - KEYQUOTA_LINK_BYTES); 902 keyring->datalen -
903 KEYQUOTA_LINK_BYTES);
904 kfree((struct keyring_list *)(prealloc & ~KEY_LINK_FIXQUOTA));
873 } 905 }
874 up_write(&keyring->sem); 906 up_write(&keyring->sem);
875} 907}
876 908
877/* 909/**
878 * link a key to a keyring 910 * key_link - Link a key to a keyring
911 * @keyring: The keyring to make the link in.
912 * @key: The key to link to.
913 *
914 * Make a link in a keyring to a key, such that the keyring holds a reference
915 * on that key and the key can potentially be found by searching that keyring.
916 *
917 * This function will write-lock the keyring's semaphore and will consume some
918 * of the user's key data quota to hold the link.
919 *
920 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring,
921 * -EKEYREVOKED if the keyring has been revoked, -ENFILE if the keyring is
922 * full, -EDQUOT if there is insufficient key data quota remaining to add
923 * another link or -ENOMEM if there's insufficient memory.
924 *
925 * It is assumed that the caller has checked that it is permitted for a link to
926 * be made (the keyring should have Write permission and the key Link
927 * permission).
879 */ 928 */
880int key_link(struct key *keyring, struct key *key) 929int key_link(struct key *keyring, struct key *key)
881{ 930{
882 struct keyring_list *prealloc; 931 unsigned long prealloc;
883 int ret; 932 int ret;
884 933
885 key_check(keyring); 934 key_check(keyring);
@@ -895,12 +944,24 @@ int key_link(struct key *keyring, struct key *key)
895 944
896 return ret; 945 return ret;
897} 946}
898
899EXPORT_SYMBOL(key_link); 947EXPORT_SYMBOL(key_link);
900 948
901/*****************************************************************************/ 949/**
902/* 950 * key_unlink - Unlink the first link to a key from a keyring.
903 * unlink the first link to a key from a keyring 951 * @keyring: The keyring to remove the link from.
952 * @key: The key the link is to.
953 *
954 * Remove a link from a keyring to a key.
955 *
956 * This function will write-lock the keyring's semaphore.
957 *
958 * Returns 0 if successful, -ENOTDIR if the keyring isn't a keyring, -ENOENT if
959 * the key isn't linked to by the keyring or -ENOMEM if there's insufficient
960 * memory.
961 *
962 * It is assumed that the caller has checked that it is permitted for a link to
963 * be removed (the keyring should have Write permission; no permissions are
964 * required on the key).
904 */ 965 */
905int key_unlink(struct key *keyring, struct key *key) 966int key_unlink(struct key *keyring, struct key *key)
906{ 967{
@@ -968,15 +1029,12 @@ nomem:
968 ret = -ENOMEM; 1029 ret = -ENOMEM;
969 up_write(&keyring->sem); 1030 up_write(&keyring->sem);
970 goto error; 1031 goto error;
971 1032}
972} /* end key_unlink() */
973
974EXPORT_SYMBOL(key_unlink); 1033EXPORT_SYMBOL(key_unlink);
975 1034
976/*****************************************************************************/
977/* 1035/*
978 * dispose of a keyring list after the RCU grace period, releasing the keys it 1036 * Dispose of a keyring list after the RCU grace period, releasing the keys it
979 * links to 1037 * links to.
980 */ 1038 */
981static void keyring_clear_rcu_disposal(struct rcu_head *rcu) 1039static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
982{ 1040{
@@ -989,13 +1047,15 @@ static void keyring_clear_rcu_disposal(struct rcu_head *rcu)
989 key_put(klist->keys[loop]); 1047 key_put(klist->keys[loop]);
990 1048
991 kfree(klist); 1049 kfree(klist);
1050}
992 1051
993} /* end keyring_clear_rcu_disposal() */ 1052/**
994 1053 * keyring_clear - Clear a keyring
995/*****************************************************************************/ 1054 * @keyring: The keyring to clear.
996/* 1055 *
997 * clear the specified process keyring 1056 * Clear the contents of the specified keyring.
998 * - implements keyctl(KEYCTL_CLEAR) 1057 *
1058 * Returns 0 if successful or -ENOTDIR if the keyring isn't a keyring.
999 */ 1059 */
1000int keyring_clear(struct key *keyring) 1060int keyring_clear(struct key *keyring)
1001{ 1061{
@@ -1027,15 +1087,13 @@ int keyring_clear(struct key *keyring)
1027 } 1087 }
1028 1088
1029 return ret; 1089 return ret;
1030 1090}
1031} /* end keyring_clear() */
1032
1033EXPORT_SYMBOL(keyring_clear); 1091EXPORT_SYMBOL(keyring_clear);
1034 1092
1035/*****************************************************************************/
1036/* 1093/*
1037 * dispose of the links from a revoked keyring 1094 * Dispose of the links from a revoked keyring.
1038 * - called with the key sem write-locked 1095 *
1096 * This is called with the key sem write-locked.
1039 */ 1097 */
1040static void keyring_revoke(struct key *keyring) 1098static void keyring_revoke(struct key *keyring)
1041{ 1099{
@@ -1050,11 +1108,10 @@ static void keyring_revoke(struct key *keyring)
1050 rcu_assign_pointer(keyring->payload.subscriptions, NULL); 1108 rcu_assign_pointer(keyring->payload.subscriptions, NULL);
1051 call_rcu(&klist->rcu, keyring_clear_rcu_disposal); 1109 call_rcu(&klist->rcu, keyring_clear_rcu_disposal);
1052 } 1110 }
1053 1111}
1054} /* end keyring_revoke() */
1055 1112
1056/* 1113/*
1057 * Determine whether a key is dead 1114 * Determine whether a key is dead.
1058 */ 1115 */
1059static bool key_is_dead(struct key *key, time_t limit) 1116static bool key_is_dead(struct key *key, time_t limit)
1060{ 1117{
@@ -1063,7 +1120,12 @@ static bool key_is_dead(struct key *key, time_t limit)
1063} 1120}
1064 1121
1065/* 1122/*
1066 * Collect garbage from the contents of a keyring 1123 * Collect garbage from the contents of a keyring, replacing the old list with
1124 * a new one with the pointers all shuffled down.
1125 *
1126 * Dead keys are classed as oned that are flagged as being dead or are revoked,
1127 * expired or negative keys that were revoked or expired before the specified
1128 * limit.
1067 */ 1129 */
1068void keyring_gc(struct key *keyring, time_t limit) 1130void keyring_gc(struct key *keyring, time_t limit)
1069{ 1131{
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 28645502cd0..c35b5229e3c 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -1,4 +1,4 @@
1/* permission.c: key permission determination 1/* Key permission checking
2 * 2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -13,18 +13,19 @@
13#include <linux/security.h> 13#include <linux/security.h>
14#include "internal.h" 14#include "internal.h"
15 15
16/*****************************************************************************/
17/** 16/**
18 * key_task_permission - Check a key can be used 17 * key_task_permission - Check a key can be used
19 * @key_ref: The key to check 18 * @key_ref: The key to check.
20 * @cred: The credentials to use 19 * @cred: The credentials to use.
21 * @perm: The permissions to check for 20 * @perm: The permissions to check for.
22 * 21 *
23 * Check to see whether permission is granted to use a key in the desired way, 22 * Check to see whether permission is granted to use a key in the desired way,
24 * but permit the security modules to override. 23 * but permit the security modules to override.
25 * 24 *
26 * The caller must hold either a ref on cred or must hold the RCU readlock or a 25 * The caller must hold either a ref on cred or must hold the RCU readlock.
27 * spinlock. 26 *
27 * Returns 0 if successful, -EACCES if access is denied based on the
28 * permissions bits or the LSM check.
28 */ 29 */
29int key_task_permission(const key_ref_t key_ref, const struct cred *cred, 30int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
30 key_perm_t perm) 31 key_perm_t perm)
@@ -79,14 +80,16 @@ use_these_perms:
79 80
80 /* let LSM be the final arbiter */ 81 /* let LSM be the final arbiter */
81 return security_key_permission(key_ref, cred, perm); 82 return security_key_permission(key_ref, cred, perm);
82 83}
83} /* end key_task_permission() */
84
85EXPORT_SYMBOL(key_task_permission); 84EXPORT_SYMBOL(key_task_permission);
86 85
87/*****************************************************************************/ 86/**
88/* 87 * key_validate - Validate a key.
89 * validate a key 88 * @key: The key to be validated.
89 *
90 * Check that a key is valid, returning 0 if the key is okay, -EKEYREVOKED if
91 * the key's type has been removed or if the key has been revoked or
92 * -EKEYEXPIRED if the key has expired.
90 */ 93 */
91int key_validate(struct key *key) 94int key_validate(struct key *key)
92{ 95{
@@ -111,7 +114,5 @@ int key_validate(struct key *key)
111 114
112error: 115error:
113 return ret; 116 return ret;
114 117}
115} /* end key_validate() */
116
117EXPORT_SYMBOL(key_validate); 118EXPORT_SYMBOL(key_validate);
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 70373966816..525cf8a29cd 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -1,4 +1,4 @@
1/* proc.c: proc files for key database enumeration 1/* procfs files for key database enumeration
2 * 2 *
3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -60,9 +60,8 @@ static const struct file_operations proc_key_users_fops = {
60 .release = seq_release, 60 .release = seq_release,
61}; 61};
62 62
63/*****************************************************************************/
64/* 63/*
65 * declare the /proc files 64 * Declare the /proc files.
66 */ 65 */
67static int __init key_proc_init(void) 66static int __init key_proc_init(void)
68{ 67{
@@ -79,14 +78,13 @@ static int __init key_proc_init(void)
79 panic("Cannot create /proc/key-users\n"); 78 panic("Cannot create /proc/key-users\n");
80 79
81 return 0; 80 return 0;
82 81}
83} /* end key_proc_init() */
84 82
85__initcall(key_proc_init); 83__initcall(key_proc_init);
86 84
87/*****************************************************************************/
88/* 85/*
89 * implement "/proc/keys" to provides a list of the keys on the system 86 * Implement "/proc/keys" to provide a list of the keys on the system that
87 * grant View permission to the caller.
90 */ 88 */
91#ifdef CONFIG_KEYS_DEBUG_PROC_KEYS 89#ifdef CONFIG_KEYS_DEBUG_PROC_KEYS
92 90
@@ -293,9 +291,9 @@ static struct rb_node *key_user_first(struct rb_root *r)
293 return __key_user_next(n); 291 return __key_user_next(n);
294} 292}
295 293
296/*****************************************************************************/
297/* 294/*
298 * implement "/proc/key-users" to provides a list of the key users 295 * Implement "/proc/key-users" to provides a list of the key users and their
296 * quotas.
299 */ 297 */
300static int proc_key_users_open(struct inode *inode, struct file *file) 298static int proc_key_users_open(struct inode *inode, struct file *file)
301{ 299{
@@ -351,5 +349,4 @@ static int proc_key_users_show(struct seq_file *m, void *v)
351 maxbytes); 349 maxbytes);
352 350
353 return 0; 351 return 0;
354
355} 352}
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 504bdd2452b..930634e4514 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -1,4 +1,4 @@
1/* Management of a process's keyrings 1/* Manage a process's keyrings
2 * 2 *
3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -21,13 +21,13 @@
21#include <asm/uaccess.h> 21#include <asm/uaccess.h>
22#include "internal.h" 22#include "internal.h"
23 23
24/* session keyring create vs join semaphore */ 24/* Session keyring create vs join semaphore */
25static DEFINE_MUTEX(key_session_mutex); 25static DEFINE_MUTEX(key_session_mutex);
26 26
27/* user keyring creation semaphore */ 27/* User keyring creation semaphore */
28static DEFINE_MUTEX(key_user_keyring_mutex); 28static DEFINE_MUTEX(key_user_keyring_mutex);
29 29
30/* the root user's tracking struct */ 30/* The root user's tracking struct */
31struct key_user root_key_user = { 31struct key_user root_key_user = {
32 .usage = ATOMIC_INIT(3), 32 .usage = ATOMIC_INIT(3),
33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock), 33 .cons_lock = __MUTEX_INITIALIZER(root_key_user.cons_lock),
@@ -38,9 +38,8 @@ struct key_user root_key_user = {
38 .user_ns = &init_user_ns, 38 .user_ns = &init_user_ns,
39}; 39};
40 40
41/*****************************************************************************/
42/* 41/*
43 * install user and user session keyrings for a particular UID 42 * Install the user and user session keyrings for the current process's UID.
44 */ 43 */
45int install_user_keyrings(void) 44int install_user_keyrings(void)
46{ 45{
@@ -122,7 +121,8 @@ error:
122} 121}
123 122
124/* 123/*
125 * install a fresh thread keyring directly to new credentials 124 * Install a fresh thread keyring directly to new credentials. This keyring is
125 * allowed to overrun the quota.
126 */ 126 */
127int install_thread_keyring_to_cred(struct cred *new) 127int install_thread_keyring_to_cred(struct cred *new)
128{ 128{
@@ -138,7 +138,7 @@ int install_thread_keyring_to_cred(struct cred *new)
138} 138}
139 139
140/* 140/*
141 * install a fresh thread keyring, discarding the old one 141 * Install a fresh thread keyring, discarding the old one.
142 */ 142 */
143static int install_thread_keyring(void) 143static int install_thread_keyring(void)
144{ 144{
@@ -161,9 +161,10 @@ static int install_thread_keyring(void)
161} 161}
162 162
163/* 163/*
164 * install a process keyring directly to a credentials struct 164 * Install a process keyring directly to a credentials struct.
165 * - returns -EEXIST if there was already a process keyring, 0 if one installed, 165 *
166 * and other -ve on any other error 166 * Returns -EEXIST if there was already a process keyring, 0 if one installed,
167 * and other value on any other error
167 */ 168 */
168int install_process_keyring_to_cred(struct cred *new) 169int install_process_keyring_to_cred(struct cred *new)
169{ 170{
@@ -192,8 +193,11 @@ int install_process_keyring_to_cred(struct cred *new)
192} 193}
193 194
194/* 195/*
195 * make sure a process keyring is installed 196 * Make sure a process keyring is installed for the current process. The
196 * - we 197 * existing process keyring is not replaced.
198 *
199 * Returns 0 if there is a process keyring by the end of this function, some
200 * error otherwise.
197 */ 201 */
198static int install_process_keyring(void) 202static int install_process_keyring(void)
199{ 203{
@@ -214,7 +218,7 @@ static int install_process_keyring(void)
214} 218}
215 219
216/* 220/*
217 * install a session keyring directly to a credentials struct 221 * Install a session keyring directly to a credentials struct.
218 */ 222 */
219int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) 223int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
220{ 224{
@@ -254,8 +258,8 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
254} 258}
255 259
256/* 260/*
257 * install a session keyring, discarding the old one 261 * Install a session keyring, discarding the old one. If a keyring is not
258 * - if a keyring is not supplied, an empty one is invented 262 * supplied, an empty one is invented.
259 */ 263 */
260static int install_session_keyring(struct key *keyring) 264static int install_session_keyring(struct key *keyring)
261{ 265{
@@ -275,9 +279,8 @@ static int install_session_keyring(struct key *keyring)
275 return commit_creds(new); 279 return commit_creds(new);
276} 280}
277 281
278/*****************************************************************************/
279/* 282/*
280 * the filesystem user ID changed 283 * Handle the fsuid changing.
281 */ 284 */
282void key_fsuid_changed(struct task_struct *tsk) 285void key_fsuid_changed(struct task_struct *tsk)
283{ 286{
@@ -288,12 +291,10 @@ void key_fsuid_changed(struct task_struct *tsk)
288 tsk->cred->thread_keyring->uid = tsk->cred->fsuid; 291 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
289 up_write(&tsk->cred->thread_keyring->sem); 292 up_write(&tsk->cred->thread_keyring->sem);
290 } 293 }
294}
291 295
292} /* end key_fsuid_changed() */
293
294/*****************************************************************************/
295/* 296/*
296 * the filesystem group ID changed 297 * Handle the fsgid changing.
297 */ 298 */
298void key_fsgid_changed(struct task_struct *tsk) 299void key_fsgid_changed(struct task_struct *tsk)
299{ 300{
@@ -304,16 +305,28 @@ void key_fsgid_changed(struct task_struct *tsk)
304 tsk->cred->thread_keyring->gid = tsk->cred->fsgid; 305 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
305 up_write(&tsk->cred->thread_keyring->sem); 306 up_write(&tsk->cred->thread_keyring->sem);
306 } 307 }
308}
307 309
308} /* end key_fsgid_changed() */
309
310/*****************************************************************************/
311/* 310/*
312 * search only my process keyrings for the first matching key 311 * Search the process keyrings attached to the supplied cred for the first
313 * - we use the supplied match function to see if the description (or other 312 * matching key.
314 * feature of interest) matches 313 *
315 * - we return -EAGAIN if we didn't find any matching key 314 * The search criteria are the type and the match function. The description is
316 * - we return -ENOKEY if we found only negative matching keys 315 * given to the match function as a parameter, but doesn't otherwise influence
316 * the search. Typically the match function will compare the description
317 * parameter to the key's description.
318 *
319 * This can only search keyrings that grant Search permission to the supplied
320 * credentials. Keyrings linked to searched keyrings will also be searched if
321 * they grant Search permission too. Keys can only be found if they grant
322 * Search permission to the credentials.
323 *
324 * Returns a pointer to the key with the key usage count incremented if
325 * successful, -EAGAIN if we didn't find any matching key or -ENOKEY if we only
326 * matched negative keys.
327 *
328 * In the case of a successful return, the possession attribute is set on the
329 * returned key reference.
317 */ 330 */
318key_ref_t search_my_process_keyrings(struct key_type *type, 331key_ref_t search_my_process_keyrings(struct key_type *type,
319 const void *description, 332 const void *description,
@@ -428,13 +441,13 @@ found:
428 return key_ref; 441 return key_ref;
429} 442}
430 443
431/*****************************************************************************/
432/* 444/*
433 * search the process keyrings for the first matching key 445 * Search the process keyrings attached to the supplied cred for the first
434 * - we use the supplied match function to see if the description (or other 446 * matching key in the manner of search_my_process_keyrings(), but also search
435 * feature of interest) matches 447 * the keys attached to the assumed authorisation key using its credentials if
436 * - we return -EAGAIN if we didn't find any matching key 448 * one is available.
437 * - we return -ENOKEY if we found only negative matching keys 449 *
450 * Return same as search_my_process_keyrings().
438 */ 451 */
439key_ref_t search_process_keyrings(struct key_type *type, 452key_ref_t search_process_keyrings(struct key_type *type,
440 const void *description, 453 const void *description,
@@ -489,24 +502,33 @@ key_ref_t search_process_keyrings(struct key_type *type,
489 502
490found: 503found:
491 return key_ref; 504 return key_ref;
505}
492 506
493} /* end search_process_keyrings() */
494
495/*****************************************************************************/
496/* 507/*
497 * see if the key we're looking at is the target key 508 * See if the key we're looking at is the target key.
498 */ 509 */
499int lookup_user_key_possessed(const struct key *key, const void *target) 510int lookup_user_key_possessed(const struct key *key, const void *target)
500{ 511{
501 return key == target; 512 return key == target;
513}
502 514
503} /* end lookup_user_key_possessed() */
504
505/*****************************************************************************/
506/* 515/*
507 * lookup a key given a key ID from userspace with a given permissions mask 516 * Look up a key ID given us by userspace with a given permissions mask to get
508 * - don't create special keyrings unless so requested 517 * the key it refers to.
509 * - partially constructed keys aren't found unless requested 518 *
519 * Flags can be passed to request that special keyrings be created if referred
520 * to directly, to permit partially constructed keys to be found and to skip
521 * validity and permission checks on the found key.
522 *
523 * Returns a pointer to the key with an incremented usage count if successful;
524 * -EINVAL if the key ID is invalid; -ENOKEY if the key ID does not correspond
525 * to a key or the best found key was a negative key; -EKEYREVOKED or
526 * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
527 * found key doesn't grant the requested permit or the LSM denied access to it;
528 * or -ENOMEM if a special keyring couldn't be created.
529 *
530 * In the case of a successful return, the possession attribute is set on the
531 * returned key reference.
510 */ 532 */
511key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, 533key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
512 key_perm_t perm) 534 key_perm_t perm)
@@ -711,15 +733,18 @@ invalid_key:
711reget_creds: 733reget_creds:
712 put_cred(cred); 734 put_cred(cred);
713 goto try_again; 735 goto try_again;
736}
714 737
715} /* end lookup_user_key() */
716
717/*****************************************************************************/
718/* 738/*
719 * join the named keyring as the session keyring if possible, or attempt to 739 * Join the named keyring as the session keyring if possible else attempt to
720 * create a new one of that name if not 740 * create a new one of that name and join that.
721 * - if the name is NULL, an empty anonymous keyring is installed instead 741 *
722 * - named session keyring joining is done with a semaphore held 742 * If the name is NULL, an empty anonymous keyring will be installed as the
743 * session keyring.
744 *
745 * Named session keyrings are joined with a semaphore held to prevent the
746 * keyrings from going away whilst the attempt is made to going them and also
747 * to prevent a race in creating compatible session keyrings.
723 */ 748 */
724long join_session_keyring(const char *name) 749long join_session_keyring(const char *name)
725{ 750{
@@ -791,8 +816,8 @@ error:
791} 816}
792 817
793/* 818/*
794 * Replace a process's session keyring when that process resumes userspace on 819 * Replace a process's session keyring on behalf of one of its children when
795 * behalf of one of its children 820 * the target process is about to resume userspace execution.
796 */ 821 */
797void key_replace_session_keyring(void) 822void key_replace_session_keyring(void)
798{ 823{
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0ea52d25a6b..a3dc0d460de 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -39,8 +39,14 @@ static int key_wait_bit_intr(void *flags)
39 return signal_pending(current) ? -ERESTARTSYS : 0; 39 return signal_pending(current) ? -ERESTARTSYS : 0;
40} 40}
41 41
42/* 42/**
43 * call to complete the construction of a key 43 * complete_request_key - Complete the construction of a key.
44 * @cons: The key construction record.
45 * @error: The success or failute of the construction.
46 *
47 * Complete the attempt to construct a key. The key will be negated
48 * if an error is indicated. The authorisation key will be revoked
49 * unconditionally.
44 */ 50 */
45void complete_request_key(struct key_construction *cons, int error) 51void complete_request_key(struct key_construction *cons, int error)
46{ 52{
@@ -58,23 +64,33 @@ void complete_request_key(struct key_construction *cons, int error)
58} 64}
59EXPORT_SYMBOL(complete_request_key); 65EXPORT_SYMBOL(complete_request_key);
60 66
67/*
68 * Initialise a usermode helper that is going to have a specific session
69 * keyring.
70 *
71 * This is called in context of freshly forked kthread before kernel_execve(),
72 * so we can simply install the desired session_keyring at this point.
73 */
61static int umh_keys_init(struct subprocess_info *info) 74static int umh_keys_init(struct subprocess_info *info)
62{ 75{
63 struct cred *cred = (struct cred*)current_cred(); 76 struct cred *cred = (struct cred*)current_cred();
64 struct key *keyring = info->data; 77 struct key *keyring = info->data;
65 /* 78
66 * This is called in context of freshly forked kthread before
67 * kernel_execve(), we can just change our ->session_keyring.
68 */
69 return install_session_keyring_to_cred(cred, keyring); 79 return install_session_keyring_to_cred(cred, keyring);
70} 80}
71 81
82/*
83 * Clean up a usermode helper with session keyring.
84 */
72static void umh_keys_cleanup(struct subprocess_info *info) 85static void umh_keys_cleanup(struct subprocess_info *info)
73{ 86{
74 struct key *keyring = info->data; 87 struct key *keyring = info->data;
75 key_put(keyring); 88 key_put(keyring);
76} 89}
77 90
91/*
92 * Call a usermode helper with a specific session keyring.
93 */
78static int call_usermodehelper_keys(char *path, char **argv, char **envp, 94static int call_usermodehelper_keys(char *path, char **argv, char **envp,
79 struct key *session_keyring, enum umh_wait wait) 95 struct key *session_keyring, enum umh_wait wait)
80{ 96{
@@ -91,7 +107,7 @@ static int call_usermodehelper_keys(char *path, char **argv, char **envp,
91} 107}
92 108
93/* 109/*
94 * request userspace finish the construction of a key 110 * Request userspace finish the construction of a key
95 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>" 111 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
96 */ 112 */
97static int call_sbin_request_key(struct key_construction *cons, 113static int call_sbin_request_key(struct key_construction *cons,
@@ -198,8 +214,9 @@ error_alloc:
198} 214}
199 215
200/* 216/*
201 * call out to userspace for key construction 217 * Call out to userspace for key construction.
202 * - we ignore program failure and go on key status instead 218 *
219 * Program failure is ignored in favour of key status.
203 */ 220 */
204static int construct_key(struct key *key, const void *callout_info, 221static int construct_key(struct key *key, const void *callout_info,
205 size_t callout_len, void *aux, 222 size_t callout_len, void *aux,
@@ -246,9 +263,10 @@ static int construct_key(struct key *key, const void *callout_info,
246} 263}
247 264
248/* 265/*
249 * get the appropriate destination keyring for the request 266 * Get the appropriate destination keyring for the request.
250 * - we return whatever keyring we select with an extra reference upon it which 267 *
251 * the caller must release 268 * The keyring selected is returned with an extra reference upon it which the
269 * caller must release.
252 */ 270 */
253static void construct_get_dest_keyring(struct key **_dest_keyring) 271static void construct_get_dest_keyring(struct key **_dest_keyring)
254{ 272{
@@ -321,9 +339,11 @@ static void construct_get_dest_keyring(struct key **_dest_keyring)
321} 339}
322 340
323/* 341/*
324 * allocate a new key in under-construction state and attempt to link it in to 342 * Allocate a new key in under-construction state and attempt to link it in to
325 * the requested place 343 * the requested keyring.
326 * - may return a key that's already under construction instead 344 *
345 * May return a key that's already under construction instead if there was a
346 * race between two thread calling request_key().
327 */ 347 */
328static int construct_alloc_key(struct key_type *type, 348static int construct_alloc_key(struct key_type *type,
329 const char *description, 349 const char *description,
@@ -332,8 +352,8 @@ static int construct_alloc_key(struct key_type *type,
332 struct key_user *user, 352 struct key_user *user,
333 struct key **_key) 353 struct key **_key)
334{ 354{
335 struct keyring_list *prealloc;
336 const struct cred *cred = current_cred(); 355 const struct cred *cred = current_cred();
356 unsigned long prealloc;
337 struct key *key; 357 struct key *key;
338 key_ref_t key_ref; 358 key_ref_t key_ref;
339 int ret; 359 int ret;
@@ -414,7 +434,7 @@ alloc_failed:
414} 434}
415 435
416/* 436/*
417 * commence key construction 437 * Commence key construction.
418 */ 438 */
419static struct key *construct_key_and_link(struct key_type *type, 439static struct key *construct_key_and_link(struct key_type *type,
420 const char *description, 440 const char *description,
@@ -465,12 +485,32 @@ construction_failed:
465 return ERR_PTR(ret); 485 return ERR_PTR(ret);
466} 486}
467 487
468/* 488/**
469 * request a key 489 * request_key_and_link - Request a key and cache it in a keyring.
470 * - search the process's keyrings 490 * @type: The type of key we want.
471 * - check the list of keys being created or updated 491 * @description: The searchable description of the key.
472 * - call out to userspace for a key if supplementary info was provided 492 * @callout_info: The data to pass to the instantiation upcall (or NULL).
473 * - cache the key in an appropriate keyring 493 * @callout_len: The length of callout_info.
494 * @aux: Auxiliary data for the upcall.
495 * @dest_keyring: Where to cache the key.
496 * @flags: Flags to key_alloc().
497 *
498 * A key matching the specified criteria is searched for in the process's
499 * keyrings and returned with its usage count incremented if found. Otherwise,
500 * if callout_info is not NULL, a key will be allocated and some service
501 * (probably in userspace) will be asked to instantiate it.
502 *
503 * If successfully found or created, the key will be linked to the destination
504 * keyring if one is provided.
505 *
506 * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
507 * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
508 * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
509 * if insufficient key quota was available to create a new key; or -ENOMEM if
510 * insufficient memory was available.
511 *
512 * If the returned key was created, then it may still be under construction,
513 * and wait_for_key_construction() should be used to wait for that to complete.
474 */ 514 */
475struct key *request_key_and_link(struct key_type *type, 515struct key *request_key_and_link(struct key_type *type,
476 const char *description, 516 const char *description,
@@ -524,8 +564,16 @@ error:
524 return key; 564 return key;
525} 565}
526 566
527/* 567/**
528 * wait for construction of a key to complete 568 * wait_for_key_construction - Wait for construction of a key to complete
569 * @key: The key being waited for.
570 * @intr: Whether to wait interruptibly.
571 *
572 * Wait for a key to finish being constructed.
573 *
574 * Returns 0 if successful; -ERESTARTSYS if the wait was interrupted; -ENOKEY
575 * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
576 * revoked or expired.
529 */ 577 */
530int wait_for_key_construction(struct key *key, bool intr) 578int wait_for_key_construction(struct key *key, bool intr)
531{ 579{
@@ -542,12 +590,19 @@ int wait_for_key_construction(struct key *key, bool intr)
542} 590}
543EXPORT_SYMBOL(wait_for_key_construction); 591EXPORT_SYMBOL(wait_for_key_construction);
544 592
545/* 593/**
546 * request a key 594 * request_key - Request a key and wait for construction
547 * - search the process's keyrings 595 * @type: Type of key.
548 * - check the list of keys being created or updated 596 * @description: The searchable description of the key.
549 * - call out to userspace for a key if supplementary info was provided 597 * @callout_info: The data to pass to the instantiation upcall (or NULL).
550 * - waits uninterruptible for creation to complete 598 *
599 * As for request_key_and_link() except that it does not add the returned key
600 * to a keyring if found, new keys are always allocated in the user's quota,
601 * the callout_info must be a NUL-terminated string and no auxiliary data can
602 * be passed.
603 *
604 * Furthermore, it then works as wait_for_key_construction() to wait for the
605 * completion of keys undergoing construction with a non-interruptible wait.
551 */ 606 */
552struct key *request_key(struct key_type *type, 607struct key *request_key(struct key_type *type,
553 const char *description, 608 const char *description,
@@ -572,12 +627,19 @@ struct key *request_key(struct key_type *type,
572} 627}
573EXPORT_SYMBOL(request_key); 628EXPORT_SYMBOL(request_key);
574 629
575/* 630/**
576 * request a key with auxiliary data for the upcaller 631 * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
577 * - search the process's keyrings 632 * @type: The type of key we want.
578 * - check the list of keys being created or updated 633 * @description: The searchable description of the key.
579 * - call out to userspace for a key if supplementary info was provided 634 * @callout_info: The data to pass to the instantiation upcall (or NULL).
580 * - waits uninterruptible for creation to complete 635 * @callout_len: The length of callout_info.
636 * @aux: Auxiliary data for the upcall.
637 *
638 * As for request_key_and_link() except that it does not add the returned key
639 * to a keyring if found and new keys are always allocated in the user's quota.
640 *
641 * Furthermore, it then works as wait_for_key_construction() to wait for the
642 * completion of keys undergoing construction with a non-interruptible wait.
581 */ 643 */
582struct key *request_key_with_auxdata(struct key_type *type, 644struct key *request_key_with_auxdata(struct key_type *type,
583 const char *description, 645 const char *description,
@@ -602,10 +664,18 @@ struct key *request_key_with_auxdata(struct key_type *type,
602EXPORT_SYMBOL(request_key_with_auxdata); 664EXPORT_SYMBOL(request_key_with_auxdata);
603 665
604/* 666/*
605 * request a key (allow async construction) 667 * request_key_async - Request a key (allow async construction)
606 * - search the process's keyrings 668 * @type: Type of key.
607 * - check the list of keys being created or updated 669 * @description: The searchable description of the key.
608 * - call out to userspace for a key if supplementary info was provided 670 * @callout_info: The data to pass to the instantiation upcall (or NULL).
671 * @callout_len: The length of callout_info.
672 *
673 * As for request_key_and_link() except that it does not add the returned key
674 * to a keyring if found, new keys are always allocated in the user's quota and
675 * no auxiliary data can be passed.
676 *
677 * The caller should call wait_for_key_construction() to wait for the
678 * completion of the returned key if it is still undergoing construction.
609 */ 679 */
610struct key *request_key_async(struct key_type *type, 680struct key *request_key_async(struct key_type *type,
611 const char *description, 681 const char *description,
@@ -620,9 +690,17 @@ EXPORT_SYMBOL(request_key_async);
620 690
621/* 691/*
622 * request a key with auxiliary data for the upcaller (allow async construction) 692 * request a key with auxiliary data for the upcaller (allow async construction)
623 * - search the process's keyrings 693 * @type: Type of key.
624 * - check the list of keys being created or updated 694 * @description: The searchable description of the key.
625 * - call out to userspace for a key if supplementary info was provided 695 * @callout_info: The data to pass to the instantiation upcall (or NULL).
696 * @callout_len: The length of callout_info.
697 * @aux: Auxiliary data for the upcall.
698 *
699 * As for request_key_and_link() except that it does not add the returned key
700 * to a keyring if found and new keys are always allocated in the user's quota.
701 *
702 * The caller should call wait_for_key_construction() to wait for the
703 * completion of the returned key if it is still undergoing construction.
626 */ 704 */
627struct key *request_key_async_with_auxdata(struct key_type *type, 705struct key *request_key_async_with_auxdata(struct key_type *type,
628 const char *description, 706 const char *description,
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 86747151ee5..68164031a74 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -1,4 +1,4 @@
1/* request_key_auth.c: request key authorisation controlling key def 1/* Request key authorisation token key definition.
2 * 2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. 3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com) 4 * Written by David Howells (dhowells@redhat.com)
@@ -26,7 +26,7 @@ static void request_key_auth_destroy(struct key *);
26static long request_key_auth_read(const struct key *, char __user *, size_t); 26static long request_key_auth_read(const struct key *, char __user *, size_t);
27 27
28/* 28/*
29 * the request-key authorisation key type definition 29 * The request-key authorisation key type definition.
30 */ 30 */
31struct key_type key_type_request_key_auth = { 31struct key_type key_type_request_key_auth = {
32 .name = ".request_key_auth", 32 .name = ".request_key_auth",
@@ -38,9 +38,8 @@ struct key_type key_type_request_key_auth = {
38 .read = request_key_auth_read, 38 .read = request_key_auth_read,
39}; 39};
40 40
41/*****************************************************************************/
42/* 41/*
43 * instantiate a request-key authorisation key 42 * Instantiate a request-key authorisation key.
44 */ 43 */
45static int request_key_auth_instantiate(struct key *key, 44static int request_key_auth_instantiate(struct key *key,
46 const void *data, 45 const void *data,
@@ -48,12 +47,10 @@ static int request_key_auth_instantiate(struct key *key,
48{ 47{
49 key->payload.data = (struct request_key_auth *) data; 48 key->payload.data = (struct request_key_auth *) data;
50 return 0; 49 return 0;
50}
51 51
52} /* end request_key_auth_instantiate() */
53
54/*****************************************************************************/
55/* 52/*
56 * reading a request-key authorisation key retrieves the callout information 53 * Describe an authorisation token.
57 */ 54 */
58static void request_key_auth_describe(const struct key *key, 55static void request_key_auth_describe(const struct key *key,
59 struct seq_file *m) 56 struct seq_file *m)
@@ -63,12 +60,10 @@ static void request_key_auth_describe(const struct key *key,
63 seq_puts(m, "key:"); 60 seq_puts(m, "key:");
64 seq_puts(m, key->description); 61 seq_puts(m, key->description);
65 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); 62 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
63}
66 64
67} /* end request_key_auth_describe() */
68
69/*****************************************************************************/
70/* 65/*
71 * read the callout_info data 66 * Read the callout_info data (retrieves the callout information).
72 * - the key's semaphore is read-locked 67 * - the key's semaphore is read-locked
73 */ 68 */
74static long request_key_auth_read(const struct key *key, 69static long request_key_auth_read(const struct key *key,
@@ -91,13 +86,12 @@ static long request_key_auth_read(const struct key *key,
91 } 86 }
92 87
93 return ret; 88 return ret;
89}
94 90
95} /* end request_key_auth_read() */
96
97/*****************************************************************************/
98/* 91/*
99 * handle revocation of an authorisation token key 92 * Handle revocation of an authorisation token key.
100 * - called with the key sem write-locked 93 *
94 * Called with the key sem write-locked.
101 */ 95 */
102static void request_key_auth_revoke(struct key *key) 96static void request_key_auth_revoke(struct key *key)
103{ 97{
@@ -109,12 +103,10 @@ static void request_key_auth_revoke(struct key *key)
109 put_cred(rka->cred); 103 put_cred(rka->cred);
110 rka->cred = NULL; 104 rka->cred = NULL;
111 } 105 }
106}
112 107
113} /* end request_key_auth_revoke() */
114
115/*****************************************************************************/
116/* 108/*
117 * destroy an instantiation authorisation token key 109 * Destroy an instantiation authorisation token key.
118 */ 110 */
119static void request_key_auth_destroy(struct key *key) 111static void request_key_auth_destroy(struct key *key)
120{ 112{
@@ -131,13 +123,11 @@ static void request_key_auth_destroy(struct key *key)
131 key_put(rka->dest_keyring); 123 key_put(rka->dest_keyring);
132 kfree(rka->callout_info); 124 kfree(rka->callout_info);
133 kfree(rka); 125 kfree(rka);
126}
134 127
135} /* end request_key_auth_destroy() */
136
137/*****************************************************************************/
138/* 128/*
139 * create an authorisation token for /sbin/request-key or whoever to gain 129 * Create an authorisation token for /sbin/request-key or whoever to gain
140 * access to the caller's security data 130 * access to the caller's security data.
141 */ 131 */
142struct key *request_key_auth_new(struct key *target, const void *callout_info, 132struct key *request_key_auth_new(struct key *target, const void *callout_info,
143 size_t callout_len, struct key *dest_keyring) 133 size_t callout_len, struct key *dest_keyring)
@@ -228,12 +218,10 @@ error_alloc:
228 kfree(rka); 218 kfree(rka);
229 kleave("= %d", ret); 219 kleave("= %d", ret);
230 return ERR_PTR(ret); 220 return ERR_PTR(ret);
221}
231 222
232} /* end request_key_auth_new() */
233
234/*****************************************************************************/
235/* 223/*
236 * see if an authorisation key is associated with a particular key 224 * See if an authorisation key is associated with a particular key.
237 */ 225 */
238static int key_get_instantiation_authkey_match(const struct key *key, 226static int key_get_instantiation_authkey_match(const struct key *key,
239 const void *_id) 227 const void *_id)
@@ -242,16 +230,11 @@ static int key_get_instantiation_authkey_match(const struct key *key,
242 key_serial_t id = (key_serial_t)(unsigned long) _id; 230 key_serial_t id = (key_serial_t)(unsigned long) _id;
243 231
244 return rka->target_key->serial == id; 232 return rka->target_key->serial == id;
233}
245 234
246} /* end key_get_instantiation_authkey_match() */
247
248/*****************************************************************************/
249/* 235/*
250 * get the authorisation key for instantiation of a specific key if attached to 236 * Search the current process's keyrings for the authorisation key for
251 * the current process's keyrings 237 * instantiation of a key.
252 * - this key is inserted into a keyring and that is set as /sbin/request-key's
253 * session keyring
254 * - a target_id of zero specifies any valid token
255 */ 238 */
256struct key *key_get_instantiation_authkey(key_serial_t target_id) 239struct key *key_get_instantiation_authkey(key_serial_t target_id)
257{ 240{
@@ -278,5 +261,4 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
278 261
279error: 262error:
280 return authkey; 263 return authkey;
281 264}
282} /* end key_get_instantiation_authkey() */
diff --git a/security/keys/trusted_defined.c b/security/keys/trusted.c
index 975e9f29a52..83fc92e297c 100644
--- a/security/keys/trusted_defined.c
+++ b/security/keys/trusted.c
@@ -29,7 +29,7 @@
29#include <linux/tpm.h> 29#include <linux/tpm.h>
30#include <linux/tpm_command.h> 30#include <linux/tpm_command.h>
31 31
32#include "trusted_defined.h" 32#include "trusted.h"
33 33
34static const char hmac_alg[] = "hmac(sha1)"; 34static const char hmac_alg[] = "hmac(sha1)";
35static const char hash_alg[] = "sha1"; 35static const char hash_alg[] = "sha1";
@@ -101,11 +101,13 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
101 if (dlen == 0) 101 if (dlen == 0)
102 break; 102 break;
103 data = va_arg(argp, unsigned char *); 103 data = va_arg(argp, unsigned char *);
104 if (data == NULL) 104 if (data == NULL) {
105 return -EINVAL; 105 ret = -EINVAL;
106 break;
107 }
106 ret = crypto_shash_update(&sdesc->shash, data, dlen); 108 ret = crypto_shash_update(&sdesc->shash, data, dlen);
107 if (ret < 0) 109 if (ret < 0)
108 goto out; 110 break;
109 } 111 }
110 va_end(argp); 112 va_end(argp);
111 if (!ret) 113 if (!ret)
@@ -146,14 +148,17 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key,
146 if (dlen == 0) 148 if (dlen == 0)
147 break; 149 break;
148 data = va_arg(argp, unsigned char *); 150 data = va_arg(argp, unsigned char *);
149 ret = crypto_shash_update(&sdesc->shash, data, dlen); 151 if (!data) {
150 if (ret < 0) { 152 ret = -EINVAL;
151 va_end(argp); 153 break;
152 goto out;
153 } 154 }
155 ret = crypto_shash_update(&sdesc->shash, data, dlen);
156 if (ret < 0)
157 break;
154 } 158 }
155 va_end(argp); 159 va_end(argp);
156 ret = crypto_shash_final(&sdesc->shash, paramdigest); 160 if (!ret)
161 ret = crypto_shash_final(&sdesc->shash, paramdigest);
157 if (!ret) 162 if (!ret)
158 ret = TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE, 163 ret = TSS_rawhmac(digest, key, keylen, SHA1_DIGEST_SIZE,
159 paramdigest, TPM_NONCE_SIZE, h1, 164 paramdigest, TPM_NONCE_SIZE, h1,
@@ -222,13 +227,12 @@ static int TSS_checkhmac1(unsigned char *buffer,
222 break; 227 break;
223 dpos = va_arg(argp, unsigned int); 228 dpos = va_arg(argp, unsigned int);
224 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen); 229 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
225 if (ret < 0) { 230 if (ret < 0)
226 va_end(argp); 231 break;
227 goto out;
228 }
229 } 232 }
230 va_end(argp); 233 va_end(argp);
231 ret = crypto_shash_final(&sdesc->shash, paramdigest); 234 if (!ret)
235 ret = crypto_shash_final(&sdesc->shash, paramdigest);
232 if (ret < 0) 236 if (ret < 0)
233 goto out; 237 goto out;
234 238
@@ -316,13 +320,12 @@ static int TSS_checkhmac2(unsigned char *buffer,
316 break; 320 break;
317 dpos = va_arg(argp, unsigned int); 321 dpos = va_arg(argp, unsigned int);
318 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen); 322 ret = crypto_shash_update(&sdesc->shash, buffer + dpos, dlen);
319 if (ret < 0) { 323 if (ret < 0)
320 va_end(argp); 324 break;
321 goto out;
322 }
323 } 325 }
324 va_end(argp); 326 va_end(argp);
325 ret = crypto_shash_final(&sdesc->shash, paramdigest); 327 if (!ret)
328 ret = crypto_shash_final(&sdesc->shash, paramdigest);
326 if (ret < 0) 329 if (ret < 0)
327 goto out; 330 goto out;
328 331
@@ -511,7 +514,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
511 /* get session for sealing key */ 514 /* get session for sealing key */
512 ret = osap(tb, &sess, keyauth, keytype, keyhandle); 515 ret = osap(tb, &sess, keyauth, keytype, keyhandle);
513 if (ret < 0) 516 if (ret < 0)
514 return ret; 517 goto out;
515 dump_sess(&sess); 518 dump_sess(&sess);
516 519
517 /* calculate encrypted authorization value */ 520 /* calculate encrypted authorization value */
@@ -519,11 +522,11 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
519 memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE); 522 memcpy(td->xorwork + SHA1_DIGEST_SIZE, sess.enonce, SHA1_DIGEST_SIZE);
520 ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash); 523 ret = TSS_sha1(td->xorwork, SHA1_DIGEST_SIZE * 2, td->xorhash);
521 if (ret < 0) 524 if (ret < 0)
522 return ret; 525 goto out;
523 526
524 ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE); 527 ret = tpm_get_random(tb, td->nonceodd, TPM_NONCE_SIZE);
525 if (ret < 0) 528 if (ret < 0)
526 return ret; 529 goto out;
527 ordinal = htonl(TPM_ORD_SEAL); 530 ordinal = htonl(TPM_ORD_SEAL);
528 datsize = htonl(datalen); 531 datsize = htonl(datalen);
529 pcrsize = htonl(pcrinfosize); 532 pcrsize = htonl(pcrinfosize);
@@ -552,7 +555,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
552 &datsize, datalen, data, 0, 0); 555 &datsize, datalen, data, 0, 0);
553 } 556 }
554 if (ret < 0) 557 if (ret < 0)
555 return ret; 558 goto out;
556 559
557 /* build and send the TPM request packet */ 560 /* build and send the TPM request packet */
558 INIT_BUF(tb); 561 INIT_BUF(tb);
@@ -572,7 +575,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
572 575
573 ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE); 576 ret = trusted_tpm_send(TPM_ANY_NUM, tb->data, MAX_BUF_SIZE);
574 if (ret < 0) 577 if (ret < 0)
575 return ret; 578 goto out;
576 579
577 /* calculate the size of the returned Blob */ 580 /* calculate the size of the returned Blob */
578 sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t)); 581 sealinfosize = LOAD32(tb->data, TPM_DATA_OFFSET + sizeof(uint32_t));
@@ -591,6 +594,8 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
591 memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize); 594 memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
592 *bloblen = storedsize; 595 *bloblen = storedsize;
593 } 596 }
597out:
598 kfree(td);
594 return ret; 599 return ret;
595} 600}
596 601
@@ -1027,6 +1032,7 @@ static int trusted_update(struct key *key, const void *data, size_t datalen)
1027 ret = datablob_parse(datablob, new_p, new_o); 1032 ret = datablob_parse(datablob, new_p, new_o);
1028 if (ret != Opt_update) { 1033 if (ret != Opt_update) {
1029 ret = -EINVAL; 1034 ret = -EINVAL;
1035 kfree(new_p);
1030 goto out; 1036 goto out;
1031 } 1037 }
1032 /* copy old key values, and reseal with new pcrs */ 1038 /* copy old key values, and reseal with new pcrs */
diff --git a/security/keys/trusted_defined.h b/security/keys/trusted.h
index 3249fbd2b65..3249fbd2b65 100644
--- a/security/keys/trusted_defined.h
+++ b/security/keys/trusted.h
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index e9aa0792965..02807fb1634 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -35,7 +35,6 @@ struct key_type key_type_user = {
35 35
36EXPORT_SYMBOL_GPL(key_type_user); 36EXPORT_SYMBOL_GPL(key_type_user);
37 37
38/*****************************************************************************/
39/* 38/*
40 * instantiate a user defined key 39 * instantiate a user defined key
41 */ 40 */
@@ -65,12 +64,10 @@ int user_instantiate(struct key *key, const void *data, size_t datalen)
65 64
66error: 65error:
67 return ret; 66 return ret;
68 67}
69} /* end user_instantiate() */
70 68
71EXPORT_SYMBOL_GPL(user_instantiate); 69EXPORT_SYMBOL_GPL(user_instantiate);
72 70
73/*****************************************************************************/
74/* 71/*
75 * dispose of the old data from an updated user defined key 72 * dispose of the old data from an updated user defined key
76 */ 73 */
@@ -81,10 +78,8 @@ static void user_update_rcu_disposal(struct rcu_head *rcu)
81 upayload = container_of(rcu, struct user_key_payload, rcu); 78 upayload = container_of(rcu, struct user_key_payload, rcu);
82 79
83 kfree(upayload); 80 kfree(upayload);
81}
84 82
85} /* end user_update_rcu_disposal() */
86
87/*****************************************************************************/
88/* 83/*
89 * update a user defined key 84 * update a user defined key
90 * - the key's semaphore is write-locked 85 * - the key's semaphore is write-locked
@@ -123,24 +118,20 @@ int user_update(struct key *key, const void *data, size_t datalen)
123 118
124error: 119error:
125 return ret; 120 return ret;
126 121}
127} /* end user_update() */
128 122
129EXPORT_SYMBOL_GPL(user_update); 123EXPORT_SYMBOL_GPL(user_update);
130 124
131/*****************************************************************************/
132/* 125/*
133 * match users on their name 126 * match users on their name
134 */ 127 */
135int user_match(const struct key *key, const void *description) 128int user_match(const struct key *key, const void *description)
136{ 129{
137 return strcmp(key->description, description) == 0; 130 return strcmp(key->description, description) == 0;
138 131}
139} /* end user_match() */
140 132
141EXPORT_SYMBOL_GPL(user_match); 133EXPORT_SYMBOL_GPL(user_match);
142 134
143/*****************************************************************************/
144/* 135/*
145 * dispose of the links from a revoked keyring 136 * dispose of the links from a revoked keyring
146 * - called with the key sem write-locked 137 * - called with the key sem write-locked
@@ -156,12 +147,10 @@ void user_revoke(struct key *key)
156 rcu_assign_pointer(key->payload.data, NULL); 147 rcu_assign_pointer(key->payload.data, NULL);
157 call_rcu(&upayload->rcu, user_update_rcu_disposal); 148 call_rcu(&upayload->rcu, user_update_rcu_disposal);
158 } 149 }
159 150}
160} /* end user_revoke() */
161 151
162EXPORT_SYMBOL(user_revoke); 152EXPORT_SYMBOL(user_revoke);
163 153
164/*****************************************************************************/
165/* 154/*
166 * dispose of the data dangling from the corpse of a user key 155 * dispose of the data dangling from the corpse of a user key
167 */ 156 */
@@ -170,12 +159,10 @@ void user_destroy(struct key *key)
170 struct user_key_payload *upayload = key->payload.data; 159 struct user_key_payload *upayload = key->payload.data;
171 160
172 kfree(upayload); 161 kfree(upayload);
173 162}
174} /* end user_destroy() */
175 163
176EXPORT_SYMBOL_GPL(user_destroy); 164EXPORT_SYMBOL_GPL(user_destroy);
177 165
178/*****************************************************************************/
179/* 166/*
180 * describe the user key 167 * describe the user key
181 */ 168 */
@@ -184,12 +171,10 @@ void user_describe(const struct key *key, struct seq_file *m)
184 seq_puts(m, key->description); 171 seq_puts(m, key->description);
185 172
186 seq_printf(m, ": %u", key->datalen); 173 seq_printf(m, ": %u", key->datalen);
187 174}
188} /* end user_describe() */
189 175
190EXPORT_SYMBOL_GPL(user_describe); 176EXPORT_SYMBOL_GPL(user_describe);
191 177
192/*****************************************************************************/
193/* 178/*
194 * read the key data 179 * read the key data
195 * - the key's semaphore is read-locked 180 * - the key's semaphore is read-locked
@@ -213,7 +198,6 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
213 } 198 }
214 199
215 return ret; 200 return ret;
216 201}
217} /* end user_read() */
218 202
219EXPORT_SYMBOL_GPL(user_read); 203EXPORT_SYMBOL_GPL(user_read);
diff --git a/security/security.c b/security/security.c
index b84a89dd59c..1a4993b1144 100644
--- a/security/security.c
+++ b/security/security.c
@@ -154,10 +154,9 @@ int security_capset(struct cred *new, const struct cred *old,
154 effective, inheritable, permitted); 154 effective, inheritable, permitted);
155} 155}
156 156
157int security_capable(int cap) 157int security_capable(const struct cred *cred, int cap)
158{ 158{
159 return security_ops->capable(current, current_cred(), cap, 159 return security_ops->capable(current, cred, cap, SECURITY_CAP_AUDIT);
160 SECURITY_CAP_AUDIT);
161} 160}
162 161
163int security_real_capable(struct task_struct *tsk, int cap) 162int security_real_capable(struct task_struct *tsk, int cap)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e276eb46853..c8d69927068 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3198,7 +3198,11 @@ static void selinux_cred_free(struct cred *cred)
3198{ 3198{
3199 struct task_security_struct *tsec = cred->security; 3199 struct task_security_struct *tsec = cred->security;
3200 3200
3201 BUG_ON((unsigned long) cred->security < PAGE_SIZE); 3201 /*
3202 * cred->security == NULL if security_cred_alloc_blank() or
3203 * security_prepare_creds() returned an error.
3204 */
3205 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3202 cred->security = (void *) 0x7UL; 3206 cred->security = (void *) 0x7UL;
3203 kfree(tsec); 3207 kfree(tsec);
3204} 3208}
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index e94e82f7381..5615081b73e 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -15,7 +15,6 @@
15#include <linux/audit.h> 15#include <linux/audit.h>
16#include <linux/lsm_audit.h> 16#include <linux/lsm_audit.h>
17#include <linux/in6.h> 17#include <linux/in6.h>
18#include <linux/path.h>
19#include <asm/system.h> 18#include <asm/system.h>
20#include "flask.h" 19#include "flask.h"
21#include "av_permissions.h" 20#include "av_permissions.h"
diff --git a/security/selinux/ss/conditional.c b/security/selinux/ss/conditional.c
index c3f845cbcd4..a53373207fb 100644
--- a/security/selinux/ss/conditional.c
+++ b/security/selinux/ss/conditional.c
@@ -178,7 +178,7 @@ int cond_init_bool_indexes(struct policydb *p)
178 p->bool_val_to_struct = (struct cond_bool_datum **) 178 p->bool_val_to_struct = (struct cond_bool_datum **)
179 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL); 179 kmalloc(p->p_bools.nprim * sizeof(struct cond_bool_datum *), GFP_KERNEL);
180 if (!p->bool_val_to_struct) 180 if (!p->bool_val_to_struct)
181 return -1; 181 return -ENOMEM;
182 return 0; 182 return 0;
183} 183}
184 184
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index be9de387283..57363562f0f 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -501,8 +501,8 @@ static int policydb_index(struct policydb *p)
501 if (rc) 501 if (rc)
502 goto out; 502 goto out;
503 503
504 rc = -ENOMEM; 504 rc = cond_init_bool_indexes(p);
505 if (cond_init_bool_indexes(p)) 505 if (rc)
506 goto out; 506 goto out;
507 507
508 for (i = 0; i < SYM_NUM; i++) { 508 for (i = 0; i < SYM_NUM; i++) {
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-28 09:26:41 -0500