9 files changed, 344 insertions, 6 deletions

diff --git a/Documentation/keys.txt b/Documentation/keys.txt
index b56aacc1fff8..203487e9b1d8 100644
--- a/Documentation/keys.txt
+++ b/Documentation/keys.txt
@@ -26,7 +26,7 @@ This document has the following sections:
         - Notes on accessing payload contents
         - Defining a key type
         - Request-key callback service
-        - Key access filesystem
+        - Garbage collection
 
 
 ============
@@ -113,6 +113,9 @@ Each key has a number of attributes:
 
      (*) Dead. The key's type was unregistered, and so the key is now useless.
 
+Keys in the last three states are subject to garbage collection.  See the
+section on "Garbage collection".
+
 
 ====================
 KEY SERVICE OVERVIEW
@@ -1231,3 +1234,17 @@ by executing:
 
 In this case, the program isn't required to actually attach the key to a ring;
 the rings are provided for reference.
+
+
+==================
+GARBAGE COLLECTION
+==================
+
+Dead keys (for which the type has been removed) will be automatically unlinked
+from those keyrings that point to them and deleted as soon as possible by a
+background garbage collector.
+
+Similarly, revoked and expired keys will be garbage collected, but only after a
+certain amount of time has passed.  This time is set as a number of seconds in:
+
+        /proc/sys/kernel/keys/gc_delay
diff --git a/include/linux/key.h b/include/linux/key.h
index e544f466d69a..33e0165de100 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -129,7 +129,10 @@ struct key {
         struct rw_semaphore     sem;            /* change vs change sem */
         struct key_user         *user;          /* owner of this key */
         void                    *security;      /* security data for this key */
-        time_t                  expiry;         /* time at which key expires (or 0) */
+        union {
+                time_t          expiry;         /* time at which key expires (or 0) */
+                time_t          revoked_at;     /* time at which key was revoked */
+        };
         uid_t                   uid;
         gid_t                   gid;
         key_perm_t              perm;           /* access permissions */
diff --git a/security/keys/Makefile b/security/keys/Makefile
index 747a464943af..74d5447d7df7 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -3,6 +3,7 @@
 #
 
 obj-y := \
+        gc.o \
         key.o \
         keyring.o \
         keyctl.o \
diff --git a/security/keys/gc.c b/security/keys/gc.c
new file mode 100644
index 000000000000..44adc325e15c
--- /dev/null
+++ b/security/keys/gc.c
@@ -0,0 +1,193 @@
+/* Key garbage collector
+ *
+ * Copyright (C) 2009 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <keys/keyring-type.h>
+#include "internal.h"
+
+/*
+ * Delay between key revocation/expiry in seconds
+ */
+unsigned key_gc_delay = 5 * 60;
+
+/*
+ * Reaper
+ */
+static void key_gc_timer_func(unsigned long);
+static void key_garbage_collector(struct work_struct *);
+static DEFINE_TIMER(key_gc_timer, key_gc_timer_func, 0, 0);
+static DECLARE_WORK(key_gc_work, key_garbage_collector);
+static key_serial_t key_gc_cursor; /* the last key the gc considered */
+static unsigned long key_gc_executing;
+static time_t key_gc_next_run = LONG_MAX;
+
+/*
+ * Schedule a garbage collection run
+ * - precision isn't particularly important
+ */
+void key_schedule_gc(time_t gc_at)
+{
+        unsigned long expires;
+        time_t now = current_kernel_time().tv_sec;
+
+        kenter("%ld", gc_at - now);
+
+        gc_at += key_gc_delay;
+
+        if (now >= gc_at) {
+                schedule_work(&key_gc_work);
+        } else if (gc_at < key_gc_next_run) {
+                expires = jiffies + (gc_at - now) * HZ;
+                mod_timer(&key_gc_timer, expires);
+        }
+}
+
+/*
+ * The garbage collector timer kicked off
+ */
+static void key_gc_timer_func(unsigned long data)
+{
+        kenter("");
+        key_gc_next_run = LONG_MAX;
+        schedule_work(&key_gc_work);
+}
+
+/*
+ * Garbage collect pointers from a keyring
+ * - return true if we altered the keyring
+ */
+static bool key_gc_keyring(struct key *keyring, time_t limit)
+{
+        struct keyring_list *klist;
+        struct key *key;
+        int loop;
+
+        kenter("%x", key_serial(keyring));
+
+        if (test_bit(KEY_FLAG_REVOKED, &keyring->flags))
+                goto dont_gc;
+
+        /* scan the keyring looking for dead keys */
+        klist = rcu_dereference(keyring->payload.subscriptions);
+        if (!klist)
+                goto dont_gc;
+
+        for (loop = klist->nkeys - 1; loop >= 0; loop--) {
+                key = klist->keys[loop];
+                if (test_bit(KEY_FLAG_DEAD, &key->flags) ||
+                    (key->expiry > 0 && key->expiry <= limit))
+                        goto do_gc;
+        }
+
+dont_gc:
+        kleave(" = false");
+        return false;
+
+do_gc:
+        key_gc_cursor = keyring->serial;
+        key_get(keyring);
+        spin_unlock(&key_serial_lock);
+        keyring_gc(keyring, limit);
+        key_put(keyring);
+        kleave(" = true");
+        return true;
+}
+
+/*
+ * Garbage collector for keys
+ * - this involves scanning the keyrings for dead, expired and revoked keys
+ *   that have overstayed their welcome
+ */
+static void key_garbage_collector(struct work_struct *work)
+{
+        struct rb_node *rb;
+        key_serial_t cursor;
+        struct key *key, *xkey;
+        time_t new_timer = LONG_MAX, limit;
+
+        kenter("");
+
+        if (test_and_set_bit(0, &key_gc_executing)) {
+                key_schedule_gc(current_kernel_time().tv_sec);
+                return;
+        }
+