1 /* request_key_auth.c: request key authorisation controlling key def
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
11 * See Documentation/keys-request-key.txt
14 #include <linux/module.h>
15 #include <linux/sched.h>
16 #include <linux/err.h>
17 #include <linux/seq_file.h>
18 #include <linux/slab.h>
19 #include <asm/uaccess.h>
22 static int request_key_auth_instantiate(struct key *, const void *, size_t);
23 static void request_key_auth_describe(const struct key *, struct seq_file *);
24 static void request_key_auth_revoke(struct key *);
25 static void request_key_auth_destroy(struct key *);
26 static long request_key_auth_read(const struct key *, char __user *, size_t);
29 * the request-key authorisation key type definition
31 struct key_type key_type_request_key_auth = {
32 .name = ".request_key_auth",
33 .def_datalen = sizeof(struct request_key_auth),
34 .instantiate = request_key_auth_instantiate,
35 .describe = request_key_auth_describe,
36 .revoke = request_key_auth_revoke,
37 .destroy = request_key_auth_destroy,
38 .read = request_key_auth_read,
41 /*****************************************************************************/
43 * instantiate a request-key authorisation key
45 static int request_key_auth_instantiate(struct key *key,
49 key->payload.data = (struct request_key_auth *) data;
52 } /* end request_key_auth_instantiate() */
54 /*****************************************************************************/
56 * reading a request-key authorisation key retrieves the callout information
58 static void request_key_auth_describe(const struct key *key,
61 struct request_key_auth *rka = key->payload.data;
64 seq_puts(m, key->description);
65 seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
67 } /* end request_key_auth_describe() */
69 /*****************************************************************************/
71 * read the callout_info data
72 * - the key's semaphore is read-locked
74 static long request_key_auth_read(const struct key *key,
75 char __user *buffer, size_t buflen)
77 struct request_key_auth *rka = key->payload.data;
81 datalen = rka->callout_len;
84 /* we can return the data as is */
85 if (buffer && buflen > 0) {
89 if (copy_to_user(buffer, rka->callout_info, buflen) != 0)
95 } /* end request_key_auth_read() */
97 /*****************************************************************************/
99 * handle revocation of an authorisation token key
100 * - called with the key sem write-locked
102 static void request_key_auth_revoke(struct key *key)
104 struct request_key_auth *rka = key->payload.data;
106 kenter("{%d}", key->serial);
109 put_task_struct(rka->context);
113 } /* end request_key_auth_revoke() */
115 /*****************************************************************************/
117 * destroy an instantiation authorisation token key
119 static void request_key_auth_destroy(struct key *key)
121 struct request_key_auth *rka = key->payload.data;
123 kenter("{%d}", key->serial);
126 put_task_struct(rka->context);
130 key_put(rka->target_key);
131 key_put(rka->dest_keyring);
132 kfree(rka->callout_info);
135 } /* end request_key_auth_destroy() */
137 /*****************************************************************************/
139 * create an authorisation token for /sbin/request-key or whoever to gain
140 * access to the caller's security data
142 struct key *request_key_auth_new(struct key *target, const void *callout_info,
143 size_t callout_len, struct key *dest_keyring)
145 struct request_key_auth *rka, *irka;
146 struct key *authkey = NULL;
150 kenter("%d,", target->serial);
152 /* allocate a auth record */
153 rka = kmalloc(sizeof(*rka), GFP_KERNEL);
155 kleave(" = -ENOMEM");
156 return ERR_PTR(-ENOMEM);
158 rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
159 if (!rka->callout_info) {
160 kleave(" = -ENOMEM");
162 return ERR_PTR(-ENOMEM);
165 /* see if the calling process is already servicing the key request of
167 if (current->cred->request_key_auth) {
168 /* it is - use that instantiation context here too */
169 down_read(¤t->cred->request_key_auth->sem);
171 /* if the auth key has been revoked, then the key we're
172 * servicing is already instantiated */
173 if (test_bit(KEY_FLAG_REVOKED,
174 ¤t->cred->request_key_auth->flags))
175 goto auth_key_revoked;
177 irka = current->cred->request_key_auth->payload.data;
178 rka->context = irka->context;
179 rka->pid = irka->pid;
180 get_task_struct(rka->context);
182 up_read(¤t->cred->request_key_auth->sem);
185 /* it isn't - use this process as the context */
186 rka->context = current;
187 rka->pid = current->pid;
188 get_task_struct(rka->context);
191 rka->target_key = key_get(target);
192 rka->dest_keyring = key_get(dest_keyring);
193 memcpy(rka->callout_info, callout_info, callout_len);
194 rka->callout_len = callout_len;
196 /* allocate the auth key */
197 sprintf(desc, "%x", target->serial);
199 authkey = key_alloc(&key_type_request_key_auth, desc,
200 current_fsuid(), current_fsgid(), current,
201 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
202 KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
203 if (IS_ERR(authkey)) {
204 ret = PTR_ERR(authkey);
208 /* construct and attach to the keyring */
209 ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
213 kleave(" = {%d}", authkey->serial);
217 up_read(¤t->cred->request_key_auth->sem);
218 kfree(rka->callout_info);
220 kleave("= -EKEYREVOKED");
221 return ERR_PTR(-EKEYREVOKED);
227 key_put(rka->target_key);
228 key_put(rka->dest_keyring);
229 kfree(rka->callout_info);
234 } /* end request_key_auth_new() */
236 /*****************************************************************************/
238 * see if an authorisation key is associated with a particular key
240 static int key_get_instantiation_authkey_match(const struct key *key,
243 struct request_key_auth *rka = key->payload.data;
244 key_serial_t id = (key_serial_t)(unsigned long) _id;
246 return rka->target_key->serial == id;
248 } /* end key_get_instantiation_authkey_match() */
250 /*****************************************************************************/
252 * get the authorisation key for instantiation of a specific key if attached to
253 * the current process's keyrings
254 * - this key is inserted into a keyring and that is set as /sbin/request-key's
256 * - a target_id of zero specifies any valid token
258 struct key *key_get_instantiation_authkey(key_serial_t target_id)
261 key_ref_t authkey_ref;
263 authkey_ref = search_process_keyrings(
264 &key_type_request_key_auth,
265 (void *) (unsigned long) target_id,
266 key_get_instantiation_authkey_match,
269 if (IS_ERR(authkey_ref)) {
270 authkey = ERR_CAST(authkey_ref);
274 authkey = key_ref_to_ptr(authkey_ref);
275 if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
277 authkey = ERR_PTR(-EKEYREVOKED);
283 } /* end key_get_instantiation_authkey() */