^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /* Request a key from userspace
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Written by David Howells (dhowells@redhat.com)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * See Documentation/security/keys/request-key.rst
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/export.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/sched.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/kmod.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/err.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/keyctl.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <net/net_namespace.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include "internal.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <keys/request_key_auth-type.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #define key_negative_timeout 60 /* default timeout on a negative key's existence */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) static struct key *check_cached_key(struct keyring_search_context *ctx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #ifdef CONFIG_KEYS_REQUEST_CACHE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) struct key *key = current->cached_requested_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) if (key &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) ctx->match_data.cmp(key, &ctx->match_data) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) (1 << KEY_FLAG_REVOKED))))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) return key_get(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) static void cache_requested_key(struct key *key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #ifdef CONFIG_KEYS_REQUEST_CACHE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) struct task_struct *t = current;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) key_put(t->cached_requested_key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) t->cached_requested_key = key_get(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) * complete_request_key - Complete the construction of a key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) * @authkey: The authorisation key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) * @error: The success or failute of the construction.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) * Complete the attempt to construct a key. The key will be negated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) * if an error is indicated. The authorisation key will be revoked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) * unconditionally.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) void complete_request_key(struct key *authkey, int error)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) struct request_key_auth *rka = get_request_key_auth(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) struct key *key = rka->target_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) kenter("%d{%d},%d", authkey->serial, key->serial, error);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) if (error < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) key_negate_and_link(key, key_negative_timeout, NULL, authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) key_revoke(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) EXPORT_SYMBOL(complete_request_key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) * Initialise a usermode helper that is going to have a specific session
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) * This is called in context of freshly forked kthread before kernel_execve(),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) * so we can simply install the desired session_keyring at this point.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) static int umh_keys_init(struct subprocess_info *info, struct cred *cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct key *keyring = info->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) return install_session_keyring_to_cred(cred, keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) * Clean up a usermode helper with session keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) static void umh_keys_cleanup(struct subprocess_info *info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) struct key *keyring = info->data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) key_put(keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) * Call a usermode helper with a specific session keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) static int call_usermodehelper_keys(const char *path, char **argv, char **envp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) struct key *session_keyring, int wait)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) struct subprocess_info *info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) info = call_usermodehelper_setup(path, argv, envp, GFP_KERNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) umh_keys_init, umh_keys_cleanup,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) session_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) if (!info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) key_get(session_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) return call_usermodehelper_exec(info, wait);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) * Request userspace finish the construction of a key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) static int call_sbin_request_key(struct key *authkey, void *aux)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) static char const request_key[] = "/sbin/request-key";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) struct request_key_auth *rka = get_request_key_auth(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) const struct cred *cred = current_cred();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) key_serial_t prkey, sskey;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) struct key *key = rka->target_key, *keyring, *session, *user_session;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) char *argv[9], *envp[3], uid_str[12], gid_str[12];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) char key_str[12], keyring_str[3][12];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) char desc[20];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) int ret, i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) ret = look_up_user_keyrings(NULL, &user_session);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) goto error_us;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) /* allocate a new session keyring */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) sprintf(desc, "_req.%u", key->serial);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) cred = get_current_cred();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) put_cred(cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) if (IS_ERR(keyring)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) ret = PTR_ERR(keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) goto error_alloc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) /* attach the auth key to the session keyring */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) ret = key_link(keyring, authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) goto error_link;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) /* record the UID and GID */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->fsuid));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->fsgid));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) /* we say which key is under construction */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) sprintf(key_str, "%d", key->serial);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) /* we specify the process's default keyrings */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) sprintf(keyring_str[0], "%d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) cred->thread_keyring ? cred->thread_keyring->serial : 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) prkey = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) if (cred->process_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) prkey = cred->process_keyring->serial;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) sprintf(keyring_str[1], "%d", prkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) session = cred->session_keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) if (!session)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) session = user_session;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) sskey = session->serial;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) sprintf(keyring_str[2], "%d", sskey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) /* set up a minimal environment */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) i = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) envp[i++] = "HOME=/";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) envp[i] = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) /* set up the argument list */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) i = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) argv[i++] = (char *)request_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) argv[i++] = (char *)rka->op;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) argv[i++] = key_str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) argv[i++] = uid_str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) argv[i++] = gid_str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) argv[i++] = keyring_str[0];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) argv[i++] = keyring_str[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) argv[i++] = keyring_str[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) argv[i] = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) /* do it */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) ret = call_usermodehelper_keys(request_key, argv, envp, keyring,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) UMH_WAIT_PROC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) kdebug("usermode -> 0x%x", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) if (ret >= 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) /* ret is the exit/wait code */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) key_validate(key) < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) ret = -ENOKEY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) /* ignore any errors from userspace if the key was
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) * instantiated */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) error_link:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) key_put(keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) error_alloc:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) key_put(user_session);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) error_us:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) complete_request_key(authkey, ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) kleave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) * Call out to userspace for key construction.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) * Program failure is ignored in favour of key status.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) static int construct_key(struct key *key, const void *callout_info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) size_t callout_len, void *aux,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) struct key *dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) request_key_actor_t actor;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) struct key *authkey;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) /* allocate an authorisation key */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) authkey = request_key_auth_new(key, "create", callout_info, callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) if (IS_ERR(authkey))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) return PTR_ERR(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) /* Make the call */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) actor = call_sbin_request_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) if (key->type->request_key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) actor = key->type->request_key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) ret = actor(authkey, aux);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) /* check that the actor called complete_request_key() prior to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) * returning an error */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) WARN_ON(ret < 0 &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) !test_bit(KEY_FLAG_INVALIDATED, &authkey->flags));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) key_put(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) kleave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) * Get the appropriate destination keyring for the request.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) * The keyring selected is returned with an extra reference upon it which the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) * caller must release.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) static int construct_get_dest_keyring(struct key **_dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) struct request_key_auth *rka;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) const struct cred *cred = current_cred();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) struct key *dest_keyring = *_dest_keyring, *authkey;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) kenter("%p", dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) /* find the appropriate keyring */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) /* the caller supplied one */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) key_get(dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) bool do_perm_check = true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) /* use a default keyring; falling through the cases until we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) * find one that we actually have */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) switch (cred->jit_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) case KEY_REQKEY_DEFL_DEFAULT:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) if (cred->request_key_auth) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) authkey = cred->request_key_auth;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) down_read(&authkey->sem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) rka = get_request_key_auth(authkey);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) if (!test_bit(KEY_FLAG_REVOKED,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) &authkey->flags))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) dest_keyring =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) key_get(rka->dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) up_read(&authkey->sem);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) do_perm_check = false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) case KEY_REQKEY_DEFL_THREAD_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) dest_keyring = key_get(cred->thread_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) if (dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) case KEY_REQKEY_DEFL_PROCESS_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) dest_keyring = key_get(cred->process_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) if (dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) case KEY_REQKEY_DEFL_SESSION_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) dest_keyring = key_get(cred->session_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) if (dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) fallthrough;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) ret = look_up_user_keyrings(NULL, &dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) case KEY_REQKEY_DEFL_USER_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) ret = look_up_user_keyrings(&dest_keyring, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) case KEY_REQKEY_DEFL_GROUP_KEYRING:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) BUG();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) * Require Write permission on the keyring. This is essential
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) * because the default keyring may be the session keyring, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) * joining a keyring only requires Search permission.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) * However, this check is skipped for the "requestor keyring" so
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) * that /sbin/request-key can itself use request_key() to add
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) * keys to the original requestor's destination keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) if (dest_keyring && do_perm_check) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) ret = key_permission(make_key_ref(dest_keyring, 1),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) KEY_NEED_WRITE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) key_put(dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) *_dest_keyring = dest_keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) kleave(" [dk %d]", key_serial(dest_keyring));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) * Allocate a new key in under-construction state and attempt to link it in to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) * the requested keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) * May return a key that's already under construction instead if there was a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) * race between two thread calling request_key().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) static int construct_alloc_key(struct keyring_search_context *ctx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) struct key *dest_keyring,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) unsigned long flags,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) struct key_user *user,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) struct key **_key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) struct assoc_array_edit *edit = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) key_perm_t perm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) key_ref_t key_ref;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) kenter("%s,%s,,,",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) ctx->index_key.type->name, ctx->index_key.description);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) *_key = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) mutex_lock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) perm |= KEY_USR_VIEW;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) if (ctx->index_key.type->read)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) perm |= KEY_POS_READ;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) if (ctx->index_key.type == &key_type_keyring ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) ctx->index_key.type->update)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) perm |= KEY_POS_WRITE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) key = key_alloc(ctx->index_key.type, ctx->index_key.description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) perm, flags, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) if (IS_ERR(key))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) goto alloc_failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) ret = __key_link_lock(dest_keyring, &ctx->index_key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) goto link_lock_failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) ret = __key_link_begin(dest_keyring, &ctx->index_key, &edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) goto link_prealloc_failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) /* attach the key to the destination keyring under lock, but we do need
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) * to do another check just in case someone beat us to it whilst we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) * waited for locks */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) mutex_lock(&key_construction_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) key_ref = search_process_keyrings_rcu(ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) if (!IS_ERR(key_ref))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) goto key_already_present;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) if (dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) __key_link(dest_keyring, key, &edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) mutex_unlock(&key_construction_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) if (dest_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) __key_link_end(dest_keyring, &ctx->index_key, edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) mutex_unlock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) *_key = key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) kleave(" = 0 [%d]", key_serial(key));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) /* the key is now present - we tell the caller that we found it by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) * returning -EINPROGRESS */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) key_already_present:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) mutex_unlock(&key_construction_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) key = key_ref_to_ptr(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) ret = __key_link_check_live_key(dest_keyring, key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) if (ret == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) __key_link(dest_keyring, key, &edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) __key_link_end(dest_keyring, &ctx->index_key, edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) goto link_check_failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) mutex_unlock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) *_key = key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) kleave(" = -EINPROGRESS [%d]", key_serial(key));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) return -EINPROGRESS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) link_check_failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) mutex_unlock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) kleave(" = %d [linkcheck]", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) link_prealloc_failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) __key_link_end(dest_keyring, &ctx->index_key, edit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) link_lock_failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) mutex_unlock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) kleave(" = %d [prelink]", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) alloc_failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) mutex_unlock(&user->cons_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) kleave(" = %ld", PTR_ERR(key));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) return PTR_ERR(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) * Commence key construction.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) static struct key *construct_key_and_link(struct keyring_search_context *ctx,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) const char *callout_info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) size_t callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) void *aux,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) struct key *dest_keyring,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) struct key_user *user;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) kenter("");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) if (ctx->index_key.type == &key_type_keyring)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) return ERR_PTR(-EPERM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) ret = construct_get_dest_keyring(&dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) user = key_user_lookup(current_fsuid());
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) if (!user) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) goto error_put_dest_keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) key_user_put(user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) if (ret == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) ret = construct_key(key, callout_info, callout_len, aux,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) kdebug("cons failed");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) goto construction_failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) } else if (ret == -EINPROGRESS) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) goto error_put_dest_keyring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515) key_put(dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) kleave(" = key %d", key_serial(key));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) construction_failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) key_negate_and_link(key, key_negative_timeout, NULL, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) error_put_dest_keyring:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) key_put(dest_keyring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) kleave(" = %d", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) return ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) * request_key_and_link - Request a key and cache it in a keyring.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) * @type: The type of key we want.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) * @description: The searchable description of the key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) * @domain_tag: The domain in which the key operates.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) * @callout_info: The data to pass to the instantiation upcall (or NULL).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) * @callout_len: The length of callout_info.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) * @aux: Auxiliary data for the upcall.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) * @dest_keyring: Where to cache the key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) * @flags: Flags to key_alloc().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) * A key matching the specified criteria (type, description, domain_tag) is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) * searched for in the process's keyrings and returned with its usage count
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) * incremented if found. Otherwise, if callout_info is not NULL, a key will be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) * allocated and some service (probably in userspace) will be asked to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) * instantiate it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) * If successfully found or created, the key will be linked to the destination
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) * keyring if one is provided.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) * if insufficient key quota was available to create a new key; or -ENOMEM if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) * insufficient memory was available.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) * If the returned key was created, then it may still be under construction,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) * and wait_for_key_construction() should be used to wait for that to complete.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) struct key *request_key_and_link(struct key_type *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) const char *description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) struct key_tag *domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) const void *callout_info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) size_t callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) void *aux,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) struct key *dest_keyring,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) unsigned long flags)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) struct keyring_search_context ctx = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) .index_key.type = type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) .index_key.domain_tag = domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) .index_key.description = description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) .index_key.desc_len = strlen(description),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) .cred = current_cred(),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) .match_data.cmp = key_default_cmp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) .match_data.raw_data = description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) .flags = (KEYRING_SEARCH_DO_STATE_CHECK |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) KEYRING_SEARCH_SKIP_EXPIRED |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) KEYRING_SEARCH_RECURSE),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) key_ref_t key_ref;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) kenter("%s,%s,%p,%zu,%p,%p,%lx",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) ctx.index_key.type->name, ctx.index_key.description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) callout_info, callout_len, aux, dest_keyring, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) if (type->match_preparse) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) ret = type->match_preparse(&ctx.match_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) key = ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592) goto error;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) key = check_cached_key(&ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) if (key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) goto error_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) /* search all the process keyrings for a key */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) key_ref = search_process_keyrings_rcu(&ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) if (!IS_ERR(key_ref)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) ret = key_task_permission(key_ref, current_cred(),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) KEY_NEED_LINK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) key_ref_put(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) key = ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) goto error_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) key = key_ref_to_ptr(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) if (dest_keyring) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) ret = key_link(dest_keyring, key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) key = ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) goto error_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) /* Only cache the key on immediate success */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) cache_requested_key(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) } else if (PTR_ERR(key_ref) != -EAGAIN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) key = ERR_CAST(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) /* the search failed, but the keyrings were searchable, so we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) * should consult userspace if we can */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) key = ERR_PTR(-ENOKEY);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) if (!callout_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635) goto error_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) key = construct_key_and_link(&ctx, callout_info, callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) aux, dest_keyring, flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) error_free:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) if (type->match_free)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) type->match_free(&ctx.match_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) error:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) kleave(" = %p", key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) * wait_for_key_construction - Wait for construction of a key to complete
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) * @key: The key being waited for.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) * @intr: Whether to wait interruptibly.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654) * Wait for a key to finish being constructed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656) * Returns 0 if successful; -ERESTARTSYS if the wait was interrupted; -ENOKEY
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) * revoked or expired.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) int wait_for_key_construction(struct key *key, bool intr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) return -ERESTARTSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) ret = key_read_state(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) if (ret < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) return key_validate(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) EXPORT_SYMBOL(wait_for_key_construction);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) * request_key_tag - Request a key and wait for construction
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) * @type: Type of key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) * @description: The searchable description of the key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) * @domain_tag: The domain in which the key operates.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) * @callout_info: The data to pass to the instantiation upcall (or NULL).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) * As for request_key_and_link() except that it does not add the returned key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) * to a keyring if found, new keys are always allocated in the user's quota,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) * the callout_info must be a NUL-terminated string and no auxiliary data can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) * be passed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) * Furthermore, it then works as wait_for_key_construction() to wait for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688) * completion of keys undergoing construction with a non-interruptible wait.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) struct key *request_key_tag(struct key_type *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) const char *description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) struct key_tag *domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) const char *callout_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) size_t callout_len = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) if (callout_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) callout_len = strlen(callout_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) key = request_key_and_link(type, description, domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) callout_info, callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) NULL, NULL, KEY_ALLOC_IN_QUOTA);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) if (!IS_ERR(key)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) ret = wait_for_key_construction(key, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) return ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) EXPORT_SYMBOL(request_key_tag);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) * @type: The type of key we want.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718) * @description: The searchable description of the key.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) * @domain_tag: The domain in which the key operates.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) * @callout_info: The data to pass to the instantiation upcall (or NULL).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) * @callout_len: The length of callout_info.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) * @aux: Auxiliary data for the upcall.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) * As for request_key_and_link() except that it does not add the returned key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) * to a keyring if found and new keys are always allocated in the user's quota.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) * Furthermore, it then works as wait_for_key_construction() to wait for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) * completion of keys undergoing construction with a non-interruptible wait.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) struct key *request_key_with_auxdata(struct key_type *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) const char *description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) struct key_tag *domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733) const void *callout_info,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) size_t callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) void *aux)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) key = request_key_and_link(type, description, domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) callout_info, callout_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) aux, NULL, KEY_ALLOC_IN_QUOTA);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) if (!IS_ERR(key)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) ret = wait_for_key_construction(key, false);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) key_put(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) return ERR_PTR(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) EXPORT_SYMBOL(request_key_with_auxdata);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) * request_key_rcu - Request key from RCU-read-locked context
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) * @type: The type of key we want.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) * @description: The name of the key we want.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) * @domain_tag: The domain in which the key operates.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760) * Request a key from a context that we may not sleep in (such as RCU-mode
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) * pathwalk). Keys under construction are ignored.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) * a key or some other error if the key found was unsuitable or inaccessible.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) struct key *request_key_rcu(struct key_type *type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) const char *description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) struct key_tag *domain_tag)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) struct keyring_search_context ctx = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) .index_key.type = type,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) .index_key.domain_tag = domain_tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) .index_key.description = description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) .index_key.desc_len = strlen(description),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) .cred = current_cred(),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776) .match_data.cmp = key_default_cmp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) .match_data.raw_data = description,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) .flags = (KEYRING_SEARCH_DO_STATE_CHECK |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) KEYRING_SEARCH_SKIP_EXPIRED),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) struct key *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) key_ref_t key_ref;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) kenter("%s,%s", type->name, description);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) key = check_cached_key(&ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) if (key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) /* search all the process keyrings for a key */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) key_ref = search_process_keyrings_rcu(&ctx);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793) if (IS_ERR(key_ref)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) key = ERR_CAST(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795) if (PTR_ERR(key_ref) == -EAGAIN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) key = ERR_PTR(-ENOKEY);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) key = key_ref_to_ptr(key_ref);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) cache_requested_key(key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) kleave(" = %p", key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) return key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) EXPORT_SYMBOL(request_key_rcu);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags