/* Userspace key control operations * * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved. * Written by David Howells (dhowells@redhat.com) * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. */ #include <linux/module.h>#include <linux/init.h>#include <linux/sched.h>#include <linux/slab.h>#include <linux/syscalls.h>#include <linux/key.h>#include <linux/keyctl.h>#include <linux/fs.h>#include <linux/capability.h>#include <linux/string.h>#include <linux/err.h>#include <linux/vmalloc.h>#include <linux/security.h>#include <linux/uio.h>#include <asm/uaccess.h>#include "internal.h" static int key_get_type_from_user(char *type,				  const char __user *_type,				  unsigned len){	int ret; 	ret = strncpy_from_user(type, _type, len);	if (ret < 0)		return ret;	if (ret == 0 || ret >= len)		return -EINVAL;	if (type[0] == '.')		return -EPERM;	type[len - 1] = '\0';	return 0;} /* * Extract the description of a new key from userspace and either add it as a * new key to the specified keyring or update a matching key in that keyring. * * If the description is NULL or an empty string, the key type is asked to * generate one from the payload. * * The keyring must be writable so that we can attach the key to it. * * If successful, the new key's serial number is returned, otherwise an error * code is returned. */SYSCALL_DEFINE5(add_key, const char __user *, _type,		const char __user *, _description,		const void __user *, _payload,		size_t, plen,		key_serial_t, ringid){	key_ref_t keyring_ref, key_ref;	char type[32], *description;	void *payload;	long ret;	bool vm; 	ret = -EINVAL;	if (plen > 1024 * 1024 - 1)		goto error; 	/* draw all the data into kernel space */	ret = key_get_type_from_user(type, _type, sizeof(type));	if (ret < 0)		goto error; 	description = NULL;	if (_description) {		description = strndup_user(_description, PAGE_SIZE);		if (IS_ERR(description)) {			ret = PTR_ERR(description);			goto error;		}		if (!*description) {			kfree(description);			description = NULL;		}	} 	/* pull the payload in if one was supplied */	payload = NULL; 	vm = false;	if (_payload) {		ret = -ENOMEM;		payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN);		if (!payload) {			if (plen <= PAGE_SIZE)				goto error2;			vm = true;			payload = vmalloc(plen);			if (!payload)				goto error2;		} 		ret = -EFAULT;		if (copy_from_user(payload, _payload, plen) != 0)			goto error3;	} 	/* find the target keyring (which must be writable) */	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);	if (IS_ERR(keyring_ref)) {		ret = PTR_ERR(keyring_ref);		goto error3;	} 	/* create or update the requested key and add it to the target	 * keyring */	key_ref = key_create_or_update(keyring_ref, type, description,				       payload, plen, KEY_PERM_UNDEF,				       KEY_ALLOC_IN_QUOTA);	if (!IS_ERR(key_ref)) {		ret = key_ref_to_ptr(key_ref)->serial;		key_ref_put(key_ref);	}	else {		ret = PTR_ERR(key_ref);	} 	key_ref_put(keyring_ref); error3:	if (!vm)		kfree(payload);	else		vfree(payload); error2:	kfree(description); error:	return ret;} /* * Search the process keyrings and keyring trees linked from those for a * matching key.  Keyrings must have appropriate Search permission to be * searched. * * If a key is found, it will be attached to the destination keyring if there's * one specified and the serial number of the key will be returned. * * If no key is found, /sbin/request-key will be invoked if _callout_info is * non-NULL in an attempt to create a key.  The _callout_info string will be * passed to /sbin/request-key to aid with completing the request.  If the * _callout_info string is "" then it will be changed to "-". */SYSCALL_DEFINE4(request_key, const char __user *, _type,		const char __user *, _description,		const char __user *, _callout_info,		key_serial_t, destringid){	struct key_type *ktype;	struct key *key;	key_ref_t dest_ref;	size_t callout_len;	char type[32], *description, *callout_info;	long ret; 	/* pull the type into kernel space */	ret = key_get_type_from_user(type, _type, sizeof(type));	if (ret < 0)		goto error; 	/* pull the description into kernel space */	description = strndup_user(_description, PAGE_SIZE);	if (IS_ERR(description)) {		ret = PTR_ERR(description);		goto error;	} 	/* pull the callout info into kernel space */	callout_info = NULL;	callout_len = 0;	if (_callout_info) {		callout_info = strndup_user(_callout_info, PAGE_SIZE);		if (IS_ERR(callout_info)) {			ret = PTR_ERR(callout_info);			goto error2;		}		callout_len = strlen(callout_info);	} 	/* get the destination keyring if specified */	dest_ref = NULL;	if (destringid) {		dest_ref = lookup_user_key(destringid, KEY_LOOKUP_CREATE,					   KEY_WRITE);		if (IS_ERR(dest_ref)) {			ret = PTR_ERR(dest_ref);			goto error3;		}	} 	/* find the key type */	ktype = key_type_lookup(type);	if (IS_ERR(ktype)) {		ret = PTR_ERR(ktype);		goto error4;	} 	/* do the search */	key = request_key_and_link(ktype, description, callout_info,				   callout_len, NULL, key_ref_to_ptr(dest_ref),				   KEY_ALLOC_IN_QUOTA);	if (IS_ERR(key)) {		ret = PTR_ERR(key);		goto error5;	} 	/* wait for the key to finish being constructed */	ret = wait_for_key_construction(key, 1);	if (ret < 0)		goto error6; 	ret = key->serial; error6: 	key_put(key);error5:	key_type_put(ktype);error4:	key_ref_put(dest_ref);error3:	kfree(callout_info);error2:	kfree(description);error:	return ret;} /* * Get the ID of the specified process keyring. * * The requested keyring must have search permission to be found. * * If successful, the ID of the requested keyring will be returned. */long keyctl_get_keyring_ID(key_serial_t id, int create){	key_ref_t key_ref;	unsigned long lflags;	long ret; 	lflags = create ? KEY_LOOKUP_CREATE : 0;	key_ref = lookup_user_key(id, lflags, KEY_SEARCH);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		goto error;	} 	ret = key_ref_to_ptr(key_ref)->serial;	key_ref_put(key_ref);error:	return ret;} /* * Join a (named) session keyring. * * Create and join an anonymous session keyring or join a named session * keyring, creating it if necessary.  A named session keyring must have Search * permission for it to be joined.  Session keyrings without this permit will * be skipped over. * * If successful, the ID of the joined session keyring will be returned. */long keyctl_join_session_keyring(const char __user *_name){	char *name;	long ret; 	/* fetch the name from userspace */	name = NULL;	if (_name) {		name = strndup_user(_name, PAGE_SIZE);		if (IS_ERR(name)) {			ret = PTR_ERR(name);			goto error;		}	} 	/* join the session */	ret = join_session_keyring(name);	kfree(name); error:	return ret;} /* * Update a key's data payload from the given data. * * The key must grant the caller Write permission and the key type must support * updating for this to work.  A negative key can be positively instantiated * with this call. * * If successful, 0 will be returned.  If the key type does not support * updating, then -EOPNOTSUPP will be returned. */long keyctl_update_key(key_serial_t id,		       const void __user *_payload,		       size_t plen){	key_ref_t key_ref;	void *payload;	long ret; 	ret = -EINVAL;	if (plen > PAGE_SIZE)		goto error; 	/* pull the payload in if one was supplied */	payload = NULL;	if (_payload) {		ret = -ENOMEM;		payload = kmalloc(plen, GFP_KERNEL);		if (!payload)			goto error; 		ret = -EFAULT;		if (copy_from_user(payload, _payload, plen) != 0)			goto error2;	} 	/* find the target key (which must be writable) */	key_ref = lookup_user_key(id, 0, KEY_WRITE);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		goto error2;	} 	/* update the key */	ret = key_update(key_ref, payload, plen); 	key_ref_put(key_ref);error2:	kfree(payload);error:	return ret;} /* * Revoke a key. * * The key must be grant the caller Write or Setattr permission for this to * work.  The key type should give up its quota claim when revoked.  The key * and any links to the key will be automatically garbage collected after a * certain amount of time (/proc/sys/kernel/keys/gc_delay). * * If successful, 0 is returned. */long keyctl_revoke_key(key_serial_t id){	key_ref_t key_ref;	long ret; 	key_ref = lookup_user_key(id, 0, KEY_WRITE);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		if (ret != -EACCES)			goto error;		key_ref = lookup_user_key(id, 0, KEY_SETATTR);		if (IS_ERR(key_ref)) {			ret = PTR_ERR(key_ref);			goto error;		}	} 	key_revoke(key_ref_to_ptr(key_ref));	ret = 0; 	key_ref_put(key_ref);error:	return ret;} /* * Invalidate a key. * * The key must be grant the caller Invalidate permission for this to work. * The key and any links to the key will be automatically garbage collected * immediately. * * If successful, 0 is returned. */long keyctl_invalidate_key(key_serial_t id){	key_ref_t key_ref;	long ret; 	kenter("%d", id); 	key_ref = lookup_user_key(id, 0, KEY_SEARCH);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		goto error;	} 	key_invalidate(key_ref_to_ptr(key_ref));	ret = 0; 	key_ref_put(key_ref);error:	kleave(" = %ld", ret);	return ret;} /* * Clear the specified keyring, creating an empty process keyring if one of the * special keyring IDs is used. * * The keyring must grant the caller Write permission for this to work.  If * successful, 0 will be returned. */long keyctl_keyring_clear(key_serial_t ringid){	key_ref_t keyring_ref;	long ret; 	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);	if (IS_ERR(keyring_ref)) {		ret = PTR_ERR(keyring_ref); 		/* Root is permitted to invalidate certain special keyrings */		if (capable(CAP_SYS_ADMIN)) {			keyring_ref = lookup_user_key(ringid, 0, 0);			if (IS_ERR(keyring_ref))				goto error;			if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR,				     &key_ref_to_ptr(keyring_ref)->flags))				goto clear;			goto error_put;		} 		goto error;	} clear:	ret = keyring_clear(key_ref_to_ptr(keyring_ref));error_put:	key_ref_put(keyring_ref);error:	return ret;} /* * Create a link from a keyring to a key if there's no matching key in the * keyring, otherwise replace the link to the matching key with a link to the * new key. * * The key must grant the caller Link permission and the the keyring must grant * the caller Write permission.  Furthermore, if an additional link is created, * the keyring's quota will be extended. * * If successful, 0 will be returned. */long keyctl_keyring_link(key_serial_t id, key_serial_t ringid){	key_ref_t keyring_ref, key_ref;	long ret; 	keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_WRITE);	if (IS_ERR(keyring_ref)) {		ret = PTR_ERR(keyring_ref);		goto error;	} 	key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE, KEY_LINK);	if (IS_ERR(key_ref)) {		ret = PTR_ERR(key_ref);		goto error2;	} 	ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref)); 	key_ref_put(key_ref);error2:	key_ref_put(keyring_ref);error:	return ret;} /* * Unlink a key from a keyring. * * The keyring must grant the caller Write permission for this to work; the key * itself need not grant the caller anything.  If the last link to a key is * removed then that key will be scheduled for destruction. *

Lines 1–500 of 1676. Load more