Pull keyring namespacing from David Howells: "These patches help make keys and keyrings more namespace aware. Firstly some miscellaneous patches to make the process easier: - Simplify key index_key handling so that the word-sized chunks assoc_array requires don't have to be shifted about, making it easier to add more bits into the key. - Cache the hash value in the key so that we don't have to calculate on every key we examine during a search (it involves a bunch of multiplications). - Allow keying_search() to search non-recursively. Then the main patches: - Make it so that keyring names are per-user_namespace from the point of view of KEYCTL_JOIN_SESSION_KEYRING so that they're not accessible cross-user_namespace. keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEYRING_NAME for this. - Move the user and user-session keyrings to the user_namespace rather than the user_struct. This prevents them propagating directly across user_namespaces boundaries (ie. the KEY_SPEC_* flags will only pick from the current user_namespace). - Make it possible to include the target namespace in which the key shall operate in the index_key. This will allow the possibility of multiple keys with the same description, but different target domains to be held in the same keyring. keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEY_TAG for this. - Make it so that keys are implicitly invalidated by removal of a domain tag, causing them to be garbage collected. - Institute a network namespace domain tag that allows keys to be differentiated by the network namespace in which they operate. New keys that are of a type marked 'KEY_TYPE_NET_DOMAIN' are assigned the network domain in force when they are created. - Make it so that the desired network namespace can be handed down into the request_key() mechanism. This allows AFS, NFS, etc. to request keys specific to the network namespace of the superblock. This also means that the keys in the DNS record cache are thenceforth namespaced, provided network filesystems pass the appropriate network namespace down into dns_query(). For DNS, AFS and NFS are good, whilst CIFS and Ceph are not. Other cache keyrings, such as idmapper keyrings, also need to set the domain tag - for which they need access to the network namespace of the superblock" * tag 'keys-namespace-20190627' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Pass the network namespace into request_key mechanism keys: Network namespace domain tag keys: Garbage collect keys for which the domain has been removed keys: Include target namespace in match criteria keys: Move the user and user-session keyrings to the user_namespace keys: Namespace keyring names keys: Add a 'recurse' flag for keyring searches keys: Cache the hash value to avoid lots of recalculation keys: Simplify key description management
Showing the changes to include/linux (5 of 36 files). Show all
Unified · Split
| @@ -26,7 +26,8 @@ · 25 unmodified lines | ||
| 26 | 26 | |
| 27 | 27 | #include <uapi/linux/dns_resolver.h> |
| 28 | 28 | |
| 29 | −extern int dns_query(const char *type, const char *name, size_t namelen, | |
| 29 | +struct net; | |
| 30 | +extern int dns_query(struct net *net, const char *type, const char *name, size_t namelen, | |
| 30 | 31 | const char *options, char **_result, time64_t *_expiry, |
| 31 | 32 | bool invalidate); |
| 32 | 33 | |
| @@ -70,6 +70,9 @@ struct key_type { · 69 unmodified lines | ||
| 70 | 70 | */ |
| 71 | 71 | size_t def_datalen; |
| 72 | 72 | |
| 73 | + unsigned int flags; | |
| 74 | +#define KEY_TYPE_NET_DOMAIN 0x00000001 /* Keys of this type have a net namespace domain */ | |
| 75 | + | |
| 73 | 76 | /* vet a description */ |
| 74 | 77 | int (*vet_description)(const char *description); |
| 75 | 78 | |
| @@ -31,6 +31,7 @@ typedef int32_t key_serial_t; · 30 unmodified lines | ||
| 31 | 31 | typedef uint32_t key_perm_t; |
| 32 | 32 | |
| 33 | 33 | struct key; |
| 34 | +struct net; | |
| 34 | 35 | |
| 35 | 36 | #ifdef CONFIG_KEYS |
| 36 | 37 | |
| @@ -77,13 +78,34 @@ struct cred; · 40 unmodified lines | ||
| 77 | 78 | |
| 78 | 79 | struct key_type; |
| 79 | 80 | struct key_owner; |
| 81 | +struct key_tag; | |
| 80 | 82 | struct keyring_list; |
| 81 | 83 | struct keyring_name; |
| 82 | 84 | |
| 85 | +struct key_tag { | |
| 86 | + struct rcu_head rcu; | |
| 87 | + refcount_t usage; | |
| 88 | + bool removed; /* T when subject removed */ | |
| 89 | +}; | |
| 90 | + | |
| 83 | 91 | struct keyring_index_key { |
| 92 | + /* [!] If this structure is altered, the union in struct key must change too! */ | |
| 93 | + unsigned long hash; /* Hash value */ | |
| 94 | + union { | |
| 95 | + struct { | |
| 96 | +#ifdef __LITTLE_ENDIAN /* Put desc_len at the LSB of x */ | |
| 97 | + u8 desc_len; | |
| 98 | + char desc[sizeof(long) - 1]; /* First few chars of description */ | |
| 99 | +#else | |
| 100 | + char desc[sizeof(long) - 1]; /* First few chars of description */ | |
| 101 | + u8 desc_len; | |
| 102 | +#endif | |
| 103 | + }; | |
| 104 | + unsigned long x; | |
| 105 | + }; | |
| 84 | 106 | struct key_type *type; |
| 107 | + struct key_tag *domain_tag; /* Domain of operation */ | |
| 85 | 108 | const char *description; |
| 86 | − size_t desc_len; | |
| 87 | 109 | }; |
| 88 | 110 | |
| 89 | 111 | union key_payload { |
| @@ -197,7 +219,10 @@ struct key { · 107 unmodified lines | ||
| 197 | 219 | union { |
| 198 | 220 | struct keyring_index_key index_key; |
| 199 | 221 | struct { |
| 222 | + unsigned long hash; | |
| 223 | + unsigned long len_desc; | |
| 200 | 224 | struct key_type *type; /* type of key */ |
| 225 | + struct key_tag *domain_tag; /* Domain of operation */ | |
| 201 | 226 | char *description; |
| 202 | 227 | }; |
| 203 | 228 | }; |
| @@ -248,6 +273,8 @@ extern struct key *key_alloc(struct key_type *type, · 44 unmodified lines | ||
| 248 | 273 | extern void key_revoke(struct key *key); |
| 249 | 274 | extern void key_invalidate(struct key *key); |
| 250 | 275 | extern void key_put(struct key *key); |
| 276 | +extern bool key_put_tag(struct key_tag *tag); | |
| 277 | +extern void key_remove_domain(struct key_tag *domain_tag); | |
| 251 | 278 | |
| 252 | 279 | static inline struct key *__key_get(struct key *key) |
| 253 | 280 | { |
| @@ -265,19 +292,57 @@ static inline void key_ref_put(key_ref_t key_ref) · 11 unmodified lines | ||
| 265 | 292 | key_put(key_ref_to_ptr(key_ref)); |
| 266 | 293 | } |
| 267 | 294 | |
| 268 | −extern struct key *request_key(struct key_type *type, | |
| 269 | − const char *description, | |
| 270 | − const char *callout_info); | |
| 295 | +extern struct key *request_key_tag(struct key_type *type, | |
| 296 | + const char *description, | |
| 297 | + struct key_tag *domain_tag, | |
| 298 | + const char *callout_info); | |
| 271 | 299 | |
| 272 | 300 | extern struct key *request_key_rcu(struct key_type *type, |
| 273 | − const char *description); | |
| 301 | + const char *description, | |
| 302 | + struct key_tag *domain_tag); | |
| 274 | 303 | |
| 275 | 304 | extern struct key *request_key_with_auxdata(struct key_type *type, |
| 276 | 305 | const char *description, |
| 306 | + struct key_tag *domain_tag, | |
| 277 | 307 | const void *callout_info, |
| 278 | 308 | size_t callout_len, |
| 279 | 309 | void *aux); |
| 280 | 310 | |
| 311 | +/** | |
| 312 | + * request_key - Request a key and wait for construction | |
| 313 | + * @type: Type of key. | |
| 314 | + * @description: The searchable description of the key. | |
| 315 | + * @callout_info: The data to pass to the instantiation upcall (or NULL). | |
| 316 | + * | |
| 317 | + * As for request_key_tag(), but with the default global domain tag. | |
| 318 | + */ | |
| 319 | +static inline struct key *request_key(struct key_type *type, | |
| 320 | + const char *description, | |
| 321 | + const char *callout_info) | |
| 322 | +{ | |
| 323 | + return request_key_tag(type, description, NULL, callout_info); | |
| 324 | +} | |
| 325 | + | |
| 326 | +#ifdef CONFIG_NET | |
| 327 | +/* | |
| 328 | + * request_key_net - Request a key for a net namespace and wait for construction | |
| 329 | + * @type: Type of key. | |
| 330 | + * @description: The searchable description of the key. | |
| 331 | + * @net: The network namespace that is the key's domain of operation. | |
| 332 | + * @callout_info: The data to pass to the instantiation upcall (or NULL). | |
| 333 | + * | |
| 334 | + * As for request_key() except that it does not add the returned key to a | |
| 335 | + * keyring if found, new keys are always allocated in the user's quota, the | |
| 336 | + * callout_info must be a NUL-terminated string and no auxiliary data can be | |
| 337 | + * passed. Only keys that operate the specified network namespace are used. | |
| 338 | + * | |
| 339 | + * Furthermore, it then works as wait_for_key_construction() to wait for the | |
| 340 | + * completion of keys undergoing construction with a non-interruptible wait. | |
| 341 | + */ | |
| 342 | +#define request_key_net(type, description, net, callout_info) \ | |
| 343 | + request_key_tag(type, description, net->key_domain, callout_info); | |
| 344 | +#endif /* CONFIG_NET */ | |
| 345 | + | |
| 281 | 346 | extern int wait_for_key_construction(struct key *key, bool intr); |
| 282 | 347 | |
| 283 | 348 | extern int key_validate(const struct key *key); |
| @@ -321,7 +386,8 @@ extern int keyring_clear(struct key *keyring); · 37 unmodified lines | ||
| 321 | 386 | |
| 322 | 387 | extern key_ref_t keyring_search(key_ref_t keyring, |
| 323 | 388 | struct key_type *type, |
| 324 | − const char *description); | |
| 389 | + const char *description, | |
| 390 | + bool recurse); | |
| 325 | 391 | |
| 326 | 392 | extern int keyring_add_key(struct key *keyring, |
| 327 | 393 | struct key *key); |
| @@ -340,6 +406,7 @@ extern void key_set_timeout(struct key *, unsigned); · 12 unmodified lines | ||
| 340 | 406 | |
| 341 | 407 | extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, |
| 342 | 408 | key_perm_t perm); |
| 409 | +extern void key_free_user_ns(struct user_namespace *); | |
| 343 | 410 | |
| 344 | 411 | /* |
| 345 | 412 | * The permissions required on a key that we're looking up. |
| @@ -413,6 +480,8 @@ extern void key_init(void); · 67 unmodified lines | ||
| 413 | 480 | #define key_fsuid_changed(c) do { } while(0) |
| 414 | 481 | #define key_fsgid_changed(c) do { } while(0) |
| 415 | 482 | #define key_init() do { } while(0) |
| 483 | +#define key_free_user_ns(ns) do { } while(0) | |
| 484 | +#define key_remove_domain(d) do { } while(0) | |
| 416 | 485 | |
| 417 | 486 | #endif /* CONFIG_KEYS */ |
| 418 | 487 | #endif /* __KERNEL__ */ |
| @@ -7,8 +7,6 @@ · 6 unmodified lines | ||
| 7 | 7 | #include <linux/refcount.h> |
| 8 | 8 | #include <linux/ratelimit.h> |
| 9 | 9 | |
| 10 | −struct key; | |
| 11 | − | |
| 12 | 10 | /* |
| 13 | 11 | * Some day this will be a full-fledged user tracking system.. |
| 14 | 12 | */ |
| @@ -30,18 +28,6 @@ struct user_struct { · 15 unmodified lines | ||
| 30 | 28 | unsigned long unix_inflight; /* How many files in flight in unix sockets */ |
| 31 | 29 | atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ |
| 32 | 30 | |
| 33 | −#ifdef CONFIG_KEYS | |
| 34 | − /* | |
| 35 | − * These pointers can only change from NULL to a non-NULL value once. | |
| 36 | − * Writes are protected by key_user_keyring_mutex. | |
| 37 | − * Unlocked readers should use READ_ONCE() unless they know that | |
| 38 | − * install_user_keyrings() has been called successfully (which sets | |
| 39 | − * these members to non-NULL values, preventing further modifications). | |
| 40 | − */ | |
| 41 | − struct key *uid_keyring; /* UID specific keyring */ | |
| 42 | − struct key *session_keyring; /* UID's default session keyring */ | |
| 43 | −#endif | |
| 44 | − | |
| 45 | 31 | /* Hash table maintenance information */ |
| 46 | 32 | struct hlist_node uidhash_node; |
| 47 | 33 | kuid_t uid; |
| @@ -64,10 +64,20 @@ struct user_namespace { · 63 unmodified lines | ||
| 64 | 64 | struct ns_common ns; |
| 65 | 65 | unsigned long flags; |
| 66 | 66 | |
| 67 | +#ifdef CONFIG_KEYS | |
| 68 | + /* List of joinable keyrings in this namespace. Modification access of | |
| 69 | + * these pointers is controlled by keyring_sem. Once | |
| 70 | + * user_keyring_register is set, it won't be changed, so it can be | |
| 71 | + * accessed directly with READ_ONCE(). | |
| 72 | + */ | |
| 73 | + struct list_head keyring_name_list; | |
| 74 | + struct key *user_keyring_register; | |
| 75 | + struct rw_semaphore keyring_sem; | |
| 76 | +#endif | |
| 77 | + | |
| 67 | 78 | /* Register of per-UID persistent keyrings for this namespace */ |
| 68 | 79 | #ifdef CONFIG_PERSISTENT_KEYRINGS |
| 69 | 80 | struct key *persistent_keyring_register; |
| 70 | − struct rw_semaphore persistent_keyring_register_sem; | |
| 71 | 81 | #endif |
| 72 | 82 | struct work_struct work; |
| 73 | 83 | #ifdef CONFIG_SYSCTL |