Diff markup
1 /* keyctl.c: userspace keyctl operations 1 /* keyctl.c: userspace keyctl operations
2 * 2 *
3 * Copyright (C) 2004-5 Red Hat, Inc. All Righ 3 * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.c 4 * Written by David Howells (dhowells@redhat.com)
5 * 5 *
6 * This program is free software; you can redi 6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Genera 7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundatio 8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any l 9 * 2 of the License, or (at your option) any later version.
10 */ 10 */
11 11
12 #include <linux/module.h> 12 #include <linux/module.h>
13 #include <linux/init.h> 13 #include <linux/init.h>
14 #include <linux/sched.h> 14 #include <linux/sched.h>
15 #include <linux/slab.h> 15 #include <linux/slab.h>
16 #include <linux/syscalls.h> 16 #include <linux/syscalls.h>
17 #include <linux/keyctl.h> 17 #include <linux/keyctl.h>
18 #include <linux/fs.h> 18 #include <linux/fs.h>
19 #include <linux/capability.h> 19 #include <linux/capability.h>
20 #include <linux/string.h> 20 #include <linux/string.h>
21 #include <linux/err.h> 21 #include <linux/err.h>
22 #include <asm/uaccess.h> 22 #include <asm/uaccess.h>
23 #include "internal.h" 23 #include "internal.h"
24 24
25 static int key_get_type_from_user(char *type, 25 static int key_get_type_from_user(char *type,
26 const char _ 26 const char __user *_type,
27 unsigned len 27 unsigned len)
28 { 28 {
29 int ret; 29 int ret;
30 30
31 ret = strncpy_from_user(type, _type, l 31 ret = strncpy_from_user(type, _type, len);
32 32
33 if (ret < 0) 33 if (ret < 0)
34 return -EFAULT; 34 return -EFAULT;
35 35
36 if (ret == 0 || ret >= len) 36 if (ret == 0 || ret >= len)
37 return -EINVAL; 37 return -EINVAL;
38 38
39 if (type[0] == '.') 39 if (type[0] == '.')
40 return -EPERM; 40 return -EPERM;
41 41
42 type[len - 1] = '\0'; 42 type[len - 1] = '\0';
43 43
44 return 0; 44 return 0;
45 } 45 }
46 46
47 /********************************************* 47 /*****************************************************************************/
48 /* 48 /*
49 * extract the description of a new key from u 49 * extract the description of a new key from userspace and either add it as a
50 * new key to the specified keyring or update 50 * new key to the specified keyring or update a matching key in that keyring
51 * - the keyring must be writable 51 * - the keyring must be writable
52 * - returns the new key's serial number 52 * - returns the new key's serial number
53 * - implements add_key() 53 * - implements add_key()
54 */ 54 */
55 asmlinkage long sys_add_key(const char __user 55 asmlinkage long sys_add_key(const char __user *_type,
56 const char __user 56 const char __user *_description,
57 const void __user 57 const void __user *_payload,
58 size_t plen, 58 size_t plen,
59 key_serial_t ringi 59 key_serial_t ringid)
60 { 60 {
61 key_ref_t keyring_ref, key_ref; 61 key_ref_t keyring_ref, key_ref;
62 char type[32], *description; 62 char type[32], *description;
63 void *payload; 63 void *payload;
64 long ret; 64 long ret;
65 65
66 ret = -EINVAL; 66 ret = -EINVAL;
67 if (plen > 32767) 67 if (plen > 32767)
68 goto error; 68 goto error;
69 69
70 /* draw all the data into kernel space 70 /* draw all the data into kernel space */
71 ret = key_get_type_from_user(type, _ty 71 ret = key_get_type_from_user(type, _type, sizeof(type));
72 if (ret < 0) 72 if (ret < 0)
73 goto error; 73 goto error;
74 74
75 description = strndup_user(_descriptio 75 description = strndup_user(_description, PAGE_SIZE);
76 if (IS_ERR(description)) { 76 if (IS_ERR(description)) {
77 ret = PTR_ERR(description); 77 ret = PTR_ERR(description);
78 goto error; 78 goto error;
79 } 79 }
80 80
81 /* pull the payload in if one was supp 81 /* pull the payload in if one was supplied */
82 payload = NULL; 82 payload = NULL;
83 83
84 if (_payload) { 84 if (_payload) {
85 ret = -ENOMEM; 85 ret = -ENOMEM;
86 payload = kmalloc(plen, GFP_KE 86 payload = kmalloc(plen, GFP_KERNEL);
87 if (!payload) 87 if (!payload)
88 goto error2; 88 goto error2;
89 89
90 ret = -EFAULT; 90 ret = -EFAULT;
91 if (copy_from_user(payload, _p 91 if (copy_from_user(payload, _payload, plen) != 0)
92 goto error3; 92 goto error3;
93 } 93 }
94 94
95 /* find the target keyring (which must 95 /* find the target keyring (which must be writable) */
96 keyring_ref = lookup_user_key(NULL, ri 96 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
97 if (IS_ERR(keyring_ref)) { 97 if (IS_ERR(keyring_ref)) {
98 ret = PTR_ERR(keyring_ref); 98 ret = PTR_ERR(keyring_ref);
99 goto error3; 99 goto error3;
100 } 100 }
101 101
102 /* create or update the requested key 102 /* create or update the requested key and add it to the target
103 * keyring */ 103 * keyring */
104 key_ref = key_create_or_update(keyring 104 key_ref = key_create_or_update(keyring_ref, type, description,
105 payload 105 payload, plen, KEY_ALLOC_IN_QUOTA);
106 if (!IS_ERR(key_ref)) { 106 if (!IS_ERR(key_ref)) {
107 ret = key_ref_to_ptr(key_ref)- 107 ret = key_ref_to_ptr(key_ref)->serial;
108 key_ref_put(key_ref); 108 key_ref_put(key_ref);
109 } 109 }
110 else { 110 else {
111 ret = PTR_ERR(key_ref); 111 ret = PTR_ERR(key_ref);
112 } 112 }
113 113
114 key_ref_put(keyring_ref); 114 key_ref_put(keyring_ref);
115 error3: 115 error3:
116 kfree(payload); 116 kfree(payload);
117 error2: 117 error2:
118 kfree(description); 118 kfree(description);
119 error: 119 error:
120 return ret; 120 return ret;
121 121
122 } /* end sys_add_key() */ 122 } /* end sys_add_key() */
123 123
124 /********************************************* 124 /*****************************************************************************/
125 /* 125 /*
126 * search the process keyrings for a matching 126 * search the process keyrings for a matching key
127 * - nested keyrings may also be searched if t 127 * - nested keyrings may also be searched if they have Search permission
128 * - if a key is found, it will be attached to 128 * - if a key is found, it will be attached to the destination keyring if
129 * there's one specified 129 * there's one specified
130 * - /sbin/request-key will be invoked if _cal 130 * - /sbin/request-key will be invoked if _callout_info is non-NULL
131 * - the _callout_info string will be passed 131 * - the _callout_info string will be passed to /sbin/request-key
132 * - if the _callout_info string is empty, i 132 * - if the _callout_info string is empty, it will be rendered as "-"
133 * - implements request_key() 133 * - implements request_key()
134 */ 134 */
135 asmlinkage long sys_request_key(const char __u 135 asmlinkage long sys_request_key(const char __user *_type,
136 const char __u 136 const char __user *_description,
137 const char __u 137 const char __user *_callout_info,
138 key_serial_t d 138 key_serial_t destringid)
139 { 139 {
140 struct key_type *ktype; 140 struct key_type *ktype;
141 struct key *key; 141 struct key *key;
142 key_ref_t dest_ref; 142 key_ref_t dest_ref;
143 char type[32], *description, *callout_ 143 char type[32], *description, *callout_info;
144 long ret; 144 long ret;
145 145
146 /* pull the type into kernel space */ 146 /* pull the type into kernel space */
147 ret = key_get_type_from_user(type, _ty 147 ret = key_get_type_from_user(type, _type, sizeof(type));
148 if (ret < 0) 148 if (ret < 0)
149 goto error; 149 goto error;
150 150
151 /* pull the description into kernel sp 151 /* pull the description into kernel space */
152 description = strndup_user(_descriptio 152 description = strndup_user(_description, PAGE_SIZE);
153 if (IS_ERR(description)) { 153 if (IS_ERR(description)) {
154 ret = PTR_ERR(description); 154 ret = PTR_ERR(description);
155 goto error; 155 goto error;
156 } 156 }
157 157
158 /* pull the callout info into kernel s 158 /* pull the callout info into kernel space */
159 callout_info = NULL; 159 callout_info = NULL;
160 if (_callout_info) { 160 if (_callout_info) {
161 callout_info = strndup_user(_c 161 callout_info = strndup_user(_callout_info, PAGE_SIZE);
162 if (IS_ERR(callout_info)) { 162 if (IS_ERR(callout_info)) {
163 ret = PTR_ERR(callout_ 163 ret = PTR_ERR(callout_info);
164 goto error2; 164 goto error2;
165 } 165 }
166 } 166 }
167 167
168 /* get the destination keyring if spec 168 /* get the destination keyring if specified */
169 dest_ref = NULL; 169 dest_ref = NULL;
170 if (destringid) { 170 if (destringid) {
171 dest_ref = lookup_user_key(NUL 171 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
172 if (IS_ERR(dest_ref)) { 172 if (IS_ERR(dest_ref)) {
173 ret = PTR_ERR(dest_ref 173 ret = PTR_ERR(dest_ref);
174 goto error3; 174 goto error3;
175 } 175 }
176 } 176 }
177 177
178 /* find the key type */ 178 /* find the key type */
179 ktype = key_type_lookup(type); 179 ktype = key_type_lookup(type);
180 if (IS_ERR(ktype)) { 180 if (IS_ERR(ktype)) {
181 ret = PTR_ERR(ktype); 181 ret = PTR_ERR(ktype);
182 goto error4; 182 goto error4;
183 } 183 }
184 184
185 /* do the search */ 185 /* do the search */
186 key = request_key_and_link(ktype, desc 186 key = request_key_and_link(ktype, description, callout_info, NULL,
187 key_ref_to_ 187 key_ref_to_ptr(dest_ref),
188 KEY_ALLOC_I 188 KEY_ALLOC_IN_QUOTA);
189 if (IS_ERR(key)) { 189 if (IS_ERR(key)) {
190 ret = PTR_ERR(key); 190 ret = PTR_ERR(key);
191 goto error5; 191 goto error5;
192 } 192 }
193 193
194 ret = key->serial; 194 ret = key->serial;
195 195
196 key_put(key); 196 key_put(key);
197 error5: 197 error5:
198 key_type_put(ktype); 198 key_type_put(ktype);
199 error4: 199 error4:
200 key_ref_put(dest_ref); 200 key_ref_put(dest_ref);
201 error3: 201 error3:
202 kfree(callout_info); 202 kfree(callout_info);
203 error2: 203 error2:
204 kfree(description); 204 kfree(description);
205 error: 205 error:
206 return ret; 206 return ret;
207 207
208 } /* end sys_request_key() */ 208 } /* end sys_request_key() */
209 209
210 /********************************************* 210 /*****************************************************************************/
211 /* 211 /*
212 * get the ID of the specified process keyring 212 * get the ID of the specified process keyring
213 * - the keyring must have search permission t 213 * - the keyring must have search permission to be found
214 * - implements keyctl(KEYCTL_GET_KEYRING_ID) 214 * - implements keyctl(KEYCTL_GET_KEYRING_ID)
215 */ 215 */
216 long keyctl_get_keyring_ID(key_serial_t id, in 216 long keyctl_get_keyring_ID(key_serial_t id, int create)
217 { 217 {
218 key_ref_t key_ref; 218 key_ref_t key_ref;
219 long ret; 219 long ret;
220 220
221 key_ref = lookup_user_key(NULL, id, cr 221 key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
222 if (IS_ERR(key_ref)) { 222 if (IS_ERR(key_ref)) {
223 ret = PTR_ERR(key_ref); 223 ret = PTR_ERR(key_ref);
224 goto error; 224 goto error;
225 } 225 }
226 226
227 ret = key_ref_to_ptr(key_ref)->serial; 227 ret = key_ref_to_ptr(key_ref)->serial;
228 key_ref_put(key_ref); 228 key_ref_put(key_ref);
229 error: 229 error:
230 return ret; 230 return ret;
231 231
232 } /* end keyctl_get_keyring_ID() */ 232 } /* end keyctl_get_keyring_ID() */
233 233
234 /********************************************* 234 /*****************************************************************************/
235 /* 235 /*
236 * join the session keyring 236 * join the session keyring
237 * - implements keyctl(KEYCTL_JOIN_SESSION_KEY 237 * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
238 */ 238 */
239 long keyctl_join_session_keyring(const char __ 239 long keyctl_join_session_keyring(const char __user *_name)
240 { 240 {
241 char *name; 241 char *name;
242 long ret; 242 long ret;
243 243
244 /* fetch the name from userspace */ 244 /* fetch the name from userspace */
245 name = NULL; 245 name = NULL;
246 if (_name) { 246 if (_name) {
247 name = strndup_user(_name, PAG 247 name = strndup_user(_name, PAGE_SIZE);
248 if (IS_ERR(name)) { 248 if (IS_ERR(name)) {
249 ret = PTR_ERR(name); 249 ret = PTR_ERR(name);
250 goto error; 250 goto error;
251 } 251 }
252 } 252 }
253 253
254 /* join the session */ 254 /* join the session */
255 ret = join_session_keyring(name); 255 ret = join_session_keyring(name);
256 256
257 error: 257 error:
258 return ret; 258 return ret;
259 259
260 } /* end keyctl_join_session_keyring() */ 260 } /* end keyctl_join_session_keyring() */
261 261
262 /********************************************* 262 /*****************************************************************************/
263 /* 263 /*
264 * update a key's data payload 264 * update a key's data payload
265 * - the key must be writable 265 * - the key must be writable
266 * - implements keyctl(KEYCTL_UPDATE) 266 * - implements keyctl(KEYCTL_UPDATE)
267 */ 267 */
268 long keyctl_update_key(key_serial_t id, 268 long keyctl_update_key(key_serial_t id,
269 const void __user *_pay 269 const void __user *_payload,
270 size_t plen) 270 size_t plen)
271 { 271 {
272 key_ref_t key_ref; 272 key_ref_t key_ref;
273 void *payload; 273 void *payload;
274 long ret; 274 long ret;
275 275
276 ret = -EINVAL; 276 ret = -EINVAL;
277 if (plen > PAGE_SIZE) 277 if (plen > PAGE_SIZE)
278 goto error; 278 goto error;
279 279
280 /* pull the payload in if one was supp 280 /* pull the payload in if one was supplied */
281 payload = NULL; 281 payload = NULL;
282 if (_payload) { 282 if (_payload) {
283 ret = -ENOMEM; 283 ret = -ENOMEM;
284 payload = kmalloc(plen, GFP_KE 284 payload = kmalloc(plen, GFP_KERNEL);
285 if (!payload) 285 if (!payload)
286 goto error; 286 goto error;
287 287
288 ret = -EFAULT; 288 ret = -EFAULT;
289 if (copy_from_user(payload, _p 289 if (copy_from_user(payload, _payload, plen) != 0)
290 goto error2; 290 goto error2;
291 } 291 }
292 292
293 /* find the target key (which must be 293 /* find the target key (which must be writable) */
294 key_ref = lookup_user_key(NULL, id, 0, 294 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
295 if (IS_ERR(key_ref)) { 295 if (IS_ERR(key_ref)) {
296 ret = PTR_ERR(key_ref); 296 ret = PTR_ERR(key_ref);
297 goto error2; 297 goto error2;
298 } 298 }
299 299
300 /* update the key */ 300 /* update the key */
301 ret = key_update(key_ref, payload, ple 301 ret = key_update(key_ref, payload, plen);
302 302
303 key_ref_put(key_ref); 303 key_ref_put(key_ref);
304 error2: 304 error2:
305 kfree(payload); 305 kfree(payload);
306 error: 306 error:
307 return ret; 307 return ret;
308 308
309 } /* end keyctl_update_key() */ 309 } /* end keyctl_update_key() */
310 310
311 /********************************************* 311 /*****************************************************************************/
312 /* 312 /*
313 * revoke a key 313 * revoke a key
314 * - the key must be writable 314 * - the key must be writable
315 * - implements keyctl(KEYCTL_REVOKE) 315 * - implements keyctl(KEYCTL_REVOKE)
316 */ 316 */
317 long keyctl_revoke_key(key_serial_t id) 317 long keyctl_revoke_key(key_serial_t id)
318 { 318 {
319 key_ref_t key_ref; 319 key_ref_t key_ref;
320 long ret; 320 long ret;
321 321
322 key_ref = lookup_user_key(NULL, id, 0, 322 key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
323 if (IS_ERR(key_ref)) { 323 if (IS_ERR(key_ref)) {
324 ret = PTR_ERR(key_ref); 324 ret = PTR_ERR(key_ref);
325 goto error; 325 goto error;
326 } 326 }
327 327
328 key_revoke(key_ref_to_ptr(key_ref)); 328 key_revoke(key_ref_to_ptr(key_ref));
329 ret = 0; 329 ret = 0;
330 330
331 key_ref_put(key_ref); 331 key_ref_put(key_ref);
332 error: 332 error:
333 return ret; 333 return ret;
334 334
335 } /* end keyctl_revoke_key() */ 335 } /* end keyctl_revoke_key() */
336 336
337 /********************************************* 337 /*****************************************************************************/
338 /* 338 /*
339 * clear the specified process keyring 339 * clear the specified process keyring
340 * - the keyring must be writable 340 * - the keyring must be writable
341 * - implements keyctl(KEYCTL_CLEAR) 341 * - implements keyctl(KEYCTL_CLEAR)
342 */ 342 */
343 long keyctl_keyring_clear(key_serial_t ringid) 343 long keyctl_keyring_clear(key_serial_t ringid)
344 { 344 {
345 key_ref_t keyring_ref; 345 key_ref_t keyring_ref;
346 long ret; 346 long ret;
347 347
348 keyring_ref = lookup_user_key(NULL, ri 348 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
349 if (IS_ERR(keyring_ref)) { 349 if (IS_ERR(keyring_ref)) {
350 ret = PTR_ERR(keyring_ref); 350 ret = PTR_ERR(keyring_ref);
351 goto error; 351 goto error;
352 } 352 }
353 353
354 ret = keyring_clear(key_ref_to_ptr(key 354 ret = keyring_clear(key_ref_to_ptr(keyring_ref));
355 355
356 key_ref_put(keyring_ref); 356 key_ref_put(keyring_ref);
357 error: 357 error:
358 return ret; 358 return ret;
359 359
360 } /* end keyctl_keyring_clear() */ 360 } /* end keyctl_keyring_clear() */
361 361
362 /********************************************* 362 /*****************************************************************************/
363 /* 363 /*
364 * link a key into a keyring 364 * link a key into a keyring
365 * - the keyring must be writable 365 * - the keyring must be writable
366 * - the key must be linkable 366 * - the key must be linkable
367 * - implements keyctl(KEYCTL_LINK) 367 * - implements keyctl(KEYCTL_LINK)
368 */ 368 */
369 long keyctl_keyring_link(key_serial_t id, key_ 369 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
370 { 370 {
371 key_ref_t keyring_ref, key_ref; 371 key_ref_t keyring_ref, key_ref;
372 long ret; 372 long ret;
373 373
374 keyring_ref = lookup_user_key(NULL, ri 374 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
375 if (IS_ERR(keyring_ref)) { 375 if (IS_ERR(keyring_ref)) {
376 ret = PTR_ERR(keyring_ref); 376 ret = PTR_ERR(keyring_ref);
377 goto error; 377 goto error;
378 } 378 }
379 379
380 key_ref = lookup_user_key(NULL, id, 1, 380 key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
381 if (IS_ERR(key_ref)) { 381 if (IS_ERR(key_ref)) {
382 ret = PTR_ERR(key_ref); 382 ret = PTR_ERR(key_ref);
383 goto error2; 383 goto error2;
384 } 384 }
385 385
386 ret = key_link(key_ref_to_ptr(keyring_ 386 ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
387 387
388 key_ref_put(key_ref); 388 key_ref_put(key_ref);
389 error2: 389 error2:
390 key_ref_put(keyring_ref); 390 key_ref_put(keyring_ref);
391 error: 391 error:
392 return ret; 392 return ret;
393 393
394 } /* end keyctl_keyring_link() */ 394 } /* end keyctl_keyring_link() */
395 395
396 /********************************************* 396 /*****************************************************************************/
397 /* 397 /*
398 * unlink the first attachment of a key from a 398 * unlink the first attachment of a key from a keyring
399 * - the keyring must be writable 399 * - the keyring must be writable
400 * - we don't need any permissions on the key 400 * - we don't need any permissions on the key
401 * - implements keyctl(KEYCTL_UNLINK) 401 * - implements keyctl(KEYCTL_UNLINK)
402 */ 402 */
403 long keyctl_keyring_unlink(key_serial_t id, ke 403 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
404 { 404 {
405 key_ref_t keyring_ref, key_ref; 405 key_ref_t keyring_ref, key_ref;
406 long ret; 406 long ret;
407 407
408 keyring_ref = lookup_user_key(NULL, ri 408 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
409 if (IS_ERR(keyring_ref)) { 409 if (IS_ERR(keyring_ref)) {
410 ret = PTR_ERR(keyring_ref); 410 ret = PTR_ERR(keyring_ref);
411 goto error; 411 goto error;
412 } 412 }
413 413
414 key_ref = lookup_user_key(NULL, id, 0, 414 key_ref = lookup_user_key(NULL, id, 0, 0, 0);
415 if (IS_ERR(key_ref)) { 415 if (IS_ERR(key_ref)) {
416 ret = PTR_ERR(key_ref); 416 ret = PTR_ERR(key_ref);
417 goto error2; 417 goto error2;
418 } 418 }
419 419
420 ret = key_unlink(key_ref_to_ptr(keyrin 420 ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
421 421
422 key_ref_put(key_ref); 422 key_ref_put(key_ref);
423 error2: 423 error2:
424 key_ref_put(keyring_ref); 424 key_ref_put(keyring_ref);
425 error: 425 error:
426 return ret; 426 return ret;
427 427
428 } /* end keyctl_keyring_unlink() */ 428 } /* end keyctl_keyring_unlink() */
429 429
430 /********************************************* 430 /*****************************************************************************/
431 /* 431 /*
432 * describe a user key 432 * describe a user key
433 * - the key must have view permission 433 * - the key must have view permission
434 * - if there's a buffer, we place up to bufle 434 * - if there's a buffer, we place up to buflen bytes of data into it
435 * - unless there's an error, we return the am 435 * - unless there's an error, we return the amount of description available,
436 * irrespective of how much we may have copi 436 * irrespective of how much we may have copied
437 * - the description is formatted thus: 437 * - the description is formatted thus:
438 * type;uid;gid;perm;description<NUL> 438 * type;uid;gid;perm;description<NUL>
439 * - implements keyctl(KEYCTL_DESCRIBE) 439 * - implements keyctl(KEYCTL_DESCRIBE)
440 */ 440 */
441 long keyctl_describe_key(key_serial_t keyid, 441 long keyctl_describe_key(key_serial_t keyid,
442 char __user *buffer, 442 char __user *buffer,
443 size_t buflen) 443 size_t buflen)
444 { 444 {
445 struct key *key, *instkey; 445 struct key *key, *instkey;
446 key_ref_t key_ref; 446 key_ref_t key_ref;
447 char *tmpbuf; 447 char *tmpbuf;
448 long ret; 448 long ret;
449 449
450 key_ref = lookup_user_key(NULL, keyid, 450 key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
451 if (IS_ERR(key_ref)) { 451 if (IS_ERR(key_ref)) {
452 /* viewing a key under constru 452 /* viewing a key under construction is permitted if we have the
453 * authorisation token handy * 453 * authorisation token handy */
454 if (PTR_ERR(key_ref) == -EACCE 454 if (PTR_ERR(key_ref) == -EACCES) {
455 instkey = key_get_inst 455 instkey = key_get_instantiation_authkey(keyid);
456 if (!IS_ERR(instkey)) 456 if (!IS_ERR(instkey)) {
457 key_put(instke 457 key_put(instkey);
458 key_ref = look 458 key_ref = lookup_user_key(NULL, keyid,
459 459 0, 1, 0);
460 if (!IS_ERR(ke 460 if (!IS_ERR(key_ref))
461 goto o 461 goto okay;
462 } 462 }
463 } 463 }
464 464
465 ret = PTR_ERR(key_ref); 465 ret = PTR_ERR(key_ref);
466 goto error; 466 goto error;
467 } 467 }
468 468
469 okay: 469 okay:
470 /* calculate how much description we'r 470 /* calculate how much description we're going to return */
471 ret = -ENOMEM; 471 ret = -ENOMEM;
472 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL 472 tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
473 if (!tmpbuf) 473 if (!tmpbuf)
474 goto error2; 474 goto error2;
475 475
476 key = key_ref_to_ptr(key_ref); 476 key = key_ref_to_ptr(key_ref);
477 477
478 ret = snprintf(tmpbuf, PAGE_SIZE - 1, 478 ret = snprintf(tmpbuf, PAGE_SIZE - 1,
479 "%s;%d;%d;%08x;%s", 479 "%s;%d;%d;%08x;%s",
480 key_ref_to_ptr(key_ref) 480 key_ref_to_ptr(key_ref)->type->name,
481 key_ref_to_ptr(key_ref) 481 key_ref_to_ptr(key_ref)->uid,
482 key_ref_to_ptr(key_ref) 482 key_ref_to_ptr(key_ref)->gid,
483 key_ref_to_ptr(key_ref) 483 key_ref_to_ptr(key_ref)->perm,
484 key_ref_to_ptr(key_ref) 484 key_ref_to_ptr(key_ref)->description ?
485 key_ref_to_ptr(key_ref) 485 key_ref_to_ptr(key_ref)->description : ""
486 ); 486 );
487 487
488 /* include a NUL char at the end of th 488 /* include a NUL char at the end of the data */
489 if (ret > PAGE_SIZE - 1) 489 if (ret > PAGE_SIZE - 1)
490 ret = PAGE_SIZE - 1; 490 ret = PAGE_SIZE - 1;
491 tmpbuf[ret] = 0; 491 tmpbuf[ret] = 0;
492 ret++; 492 ret++;
493 493
494 /* consider returning the data */ 494 /* consider returning the data */
495 if (buffer && buflen > 0) { 495 if (buffer && buflen > 0) {
496 if (buflen > ret) 496 if (buflen > ret)
497 buflen = ret; 497 buflen = ret;
498 498
499 if (copy_to_user(buffer, tmpbu 499 if (copy_to_user(buffer, tmpbuf, buflen) != 0)
500 ret = -EFAULT; 500 ret = -EFAULT;
501 } 501 }
502 502
503 kfree(tmpbuf); 503 kfree(tmpbuf);
504 error2: 504 error2:
505 key_ref_put(key_ref); 505 key_ref_put(key_ref);
506 error: 506 error:
507 return ret; 507 return ret;
508 508
509 } /* end keyctl_describe_key() */ 509 } /* end keyctl_describe_key() */
510 510
511 /********************************************* 511 /*****************************************************************************/
512 /* 512 /*
513 * search the specified keyring for a matching 513 * search the specified keyring for a matching key
514 * - the start keyring must be searchable 514 * - the start keyring must be searchable
515 * - nested keyrings may also be searched if t 515 * - nested keyrings may also be searched if they are searchable
516 * - only keys with search permission may be f 516 * - only keys with search permission may be found
517 * - if a key is found, it will be attached to 517 * - if a key is found, it will be attached to the destination keyring if
518 * there's one specified 518 * there's one specified
519 * - implements keyctl(KEYCTL_SEARCH) 519 * - implements keyctl(KEYCTL_SEARCH)
520 */ 520 */
521 long keyctl_keyring_search(key_serial_t ringid 521 long keyctl_keyring_search(key_serial_t ringid,
522 const char __user * 522 const char __user *_type,
523 const char __user * 523 const char __user *_description,
524 key_serial_t destri 524 key_serial_t destringid)
525 { 525 {
526 struct key_type *ktype; 526 struct key_type *ktype;
527 key_ref_t keyring_ref, key_ref, dest_r 527 key_ref_t keyring_ref, key_ref, dest_ref;
528 char type[32], *description; 528 char type[32], *description;
529 long ret; 529 long ret;
530 530
531 /* pull the type and description into 531 /* pull the type and description into kernel space */
532 ret = key_get_type_from_user(type, _ty 532 ret = key_get_type_from_user(type, _type, sizeof(type));
533 if (ret < 0) 533 if (ret < 0)
534 goto error; 534 goto error;
535 535
536 description = strndup_user(_descriptio 536 description = strndup_user(_description, PAGE_SIZE);
537 if (IS_ERR(description)) { 537 if (IS_ERR(description)) {
538 ret = PTR_ERR(description); 538 ret = PTR_ERR(description);
539 goto error; 539 goto error;
540 } 540 }
541 541
542 /* get the keyring at which to begin t 542 /* get the keyring at which to begin the search */
543 keyring_ref = lookup_user_key(NULL, ri 543 keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
544 if (IS_ERR(keyring_ref)) { 544 if (IS_ERR(keyring_ref)) {
545 ret = PTR_ERR(keyring_ref); 545 ret = PTR_ERR(keyring_ref);
546 goto error2; 546 goto error2;
547 } 547 }
548 548
549 /* get the destination keyring if spec 549 /* get the destination keyring if specified */
550 dest_ref = NULL; 550 dest_ref = NULL;
551 if (destringid) { 551 if (destringid) {
552 dest_ref = lookup_user_key(NUL 552 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
553 if (IS_ERR(dest_ref)) { 553 if (IS_ERR(dest_ref)) {
554 ret = PTR_ERR(dest_ref 554 ret = PTR_ERR(dest_ref);
555 goto error3; 555 goto error3;
556 } 556 }
557 } 557 }
558 558
559 /* find the key type */ 559 /* find the key type */
560 ktype = key_type_lookup(type); 560 ktype = key_type_lookup(type);
561 if (IS_ERR(ktype)) { 561 if (IS_ERR(ktype)) {
562 ret = PTR_ERR(ktype); 562 ret = PTR_ERR(ktype);
563 goto error4; 563 goto error4;
564 } 564 }
565 565
566 /* do the search */ 566 /* do the search */
567 key_ref = keyring_search(keyring_ref, 567 key_ref = keyring_search(keyring_ref, ktype, description);
568 if (IS_ERR(key_ref)) { 568 if (IS_ERR(key_ref)) {
569 ret = PTR_ERR(key_ref); 569 ret = PTR_ERR(key_ref);
570 570
571 /* treat lack or presence of a 571 /* treat lack or presence of a negative key the same */
572 if (ret == -EAGAIN) 572 if (ret == -EAGAIN)
573 ret = -ENOKEY; 573 ret = -ENOKEY;
574 goto error5; 574 goto error5;
575 } 575 }
576 576
577 /* link the resulting key to the desti 577 /* link the resulting key to the destination keyring if we can */
578 if (dest_ref) { 578 if (dest_ref) {
579 ret = key_permission(key_ref, 579 ret = key_permission(key_ref, KEY_LINK);
580 if (ret < 0) 580 if (ret < 0)
581 goto error6; 581 goto error6;
582 582
583 ret = key_link(key_ref_to_ptr( 583 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
584 if (ret < 0) 584 if (ret < 0)
585 goto error6; 585 goto error6;
586 } 586 }
587 587
588 ret = key_ref_to_ptr(key_ref)->serial; 588 ret = key_ref_to_ptr(key_ref)->serial;
589 589
590 error6: 590 error6:
591 key_ref_put(key_ref); 591 key_ref_put(key_ref);
592 error5: 592 error5:
593 key_type_put(ktype); 593 key_type_put(ktype);
594 error4: 594 error4:
595 key_ref_put(dest_ref); 595 key_ref_put(dest_ref);
596 error3: 596 error3:
597 key_ref_put(keyring_ref); 597 key_ref_put(keyring_ref);
598 error2: 598 error2:
599 kfree(description); 599 kfree(description);
600 error: 600 error:
601 return ret; 601 return ret;
602 602
603 } /* end keyctl_keyring_search() */ 603 } /* end keyctl_keyring_search() */
604 604
605 /********************************************* 605 /*****************************************************************************/
606 /* 606 /*
607 * read a user key's payload 607 * read a user key's payload
608 * - the keyring must be readable or the key m 608 * - the keyring must be readable or the key must be searchable from the
609 * process's keyrings 609 * process's keyrings
610 * - if there's a buffer, we place up to bufle 610 * - if there's a buffer, we place up to buflen bytes of data into it
611 * - unless there's an error, we return the am 611 * - unless there's an error, we return the amount of data in the key,
612 * irrespective of how much we may have copi 612 * irrespective of how much we may have copied
613 * - implements keyctl(KEYCTL_READ) 613 * - implements keyctl(KEYCTL_READ)
614 */ 614 */
615 long keyctl_read_key(key_serial_t keyid, char 615 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
616 { 616 {
617 struct key *key; 617 struct key *key;
618 key_ref_t key_ref; 618 key_ref_t key_ref;
619 long ret; 619 long ret;
620 620
621 /* find the key first */ 621 /* find the key first */
622 key_ref = lookup_user_key(NULL, keyid, 622 key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
623 if (IS_ERR(key_ref)) { 623 if (IS_ERR(key_ref)) {
624 ret = -ENOKEY; 624 ret = -ENOKEY;
625 goto error; 625 goto error;
626 } 626 }
627 627
628 key = key_ref_to_ptr(key_ref); 628 key = key_ref_to_ptr(key_ref);
629 629
630 /* see if we can read it directly */ 630 /* see if we can read it directly */
631 ret = key_permission(key_ref, KEY_READ 631 ret = key_permission(key_ref, KEY_READ);
632 if (ret == 0) 632 if (ret == 0)
633 goto can_read_key; 633 goto can_read_key;
634 if (ret != -EACCES) 634 if (ret != -EACCES)
635 goto error; 635 goto error;
636 636
637 /* we can't; see if it's searchable fr 637 /* we can't; see if it's searchable from this process's keyrings
638 * - we automatically take account of 638 * - we automatically take account of the fact that it may be
639 * dangling off an instantiation key 639 * dangling off an instantiation key
640 */ 640 */
641 if (!is_key_possessed(key_ref)) { 641 if (!is_key_possessed(key_ref)) {
642 ret = -EACCES; 642 ret = -EACCES;
643 goto error2; 643 goto error2;
644 } 644 }
645 645
646 /* the key is probably readable - now 646 /* the key is probably readable - now try to read it */
647 can_read_key: 647 can_read_key:
648 ret = key_validate(key); 648 ret = key_validate(key);
649 if (ret == 0) { 649 if (ret == 0) {
650 ret = -EOPNOTSUPP; 650 ret = -EOPNOTSUPP;
651 if (key->type->read) { 651 if (key->type->read) {
652 /* read the data with 652 /* read the data with the semaphore held (since we
653 * might sleep) */ 653 * might sleep) */
654 down_read(&key->sem); 654 down_read(&key->sem);
655 ret = key->type->read( 655 ret = key->type->read(key, buffer, buflen);
656 up_read(&key->sem); 656 up_read(&key->sem);
657 } 657 }
658 } 658 }
659 659
660 error2: 660 error2:
661 key_put(key); 661 key_put(key);
662 error: 662 error:
663 return ret; 663 return ret;
664 664
665 } /* end keyctl_read_key() */ 665 } /* end keyctl_read_key() */
666 666
667 /********************************************* 667 /*****************************************************************************/
668 /* 668 /*
669 * change the ownership of a key 669 * change the ownership of a key
670 * - the keyring owned by the changer 670 * - the keyring owned by the changer
671 * - if the uid or gid is -1, then that parame 671 * - if the uid or gid is -1, then that parameter is not changed
672 * - implements keyctl(KEYCTL_CHOWN) 672 * - implements keyctl(KEYCTL_CHOWN)
673 */ 673 */
674 long keyctl_chown_key(key_serial_t id, uid_t u 674 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
675 { 675 {
676 struct key_user *newowner, *zapowner = 676 struct key_user *newowner, *zapowner = NULL;
677 struct key *key; 677 struct key *key;
678 key_ref_t key_ref; 678 key_ref_t key_ref;
679 long ret; 679 long ret;
680 680
681 ret = 0; 681 ret = 0;
682 if (uid == (uid_t) -1 && gid == (gid_t 682 if (uid == (uid_t) -1 && gid == (gid_t) -1)
683 goto error; 683 goto error;
684 684
685 key_ref = lookup_user_key(NULL, id, 1, 685 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
686 if (IS_ERR(key_ref)) { 686 if (IS_ERR(key_ref)) {
687 ret = PTR_ERR(key_ref); 687 ret = PTR_ERR(key_ref);
688 goto error; 688 goto error;
689 } 689 }
690 690
691 key = key_ref_to_ptr(key_ref); 691 key = key_ref_to_ptr(key_ref);
692 692
693 /* make the changes with the locks hel 693 /* make the changes with the locks held to prevent chown/chown races */
694 ret = -EACCES; 694 ret = -EACCES;
695 down_write(&key->sem); 695 down_write(&key->sem);
696 696
697 if (!capable(CAP_SYS_ADMIN)) { 697 if (!capable(CAP_SYS_ADMIN)) {
698 /* only the sysadmin can chown 698 /* only the sysadmin can chown a key to some other UID */
699 if (uid != (uid_t) -1 && key-> 699 if (uid != (uid_t) -1 && key->uid != uid)
700 goto error_put; 700 goto error_put;
701 701
702 /* only the sysadmin can set t 702 /* only the sysadmin can set the key's GID to a group other
703 * than one of those that the 703 * than one of those that the current process subscribes to */
704 if (gid != (gid_t) -1 && gid ! 704 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
705 goto error_put; 705 goto error_put;
706 } 706 }
707 707
708 /* change the UID */ 708 /* change the UID */
709 if (uid != (uid_t) -1 && uid != key->u 709 if (uid != (uid_t) -1 && uid != key->uid) {
710 ret = -ENOMEM; 710 ret = -ENOMEM;
711 newowner = key_user_lookup(uid 711 newowner = key_user_lookup(uid);
712 if (!newowner) 712 if (!newowner)
713 goto error_put; 713 goto error_put;
714 714
715 /* transfer the quota burden t 715 /* transfer the quota burden to the new user */
716 if (test_bit(KEY_FLAG_IN_QUOTA 716 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
717 spin_lock(&newowner->l 717 spin_lock(&newowner->lock);
718 if (newowner->qnkeys + 718 if (newowner->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
719 newowner->qnbytes 719 newowner->qnbytes + key->quotalen >=
720 KEYQUOTA_MAX_BYTES 720 KEYQUOTA_MAX_BYTES)
721 goto quota_ove 721 goto quota_overrun;
722 722
723 newowner->qnkeys++; 723 newowner->qnkeys++;
724 newowner->qnbytes += k 724 newowner->qnbytes += key->quotalen;
725 spin_unlock(&newowner- 725 spin_unlock(&newowner->lock);
726 726
727 spin_lock(&key->user-> 727 spin_lock(&key->user->lock);
728 key->user->qnkeys--; 728 key->user->qnkeys--;
729 key->user->qnbytes -= 729 key->user->qnbytes -= key->quotalen;
730 spin_unlock(&key->user 730 spin_unlock(&key->user->lock);
731 } 731 }
732 732
733 atomic_dec(&key->user->nkeys); 733 atomic_dec(&key->user->nkeys);
734 atomic_inc(&newowner->nkeys); 734 atomic_inc(&newowner->nkeys);
735 735
736 if (test_bit(KEY_FLAG_INSTANTI 736 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
737 atomic_dec(&key->user- 737 atomic_dec(&key->user->nikeys);
738 atomic_inc(&newowner-> 738 atomic_inc(&newowner->nikeys);
739 } 739 }
740 740
741 zapowner = key->user; 741 zapowner = key->user;
742 key->user = newowner; 742 key->user = newowner;
743 key->uid = uid; 743 key->uid = uid;
744 } 744 }
745 745
746 /* change the GID */ 746 /* change the GID */
747 if (gid != (gid_t) -1) 747 if (gid != (gid_t) -1)
748 key->gid = gid; 748 key->gid = gid;
749 749
750 ret = 0; 750 ret = 0;
751 751
752 error_put: 752 error_put:
753 up_write(&key->sem); 753 up_write(&key->sem);
754 key_put(key); 754 key_put(key);
755 if (zapowner) 755 if (zapowner)
756 key_user_put(zapowner); 756 key_user_put(zapowner);
757 error: 757 error:
758 return ret; 758 return ret;
759 759
760 quota_overrun: 760 quota_overrun:
761 spin_unlock(&newowner->lock); 761 spin_unlock(&newowner->lock);
762 zapowner = newowner; 762 zapowner = newowner;
763 ret = -EDQUOT; 763 ret = -EDQUOT;
764 goto error_put; 764 goto error_put;
765 765
766 } /* end keyctl_chown_key() */ 766 } /* end keyctl_chown_key() */
767 767
768 /********************************************* 768 /*****************************************************************************/
769 /* 769 /*
770 * change the permission mask on a key 770 * change the permission mask on a key
771 * - the keyring owned by the changer 771 * - the keyring owned by the changer
772 * - implements keyctl(KEYCTL_SETPERM) 772 * - implements keyctl(KEYCTL_SETPERM)
773 */ 773 */
774 long keyctl_setperm_key(key_serial_t id, key_p 774 long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
775 { 775 {
776 struct key *key; 776 struct key *key;
777 key_ref_t key_ref; 777 key_ref_t key_ref;
778 long ret; 778 long ret;
779 779
780 ret = -EINVAL; 780 ret = -EINVAL;
781 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL 781 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
782 goto error; 782 goto error;
783 783
784 key_ref = lookup_user_key(NULL, id, 1, 784 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
785 if (IS_ERR(key_ref)) { 785 if (IS_ERR(key_ref)) {
786 ret = PTR_ERR(key_ref); 786 ret = PTR_ERR(key_ref);
787 goto error; 787 goto error;
788 } 788 }
789 789
790 key = key_ref_to_ptr(key_ref); 790 key = key_ref_to_ptr(key_ref);
791 791
792 /* make the changes with the locks hel 792 /* make the changes with the locks held to prevent chown/chmod races */
793 ret = -EACCES; 793 ret = -EACCES;
794 down_write(&key->sem); 794 down_write(&key->sem);
795 795
796 /* if we're not the sysadmin, we can o 796 /* if we're not the sysadmin, we can only change a key that we own */
797 if (capable(CAP_SYS_ADMIN) || key->uid 797 if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
798 key->perm = perm; 798 key->perm = perm;
799 ret = 0; 799 ret = 0;
800 } 800 }
801 801
802 up_write(&key->sem); 802 up_write(&key->sem);
803 key_put(key); 803 key_put(key);
804 error: 804 error:
805 return ret; 805 return ret;
806 806
807 } /* end keyctl_setperm_key() */ 807 } /* end keyctl_setperm_key() */
808 808
809 /********************************************* 809 /*****************************************************************************/
810 /* 810 /*
811 * instantiate the key with the specified payl 811 * instantiate the key with the specified payload, and, if one is given, link
812 * the key into the keyring 812 * the key into the keyring
813 */ 813 */
814 long keyctl_instantiate_key(key_serial_t id, 814 long keyctl_instantiate_key(key_serial_t id,
815 const void __user 815 const void __user *_payload,
816 size_t plen, 816 size_t plen,
817 key_serial_t ringi 817 key_serial_t ringid)
818 { 818 {
819 struct request_key_auth *rka; 819 struct request_key_auth *rka;
820 struct key *instkey; 820 struct key *instkey;
821 key_ref_t keyring_ref; 821 key_ref_t keyring_ref;
822 void *payload; 822 void *payload;
823 long ret; 823 long ret;
824 824
825 ret = -EINVAL; 825 ret = -EINVAL;
826 if (plen > 32767) 826 if (plen > 32767)
827 goto error; 827 goto error;
828 828
829 /* the appropriate instantiation autho 829 /* the appropriate instantiation authorisation key must have been
830 * assumed before calling this */ 830 * assumed before calling this */
831 ret = -EPERM; 831 ret = -EPERM;
832 instkey = current->request_key_auth; 832 instkey = current->request_key_auth;
833 if (!instkey) 833 if (!instkey)
834 goto error; 834 goto error;
835 835
836 rka = instkey->payload.data; 836 rka = instkey->payload.data;
837 if (rka->target_key->serial != id) 837 if (rka->target_key->serial != id)
838 goto error; 838 goto error;
839 839
840 /* pull the payload in if one was supp 840 /* pull the payload in if one was supplied */
841 payload = NULL; 841 payload = NULL;
842 842
843 if (_payload) { 843 if (_payload) {
844 ret = -ENOMEM; 844 ret = -ENOMEM;
845 payload = kmalloc(plen, GFP_KE 845 payload = kmalloc(plen, GFP_KERNEL);
846 if (!payload) 846 if (!payload)
847 goto error; 847 goto error;
848 848
849 ret = -EFAULT; 849 ret = -EFAULT;
850 if (copy_from_user(payload, _p 850 if (copy_from_user(payload, _payload, plen) != 0)
851 goto error2; 851 goto error2;
852 } 852 }
853 853
854 /* find the destination keyring amongs 854 /* find the destination keyring amongst those belonging to the
855 * requesting task */ 855 * requesting task */
856 keyring_ref = NULL; 856 keyring_ref = NULL;
857 if (ringid) { 857 if (ringid) {
858 keyring_ref = lookup_user_key( 858 keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
859 859 KEY_WRITE);
860 if (IS_ERR(keyring_ref)) { 860 if (IS_ERR(keyring_ref)) {
861 ret = PTR_ERR(keyring_ 861 ret = PTR_ERR(keyring_ref);
862 goto error2; 862 goto error2;
863 } 863 }
864 } 864 }
865 865
866 /* instantiate the key and link it int 866 /* instantiate the key and link it into a keyring */
867 ret = key_instantiate_and_link(rka->ta 867 ret = key_instantiate_and_link(rka->target_key, payload, plen,
868 key_ref 868 key_ref_to_ptr(keyring_ref), instkey);
869 869
870 key_ref_put(keyring_ref); 870 key_ref_put(keyring_ref);
871 871
872 /* discard the assumed authority if it 872 /* discard the assumed authority if it's just been disabled by
873 * instantiation of the key */ 873 * instantiation of the key */
874 if (ret == 0) { 874 if (ret == 0) {
875 key_put(current->request_key_a 875 key_put(current->request_key_auth);
876 current->request_key_auth = NU 876 current->request_key_auth = NULL;
877 } 877 }
878 878
879 error2: 879 error2:
880 kfree(payload); 880 kfree(payload);
881 error: 881 error:
882 return ret; 882 return ret;
883 883
884 } /* end keyctl_instantiate_key() */ 884 } /* end keyctl_instantiate_key() */
885 885
886 /********************************************* 886 /*****************************************************************************/
887 /* 887 /*
888 * negatively instantiate the key with the giv 888 * negatively instantiate the key with the given timeout (in seconds), and, if
889 * one is given, link the key into the keyring 889 * one is given, link the key into the keyring
890 */ 890 */
891 long keyctl_negate_key(key_serial_t id, unsign 891 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
892 { 892 {
893 struct request_key_auth *rka; 893 struct request_key_auth *rka;
894 struct key *instkey; 894 struct key *instkey;
895 key_ref_t keyring_ref; 895 key_ref_t keyring_ref;
896 long ret; 896 long ret;
897 897
898 /* the appropriate instantiation autho 898 /* the appropriate instantiation authorisation key must have been
899 * assumed before calling this */ 899 * assumed before calling this */
900 ret = -EPERM; 900 ret = -EPERM;
901 instkey = current->request_key_auth; 901 instkey = current->request_key_auth;
902 if (!instkey) 902 if (!instkey)
903 goto error; 903 goto error;
904 904
905 rka = instkey->payload.data; 905 rka = instkey->payload.data;
906 if (rka->target_key->serial != id) 906 if (rka->target_key->serial != id)
907 goto error; 907 goto error;
908 908
909 /* find the destination keyring if pre 909 /* find the destination keyring if present (which must also be
910 * writable) */ 910 * writable) */
911 keyring_ref = NULL; 911 keyring_ref = NULL;
912 if (ringid) { 912 if (ringid) {
913 keyring_ref = lookup_user_key( 913 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
914 if (IS_ERR(keyring_ref)) { 914 if (IS_ERR(keyring_ref)) {
915 ret = PTR_ERR(keyring_ 915 ret = PTR_ERR(keyring_ref);
916 goto error; 916 goto error;
917 } 917 }
918 } 918 }
919 919
920 /* instantiate the key and link it int 920 /* instantiate the key and link it into a keyring */
921 ret = key_negate_and_link(rka->target_ 921 ret = key_negate_and_link(rka->target_key, timeout,
922 key_ref_to_p 922 key_ref_to_ptr(keyring_ref), instkey);
923 923
924 key_ref_put(keyring_ref); 924 key_ref_put(keyring_ref);
925 925
926 /* discard the assumed authority if it 926 /* discard the assumed authority if it's just been disabled by
927 * instantiation of the key */ 927 * instantiation of the key */
928 if (ret == 0) { 928 if (ret == 0) {
929 key_put(current->request_key_a 929 key_put(current->request_key_auth);
930 current->request_key_auth = NU 930 current->request_key_auth = NULL;
931 } 931 }
932 932
933 error: 933 error:
934 return ret; 934 return ret;
935 935
936 } /* end keyctl_negate_key() */ 936 } /* end keyctl_negate_key() */
937 937
938 /********************************************* 938 /*****************************************************************************/
939 /* 939 /*
940 * set the default keyring in which request_ke 940 * set the default keyring in which request_key() will cache keys
941 * - return the old setting 941 * - return the old setting
942 */ 942 */
943 long keyctl_set_reqkey_keyring(int reqkey_defl 943 long keyctl_set_reqkey_keyring(int reqkey_defl)
944 { 944 {
945 int ret; 945 int ret;
946 946
947 switch (reqkey_defl) { 947 switch (reqkey_defl) {
948 case KEY_REQKEY_DEFL_THREAD_KEYRING: 948 case KEY_REQKEY_DEFL_THREAD_KEYRING:
949 ret = install_thread_keyring(c 949 ret = install_thread_keyring(current);
950 if (ret < 0) 950 if (ret < 0)
951 return ret; 951 return ret;
952 goto set; 952 goto set;
953 953
954 case KEY_REQKEY_DEFL_PROCESS_KEYRING: 954 case KEY_REQKEY_DEFL_PROCESS_KEYRING:
955 ret = install_process_keyring( 955 ret = install_process_keyring(current);
956 if (ret < 0) 956 if (ret < 0)
957 return ret; 957 return ret;
958 958
959 case KEY_REQKEY_DEFL_DEFAULT: 959 case KEY_REQKEY_DEFL_DEFAULT:
960 case KEY_REQKEY_DEFL_SESSION_KEYRING: 960 case KEY_REQKEY_DEFL_SESSION_KEYRING:
961 case KEY_REQKEY_DEFL_USER_KEYRING: 961 case KEY_REQKEY_DEFL_USER_KEYRING:
962 case KEY_REQKEY_DEFL_USER_SESSION_KEYR 962 case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
963 set: 963 set:
964 current->jit_keyring = reqkey_ 964 current->jit_keyring = reqkey_defl;
965 965
966 case KEY_REQKEY_DEFL_NO_CHANGE: 966 case KEY_REQKEY_DEFL_NO_CHANGE:
967 return current->jit_keyring; 967 return current->jit_keyring;
968 968
969 case KEY_REQKEY_DEFL_GROUP_KEYRING: 969 case KEY_REQKEY_DEFL_GROUP_KEYRING:
970 default: 970 default:
971 return -EINVAL; 971 return -EINVAL;
972 } 972 }
973 973
974 } /* end keyctl_set_reqkey_keyring() */ 974 } /* end keyctl_set_reqkey_keyring() */
975 975
976 /********************************************* 976 /*****************************************************************************/
977 /* 977 /*
978 * set or clear the timeout for a key 978 * set or clear the timeout for a key
979 */ 979 */
980 long keyctl_set_timeout(key_serial_t id, unsig 980 long keyctl_set_timeout(key_serial_t id, unsigned timeout)
981 { 981 {
982 struct timespec now; 982 struct timespec now;
983 struct key *key; 983 struct key *key;
984 key_ref_t key_ref; 984 key_ref_t key_ref;
985 time_t expiry; 985 time_t expiry;
986 long ret; 986 long ret;
987 987
988 key_ref = lookup_user_key(NULL, id, 1, 988 key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
989 if (IS_ERR(key_ref)) { 989 if (IS_ERR(key_ref)) {
990 ret = PTR_ERR(key_ref); 990 ret = PTR_ERR(key_ref);
991 goto error; 991 goto error;
992 } 992 }
993 993
994 key = key_ref_to_ptr(key_ref); 994 key = key_ref_to_ptr(key_ref);
995 995
996 /* make the changes with the locks hel 996 /* make the changes with the locks held to prevent races */
997 down_write(&key->sem); 997 down_write(&key->sem);
998 998
999 expiry = 0; 999 expiry = 0;
1000 if (timeout > 0) { 1000 if (timeout > 0) {
1001 now = current_kernel_time(); 1001 now = current_kernel_time();
1002 expiry = now.tv_sec + timeout 1002 expiry = now.tv_sec + timeout;
1003 } 1003 }
1004 1004
1005 key->expiry = expiry; 1005 key->expiry = expiry;
1006 1006
1007 up_write(&key->sem); 1007 up_write(&key->sem);
1008 key_put(key); 1008 key_put(key);
1009 1009
1010 ret = 0; 1010 ret = 0;
1011 error: 1011 error:
1012 return ret; 1012 return ret;
1013 1013
1014 } /* end keyctl_set_timeout() */ 1014 } /* end keyctl_set_timeout() */
1015 1015
1016 /******************************************** 1016 /*****************************************************************************/
1017 /* 1017 /*
1018 * assume the authority to instantiate the sp 1018 * assume the authority to instantiate the specified key
1019 */ 1019 */
1020 long keyctl_assume_authority(key_serial_t id) 1020 long keyctl_assume_authority(key_serial_t id)
1021 { 1021 {
1022 struct key *authkey; 1022 struct key *authkey;
1023 long ret; 1023 long ret;
1024 1024
1025 /* special key IDs aren't permitted * 1025 /* special key IDs aren't permitted */
1026 ret = -EINVAL; 1026 ret = -EINVAL;
1027 if (id < 0) 1027 if (id < 0)
1028 goto error; 1028 goto error;
1029 1029
1030 /* we divest ourselves of authority i 1030 /* we divest ourselves of authority if given an ID of 0 */
1031 if (id == 0) { 1031 if (id == 0) {
1032 key_put(current->request_key_ 1032 key_put(current->request_key_auth);
1033 current->request_key_auth = N 1033 current->request_key_auth = NULL;
1034 ret = 0; 1034 ret = 0;
1035 goto error; 1035 goto error;
1036 } 1036 }
1037 1037
1038 /* attempt to assume the authority te 1038 /* attempt to assume the authority temporarily granted to us whilst we
1039 * instantiate the specified key 1039 * instantiate the specified key
1040 * - the authorisation key must be in 1040 * - the authorisation key must be in the current task's keyrings
1041 * somewhere 1041 * somewhere
1042 */ 1042 */
1043 authkey = key_get_instantiation_authk 1043 authkey = key_get_instantiation_authkey(id);
1044 if (IS_ERR(authkey)) { 1044 if (IS_ERR(authkey)) {
1045 ret = PTR_ERR(authkey); 1045 ret = PTR_ERR(authkey);
1046 goto error; 1046 goto error;
1047 } 1047 }
1048 1048
1049 key_put(current->request_key_auth); 1049 key_put(current->request_key_auth);
1050 current->request_key_auth = authkey; 1050 current->request_key_auth = authkey;
1051 ret = authkey->serial; 1051 ret = authkey->serial;
1052 1052
1053 error: 1053 error:
1054 return ret; 1054 return ret;
1055 1055
1056 } /* end keyctl_assume_authority() */ 1056 } /* end keyctl_assume_authority() */
1057 1057
1058 /******************************************** 1058 /*****************************************************************************/
1059 /* 1059 /*
1060 * the key control system call 1060 * the key control system call
1061 */ 1061 */
1062 asmlinkage long sys_keyctl(int option, unsign 1062 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
1063 unsigned long arg4 1063 unsigned long arg4, unsigned long arg5)
1064 { 1064 {
1065 switch (option) { 1065 switch (option) {
1066 case KEYCTL_GET_KEYRING_ID: 1066 case KEYCTL_GET_KEYRING_ID:
1067 return keyctl_get_keyring_ID( 1067 return keyctl_get_keyring_ID((key_serial_t) arg2,
1068 1068 (int) arg3);
1069 1069
1070 case KEYCTL_JOIN_SESSION_KEYRING: 1070 case KEYCTL_JOIN_SESSION_KEYRING:
1071 return keyctl_join_session_ke 1071 return keyctl_join_session_keyring((const char __user *) arg2);
1072 1072
1073 case KEYCTL_UPDATE: 1073 case KEYCTL_UPDATE:
1074 return keyctl_update_key((key 1074 return keyctl_update_key((key_serial_t) arg2,
1075 (con 1075 (const void __user *) arg3,
1076 (siz 1076 (size_t) arg4);
1077 1077
1078 case KEYCTL_REVOKE: 1078 case KEYCTL_REVOKE:
1079 return keyctl_revoke_key((key 1079 return keyctl_revoke_key((key_serial_t) arg2);
1080 1080
1081 case KEYCTL_DESCRIBE: 1081 case KEYCTL_DESCRIBE:
1082 return keyctl_describe_key((k 1082 return keyctl_describe_key((key_serial_t) arg2,
1083 (c 1083 (char __user *) arg3,
1084 (u 1084 (unsigned) arg4);
1085 1085
1086 case KEYCTL_CLEAR: 1086 case KEYCTL_CLEAR:
1087 return keyctl_keyring_clear(( 1087 return keyctl_keyring_clear((key_serial_t) arg2);
1088 1088
1089 case KEYCTL_LINK: 1089 case KEYCTL_LINK:
1090 return keyctl_keyring_link((k 1090 return keyctl_keyring_link((key_serial_t) arg2,
1091 (k 1091 (key_serial_t) arg3);
1092 1092
1093 case KEYCTL_UNLINK: 1093 case KEYCTL_UNLINK:
1094 return keyctl_keyring_unlink( 1094 return keyctl_keyring_unlink((key_serial_t) arg2,
1095 1095 (key_serial_t) arg3);
1096 1096
1097 case KEYCTL_SEARCH: 1097 case KEYCTL_SEARCH:
1098 return keyctl_keyring_search( 1098 return keyctl_keyring_search((key_serial_t) arg2,
1099 1099 (const char __user *) arg3,
1100 1100 (const char __user *) arg4,
1101 1101 (key_serial_t) arg5);
1102 1102
1103 case KEYCTL_READ: 1103 case KEYCTL_READ:
1104 return keyctl_read_key((key_s 1104 return keyctl_read_key((key_serial_t) arg2,
1105 (char 1105 (char __user *) arg3,
1106 (size_ 1106 (size_t) arg4);
1107 1107
1108 case KEYCTL_CHOWN: 1108 case KEYCTL_CHOWN:
1109 return keyctl_chown_key((key_ 1109 return keyctl_chown_key((key_serial_t) arg2,
1110 (uid_ 1110 (uid_t) arg3,
1111 (gid_ 1111 (gid_t) arg4);
1112 1112
1113 case KEYCTL_SETPERM: 1113 case KEYCTL_SETPERM:
1114 return keyctl_setperm_key((ke 1114 return keyctl_setperm_key((key_serial_t) arg2,
1115 (ke 1115 (key_perm_t) arg3);
1116 1116
1117 case KEYCTL_INSTANTIATE: 1117 case KEYCTL_INSTANTIATE:
1118 return keyctl_instantiate_key 1118 return keyctl_instantiate_key((key_serial_t) arg2,
1119 1119 (const void __user *) arg3,
1120 1120 (size_t) arg4,
1121 1121 (key_serial_t) arg5);
1122 1122
1123 case KEYCTL_NEGATE: 1123 case KEYCTL_NEGATE:
1124 return keyctl_negate_key((key 1124 return keyctl_negate_key((key_serial_t) arg2,
1125 (uns 1125 (unsigned) arg3,
1126 (key 1126 (key_serial_t) arg4);
1127 1127
1128 case KEYCTL_SET_REQKEY_KEYRING: 1128 case KEYCTL_SET_REQKEY_KEYRING:
1129 return keyctl_set_reqkey_keyr 1129 return keyctl_set_reqkey_keyring(arg2);
1130 1130
1131 case KEYCTL_SET_TIMEOUT: 1131 case KEYCTL_SET_TIMEOUT:
1132 return keyctl_set_timeout((ke 1132 return keyctl_set_timeout((key_serial_t) arg2,
1133 (un 1133 (unsigned) arg3);
1134 1134
1135 case KEYCTL_ASSUME_AUTHORITY: 1135 case KEYCTL_ASSUME_AUTHORITY:
1136 return keyctl_assume_authorit 1136 return keyctl_assume_authority((key_serial_t) arg2);
1137 1137
1138 default: 1138 default:
1139 return -EOPNOTSUPP; 1139 return -EOPNOTSUPP;
1140 } 1140 }
1141 1141
1142 } /* end sys_keyctl() */ 1142 } /* end sys_keyctl() */
1143 1143
|
This page was automatically generated by the
LXR engine.
|