security/keys/request_key_auth.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /* Request key authorisation token key definition.
0003  *
0004  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
0005  * Written by David Howells (dhowells@redhat.com)
0006  *
0007  * See Documentation/security/keys/request-key.rst
0008  */
0009
0010 #include <linux/sched.h>
0011 #include <linux/err.h>
0012 #include <linux/seq_file.h>
0013 #include <linux/slab.h>
0014 #include <linux/uaccess.h>
0015 #include "internal.h"
0016 #include <keys/request_key_auth-type.h>
0017
0018 static int request_key_auth_preparse(struct key_preparsed_payload *);
0019 static void request_key_auth_free_preparse(struct key_preparsed_payload *);
0020 static int request_key_auth_instantiate(struct key *,
0021                     struct key_preparsed_payload *);
0022 static void request_key_auth_describe(const struct key *, struct seq_file *);
0023 static void request_key_auth_revoke(struct key *);
0024 static void request_key_auth_destroy(struct key *);
0025 static long request_key_auth_read(const struct key *, char *, size_t);
0026
0027 /*
0028  * The request-key authorisation key type definition.
0029  */
0030 struct key_type key_type_request_key_auth = {
0031     .name       = ".request_key_auth",
0032     .def_datalen    = sizeof(struct request_key_auth),
0033     .preparse   = request_key_auth_preparse,
0034     .free_preparse  = request_key_auth_free_preparse,
0035     .instantiate    = request_key_auth_instantiate,
0036     .describe   = request_key_auth_describe,
0037     .revoke     = request_key_auth_revoke,
0038     .destroy    = request_key_auth_destroy,
0039     .read       = request_key_auth_read,
0040 };
0041
0042 static int request_key_auth_preparse(struct key_preparsed_payload *prep)
0043 {
0044     return 0;
0045 }
0046
0047 static void request_key_auth_free_preparse(struct key_preparsed_payload *prep)
0048 {
0049 }
0050
0051 /*
0052  * Instantiate a request-key authorisation key.
0053  */
0054 static int request_key_auth_instantiate(struct key *key,
0055                     struct key_preparsed_payload *prep)
0056 {
0057     rcu_assign_keypointer(key, (struct request_key_auth *)prep->data);
0058     return 0;
0059 }
0060
0061 /*
0062  * Describe an authorisation token.
0063  */
0064 static void request_key_auth_describe(const struct key *key,
0065                       struct seq_file *m)
0066 {
0067     struct request_key_auth *rka = dereference_key_rcu(key);
0068
0069     if (!rka)
0070         return;
0071
0072     seq_puts(m, "key:");
0073     seq_puts(m, key->description);
0074     if (key_is_positive(key))
0075         seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
0076 }
0077
0078 /*
0079  * Read the callout_info data (retrieves the callout information).
0080  * - the key's semaphore is read-locked
0081  */
0082 static long request_key_auth_read(const struct key *key,
0083                   char *buffer, size_t buflen)
0084 {
0085     struct request_key_auth *rka = dereference_key_locked(key);
0086     size_t datalen;
0087     long ret;
0088
0089     if (!rka)
0090         return -EKEYREVOKED;
0091
0092     datalen = rka->callout_len;
0093     ret = datalen;
0094
0095     /* we can return the data as is */
0096     if (buffer && buflen > 0) {
0097         if (buflen > datalen)
0098             buflen = datalen;
0099
0100         memcpy(buffer, rka->callout_info, buflen);
0101     }
0102
0103     return ret;
0104 }
0105
0106 static void free_request_key_auth(struct request_key_auth *rka)
0107 {
0108     if (!rka)
0109         return;
0110     key_put(rka->target_key);
0111     key_put(rka->dest_keyring);
0112     if (rka->cred)
0113         put_cred(rka->cred);
0114     kfree(rka->callout_info);
0115     kfree(rka);
0116 }
0117
0118 /*
0119  * Dispose of the request_key_auth record under RCU conditions
0120  */
0121 static void request_key_auth_rcu_disposal(struct rcu_head *rcu)
0122 {
0123     struct request_key_auth *rka =
0124         container_of(rcu, struct request_key_auth, rcu);
0125
0126     free_request_key_auth(rka);
0127 }
0128
0129 /*
0130  * Handle revocation of an authorisation token key.
0131  *
0132  * Called with the key sem write-locked.
0133  */
0134 static void request_key_auth_revoke(struct key *key)
0135 {
0136     struct request_key_auth *rka = dereference_key_locked(key);
0137
0138     kenter("{%d}", key->serial);
0139     rcu_assign_keypointer(key, NULL);
0140     call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
0141 }
0142
0143 /*
0144  * Destroy an instantiation authorisation token key.
0145  */
0146 static void request_key_auth_destroy(struct key *key)
0147 {
0148     struct request_key_auth *rka = rcu_access_pointer(key->payload.rcu_data0);
0149
0150     kenter("{%d}", key->serial);
0151     if (rka) {
0152         rcu_assign_keypointer(key, NULL);
0153         call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
0154     }
0155 }
0156
0157 /*
0158  * Create an authorisation token for /sbin/request-key or whoever to gain
0159  * access to the caller's security data.
0160  */
0161 struct key *request_key_auth_new(struct key *target, const char *op,
0162                  const void *callout_info, size_t callout_len,
0163                  struct key *dest_keyring)
0164 {
0165     struct request_key_auth *rka, *irka;
0166     const struct cred *cred = current_cred();
0167     struct key *authkey = NULL;
0168     char desc[20];
0169     int ret = -ENOMEM;
0170
0171     kenter("%d,", target->serial);
0172
0173     /* allocate a auth record */
0174     rka = kzalloc(sizeof(*rka), GFP_KERNEL);
0175     if (!rka)
0176         goto error;
0177     rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
0178     if (!rka->callout_info)
0179         goto error_free_rka;
0180     rka->callout_len = callout_len;
0181     strlcpy(rka->op, op, sizeof(rka->op));
0182
0183     /* see if the calling process is already servicing the key request of
0184      * another process */
0185     if (cred->request_key_auth) {
0186         /* it is - use that instantiation context here too */
0187         down_read(&cred->request_key_auth->sem);
0188
0189         /* if the auth key has been revoked, then the key we're
0190          * servicing is already instantiated */
0191         if (test_bit(KEY_FLAG_REVOKED,
0192                  &cred->request_key_auth->flags)) {
0193             up_read(&cred->request_key_auth->sem);
0194             ret = -EKEYREVOKED;
0195             goto error_free_rka;
0196         }
0197
0198         irka = cred->request_key_auth->payload.data[0];
0199         rka->cred = get_cred(irka->cred);
0200         rka->pid = irka->pid;
0201
0202         up_read(&cred->request_key_auth->sem);
0203     }
0204     else {
0205         /* it isn't - use this process as the context */
0206         rka->cred = get_cred(cred);
0207         rka->pid = current->pid;
0208     }
0209
0210     rka->target_key = key_get(target);
0211     rka->dest_keyring = key_get(dest_keyring);
0212
0213     /* allocate the auth key */
0214     sprintf(desc, "%x", target->serial);
0215
0216     authkey = key_alloc(&key_type_request_key_auth, desc,
0217                 cred->fsuid, cred->fsgid, cred,
0218                 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_LINK |
0219                 KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
0220     if (IS_ERR(authkey)) {
0221         ret = PTR_ERR(authkey);
0222         goto error_free_rka;
0223     }
0224
0225     /* construct the auth key */
0226     ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
0227     if (ret < 0)
0228         goto error_put_authkey;
0229
0230     kleave(" = {%d,%d}", authkey->serial, refcount_read(&authkey->usage));
0231     return authkey;
0232
0233 error_put_authkey:
0234     key_put(authkey);
0235 error_free_rka:
0236     free_request_key_auth(rka);
0237 error:
0238     kleave("= %d", ret);
0239     return ERR_PTR(ret);
0240 }
0241
0242 /*
0243  * Search the current process's keyrings for the authorisation key for
0244  * instantiation of a key.
0245  */
0246 struct key *key_get_instantiation_authkey(key_serial_t target_id)
0247 {
0248     char description[16];
0249     struct keyring_search_context ctx = {
0250         .index_key.type     = &key_type_request_key_auth,
0251         .index_key.description  = description,
0252         .cred           = current_cred(),
0253         .match_data.cmp     = key_default_cmp,
0254         .match_data.raw_data    = description,
0255         .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
0256         .flags          = (KEYRING_SEARCH_DO_STATE_CHECK |
0257                        KEYRING_SEARCH_RECURSE),
0258     };
0259     struct key *authkey;
0260     key_ref_t authkey_ref;
0261
0262     ctx.index_key.desc_len = sprintf(description, "%x", target_id);
0263
0264     rcu_read_lock();
0265     authkey_ref = search_process_keyrings_rcu(&ctx);
0266     rcu_read_unlock();
0267
0268     if (IS_ERR(authkey_ref)) {
0269         authkey = ERR_CAST(authkey_ref);
0270         if (authkey == ERR_PTR(-EAGAIN))
0271             authkey = ERR_PTR(-ENOKEY);
0272         goto error;
0273     }
0274
0275     authkey = key_ref_to_ptr(authkey_ref);
0276     if (test_bit(KEY_FLAG_REVOKED, &authkey->flags)) {
0277         key_put(authkey);
0278         authkey = ERR_PTR(-EKEYREVOKED);
0279     }
0280
0281 error:
0282     return authkey;
0283 }