security/keys/keyctl.c

   1 /* keyctl.c: userspace keyctl operations
   2  *
   3  * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/sched.h>
  15 #include <linux/slab.h>
  16 #include <linux/syscalls.h>
  17 #include <linux/keyctl.h>
  18 #include <linux/fs.h>
  19 #include <linux/capability.h>
  20 #include <linux/string.h>
  21 #include <linux/err.h>
  22 #include <asm/uaccess.h>
  23 #include "internal.h"
  24
  25 static int key_get_type_from_user(char *type,
  26                                   const char __user *_type,
  27                                   unsigned len)
  28 {
  29         int ret;
  30
  31         ret = strncpy_from_user(type, _type, len);
  32
  33         if (ret < 0)
  34                 return -EFAULT;
  35
  36         if (ret == 0 || ret >= len)
  37                 return -EINVAL;
  38
  39         if (type[0] == '.')
  40                 return -EPERM;
  41
  42         type[len - 1] = '\0';
  43
  44         return 0;
  45 }
  46
  47 /*****************************************************************************/
  48 /*
  49  * extract the description of a new key from userspace and either add it as a
  50  * new key to the specified keyring or update a matching key in that keyring
  51  * - the keyring must be writable
  52  * - returns the new key's serial number
  53  * - implements add_key()
  54  */
  55 asmlinkage long sys_add_key(const char __user *_type,
  56                             const char __user *_description,
  57                             const void __user *_payload,
  58                             size_t plen,
  59                             key_serial_t ringid)
  60 {
  61         key_ref_t keyring_ref, key_ref;
  62         char type[32], *description;
  63         void *payload;
  64         long ret;
  65
  66         ret = -EINVAL;
  67         if (plen > 32767)
  68                 goto error;
  69
  70         /* draw all the data into kernel space */
  71         ret = key_get_type_from_user(type, _type, sizeof(type));
  72         if (ret < 0)
  73                 goto error;
  74
  75         description = strndup_user(_description, PAGE_SIZE);
  76         if (IS_ERR(description)) {
  77                 ret = PTR_ERR(description);
  78                 goto error;
  79         }
  80
  81         /* pull the payload in if one was supplied */
  82         payload = NULL;
  83
  84         if (_payload) {
  85                 ret = -ENOMEM;
  86                 payload = kmalloc(plen, GFP_KERNEL);
  87                 if (!payload)
  88                         goto error2;
  89
  90                 ret = -EFAULT;
  91                 if (copy_from_user(payload, _payload, plen) != 0)
  92                         goto error3;
  93         }
  94
  95         /* find the target keyring (which must be writable) */
  96         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
  97         if (IS_ERR(keyring_ref)) {
  98                 ret = PTR_ERR(keyring_ref);
  99                 goto error3;
 100         }
 101
 102         /* create or update the requested key and add it to the target
 103          * keyring */
 104         key_ref = key_create_or_update(keyring_ref, type, description,
 105                                        payload, plen, KEY_ALLOC_IN_QUOTA);
 106         if (!IS_ERR(key_ref)) {
 107                 ret = key_ref_to_ptr(key_ref)->serial;
 108                 key_ref_put(key_ref);
 109         }
 110         else {
 111                 ret = PTR_ERR(key_ref);
 112         }
 113
 114         key_ref_put(keyring_ref);
 115  error3:
 116         kfree(payload);
 117  error2:
 118         kfree(description);
 119  error:
 120         return ret;
 121
 122 } /* end sys_add_key() */
 123
 124 /*****************************************************************************/
 125 /*
 126  * search the process keyrings for a matching key
 127  * - nested keyrings may also be searched if they have Search permission
 128  * - if a key is found, it will be attached to the destination keyring if
 129  *   there's one specified
 130  * - /sbin/request-key will be invoked if _callout_info is non-NULL
 131  *   - the _callout_info string will be passed to /sbin/request-key
 132  *   - if the _callout_info string is empty, it will be rendered as "-"
 133  * - implements request_key()
 134  */
 135 asmlinkage long sys_request_key(const char __user *_type,
 136                                 const char __user *_description,
 137                                 const char __user *_callout_info,
 138                                 key_serial_t destringid)
 139 {
 140         struct key_type *ktype;
 141         struct key *key;
 142         key_ref_t dest_ref;
 143         char type[32], *description, *callout_info;
 144         long ret;
 145
 146         /* pull the type into kernel space */
 147         ret = key_get_type_from_user(type, _type, sizeof(type));
 148         if (ret < 0)
 149                 goto error;
 150
 151         /* pull the description into kernel space */
 152         description = strndup_user(_description, PAGE_SIZE);
 153         if (IS_ERR(description)) {
 154                 ret = PTR_ERR(description);
 155                 goto error;
 156         }
 157
 158         /* pull the callout info into kernel space */
 159         callout_info = NULL;
 160         if (_callout_info) {
 161                 callout_info = strndup_user(_callout_info, PAGE_SIZE);
 162                 if (IS_ERR(callout_info)) {
 163                         ret = PTR_ERR(callout_info);
 164                         goto error2;
 165                 }
 166         }
 167
 168         /* get the destination keyring if specified */
 169         dest_ref = NULL;
 170         if (destringid) {
 171                 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
 172                 if (IS_ERR(dest_ref)) {
 173                         ret = PTR_ERR(dest_ref);
 174                         goto error3;
 175                 }
 176         }
 177
 178         /* find the key type */
 179         ktype = key_type_lookup(type);
 180         if (IS_ERR(ktype)) {
 181                 ret = PTR_ERR(ktype);
 182                 goto error4;
 183         }
 184
 185         /* do the search */
 186         key = request_key_and_link(ktype, description, callout_info, NULL,
 187                                    key_ref_to_ptr(dest_ref),
 188                                    KEY_ALLOC_IN_QUOTA);
 189         if (IS_ERR(key)) {
 190                 ret = PTR_ERR(key);
 191                 goto error5;
 192         }
 193
 194         ret = key->serial;
 195
 196         key_put(key);
 197  error5:
 198         key_type_put(ktype);
 199  error4:
 200         key_ref_put(dest_ref);
 201  error3:
 202         kfree(callout_info);
 203  error2:
 204         kfree(description);
 205  error:
 206         return ret;
 207
 208 } /* end sys_request_key() */
 209
 210 /*****************************************************************************/
 211 /*
 212  * get the ID of the specified process keyring
 213  * - the keyring must have search permission to be found
 214  * - implements keyctl(KEYCTL_GET_KEYRING_ID)
 215  */
 216 long keyctl_get_keyring_ID(key_serial_t id, int create)
 217 {
 218         key_ref_t key_ref;
 219         long ret;
 220
 221         key_ref = lookup_user_key(NULL, id, create, 0, KEY_SEARCH);
 222         if (IS_ERR(key_ref)) {
 223                 ret = PTR_ERR(key_ref);
 224                 goto error;
 225         }
 226
 227         ret = key_ref_to_ptr(key_ref)->serial;
 228         key_ref_put(key_ref);
 229  error:
 230         return ret;
 231
 232 } /* end keyctl_get_keyring_ID() */
 233
 234 /*****************************************************************************/
 235 /*
 236  * join the session keyring
 237  * - implements keyctl(KEYCTL_JOIN_SESSION_KEYRING)
 238  */
 239 long keyctl_join_session_keyring(const char __user *_name)
 240 {
 241         char *name;
 242         long ret;
 243
 244         /* fetch the name from userspace */
 245         name = NULL;
 246         if (_name) {
 247                 name = strndup_user(_name, PAGE_SIZE);
 248                 if (IS_ERR(name)) {
 249                         ret = PTR_ERR(name);
 250                         goto error;
 251                 }
 252         }
 253
 254         /* join the session */
 255         ret = join_session_keyring(name);
 256
 257  error:
 258         return ret;
 259
 260 } /* end keyctl_join_session_keyring() */
 261
 262 /*****************************************************************************/
 263 /*
 264  * update a key's data payload
 265  * - the key must be writable
 266  * - implements keyctl(KEYCTL_UPDATE)
 267  */
 268 long keyctl_update_key(key_serial_t id,
 269                        const void __user *_payload,
 270                        size_t plen)
 271 {
 272         key_ref_t key_ref;
 273         void *payload;
 274         long ret;
 275
 276         ret = -EINVAL;
 277         if (plen > PAGE_SIZE)
 278                 goto error;
 279
 280         /* pull the payload in if one was supplied */
 281         payload = NULL;
 282         if (_payload) {
 283                 ret = -ENOMEM;
 284                 payload = kmalloc(plen, GFP_KERNEL);
 285                 if (!payload)
 286                         goto error;
 287
 288                 ret = -EFAULT;
 289                 if (copy_from_user(payload, _payload, plen) != 0)
 290                         goto error2;
 291         }
 292
 293         /* find the target key (which must be writable) */
 294         key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
 295         if (IS_ERR(key_ref)) {
 296                 ret = PTR_ERR(key_ref);
 297                 goto error2;
 298         }
 299
 300         /* update the key */
 301         ret = key_update(key_ref, payload, plen);
 302
 303         key_ref_put(key_ref);
 304  error2:
 305         kfree(payload);
 306  error:
 307         return ret;
 308
 309 } /* end keyctl_update_key() */
 310
 311 /*****************************************************************************/
 312 /*
 313  * revoke a key
 314  * - the key must be writable
 315  * - implements keyctl(KEYCTL_REVOKE)
 316  */
 317 long keyctl_revoke_key(key_serial_t id)
 318 {
 319         key_ref_t key_ref;
 320         long ret;
 321
 322         key_ref = lookup_user_key(NULL, id, 0, 0, KEY_WRITE);
 323         if (IS_ERR(key_ref)) {
 324                 ret = PTR_ERR(key_ref);
 325                 goto error;
 326         }
 327
 328         key_revoke(key_ref_to_ptr(key_ref));
 329         ret = 0;
 330
 331         key_ref_put(key_ref);
 332  error:
 333         return ret;
 334
 335 } /* end keyctl_revoke_key() */
 336
 337 /*****************************************************************************/
 338 /*
 339  * clear the specified process keyring
 340  * - the keyring must be writable
 341  * - implements keyctl(KEYCTL_CLEAR)
 342  */
 343 long keyctl_keyring_clear(key_serial_t ringid)
 344 {
 345         key_ref_t keyring_ref;
 346         long ret;
 347
 348         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 349         if (IS_ERR(keyring_ref)) {
 350                 ret = PTR_ERR(keyring_ref);
 351                 goto error;
 352         }
 353
 354         ret = keyring_clear(key_ref_to_ptr(keyring_ref));
 355
 356         key_ref_put(keyring_ref);
 357  error:
 358         return ret;
 359
 360 } /* end keyctl_keyring_clear() */
 361
 362 /*****************************************************************************/
 363 /*
 364  * link a key into a keyring
 365  * - the keyring must be writable
 366  * - the key must be linkable
 367  * - implements keyctl(KEYCTL_LINK)
 368  */
 369 long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
 370 {
 371         key_ref_t keyring_ref, key_ref;
 372         long ret;
 373
 374         keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 375         if (IS_ERR(keyring_ref)) {
 376                 ret = PTR_ERR(keyring_ref);
 377                 goto error;
 378         }
 379
 380         key_ref = lookup_user_key(NULL, id, 1, 0, KEY_LINK);
 381         if (IS_ERR(key_ref)) {
 382                 ret = PTR_ERR(key_ref);
 383                 goto error2;
 384         }
 385
 386         ret = key_link(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 387
 388         key_ref_put(key_ref);
 389  error2:
 390         key_ref_put(keyring_ref);
 391  error:
 392         return ret;
 393
 394 } /* end keyctl_keyring_link() */
 395
 396 /*****************************************************************************/
 397 /*
 398  * unlink the first attachment of a key from a keyring
 399  * - the keyring must be writable
 400  * - we don't need any permissions on the key
 401  * - implements keyctl(KEYCTL_UNLINK)
 402  */
 403 long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
 404 {
 405         key_ref_t keyring_ref, key_ref;
 406         long ret;
 407
 408         keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_WRITE);
 409         if (IS_ERR(keyring_ref)) {
 410                 ret = PTR_ERR(keyring_ref);
 411                 goto error;
 412         }
 413
 414         key_ref = lookup_user_key(NULL, id, 0, 0, 0);
 415         if (IS_ERR(key_ref)) {
 416                 ret = PTR_ERR(key_ref);
 417                 goto error2;
 418         }
 419
 420         ret = key_unlink(key_ref_to_ptr(keyring_ref), key_ref_to_ptr(key_ref));
 421
 422         key_ref_put(key_ref);
 423  error2:
 424         key_ref_put(keyring_ref);
 425  error:
 426         return ret;
 427
 428 } /* end keyctl_keyring_unlink() */
 429
 430 /*****************************************************************************/
 431 /*
 432  * describe a user key
 433  * - the key must have view permission
 434  * - if there's a buffer, we place up to buflen bytes of data into it
 435  * - unless there's an error, we return the amount of description available,
 436  *   irrespective of how much we may have copied
 437  * - the description is formatted thus:
 438  *      type;uid;gid;perm;description<NUL>
 439  * - implements keyctl(KEYCTL_DESCRIBE)
 440  */
 441 long keyctl_describe_key(key_serial_t keyid,
 442                          char __user *buffer,
 443                          size_t buflen)
 444 {
 445         struct key *key, *instkey;
 446         key_ref_t key_ref;
 447         char *tmpbuf;
 448         long ret;
 449
 450         key_ref = lookup_user_key(NULL, keyid, 0, 1, KEY_VIEW);
 451         if (IS_ERR(key_ref)) {
 452                 /* viewing a key under construction is permitted if we have the
 453                  * authorisation token handy */
 454                 if (PTR_ERR(key_ref) == -EACCES) {
 455                         instkey = key_get_instantiation_authkey(keyid);
 456                         if (!IS_ERR(instkey)) {
 457                                 key_put(instkey);
 458                                 key_ref = lookup_user_key(NULL, keyid,
 459                                                           0, 1, 0);
 460                                 if (!IS_ERR(key_ref))
 461                                         goto okay;
 462                         }
 463                 }
 464
 465                 ret = PTR_ERR(key_ref);
 466                 goto error;
 467         }
 468
 469 okay:
 470         /* calculate how much description we're going to return */
 471         ret = -ENOMEM;
 472         tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 473         if (!tmpbuf)
 474                 goto error2;
 475
 476         key = key_ref_to_ptr(key_ref);
 477
 478         ret = snprintf(tmpbuf, PAGE_SIZE - 1,
 479                        "%s;%d;%d;%08x;%s",
 480                        key_ref_to_ptr(key_ref)->type->name,
 481                        key_ref_to_ptr(key_ref)->uid,
 482                        key_ref_to_ptr(key_ref)->gid,
 483                        key_ref_to_ptr(key_ref)->perm,
 484                        key_ref_to_ptr(key_ref)->description ?
 485                        key_ref_to_ptr(key_ref)->description : ""
 486                        );
 487
 488         /* include a NUL char at the end of the data */
 489         if (ret > PAGE_SIZE - 1)
 490                 ret = PAGE_SIZE - 1;
 491         tmpbuf[ret] = 0;
 492         ret++;
 493
 494         /* consider returning the data */
 495         if (buffer && buflen > 0) {
 496                 if (buflen > ret)
 497                         buflen = ret;
 498
 499                 if (copy_to_user(buffer, tmpbuf, buflen) != 0)
 500                         ret = -EFAULT;
 501         }
 502
 503         kfree(tmpbuf);
 504  error2:
 505         key_ref_put(key_ref);
 506  error:
 507         return ret;
 508
 509 } /* end keyctl_describe_key() */
 510
 511 /*****************************************************************************/
 512 /*
 513  * search the specified keyring for a matching key
 514  * - the start keyring must be searchable
 515  * - nested keyrings may also be searched if they are searchable
 516  * - only keys with search permission may be found
 517  * - if a key is found, it will be attached to the destination keyring if
 518  *   there's one specified
 519  * - implements keyctl(KEYCTL_SEARCH)
 520  */
 521 long keyctl_keyring_search(key_serial_t ringid,
 522                            const char __user *_type,
 523                            const char __user *_description,
 524                            key_serial_t destringid)
 525 {
 526         struct key_type *ktype;
 527         key_ref_t keyring_ref, key_ref, dest_ref;
 528         char type[32], *description;
 529         long ret;
 530
 531         /* pull the type and description into kernel space */
 532         ret = key_get_type_from_user(type, _type, sizeof(type));
 533         if (ret < 0)
 534                 goto error;
 535
 536         description = strndup_user(_description, PAGE_SIZE);
 537         if (IS_ERR(description)) {
 538                 ret = PTR_ERR(description);
 539                 goto error;
 540         }
 541
 542         /* get the keyring at which to begin the search */
 543         keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
 544         if (IS_ERR(keyring_ref)) {
 545                 ret = PTR_ERR(keyring_ref);
 546                 goto error2;
 547         }
 548
 549         /* get the destination keyring if specified */
 550         dest_ref = NULL;
 551         if (destringid) {
 552                 dest_ref = lookup_user_key(NULL, destringid, 1, 0, KEY_WRITE);
 553                 if (IS_ERR(dest_ref)) {
 554                         ret = PTR_ERR(dest_ref);
 555                         goto error3;
 556                 }
 557         }
 558
 559         /* find the key type */
 560         ktype = key_type_lookup(type);
 561         if (IS_ERR(ktype)) {
 562                 ret = PTR_ERR(ktype);
 563                 goto error4;
 564         }
 565
 566         /* do the search */
 567         key_ref = keyring_search(keyring_ref, ktype, description);
 568         if (IS_ERR(key_ref)) {
 569                 ret = PTR_ERR(key_ref);
 570
 571                 /* treat lack or presence of a negative key the same */
 572                 if (ret == -EAGAIN)
 573                         ret = -ENOKEY;
 574                 goto error5;
 575         }
 576
 577         /* link the resulting key to the destination keyring if we can */
 578         if (dest_ref) {
 579                 ret = key_permission(key_ref, KEY_LINK);
 580                 if (ret < 0)
 581                         goto error6;
 582
 583                 ret = key_link(key_ref_to_ptr(dest_ref), key_ref_to_ptr(key_ref));
 584                 if (ret < 0)
 585                         goto error6;
 586         }
 587
 588         ret = key_ref_to_ptr(key_ref)->serial;
 589
 590  error6:
 591         key_ref_put(key_ref);
 592  error5:
 593         key_type_put(ktype);
 594  error4:
 595         key_ref_put(dest_ref);
 596  error3:
 597         key_ref_put(keyring_ref);
 598  error2:
 599         kfree(description);
 600  error:
 601         return ret;
 602
 603 } /* end keyctl_keyring_search() */
 604
 605 /*****************************************************************************/
 606 /*
 607  * read a user key's payload
 608  * - the keyring must be readable or the key must be searchable from the
 609  *   process's keyrings
 610  * - if there's a buffer, we place up to buflen bytes of data into it
 611  * - unless there's an error, we return the amount of data in the key,
 612  *   irrespective of how much we may have copied
 613  * - implements keyctl(KEYCTL_READ)
 614  */
 615 long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 616 {
 617         struct key *key;
 618         key_ref_t key_ref;
 619         long ret;
 620
 621         /* find the key first */
 622         key_ref = lookup_user_key(NULL, keyid, 0, 0, 0);
 623         if (IS_ERR(key_ref)) {
 624                 ret = -ENOKEY;
 625                 goto error;
 626         }
 627
 628         key = key_ref_to_ptr(key_ref);
 629
 630         /* see if we can read it directly */
 631         ret = key_permission(key_ref, KEY_READ);
 632         if (ret == 0)
 633                 goto can_read_key;
 634         if (ret != -EACCES)
 635                 goto error;
 636
 637         /* we can't; see if it's searchable from this process's keyrings
 638          * - we automatically take account of the fact that it may be
 639          *   dangling off an instantiation key
 640          */
 641         if (!is_key_possessed(key_ref)) {
 642                 ret = -EACCES;
 643                 goto error2;
 644         }
 645
 646         /* the key is probably readable - now try to read it */
 647  can_read_key:
 648         ret = key_validate(key);
 649         if (ret == 0) {
 650                 ret = -EOPNOTSUPP;
 651                 if (key->type->read) {
 652                         /* read the data with the semaphore held (since we
 653                          * might sleep) */
 654                         down_read(&key->sem);
 655                         ret = key->type->read(key, buffer, buflen);
 656                         up_read(&key->sem);
 657                 }
 658         }
 659
 660  error2:
 661         key_put(key);
 662  error:
 663         return ret;
 664
 665 } /* end keyctl_read_key() */
 666
 667 /*****************************************************************************/
 668 /*
 669  * change the ownership of a key
 670  * - the keyring owned by the changer
 671  * - if the uid or gid is -1, then that parameter is not changed
 672  * - implements keyctl(KEYCTL_CHOWN)
 673  */
 674 long keyctl_chown_key(key_serial_t id, uid_t uid, gid_t gid)
 675 {
 676         struct key_user *newowner, *zapowner = NULL;
 677         struct key *key;
 678         key_ref_t key_ref;
 679         long ret;
 680
 681         ret = 0;
 682         if (uid == (uid_t) -1 && gid == (gid_t) -1)
 683                 goto error;
 684
 685         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 686         if (IS_ERR(key_ref)) {
 687                 ret = PTR_ERR(key_ref);
 688                 goto error;
 689         }
 690
 691         key = key_ref_to_ptr(key_ref);
 692
 693         /* make the changes with the locks held to prevent chown/chown races */
 694         ret = -EACCES;
 695         down_write(&key->sem);
 696
 697         if (!capable(CAP_SYS_ADMIN)) {
 698                 /* only the sysadmin can chown a key to some other UID */
 699                 if (uid != (uid_t) -1 && key->uid != uid)
 700                         goto error_put;
 701
 702                 /* only the sysadmin can set the key's GID to a group other
 703                  * than one of those that the current process subscribes to */
 704                 if (gid != (gid_t) -1 && gid != key->gid && !in_group_p(gid))
 705                         goto error_put;
 706         }
 707
 708         /* change the UID */
 709         if (uid != (uid_t) -1 && uid != key->uid) {
 710                 ret = -ENOMEM;
 711                 newowner = key_user_lookup(uid);
 712                 if (!newowner)
 713                         goto error_put;
 714
 715                 /* transfer the quota burden to the new user */
 716                 if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
 717                         spin_lock(&newowner->lock);
 718                         if (newowner->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
 719                             newowner->qnbytes + key->quotalen >=
 720                             KEYQUOTA_MAX_BYTES)
 721                                 goto quota_overrun;
 722
 723                         newowner->qnkeys++;
 724                         newowner->qnbytes += key->quotalen;
 725                         spin_unlock(&newowner->lock);
 726
 727                         spin_lock(&key->user->lock);
 728                         key->user->qnkeys--;
 729                         key->user->qnbytes -= key->quotalen;
 730                         spin_unlock(&key->user->lock);
 731                 }
 732
 733                 atomic_dec(&key->user->nkeys);
 734                 atomic_inc(&newowner->nkeys);
 735
 736                 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
 737                         atomic_dec(&key->user->nikeys);
 738                         atomic_inc(&newowner->nikeys);
 739                 }
 740
 741                 zapowner = key->user;
 742                 key->user = newowner;
 743                 key->uid = uid;
 744         }
 745
 746         /* change the GID */
 747         if (gid != (gid_t) -1)
 748                 key->gid = gid;
 749
 750         ret = 0;
 751
 752 error_put:
 753         up_write(&key->sem);
 754         key_put(key);
 755         if (zapowner)
 756                 key_user_put(zapowner);
 757 error:
 758         return ret;
 759
 760 quota_overrun:
 761         spin_unlock(&newowner->lock);
 762         zapowner = newowner;
 763         ret = -EDQUOT;
 764         goto error_put;
 765
 766 } /* end keyctl_chown_key() */
 767
 768 /*****************************************************************************/
 769 /*
 770  * change the permission mask on a key
 771  * - the keyring owned by the changer
 772  * - implements keyctl(KEYCTL_SETPERM)
 773  */
 774 long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
 775 {
 776         struct key *key;
 777         key_ref_t key_ref;
 778         long ret;
 779
 780         ret = -EINVAL;
 781         if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
 782                 goto error;
 783
 784         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 785         if (IS_ERR(key_ref)) {
 786                 ret = PTR_ERR(key_ref);
 787                 goto error;
 788         }
 789
 790         key = key_ref_to_ptr(key_ref);
 791
 792         /* make the changes with the locks held to prevent chown/chmod races */
 793         ret = -EACCES;
 794         down_write(&key->sem);
 795
 796         /* if we're not the sysadmin, we can only change a key that we own */
 797         if (capable(CAP_SYS_ADMIN) || key->uid == current->fsuid) {
 798                 key->perm = perm;
 799                 ret = 0;
 800         }
 801
 802         up_write(&key->sem);
 803         key_put(key);
 804 error:
 805         return ret;
 806
 807 } /* end keyctl_setperm_key() */
 808
 809 /*****************************************************************************/
 810 /*
 811  * instantiate the key with the specified payload, and, if one is given, link
 812  * the key into the keyring
 813  */
 814 long keyctl_instantiate_key(key_serial_t id,
 815                             const void __user *_payload,
 816                             size_t plen,
 817                             key_serial_t ringid)
 818 {
 819         struct request_key_auth *rka;
 820         struct key *instkey;
 821         key_ref_t keyring_ref;
 822         void *payload;
 823         long ret;
 824
 825         ret = -EINVAL;
 826         if (plen > 32767)
 827                 goto error;
 828
 829         /* the appropriate instantiation authorisation key must have been
 830          * assumed before calling this */
 831         ret = -EPERM;
 832         instkey = current->request_key_auth;
 833         if (!instkey)
 834                 goto error;
 835
 836         rka = instkey->payload.data;
 837         if (rka->target_key->serial != id)
 838                 goto error;
 839
 840         /* pull the payload in if one was supplied */
 841         payload = NULL;
 842
 843         if (_payload) {
 844                 ret = -ENOMEM;
 845                 payload = kmalloc(plen, GFP_KERNEL);
 846                 if (!payload)
 847                         goto error;
 848
 849                 ret = -EFAULT;
 850                 if (copy_from_user(payload, _payload, plen) != 0)
 851                         goto error2;
 852         }
 853
 854         /* find the destination keyring amongst those belonging to the
 855          * requesting task */
 856         keyring_ref = NULL;
 857         if (ringid) {
 858                 keyring_ref = lookup_user_key(rka->context, ringid, 1, 0,
 859                                               KEY_WRITE);
 860                 if (IS_ERR(keyring_ref)) {
 861                         ret = PTR_ERR(keyring_ref);
 862                         goto error2;
 863                 }
 864         }
 865
 866         /* instantiate the key and link it into a keyring */
 867         ret = key_instantiate_and_link(rka->target_key, payload, plen,
 868                                        key_ref_to_ptr(keyring_ref), instkey);
 869
 870         key_ref_put(keyring_ref);
 871
 872         /* discard the assumed authority if it's just been disabled by
 873          * instantiation of the key */
 874         if (ret == 0) {
 875                 key_put(current->request_key_auth);
 876                 current->request_key_auth = NULL;
 877         }
 878
 879 error2:
 880         kfree(payload);
 881 error:
 882         return ret;
 883
 884 } /* end keyctl_instantiate_key() */
 885
 886 /*****************************************************************************/
 887 /*
 888  * negatively instantiate the key with the given timeout (in seconds), and, if
 889  * one is given, link the key into the keyring
 890  */
 891 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 892 {
 893         struct request_key_auth *rka;
 894         struct key *instkey;
 895         key_ref_t keyring_ref;
 896         long ret;
 897
 898         /* the appropriate instantiation authorisation key must have been
 899          * assumed before calling this */
 900         ret = -EPERM;
 901         instkey = current->request_key_auth;
 902         if (!instkey)
 903                 goto error;
 904
 905         rka = instkey->payload.data;
 906         if (rka->target_key->serial != id)
 907                 goto error;
 908
 909         /* find the destination keyring if present (which must also be
 910          * writable) */
 911         keyring_ref = NULL;
 912         if (ringid) {
 913                 keyring_ref = lookup_user_key(NULL, ringid, 1, 0, KEY_WRITE);
 914                 if (IS_ERR(keyring_ref)) {
 915                         ret = PTR_ERR(keyring_ref);
 916                         goto error;
 917                 }
 918         }
 919
 920         /* instantiate the key and link it into a keyring */
 921         ret = key_negate_and_link(rka->target_key, timeout,
 922                                   key_ref_to_ptr(keyring_ref), instkey);
 923
 924         key_ref_put(keyring_ref);
 925
 926         /* discard the assumed authority if it's just been disabled by
 927          * instantiation of the key */
 928         if (ret == 0) {
 929                 key_put(current->request_key_auth);
 930                 current->request_key_auth = NULL;
 931         }
 932
 933 error:
 934         return ret;
 935
 936 } /* end keyctl_negate_key() */
 937
 938 /*****************************************************************************/
 939 /*
 940  * set the default keyring in which request_key() will cache keys
 941  * - return the old setting
 942  */
 943 long keyctl_set_reqkey_keyring(int reqkey_defl)
 944 {
 945         int ret;
 946
 947         switch (reqkey_defl) {
 948         case KEY_REQKEY_DEFL_THREAD_KEYRING:
 949                 ret = install_thread_keyring(current);
 950                 if (ret < 0)
 951                         return ret;
 952                 goto set;
 953
 954         case KEY_REQKEY_DEFL_PROCESS_KEYRING:
 955                 ret = install_process_keyring(current);
 956                 if (ret < 0)
 957                         return ret;
 958
 959         case KEY_REQKEY_DEFL_DEFAULT:
 960         case KEY_REQKEY_DEFL_SESSION_KEYRING:
 961         case KEY_REQKEY_DEFL_USER_KEYRING:
 962         case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
 963         set:
 964                 current->jit_keyring = reqkey_defl;
 965
 966         case KEY_REQKEY_DEFL_NO_CHANGE:
 967                 return current->jit_keyring;
 968
 969         case KEY_REQKEY_DEFL_GROUP_KEYRING:
 970         default:
 971                 return -EINVAL;
 972         }
 973
 974 } /* end keyctl_set_reqkey_keyring() */
 975
 976 /*****************************************************************************/
 977 /*
 978  * set or clear the timeout for a key
 979  */
 980 long keyctl_set_timeout(key_serial_t id, unsigned timeout)
 981 {
 982         struct timespec now;
 983         struct key *key;
 984         key_ref_t key_ref;
 985         time_t expiry;
 986         long ret;
 987
 988         key_ref = lookup_user_key(NULL, id, 1, 1, KEY_SETATTR);
 989         if (IS_ERR(key_ref)) {
 990                 ret = PTR_ERR(key_ref);
 991                 goto error;
 992         }
 993
 994         key = key_ref_to_ptr(key_ref);
 995
 996         /* make the changes with the locks held to prevent races */
 997         down_write(&key->sem);
 998
 999         expiry = 0;
1000         if (timeout > 0) {
1001                 now = current_kernel_time();
1002                 expiry = now.tv_sec + timeout;
1003         }
1004
1005         key->expiry = expiry;
1006
1007         up_write(&key->sem);
1008         key_put(key);
1009
1010         ret = 0;
1011 error:
1012         return ret;
1013
1014 } /* end keyctl_set_timeout() */
1015
1016 /*****************************************************************************/
1017 /*
1018  * assume the authority to instantiate the specified key
1019  */
1020 long keyctl_assume_authority(key_serial_t id)
1021 {
1022         struct key *authkey;
1023         long ret;
1024
1025         /* special key IDs aren't permitted */
1026         ret = -EINVAL;
1027         if (id < 0)
1028                 goto error;
1029
1030         /* we divest ourselves of authority if given an ID of 0 */
1031         if (id == 0) {
1032                 key_put(current->request_key_auth);
1033                 current->request_key_auth = NULL;
1034                 ret = 0;
1035                 goto error;
1036         }
1037
1038         /* attempt to assume the authority temporarily granted to us whilst we
1039          * instantiate the specified key
1040          * - the authorisation key must be in the current task's keyrings
1041          *   somewhere
1042          */
1043         authkey = key_get_instantiation_authkey(id);
1044         if (IS_ERR(authkey)) {
1045                 ret = PTR_ERR(authkey);
1046                 goto error;
1047         }
1048
1049         key_put(current->request_key_auth);
1050         current->request_key_auth = authkey;
1051         ret = authkey->serial;
1052
1053 error:
1054         return ret;
1055
1056 } /* end keyctl_assume_authority() */
1057
1058 /*****************************************************************************/
1059 /*
1060  * the key control system call
1061  */
1062 asmlinkage long sys_keyctl(int option, unsigned long arg2, unsigned long arg3,
1063                            unsigned long arg4, unsigned long arg5)
1064 {
1065         switch (option) {
1066         case KEYCTL_GET_KEYRING_ID:
1067                 return keyctl_get_keyring_ID((key_serial_t) arg2,
1068                                              (int) arg3);
1069
1070         case KEYCTL_JOIN_SESSION_KEYRING:
1071                 return keyctl_join_session_keyring((const char __user *) arg2);
1072
1073         case KEYCTL_UPDATE:
1074                 return keyctl_update_key((key_serial_t) arg2,
1075                                          (const void __user *) arg3,
1076                                          (size_t) arg4);
1077
1078         case KEYCTL_REVOKE:
1079                 return keyctl_revoke_key((key_serial_t) arg2);
1080
1081         case KEYCTL_DESCRIBE:
1082                 return keyctl_describe_key((key_serial_t) arg2,
1083                                            (char __user *) arg3,
1084                                            (unsigned) arg4);
1085
1086         case KEYCTL_CLEAR:
1087                 return keyctl_keyring_clear((key_serial_t) arg2);
1088
1089         case KEYCTL_LINK:
1090                 return keyctl_keyring_link((key_serial_t) arg2,
1091                                            (key_serial_t) arg3);
1092
1093         case KEYCTL_UNLINK:
1094                 return keyctl_keyring_unlink((key_serial_t) arg2,
1095                                              (key_serial_t) arg3);
1096
1097         case KEYCTL_SEARCH:
1098                 return keyctl_keyring_search((key_serial_t) arg2,
1099                                              (const char __user *) arg3,
1100                                              (const char __user *) arg4,
1101                                              (key_serial_t) arg5);
1102
1103         case KEYCTL_READ:
1104                 return keyctl_read_key((key_serial_t) arg2,
1105                                        (char __user *) arg3,
1106                                        (size_t) arg4);
1107
1108         case KEYCTL_CHOWN:
1109                 return keyctl_chown_key((key_serial_t) arg2,
1110                                         (uid_t) arg3,
1111                                         (gid_t) arg4);
1112
1113         case KEYCTL_SETPERM:
1114                 return keyctl_setperm_key((key_serial_t) arg2,
1115                                           (key_perm_t) arg3);
1116
1117         case KEYCTL_INSTANTIATE:
1118                 return keyctl_instantiate_key((key_serial_t) arg2,
1119                                               (const void __user *) arg3,
1120                                               (size_t) arg4,
1121                                               (key_serial_t) arg5);
1122
1123         case KEYCTL_NEGATE:
1124                 return keyctl_negate_key((key_serial_t) arg2,
1125                                          (unsigned) arg3,
1126                                          (key_serial_t) arg4);
1127
1128         case KEYCTL_SET_REQKEY_KEYRING:
1129                 return keyctl_set_reqkey_keyring(arg2);
1130
1131         case KEYCTL_SET_TIMEOUT:
1132                 return keyctl_set_timeout((key_serial_t) arg2,
1133                                           (unsigned) arg3);
1134
1135         case KEYCTL_ASSUME_AUTHORITY:
1136                 return keyctl_assume_authority((key_serial_t) arg2);
1137
1138         default:
1139                 return -EOPNOTSUPP;
1140         }
1141
1142 } /* end sys_keyctl() */