security/keys/process_keys.c

22 /* Session keyring create vs join semaphore */
36  * Get or create a user register keyring.
47 	/* Make sure there's a register keyring.  It gets owned by the
66 	/* We don't return a ref since the keyring is pinned by the user_ns */
97 	/* Get the user keyring.  Note that there may be one in existence
122 	/* Get a default session keyring (which might also exist already) */
138 		/* We install a link from the user session keyring to
139 		 * the user keyring.
145 		/* And only then link the user-session keyring to the
182  * Get the user session keyring if it exists, but don't create it if it
216  * Install a thread keyring to the given credentials struct if it didn't have
219  * Return: 0 if a thread keyring is now present; -errno on failure.
223 	struct key *keyring;
228 	keyring = keyring_alloc("_tid", new->uid, new->gid, new,
232 	if (IS_ERR(keyring))
233 		return PTR_ERR(keyring);
235 	new->thread_keyring = keyring;
240  * Install a thread keyring to the current task if it didn't have one already.
242  * Return: 0 if a thread keyring is now present; -errno on failure.
263  * Install a process keyring to the given credentials struct if it didn't have
266  * Return: 0 if a process keyring is now present; -errno on failure.
270 	struct key *keyring;
275 	keyring = keyring_alloc("_pid", new->uid, new->gid, new,
279 	if (IS_ERR(keyring))
280 		return PTR_ERR(keyring);
282 	new->process_keyring = keyring;
287  * Install a process keyring to the current task if it didn't have one already.
289  * Return: 0 if a process keyring is now present; -errno on failure.
310  * Install the given keyring as the session keyring of the given credentials
311  * struct, replacing the existing one if any.  If the given keyring is NULL,
312  * then install a new anonymous session keyring.
317 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
324 	/* create an empty session keyring */
325 	if (!keyring) {
330 		keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred,
333 		if (IS_ERR(keyring))
334 			return PTR_ERR(keyring);
336 		__key_get(keyring);
339 	/* install the keyring */
341 	cred->session_keyring = keyring;
350  * Install the given keyring as the session keyring of the current task,
351  * replacing the existing one if any.  If the given keyring is NULL, then
352  * install a new anonymous session keyring.
356 static int install_session_keyring(struct key *keyring)
365 	ret = install_session_keyring_to_cred(new, keyring);
379 	/* update the ownership of the thread keyring */
392 	/* update the ownership of the thread keyring */
439 	/* search the thread keyring first */
457 	/* search the process keyring second */
478 	/* search the session keyring */
499 	/* or search the user-session keyring */
606  * or -ENOMEM if a special keyring couldn't be created.
668 			/* always install a session keyring upon access if one
775 	 * the permission checks as it is only concerned with the keyring */
818 	/* if we attempted to install a keyring, then it may have caused new
827  * Join the named keyring as the session keyring if possible else attempt to
830  * If the name is NULL, an empty anonymous keyring will be installed as the
831  * session keyring.
841 	struct key *keyring;
849 	/* if no name is provided, install an anonymous keyring */
862 	/* allow the user to join or create a named keyring */
865 	/* look for an existing keyring of this name */
866 	keyring = find_keyring_by_name(name, false);
867 	if (PTR_ERR(keyring) == -ENOKEY) {
869 		keyring = keyring_alloc(
873 		if (IS_ERR(keyring)) {
874 			ret = PTR_ERR(keyring);
877 	} else if (IS_ERR(keyring)) {
878 		ret = PTR_ERR(keyring);
880 	} else if (keyring == new->session_keyring) {
885 	/* we've got a keyring - now to install it */
886 	ret = install_session_keyring_to_cred(new, keyring);
893 	ret = keyring->serial;
894 	key_put(keyring);
899 	key_put(keyring);
908  * Replace a process's session keyring on behalf of one of its children when