2 /* Request a key from userspace
7  * See Documentation/security/keys/request-key.rst
20 #define key_negative_timeout	60	/* default timeout on a negative key's existence */
22 static struct key *check_cached_key(struct keyring_search_context *ctx)
25 	struct key *key = current->cached_requested_key;
27 	if (key &&
28 	    ctx->match_data.cmp(key, &ctx->match_data) &&
29 	    !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |
31 		return key_get(key);
36 static void cache_requested_key(struct key *key)
41 	/* Do not cache key if it is a kernel thread */
44 		t->cached_requested_key = key_get(key);
51  * complete_request_key - Complete the construction of a key.
52  * @authkey: The authorisation key.
55  * Complete the attempt to construct a key.  The key will be negated
56  * if an error is indicated.  The authorisation key will be revoked
59 void complete_request_key(struct key *authkey, int error)
62 	struct key *key = rka->target_key;
64 	kenter("%d{%d},%d", authkey->serial, key->serial, error);
67 		key_negate_and_link(key, key_negative_timeout, NULL, authkey);
82 	struct key *keyring = info->data;
92 	struct key *keyring = info->data;
100 					struct key *session_keyring, int wait)
115  * Request userspace finish the construction of a key
116  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
118 static int call_sbin_request_key(struct key *authkey, void *aux)
120 	static char const request_key[] = "/sbin/request-key";
124 	struct key *key = rka->target_key, *keyring, *session, *user_session;
130 	kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
137 	sprintf(desc, "_req.%u", key->serial);
149 	/* attach the auth key to the session keyring */
158 	/* we say which key is under construction */
159 	sprintf(key_str, "%d", key->serial);
201 		if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) ||
202 		    key_validate(key) < 0)
205 			/* ignore any errors from userspace if the key was
222  * Call out to userspace for key construction.
224  * Program failure is ignored in favour of key status.
226 static int construct_key(struct key *key, const void *callout_info,
228 			 struct key *dest_keyring)
231 	struct key *authkey;
234 	kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);
236 	/* allocate an authorisation key */
237 	authkey = request_key_auth_new(key, "create", callout_info, callout_len,
244 	if (key->type->request_key)
245 		actor = key->type->request_key;
265 static int construct_get_dest_keyring(struct key **_dest_keyring)
269 	struct key *dest_keyring = *_dest_keyring, *authkey;
344 		 * that /sbin/request-key can itself use request_key() to add
363  * Allocate a new key in under-construction state and attempt to link it in to
366  * May return a key that's already under construction instead if there was a
370 			       struct key *dest_keyring,
373 			       struct key **_key)
376 	struct key *key;
395 	key = key_alloc(ctx->index_key.type, ctx->index_key.description,
398 	if (IS_ERR(key))
401 	set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
404 		ret = __key_link_lock(dest_keyring, &key->index_key);
410 	 * Attach the key to the destination keyring under lock, but we do need
417 	 * an actual key is determined.
428 		ret = __key_link_begin(dest_keyring, &key->index_key, &edit);
431 		__key_link(dest_keyring, key, &edit);
436 		__key_link_end(dest_keyring, &key->index_key, edit);
438 	*_key = key;
439 	kleave(" = 0 [%d]", key_serial(key));
442 	/* the key is now present - we tell the caller that we found it by
445 	key_put(key);
447 	key = key_ref_to_ptr(key_ref);
449 		ret = __key_link_begin(dest_keyring, &key->index_key, &edit);
452 		ret = __key_link_check_live_key(dest_keyring, key);
454 			__key_link(dest_keyring, key, &edit);
455 		__key_link_end(dest_keyring, &key->index_key, edit);
460 	*_key = key;
461 	kleave(" = -EINPROGRESS [%d]", key_serial(key));
466 	key_put(key);
473 	__key_link_end(dest_keyring, &key->index_key, edit);
476 	key_put(key);
482 	kleave(" = %ld", PTR_ERR(key));
483 	return PTR_ERR(key);
487  * Commence key construction.
489 static struct key *construct_key_and_link(struct keyring_search_context *ctx,
493 					  struct key *dest_keyring,
497 	struct key *key;
515 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
519 		ret = construct_key(key, callout_info, callout_len, aux,
532 	kleave(" = key %d", key_serial(key));
533 	return key;
536 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
537 	key_put(key);
546  * request_key_and_link - Request a key and cache it in a keyring.
547  * @type: The type of key we want.
548  * @description: The searchable description of the key.
549  * @domain_tag: The domain in which the key operates.
553  * @dest_keyring: Where to cache the key.
556  * A key matching the specified criteria (type, description, domain_tag) is
558  * incremented if found.  Otherwise, if callout_info is not NULL, a key will be
562  * If successfully found or created, the key will be linked to the destination
565  * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
566  * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
567  * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
568  * if insufficient key quota was available to create a new key; or -ENOMEM if
571  * If the returned key was created, then it may still be under construction,
574 struct key *request_key_and_link(struct key_type *type,
580 				 struct key *dest_keyring,
596 	struct key *key;
607 			key = ERR_PTR(ret);
612 	key = check_cached_key(&ctx);
613 	if (key)
616 	/* search all the process keyrings for a key */
627 				key = ERR_PTR(ret);
632 		key = key_ref_to_ptr(key_ref);
634 			ret = key_link(dest_keyring, key);
636 				key_put(key);
637 				key = ERR_PTR(ret);
642 		/* Only cache the key on immediate success */
643 		cache_requested_key(key);
645 		key = ERR_CAST(key_ref);
649 		key = ERR_PTR(-ENOKEY);
653 		key = construct_key_and_link(&ctx, callout_info, callout_len,
661 	kleave(" = %p", key);
662 	return key;
666  * wait_for_key_construction - Wait for construction of a key to complete
667  * @key: The key being waited for.
670  * Wait for a key to finish being constructed.
673  * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
676 int wait_for_key_construction(struct key *key, bool intr)
680 	ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,
684 	ret = key_read_state(key);
687 	return key_validate(key);
692  * request_key_tag - Request a key and wait for construction
693  * @type: Type of key.
694  * @description: The searchable description of the key.
695  * @domain_tag: The domain in which the key operates.
698  * As for request_key_and_link() except that it does not add the returned key
706 struct key *request_key_tag(struct key_type *type,
711 	struct key *key;
717 	key = request_key_and_link(type, description, domain_tag,
720 	if (!IS_ERR(key)) {
721 		ret = wait_for_key_construction(key, false);
723 			key_put(key);
727 	return key;
732  * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
733  * @type: The type of key we want.
734  * @description: The searchable description of the key.
735  * @domain_tag: The domain in which the key operates.
740  * As for request_key_and_link() except that it does not add the returned key
746 struct key *request_key_with_auxdata(struct key_type *type,
753 	struct key *key;
756 	key = request_key_and_link(type, description, domain_tag,
759 	if (!IS_ERR(key)) {
760 		ret = wait_for_key_construction(key, false);
762 			key_put(key);
766 	return key;
771  * request_key_rcu - Request key from RCU-read-locked context
772  * @type: The type of key we want.
773  * @description: The name of the key we want.
774  * @domain_tag: The domain in which the key operates.
776  * Request a key from a context that we may not sleep in (such as RCU-mode
779  * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
780  * a key or some other error if the key found was unsuitable or inaccessible.
782 struct key *request_key_rcu(struct key_type *type,
798 	struct key *key;
803 	key = check_cached_key(&ctx);
804 	if (key)
805 		return key;
807 	/* search all the process keyrings for a key */
810 		key = ERR_CAST(key_ref);
812 			key = ERR_PTR(-ENOKEY);
814 		key = key_ref_to_ptr(key_ref);
815 		cache_requested_key(key);
818 	kleave(" = %p", key);
819 	return key;

Indexes created Thu May 02 11:06:28 MDT 2024