2 /* Authentication token and access key management
27 /* key handle serial number */
30 /* key handle permissions mask */
33 struct key;
40 #define KEY_POS_VIEW	0x01000000	/* possessor can view a key's attributes */
41 #define KEY_POS_READ	0x02000000	/* possessor can read key payload / view keyring */
42 #define KEY_POS_WRITE	0x04000000	/* possessor can update key payload / add link to keyring */
43 #define KEY_POS_SEARCH	0x08000000	/* possessor can find a key in search / search a keyring */
44 #define KEY_POS_LINK	0x10000000	/* possessor can create a link to a key/keyring */
45 #define KEY_POS_SETATTR	0x20000000	/* possessor can set key attributes */
92 	/* [!] If this structure is altered, the union in struct key must change too! */
118  * key reference with possession attribute handling
122  * flag to indicate whether the calling process possesses that key in one of
132 static inline key_ref_t make_key_ref(const struct key *key,  in make_key_ref()  argument
135 	return (key_ref_t) ((unsigned long) key | possession);  in make_key_ref()
138 static inline struct key *key_ref_to_ptr(const key_ref_t key_ref)  in key_ref_to_ptr()
140 	return (struct key *) ((unsigned long) key_ref & ~1UL);  in key_ref_to_ptr()
148 typedef int (*key_restrict_link_func_t)(struct key *dest_keyring,
151 					struct key *restriction_key);
155 	struct key *key;  member
167  * - types of key include:
172 struct key {  struct
174 	key_serial_t		serial;		/* key serial number */  argument
180 	struct key_user		*user;		/* owner of this key */  argument
181 	void			*security;	/* security data for this key */  argument
183 		time64_t	expiry;		/* time at which key expires (or 0) */  argument
184 		time64_t	revoked_at;	/* time at which key was revoked */
195 	short			state;		/* Key state (+) or rejection error (-) */
203 #define KEY_FLAG_DEAD		0	/* set if key type has been deleted */  argument
204 #define KEY_FLAG_REVOKED	1	/* set if key had been revoked */
205 #define KEY_FLAG_IN_QUOTA	2	/* set if key consumes quota */
206 #define KEY_FLAG_USER_CONSTRUCT	3	/* set if key is being constructed in userspace */
207 #define KEY_FLAG_ROOT_CAN_CLEAR	4	/* set if key can be cleared by root without permission */
208 #define KEY_FLAG_INVALIDATED	5	/* set if key has been invalidated */
209 #define KEY_FLAG_BUILTIN	6	/* set if key is built in to the kernel */
210 #define KEY_FLAG_ROOT_CAN_INVAL	7	/* set if key can be invalidated by root without permission */
211 #define KEY_FLAG_KEEP		8	/* set if key should not be removed */
212 #define KEY_FLAG_UID_KEYRING	9	/* set if key is a user or user session keyring */
214 	/* the key type and key description string
215 	 * - the desc is used to match a key against search criteria
224 			struct key_type	*type;		/* type of key */  argument
230 	/* key data
243 	/* This is set on a keyring to restrict the addition of a link to a key  argument
257 extern struct key *key_alloc(struct key_type *type,
269 #define KEY_ALLOC_BUILT_IN		0x0004	/* Key is built into kernel */
273 extern void key_revoke(struct key *key);
274 extern void key_invalidate(struct key *key);
275 extern void key_put(struct key *key);
279 static inline struct key *__key_get(struct key *key)  in __key_get()  argument
281 	refcount_inc(&key->usage);  in __key_get()
282 	return key;  in __key_get()
285 static inline struct key *key_get(struct key *key)  in key_get()  argument
287 	return key ? __key_get(key) : key;  in key_get()
295 extern struct key *request_key_tag(struct key_type *type,
300 extern struct key *request_key_rcu(struct key_type *type,
304 extern struct key *request_key_with_auxdata(struct key_type *type,
312  * request_key - Request a key and wait for construction
313  * @type: Type of key.
314  * @description: The searchable description of the key.
319 static inline struct key *request_key(struct key_type *type,  in request_key()
328  * request_key_net - Request a key for a net namespace and wait for construction
329  * @type: Type of key.
330  * @description: The searchable description of the key.
331  * @net: The network namespace that is the key's domain of operation.
334  * As for request_key() except that it does not add the returned key to a
346  * request_key_net_rcu - Request a key for a net namespace under RCU conditions
347  * @type: Type of key.
348  * @description: The searchable description of the key.
349  * @net: The network namespace that is the key's domain of operation.
358 extern int wait_for_key_construction(struct key *key, bool intr);
360 extern int key_validate(const struct key *key);
370 extern int key_update(key_ref_t key,
374 extern int key_link(struct key *keyring,
375 		    struct key *key);
377 extern int key_move(struct key *key,
378 		    struct key *from_keyring,
379 		    struct key *to_keyring,
382 extern int key_unlink(struct key *keyring,
383 		      struct key *key);
385 extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
390 				 struct key *dest);
392 extern int restrict_link_reject(struct key *keyring,
395 				struct key *restriction_key);
397 extern int keyring_clear(struct key *keyring);
404 extern int keyring_add_key(struct key *keyring,
405 			   struct key *key);
410 extern struct key *key_lookup(key_serial_t id);
412 static inline key_serial_t key_serial(const struct key *key)  in key_serial()  argument
414 	return key ? key->serial : 0;  in key_serial()
417 extern void key_set_timeout(struct key *, unsigned);
424  * The permissions required on a key that we're looking up.
429 #define	KEY_NEED_SEARCH	0x08	/* Require permission to search (keyring) or find (key) */
434 static inline short key_read_state(const struct key *key)  in key_read_state()  argument
437 	return smp_load_acquire(&key->state);  in key_read_state()
441  * key_is_positive - Determine if a key has been positively instantiated
442  * @key: The key to check.
444  * Return true if the specified key has been positively instantiated, false
447 static inline bool key_is_positive(const struct key *key)  in key_is_positive()  argument
449 	return key_read_state(key) == KEY_IS_POSITIVE;  in key_is_positive()
452 static inline bool key_is_negative(const struct key *key)  in key_is_negative()  argument
454 	return key_read_state(key) < 0;  in key_is_negative()
457 #define dereference_key_rcu(KEY)					\  argument
458 	(rcu_dereference((KEY)->payload.rcu_data0))
460 #define dereference_key_locked(KEY)					\  argument
461 	(rcu_dereference_protected((KEY)->payload.rcu_data0,		\
462 				   rwsem_is_locked(&((struct key *)(KEY))->sem)))
464 #define rcu_assign_keypointer(KEY, PAYLOAD)				\  argument
466 	rcu_assign_pointer((KEY)->payload.rcu_data0, (PAYLOAD));	\