2 /* Request a key from userspace
7  * See Documentation/security/keys/request-key.rst
20 #define key_negative_timeout	60	/* default timeout on a negative key's existence */
22 static struct key *check_cached_key(struct keyring_search_context *ctx)  in check_cached_key()
25 	struct key *key = current->cached_requested_key;  in check_cached_key()  local
27 	if (key &&  in check_cached_key()
28 	    ctx->match_data.cmp(key, &ctx->match_data) &&  in check_cached_key()
29 	    !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |  in check_cached_key()
31 		return key_get(key);  in check_cached_key()
36 static void cache_requested_key(struct key *key)  in cache_requested_key()  argument
42 	t->cached_requested_key = key_get(key);  in cache_requested_key()
48  * complete_request_key - Complete the construction of a key.
49  * @authkey: The authorisation key.
52  * Complete the attempt to construct a key.  The key will be negated
53  * if an error is indicated.  The authorisation key will be revoked
56 void complete_request_key(struct key *authkey, int error)  in complete_request_key()
59 	struct key *key = rka->target_key;  in complete_request_key()  local
61 	kenter("%d{%d},%d", authkey->serial, key->serial, error);  in complete_request_key()
64 		key_negate_and_link(key, key_negative_timeout, NULL, authkey);  in complete_request_key()
79 	struct key *keyring = info->data;  in umh_keys_init()
89 	struct key *keyring = info->data;  in umh_keys_cleanup()
97 					struct key *session_keyring, int wait)  in call_usermodehelper_keys()
112  * Request userspace finish the construction of a key
113  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
115 static int call_sbin_request_key(struct key *authkey, void *aux)  in call_sbin_request_key()
117 	static char const request_key[] = "/sbin/request-key";  in call_sbin_request_key()
121 	struct key *key = rka->target_key, *keyring, *session, *user_session;  in call_sbin_request_key()  local
127 	kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);  in call_sbin_request_key()
134 	sprintf(desc, "_req.%u", key->serial);  in call_sbin_request_key()
146 	/* attach the auth key to the session keyring */  in call_sbin_request_key()
155 	/* we say which key is under construction */  in call_sbin_request_key()
156 	sprintf(key_str, "%d", key->serial);  in call_sbin_request_key()
198 		if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) ||  in call_sbin_request_key()
199 		    key_validate(key) < 0)  in call_sbin_request_key()
202 			/* ignore any errors from userspace if the key was  in call_sbin_request_key()
219  * Call out to userspace for key construction.
221  * Program failure is ignored in favour of key status.
223 static int construct_key(struct key *key, const void *callout_info,  in construct_key()  argument
225 			 struct key *dest_keyring)  in construct_key()
228 	struct key *authkey;  in construct_key()
231 	kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux);  in construct_key()
233 	/* allocate an authorisation key */  in construct_key()
234 	authkey = request_key_auth_new(key, "create", callout_info, callout_len,  in construct_key()
241 	if (key->type->request_key)  in construct_key()
242 		actor = key->type->request_key;  in construct_key()
262 static int construct_get_dest_keyring(struct key **_dest_keyring)  in construct_get_dest_keyring()
266 	struct key *dest_keyring = *_dest_keyring, *authkey;  in construct_get_dest_keyring()
341 		 * that /sbin/request-key can itself use request_key() to add  in construct_get_dest_keyring()
360  * Allocate a new key in under-construction state and attempt to link it in to
363  * May return a key that's already under construction instead if there was a
367 			       struct key *dest_keyring,  in construct_alloc_key()
370 			       struct key **_key)  in construct_alloc_key()
373 	struct key *key;  in construct_alloc_key()  local
392 	key = key_alloc(ctx->index_key.type, ctx->index_key.description,  in construct_alloc_key()
395 	if (IS_ERR(key))  in construct_alloc_key()
398 	set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);  in construct_alloc_key()
409 	/* attach the key to the destination keyring under lock, but we do need  in construct_alloc_key()
421 		__key_link(dest_keyring, key, &edit);  in construct_alloc_key()
427 	*_key = key;  in construct_alloc_key()
428 	kleave(" = 0 [%d]", key_serial(key));  in construct_alloc_key()
431 	/* the key is now present - we tell the caller that we found it by  in construct_alloc_key()
434 	key_put(key);  in construct_alloc_key()
436 	key = key_ref_to_ptr(key_ref);  in construct_alloc_key()
438 		ret = __key_link_check_live_key(dest_keyring, key);  in construct_alloc_key()
440 			__key_link(dest_keyring, key, &edit);  in construct_alloc_key()
446 	*_key = key;  in construct_alloc_key()
447 	kleave(" = -EINPROGRESS [%d]", key_serial(key));  in construct_alloc_key()
452 	key_put(key);  in construct_alloc_key()
460 	key_put(key);  in construct_alloc_key()
466 	kleave(" = %ld", PTR_ERR(key));  in construct_alloc_key()
467 	return PTR_ERR(key);  in construct_alloc_key()
471  * Commence key construction.
473 static struct key *construct_key_and_link(struct keyring_search_context *ctx,  in construct_key_and_link()
477 					  struct key *dest_keyring,  in construct_key_and_link()
481 	struct key *key;  in construct_key_and_link()  local
499 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);  in construct_key_and_link()
503 		ret = construct_key(key, callout_info, callout_len, aux,  in construct_key_and_link()
516 	kleave(" = key %d", key_serial(key));  in construct_key_and_link()
517 	return key;  in construct_key_and_link()
520 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);  in construct_key_and_link()
521 	key_put(key);  in construct_key_and_link()
530  * request_key_and_link - Request a key and cache it in a keyring.
531  * @type: The type of key we want.
532  * @description: The searchable description of the key.
533  * @domain_tag: The domain in which the key operates.
537  * @dest_keyring: Where to cache the key.
540  * A key matching the specified criteria (type, description, domain_tag) is
542  * incremented if found.  Otherwise, if callout_info is not NULL, a key will be
546  * If successfully found or created, the key will be linked to the destination
549  * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
550  * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
551  * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
552  * if insufficient key quota was available to create a new key; or -ENOMEM if
555  * If the returned key was created, then it may still be under construction,
558 struct key *request_key_and_link(struct key_type *type,  in request_key_and_link()
564 				 struct key *dest_keyring,  in request_key_and_link()
580 	struct key *key;  in request_key_and_link()  local
591 			key = ERR_PTR(ret);  in request_key_and_link()
596 	key = check_cached_key(&ctx);  in request_key_and_link()
597 	if (key)  in request_key_and_link()
600 	/* search all the process keyrings for a key */  in request_key_and_link()
611 				key = ERR_PTR(ret);  in request_key_and_link()
616 		key = key_ref_to_ptr(key_ref);  in request_key_and_link()
618 			ret = key_link(dest_keyring, key);  in request_key_and_link()
620 				key_put(key);  in request_key_and_link()
621 				key = ERR_PTR(ret);  in request_key_and_link()
626 		/* Only cache the key on immediate success */  in request_key_and_link()
627 		cache_requested_key(key);  in request_key_and_link()
629 		key = ERR_CAST(key_ref);  in request_key_and_link()
633 		key = ERR_PTR(-ENOKEY);  in request_key_and_link()
637 		key = construct_key_and_link(&ctx, callout_info, callout_len,  in request_key_and_link()
645 	kleave(" = %p", key);  in request_key_and_link()
646 	return key;  in request_key_and_link()
650  * wait_for_key_construction - Wait for construction of a key to complete
651  * @key: The key being waited for.
654  * Wait for a key to finish being constructed.
657  * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
660 int wait_for_key_construction(struct key *key, bool intr)  in wait_for_key_construction()  argument
664 	ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT,  in wait_for_key_construction()
668 	ret = key_read_state(key);  in wait_for_key_construction()
671 	return key_validate(key);  in wait_for_key_construction()
676  * request_key_tag - Request a key and wait for construction
677  * @type: Type of key.
678  * @description: The searchable description of the key.
679  * @domain_tag: The domain in which the key operates.
682  * As for request_key_and_link() except that it does not add the returned key
690 struct key *request_key_tag(struct key_type *type,  in request_key_tag()
695 	struct key *key;  in request_key_tag()  local
701 	key = request_key_and_link(type, description, domain_tag,  in request_key_tag()
704 	if (!IS_ERR(key)) {  in request_key_tag()
705 		ret = wait_for_key_construction(key, false);  in request_key_tag()
707 			key_put(key);  in request_key_tag()
711 	return key;  in request_key_tag()
716  * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
717  * @type: The type of key we want.
718  * @description: The searchable description of the key.
719  * @domain_tag: The domain in which the key operates.
724  * As for request_key_and_link() except that it does not add the returned key
730 struct key *request_key_with_auxdata(struct key_type *type,  in request_key_with_auxdata()
737 	struct key *key;  in request_key_with_auxdata()  local
740 	key = request_key_and_link(type, description, domain_tag,  in request_key_with_auxdata()
743 	if (!IS_ERR(key)) {  in request_key_with_auxdata()
744 		ret = wait_for_key_construction(key, false);  in request_key_with_auxdata()
746 			key_put(key);  in request_key_with_auxdata()
750 	return key;  in request_key_with_auxdata()
755  * request_key_rcu - Request key from RCU-read-locked context
756  * @type: The type of key we want.
757  * @description: The name of the key we want.
758  * @domain_tag: The domain in which the key operates.
760  * Request a key from a context that we may not sleep in (such as RCU-mode
763  * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
764  * a key or some other error if the key found was unsuitable or inaccessible.
766 struct key *request_key_rcu(struct key_type *type,  in request_key_rcu()
782 	struct key *key;  in request_key_rcu()  local
787 	key = check_cached_key(&ctx);  in request_key_rcu()
788 	if (key)  in request_key_rcu()
789 		return key;  in request_key_rcu()
791 	/* search all the process keyrings for a key */  in request_key_rcu()
794 		key = ERR_CAST(key_ref);  in request_key_rcu()
796 			key = ERR_PTR(-ENOKEY);  in request_key_rcu()
798 		key = key_ref_to_ptr(key_ref);  in request_key_rcu()
799 		cache_requested_key(key);  in request_key_rcu()
802 	kleave(" = %p", key);  in request_key_rcu()
803 	return key;  in request_key_rcu()