add new system file

hc

2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c

 kernel/security/keys/request_key_auth.c
..
..
@@ -1,17 +1,12 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
1
2
 /* Request key authorisation token key definition.
2
3
  *
3
4
  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4
5
  * Written by David Howells (dhowells@redhat.com)
5
6
  *
6
- * This program is free software; you can redistribute it and/or
7
- * modify it under the terms of the GNU General Public License
8
- * as published by the Free Software Foundation; either version
9
- * 2 of the License, or (at your option) any later version.
10
- *
11
7
  * See Documentation/security/keys/request-key.rst
12
8
  */
13
9
 
14
-#include <linux/module.h>
15
10
 #include <linux/sched.h>
16
11
 #include <linux/err.h>
17
12
 #include <linux/seq_file.h>
..
..
@@ -59,7 +54,7 @@
59
54
 static int request_key_auth_instantiate(struct key *key,
60
55
 					struct key_preparsed_payload *prep)
61
56
 {
62
-	key->payload.data[0] = (struct request_key_auth *)prep->data;
57
+	rcu_assign_keypointer(key, (struct request_key_auth *)prep->data);
63
58
 	return 0;
64
59
 }
65
60
 
..
..
@@ -69,7 +64,7 @@
69
64
 static void request_key_auth_describe(const struct key *key,
70
65
 				      struct seq_file *m)
71
66
 {
72
-	struct request_key_auth *rka = get_request_key_auth(key);
67
+	struct request_key_auth *rka = dereference_key_rcu(key);
73
68
 
74
69
 	if (!rka)
75
70
 		return;
..
..
@@ -87,7 +82,7 @@
87
82
 static long request_key_auth_read(const struct key *key,
88
83
 				  char *buffer, size_t buflen)
89
84
 {
90
-	struct request_key_auth *rka = get_request_key_auth(key);
85
+	struct request_key_auth *rka = dereference_key_locked(key);
91
86
 	size_t datalen;
92
87
 	long ret;
93
88
 
..
..
@@ -108,23 +103,6 @@
108
103
 	return ret;
109
104
 }
110
105
 
111
-/*
112
- * Handle revocation of an authorisation token key.
113
- *
114
- * Called with the key sem write-locked.
115
- */
116
-static void request_key_auth_revoke(struct key *key)
117
-{
118
-	struct request_key_auth *rka = get_request_key_auth(key);
119
-
120
-	kenter("{%d}", key->serial);
121
-
122
-	if (rka->cred) {
123
-		put_cred(rka->cred);
124
-		rka->cred = NULL;
125
-	}
126
-}
127
-
128
106
 static void free_request_key_auth(struct request_key_auth *rka)
129
107
 {
130
108
 	if (!rka)
..
..
@@ -138,15 +116,42 @@
138
116
 }
139
117
 
140
118
 /*
119
+ * Dispose of the request_key_auth record under RCU conditions
120
+ */
121
+static void request_key_auth_rcu_disposal(struct rcu_head *rcu)
122
+{
123
+	struct request_key_auth *rka =
124
+		container_of(rcu, struct request_key_auth, rcu);
125
+
126
+	free_request_key_auth(rka);
127
+}
128
+
129
+/*
130
+ * Handle revocation of an authorisation token key.
131
+ *
132
+ * Called with the key sem write-locked.
133
+ */
134
+static void request_key_auth_revoke(struct key *key)
135
+{
136
+	struct request_key_auth *rka = dereference_key_locked(key);
137
+
138
+	kenter("{%d}", key->serial);
139
+	rcu_assign_keypointer(key, NULL);
140
+	call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
141
+}
142
+
143
+/*
141
144
  * Destroy an instantiation authorisation token key.
142
145
  */
143
146
 static void request_key_auth_destroy(struct key *key)
144
147
 {
145
-	struct request_key_auth *rka = get_request_key_auth(key);
148
+	struct request_key_auth *rka = rcu_access_pointer(key->payload.rcu_data0);
146
149
 
147
150
 	kenter("{%d}", key->serial);
148
-
149
-	free_request_key_auth(rka);
151
+	if (rka) {
152
+		rcu_assign_keypointer(key, NULL);
153
+		call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
154
+	}
150
155
 }
151
156
 
152
157
 /*
..
..
@@ -158,7 +163,7 @@
158
163
 				 struct key *dest_keyring)
159
164
 {
160
165
 	struct request_key_auth *rka, *irka;
161
-	const struct cred *cred = current->cred;
166
+	const struct cred *cred = current_cred();
162
167
 	struct key *authkey = NULL;
163
168
 	char desc[20];
164
169
 	int ret = -ENOMEM;
..
..
@@ -210,7 +215,7 @@
210
215
 
211
216
 	authkey = key_alloc(&key_type_request_key_auth, desc,
212
217
 			    cred->fsuid, cred->fsgid, cred,
213
-			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
218
+			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_LINK |
214
219
 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
215
220
 	if (IS_ERR(authkey)) {
216
221
 		ret = PTR_ERR(authkey);
..
..
@@ -248,14 +253,17 @@
248
253
 		.match_data.cmp		= key_default_cmp,
249
254
 		.match_data.raw_data	= description,
250
255
 		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
251
-		.flags			= KEYRING_SEARCH_DO_STATE_CHECK,
256
+		.flags			= (KEYRING_SEARCH_DO_STATE_CHECK |
257
+					   KEYRING_SEARCH_RECURSE),
252
258
 	};
253
259
 	struct key *authkey;
254
260
 	key_ref_t authkey_ref;
255
261
 
256
262
 	ctx.index_key.desc_len = sprintf(description, "%x", target_id);
257
263
 
258
-	authkey_ref = search_process_keyrings(&ctx);
264
+	rcu_read_lock();
265
+	authkey_ref = search_process_keyrings_rcu(&ctx);
266
+	rcu_read_unlock();
259
267
 
260
268
 	if (IS_ERR(authkey_ref)) {
261
269
 		authkey = ERR_CAST(authkey_ref);