forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-11 1f93a7dfd1f8d5ff7a5c53246c7534fe2332d6f4 
 kernel/security/keys/request_key.c
....@@ -1,30 +1,52 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /* Request a key from userspace
23  *
34  * Copyright (C) 2004-2007 Red Hat, Inc. All Rights Reserved.
45  * Written by David Howells (dhowells@redhat.com)
56  *
6
- * This program is free software; you can redistribute it and/or
7
- * modify it under the terms of the GNU General Public License
8
- * as published by the Free Software Foundation; either version
9
- * 2 of the License, or (at your option) any later version.
10
- *
117  * See Documentation/security/keys/request-key.rst
128  */
139 
14
-#include <linux/module.h>
10
+#include <linux/export.h>
1511 #include <linux/sched.h>
1612 #include <linux/kmod.h>
1713 #include <linux/err.h>
1814 #include <linux/keyctl.h>
1915 #include <linux/slab.h>
16
+#include <net/net_namespace.h>
2017 #include "internal.h"
2118 #include <keys/request_key_auth-type.h>
2219 
2320 #define key_negative_timeout	60	/* default timeout on a negative key's existence */
2421 
22
+static struct key *check_cached_key(struct keyring_search_context *ctx)
23
+{
24
+#ifdef CONFIG_KEYS_REQUEST_CACHE
25
+	struct key *key = current->cached_requested_key;
26
+
27
+	if (key &&
28
+	    ctx->match_data.cmp(key, &ctx->match_data) &&
29
+	    !(key->flags & ((1 << KEY_FLAG_INVALIDATED) |
30
+			    (1 << KEY_FLAG_REVOKED))))
31
+		return key_get(key);
32
+#endif
33
+	return NULL;
34
+}
35
+
36
+static void cache_requested_key(struct key *key)
37
+{
38
+#ifdef CONFIG_KEYS_REQUEST_CACHE
39
+	struct task_struct *t = current;
40
+
41
+	key_put(t->cached_requested_key);
42
+	t->cached_requested_key = key_get(key);
43
+	set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
44
+#endif
45
+}
46
+
2547 /**
2648  * complete_request_key - Complete the construction of a key.
27
- * @auth_key: The authorisation key.
49
+ * @authkey: The authorisation key.
2850  * @error: The success or failute of the construction.
2951  *
3052  * Complete the attempt to construct a key.  The key will be negated
....@@ -96,7 +118,7 @@
96118 	struct request_key_auth *rka = get_request_key_auth(authkey);
97119 	const struct cred *cred = current_cred();
98120 	key_serial_t prkey, sskey;
99
-	struct key *key = rka->target_key, *keyring, *session;
121
+	struct key *key = rka->target_key, *keyring, *session, *user_session;
100122 	char *argv[9], *envp[3], uid_str[12], gid_str[12];
101123 	char key_str[12], keyring_str[3][12];
102124 	char desc[20];
....@@ -104,9 +126,9 @@
104126 
105127 	kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op);
106128 
107
-	ret = install_user_keyrings();
129
+	ret = look_up_user_keyrings(NULL, &user_session);
108130 	if (ret < 0)
109
-		goto error_alloc;
131
+		goto error_us;
110132 
111133 	/* allocate a new session keyring */
112134 	sprintf(desc, "_req.%u", key->serial);
....@@ -142,12 +164,10 @@
142164 		prkey = cred->process_keyring->serial;
143165 	sprintf(keyring_str[1], "%d", prkey);
144166 
145
-	rcu_read_lock();
146
-	session = rcu_dereference(cred->session_keyring);
167
+	session = cred->session_keyring;
147168 	if (!session)
148
-		session = cred->user->session_keyring;
169
+		session = user_session;
149170 	sskey = session->serial;
150
-	rcu_read_unlock();
151171 
152172 	sprintf(keyring_str[2], "%d", sskey);
153173 
....@@ -188,6 +208,8 @@
188208 	key_put(keyring);
189209 
190210 error_alloc:
211
+	key_put(user_session);
212
+error_us:
191213 	complete_request_key(authkey, ret);
192214 	kleave(" = %d", ret);
193215 	return ret;
....@@ -224,7 +246,7 @@
224246 	/* check that the actor called complete_request_key() prior to
225247 	 * returning an error */
226248 	WARN_ON(ret < 0 &&
227
-		!test_bit(KEY_FLAG_REVOKED, &authkey->flags));
249
+		!test_bit(KEY_FLAG_INVALIDATED, &authkey->flags));
228250 
229251 	key_put(authkey);
230252 	kleave(" = %d", ret);
....@@ -273,32 +295,36 @@
273295 				}
274296 			}
275297 
298
+			fallthrough;
276299 		case KEY_REQKEY_DEFL_THREAD_KEYRING:
277300 			dest_keyring = key_get(cred->thread_keyring);
278301 			if (dest_keyring)
279302 				break;
280303 
304
+			fallthrough;
281305 		case KEY_REQKEY_DEFL_PROCESS_KEYRING:
282306 			dest_keyring = key_get(cred->process_keyring);
283307 			if (dest_keyring)
284308 				break;
285309 
310
+			fallthrough;
286311 		case KEY_REQKEY_DEFL_SESSION_KEYRING:
287
-			rcu_read_lock();
288
-			dest_keyring = key_get(
289
-				rcu_dereference(cred->session_keyring));
290
-			rcu_read_unlock();
312
+			dest_keyring = key_get(cred->session_keyring);
291313 
292314 			if (dest_keyring)
293315 				break;
294316 
317
+			fallthrough;
295318 		case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
296
-			dest_keyring =
297
-				key_get(cred->user->session_keyring);
319
+			ret = look_up_user_keyrings(NULL, &dest_keyring);
320
+			if (ret < 0)
321
+				return ret;
298322 			break;
299323 
300324 		case KEY_REQKEY_DEFL_USER_KEYRING:
301
-			dest_keyring = key_get(cred->user->uid_keyring);
325
+			ret = look_up_user_keyrings(&dest_keyring, NULL);
326
+			if (ret < 0)
327
+				return ret;
302328 			break;
303329 
304330 		case KEY_REQKEY_DEFL_GROUP_KEYRING:
....@@ -343,7 +369,7 @@
343369 			       struct key_user *user,
344370 			       struct key **_key)
345371 {
346
-	struct assoc_array_edit *edit;
372
+	struct assoc_array_edit *edit = NULL;
347373 	struct key *key;
348374 	key_perm_t perm;
349375 	key_ref_t key_ref;
....@@ -372,6 +398,9 @@
372398 	set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
373399 
374400 	if (dest_keyring) {
401
+		ret = __key_link_lock(dest_keyring, &ctx->index_key);
402
+		if (ret < 0)
403
+			goto link_lock_failed;
375404 		ret = __key_link_begin(dest_keyring, &ctx->index_key, &edit);
376405 		if (ret < 0)
377406 			goto link_prealloc_failed;
....@@ -382,12 +411,14 @@
382411 	 * waited for locks */
383412 	mutex_lock(&key_construction_mutex);
384413 
385
-	key_ref = search_process_keyrings(ctx);
414
+	rcu_read_lock();
415
+	key_ref = search_process_keyrings_rcu(ctx);
416
+	rcu_read_unlock();
386417 	if (!IS_ERR(key_ref))
387418 		goto key_already_present;
388419 
389420 	if (dest_keyring)
390
-		__key_link(key, &edit);
421
+		__key_link(dest_keyring, key, &edit);
391422 
392423 	mutex_unlock(&key_construction_mutex);
393424 	if (dest_keyring)
....@@ -406,7 +437,7 @@
406437 	if (dest_keyring) {
407438 		ret = __key_link_check_live_key(dest_keyring, key);
408439 		if (ret == 0)
409
-			__key_link(key, &edit);
440
+			__key_link(dest_keyring, key, &edit);
410441 		__key_link_end(dest_keyring, &ctx->index_key, edit);
411442 		if (ret < 0)
412443 			goto link_check_failed;
....@@ -423,6 +454,8 @@
423454 	return ret;
424455 
425456 link_prealloc_failed:
457
+	__key_link_end(dest_keyring, &ctx->index_key, edit);
458
+link_lock_failed:
426459 	mutex_unlock(&user->cons_lock);
427460 	key_put(key);
428461 	kleave(" = %d [prelink]", ret);
....@@ -497,16 +530,18 @@
497530  * request_key_and_link - Request a key and cache it in a keyring.
498531  * @type: The type of key we want.
499532  * @description: The searchable description of the key.
533
+ * @domain_tag: The domain in which the key operates.
500534  * @callout_info: The data to pass to the instantiation upcall (or NULL).
501535  * @callout_len: The length of callout_info.
502536  * @aux: Auxiliary data for the upcall.
503537  * @dest_keyring: Where to cache the key.
504538  * @flags: Flags to key_alloc().
505539  *
506
- * A key matching the specified criteria is searched for in the process's
507
- * keyrings and returned with its usage count incremented if found.  Otherwise,
508
- * if callout_info is not NULL, a key will be allocated and some service
509
- * (probably in userspace) will be asked to instantiate it.
540
+ * A key matching the specified criteria (type, description, domain_tag) is
541
+ * searched for in the process's keyrings and returned with its usage count
542
+ * incremented if found.  Otherwise, if callout_info is not NULL, a key will be
543
+ * allocated and some service (probably in userspace) will be asked to
544
+ * instantiate it.
510545  *
511546  * If successfully found or created, the key will be linked to the destination
512547  * keyring if one is provided.
....@@ -522,6 +557,7 @@
522557  */
523558 struct key *request_key_and_link(struct key_type *type,
524559 				 const char *description,
560
+				 struct key_tag *domain_tag,
525561 				 const void *callout_info,
526562 				 size_t callout_len,
527563 				 void *aux,
....@@ -530,6 +566,7 @@
530566 {
531567 	struct keyring_search_context ctx = {
532568 		.index_key.type		= type,
569
+		.index_key.domain_tag	= domain_tag,
533570 		.index_key.description	= description,
534571 		.index_key.desc_len	= strlen(description),
535572 		.cred			= current_cred(),
....@@ -537,7 +574,8 @@
537574 		.match_data.raw_data	= description,
538575 		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
539576 		.flags			= (KEYRING_SEARCH_DO_STATE_CHECK |
540
-					   KEYRING_SEARCH_SKIP_EXPIRED),
577
+					   KEYRING_SEARCH_SKIP_EXPIRED |
578
+					   KEYRING_SEARCH_RECURSE),
541579 	};
542580 	struct key *key;
543581 	key_ref_t key_ref;
....@@ -555,10 +593,26 @@
555593 		}
556594 	}
557595 
596
+	key = check_cached_key(&ctx);
597
+	if (key)
598
+		goto error_free;
599
+
558600 	/* search all the process keyrings for a key */
559
-	key_ref = search_process_keyrings(&ctx);
601
+	rcu_read_lock();
602
+	key_ref = search_process_keyrings_rcu(&ctx);
603
+	rcu_read_unlock();
560604 
561605 	if (!IS_ERR(key_ref)) {
606
+		if (dest_keyring) {
607
+			ret = key_task_permission(key_ref, current_cred(),
608
+						  KEY_NEED_LINK);
609
+			if (ret < 0) {
610
+				key_ref_put(key_ref);
611
+				key = ERR_PTR(ret);
612
+				goto error_free;
613
+			}
614
+		}
615
+
562616 		key = key_ref_to_ptr(key_ref);
563617 		if (dest_keyring) {
564618 			ret = key_link(dest_keyring, key);
....@@ -568,6 +622,9 @@
568622 				goto error_free;
569623 			}
570624 		}
625
+
626
+		/* Only cache the key on immediate success */
627
+		cache_requested_key(key);
571628 	} else if (PTR_ERR(key_ref) != -EAGAIN) {
572629 		key = ERR_CAST(key_ref);
573630 	} else  {
....@@ -616,9 +673,10 @@
616673 EXPORT_SYMBOL(wait_for_key_construction);
617674 
618675 /**
619
- * request_key - Request a key and wait for construction
676
+ * request_key_tag - Request a key and wait for construction
620677  * @type: Type of key.
621678  * @description: The searchable description of the key.
679
+ * @domain_tag: The domain in which the key operates.
622680  * @callout_info: The data to pass to the instantiation upcall (or NULL).
623681  *
624682  * As for request_key_and_link() except that it does not add the returned key
....@@ -629,9 +687,10 @@
629687  * Furthermore, it then works as wait_for_key_construction() to wait for the
630688  * completion of keys undergoing construction with a non-interruptible wait.
631689  */
632
-struct key *request_key(struct key_type *type,
633
-			const char *description,
634
-			const char *callout_info)
690
+struct key *request_key_tag(struct key_type *type,
691
+			    const char *description,
692
+			    struct key_tag *domain_tag,
693
+			    const char *callout_info)
635694 {
636695 	struct key *key;
637696 	size_t callout_len = 0;
....@@ -639,7 +698,8 @@
639698 
640699 	if (callout_info)
641700 		callout_len = strlen(callout_info);
642
-	key = request_key_and_link(type, description, callout_info, callout_len,
701
+	key = request_key_and_link(type, description, domain_tag,
702
+				   callout_info, callout_len,
643703 				   NULL, NULL, KEY_ALLOC_IN_QUOTA);
644704 	if (!IS_ERR(key)) {
645705 		ret = wait_for_key_construction(key, false);
....@@ -650,12 +710,13 @@
650710 	}
651711 	return key;
652712 }
653
-EXPORT_SYMBOL(request_key);
713
+EXPORT_SYMBOL(request_key_tag);
654714 
655715 /**
656716  * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
657717  * @type: The type of key we want.
658718  * @description: The searchable description of the key.
719
+ * @domain_tag: The domain in which the key operates.
659720  * @callout_info: The data to pass to the instantiation upcall (or NULL).
660721  * @callout_len: The length of callout_info.
661722  * @aux: Auxiliary data for the upcall.
....@@ -668,6 +729,7 @@
668729  */
669730 struct key *request_key_with_auxdata(struct key_type *type,
670731 				     const char *description,
732
+				     struct key_tag *domain_tag,
671733 				     const void *callout_info,
672734 				     size_t callout_len,
673735 				     void *aux)
....@@ -675,7 +737,8 @@
675737 	struct key *key;
676738 	int ret;
677739 
678
-	key = request_key_and_link(type, description, callout_info, callout_len,
740
+	key = request_key_and_link(type, description, domain_tag,
741
+				   callout_info, callout_len,
679742 				   aux, NULL, KEY_ALLOC_IN_QUOTA);
680743 	if (!IS_ERR(key)) {
681744 		ret = wait_for_key_construction(key, false);
....@@ -688,52 +751,55 @@
688751 }
689752 EXPORT_SYMBOL(request_key_with_auxdata);
690753 
691
-/*
692
- * request_key_async - Request a key (allow async construction)
693
- * @type: Type of key.
694
- * @description: The searchable description of the key.
695
- * @callout_info: The data to pass to the instantiation upcall (or NULL).
696
- * @callout_len: The length of callout_info.
754
+/**
755
+ * request_key_rcu - Request key from RCU-read-locked context
756
+ * @type: The type of key we want.
757
+ * @description: The name of the key we want.
758
+ * @domain_tag: The domain in which the key operates.
697759  *
698
- * As for request_key_and_link() except that it does not add the returned key
699
- * to a keyring if found, new keys are always allocated in the user's quota and
700
- * no auxiliary data can be passed.
760
+ * Request a key from a context that we may not sleep in (such as RCU-mode
761
+ * pathwalk).  Keys under construction are ignored.
701762  *
702
- * The caller should call wait_for_key_construction() to wait for the
703
- * completion of the returned key if it is still undergoing construction.
763
+ * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
764
+ * a key or some other error if the key found was unsuitable or inaccessible.
704765  */
705
-struct key *request_key_async(struct key_type *type,
706
-			      const char *description,
707
-			      const void *callout_info,
708
-			      size_t callout_len)
766
+struct key *request_key_rcu(struct key_type *type,
767
+			    const char *description,
768
+			    struct key_tag *domain_tag)
709769 {
710
-	return request_key_and_link(type, description, callout_info,
711
-				    callout_len, NULL, NULL,
712
-				    KEY_ALLOC_IN_QUOTA);
713
-}
714
-EXPORT_SYMBOL(request_key_async);
770
+	struct keyring_search_context ctx = {
771
+		.index_key.type		= type,
772
+		.index_key.domain_tag	= domain_tag,
773
+		.index_key.description	= description,
774
+		.index_key.desc_len	= strlen(description),
775
+		.cred			= current_cred(),
776
+		.match_data.cmp		= key_default_cmp,
777
+		.match_data.raw_data	= description,
778
+		.match_data.lookup_type	= KEYRING_SEARCH_LOOKUP_DIRECT,
779
+		.flags			= (KEYRING_SEARCH_DO_STATE_CHECK |
780
+					   KEYRING_SEARCH_SKIP_EXPIRED),
781
+	};
782
+	struct key *key;
783
+	key_ref_t key_ref;
715784 
716
-/*
717
- * request a key with auxiliary data for the upcaller (allow async construction)
718
- * @type: Type of key.
719
- * @description: The searchable description of the key.
720
- * @callout_info: The data to pass to the instantiation upcall (or NULL).
721
- * @callout_len: The length of callout_info.
722
- * @aux: Auxiliary data for the upcall.
723
- *
724
- * As for request_key_and_link() except that it does not add the returned key
725
- * to a keyring if found and new keys are always allocated in the user's quota.
726
- *
727
- * The caller should call wait_for_key_construction() to wait for the
728
- * completion of the returned key if it is still undergoing construction.
729
- */
730
-struct key *request_key_async_with_auxdata(struct key_type *type,
731
-					   const char *description,
732
-					   const void *callout_info,
733
-					   size_t callout_len,
734
-					   void *aux)
735
-{
736
-	return request_key_and_link(type, description, callout_info,
737
-				    callout_len, aux, NULL, KEY_ALLOC_IN_QUOTA);
785
+	kenter("%s,%s", type->name, description);
786
+
787
+	key = check_cached_key(&ctx);
788
+	if (key)
789
+		return key;
790
+
791
+	/* search all the process keyrings for a key */
792
+	key_ref = search_process_keyrings_rcu(&ctx);
793
+	if (IS_ERR(key_ref)) {
794
+		key = ERR_CAST(key_ref);
795
+		if (PTR_ERR(key_ref) == -EAGAIN)
796
+			key = ERR_PTR(-ENOKEY);
797
+	} else {
798
+		key = key_ref_to_ptr(key_ref);
799
+		cache_requested_key(key);
800
+	}
801
+
802
+	kleave(" = %p", key);
803
+	return key;
738804 }
739
-EXPORT_SYMBOL(request_key_async_with_auxdata);
805
+EXPORT_SYMBOL(request_key_rcu);