forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-11 6778948f9de86c3cfaf36725a7c87dcff9ba247f 
 kernel/security/keys/key.c
....@@ -1,15 +1,11 @@
1
+// SPDX-License-Identifier: GPL-2.0-or-later
12 /* Basic authentication token and access key management
23  *
34  * Copyright (C) 2004-2008 Red Hat, Inc. All Rights Reserved.
45  * Written by David Howells (dhowells@redhat.com)
5
- *
6
- * This program is free software; you can redistribute it and/or
7
- * modify it under the terms of the GNU General Public License
8
- * as published by the Free Software Foundation; either version
9
- * 2 of the License, or (at your option) any later version.
106  */
117 
12
-#include <linux/module.h>
8
+#include <linux/export.h>
139 #include <linux/init.h>
1410 #include <linux/poison.h>
1511 #include <linux/sched.h>
....@@ -17,6 +13,7 @@
1713 #include <linux/security.h>
1814 #include <linux/workqueue.h>
1915 #include <linux/random.h>
16
+#include <linux/ima.h>
2017 #include <linux/err.h>
2118 #include "internal.h"
2219 
....@@ -285,11 +282,12 @@
285282 	key->index_key.description = kmemdup(desc, desclen + 1, GFP_KERNEL);
286283 	if (!key->index_key.description)
287284 		goto no_memory_3;
285
+	key->index_key.type = type;
286
+	key_set_index_key(&key->index_key);
288287 
289288 	refcount_set(&key->usage, 1);
290289 	init_rwsem(&key->sem);
291290 	lockdep_set_class(&key->sem, &type->lock_class);
292
-	key->index_key.type = type;
293291 	key->user = user;
294292 	key->quotalen = quotalen;
295293 	key->datalen = type->def_datalen;
....@@ -318,6 +316,7 @@
318316 		goto security_error;
319317 
320318 	/* publish the key by giving it a serial number */
319
+	refcount_inc(&key->domain_tag->usage);
321320 	atomic_inc(&user->nkeys);
322321 	key_alloc_serial(key);
323322 
....@@ -447,6 +446,7 @@
447446 			/* mark the key as being instantiated */
448447 			atomic_inc(&key->user->nikeys);
449448 			mark_key_instantiated(key, 0);
449
+			notify_key(key, NOTIFY_KEY_INSTANTIATED, 0);
450450 
451451 			if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
452452 				awaken = 1;
....@@ -456,12 +456,12 @@
456456 				if (test_bit(KEY_FLAG_KEEP, &keyring->flags))
457457 					set_bit(KEY_FLAG_KEEP, &key->flags);
458458 
459
-				__key_link(key, _edit);
459
+				__key_link(keyring, key, _edit);
460460 			}
461461 
462462 			/* disable the authorisation key */
463463 			if (authkey)
464
-				key_revoke(authkey);
464
+				key_invalidate(authkey);
465465 
466466 			if (prep->expiry != TIME64_MAX) {
467467 				key->expiry = prep->expiry;
....@@ -502,7 +502,7 @@
502502 			     struct key *authkey)
503503 {
504504 	struct key_preparsed_payload prep;
505
-	struct assoc_array_edit *edit;
505
+	struct assoc_array_edit *edit = NULL;
506506 	int ret;
507507 
508508 	memset(&prep, 0, sizeof(prep));
....@@ -517,9 +517,13 @@
517517 	}
518518 
519519 	if (keyring) {
520
-		ret = __key_link_begin(keyring, &key->index_key, &edit);
520
+		ret = __key_link_lock(keyring, &key->index_key);
521521 		if (ret < 0)
522522 			goto error;
523
+
524
+		ret = __key_link_begin(keyring, &key->index_key, &edit);
525
+		if (ret < 0)
526
+			goto error_link_end;
523527 
524528 		if (keyring->restrict_link && keyring->restrict_link->check) {
525529 			struct key_restriction *keyres = keyring->restrict_link;
....@@ -572,7 +576,7 @@
572576 			struct key *keyring,
573577 			struct key *authkey)
574578 {
575
-	struct assoc_array_edit *edit;
579
+	struct assoc_array_edit *edit = NULL;
576580 	int ret, awaken, link_ret = 0;
577581 
578582 	key_check(key);
....@@ -585,7 +589,12 @@
585589 		if (keyring->restrict_link)
586590 			return -EPERM;
587591 
588
-		link_ret = __key_link_begin(keyring, &key->index_key, &edit);
592
+		link_ret = __key_link_lock(keyring, &key->index_key);
593
+		if (link_ret == 0) {
594
+			link_ret = __key_link_begin(keyring, &key->index_key, &edit);
595
+			if (link_ret < 0)
596
+				__key_link_end(keyring, &key->index_key, edit);
597
+		}
589598 	}
590599 
591600 	mutex_lock(&key_construction_mutex);
....@@ -595,6 +604,7 @@
595604 		/* mark the key as being negatively instantiated */
596605 		atomic_inc(&key->user->nikeys);
597606 		mark_key_instantiated(key, -error);
607
+		notify_key(key, NOTIFY_KEY_INSTANTIATED, -error);
598608 		key->expiry = ktime_get_real_seconds() + timeout;
599609 		key_schedule_gc(key->expiry + key_gc_delay);
600610 
....@@ -605,11 +615,11 @@
605615 
606616 		/* and link it into the destination keyring */
607617 		if (keyring && link_ret == 0)
608
-			__key_link(key, &edit);
618
+			__key_link(keyring, key, &edit);
609619 
610620 		/* disable the authorisation key */
611621 		if (authkey)
612
-			key_revoke(authkey);
622
+			key_invalidate(authkey);
613623 	}
614624 
615625 	mutex_unlock(&key_construction_mutex);
....@@ -758,9 +768,11 @@
758768 	down_write(&key->sem);
759769 
760770 	ret = key->type->update(key, prep);
761
-	if (ret == 0)
771
+	if (ret == 0) {
762772 		/* Updating a negative key positively instantiates it */
763773 		mark_key_instantiated(key, 0);
774
+		notify_key(key, NOTIFY_KEY_UPDATED, 0);
775
+	}
764776 
765777 	up_write(&key->sem);
766778 
....@@ -812,7 +824,7 @@
812824 		.description	= description,
813825 	};
814826 	struct key_preparsed_payload prep;
815
-	struct assoc_array_edit *edit;
827
+	struct assoc_array_edit *edit = NULL;
816828 	const struct cred *cred = current_cred();
817829 	struct key *keyring, *key = NULL;
818830 	key_ref_t key_ref;
....@@ -861,11 +873,18 @@
861873 			goto error_free_prep;
862874 	}
863875 	index_key.desc_len = strlen(index_key.description);
876
+	key_set_index_key(&index_key);
877
+
878
+	ret = __key_link_lock(keyring, &index_key);
879
+	if (ret < 0) {
880
+		key_ref = ERR_PTR(ret);
881
+		goto error_free_prep;
882
+	}
864883 
865884 	ret = __key_link_begin(keyring, &index_key, &edit);
866885 	if (ret < 0) {
867886 		key_ref = ERR_PTR(ret);
868
-		goto error_free_prep;
887
+		goto error_link_end;
869888 	}
870889 
871890 	if (restrict_link && restrict_link->check) {
....@@ -924,6 +943,9 @@
924943 		goto error_link_end;
925944 	}
926945 
946
+	ima_post_key_create_or_update(keyring, key, payload, plen,
947
+				      flags, true);
948
+
927949 	key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
928950 
929951 error_link_end:
....@@ -953,6 +975,12 @@
953975 	}
954976 
955977 	key_ref = __key_update(key_ref, &prep);
978
+
979
+	if (!IS_ERR(key_ref))
980
+		ima_post_key_create_or_update(keyring, key,
981
+					      payload, plen,
982
+					      flags, false);
983
+
956984 	goto error_free_prep;
957985 }
958986 EXPORT_SYMBOL(key_create_or_update);
....@@ -1001,9 +1029,11 @@
10011029 	down_write(&key->sem);
10021030 
10031031 	ret = key->type->update(key, &prep);
1004
-	if (ret == 0)
1032
+	if (ret == 0) {
10051033 		/* Updating a negative key positively instantiates it */
10061034 		mark_key_instantiated(key, 0);
1035
+		notify_key(key, NOTIFY_KEY_UPDATED, 0);
1036
+	}
10071037 
10081038 	up_write(&key->sem);
10091039 
....@@ -1035,15 +1065,17 @@
10351065 	 *   instantiated
10361066 	 */
10371067 	down_write_nested(&key->sem, 1);
1038
-	if (!test_and_set_bit(KEY_FLAG_REVOKED, &key->flags) &&
1039
-	    key->type->revoke)
1040
-		key->type->revoke(key);
1068
+	if (!test_and_set_bit(KEY_FLAG_REVOKED, &key->flags)) {
1069
+		notify_key(key, NOTIFY_KEY_REVOKED, 0);
1070
+		if (key->type->revoke)
1071
+			key->type->revoke(key);
10411072 
1042
-	/* set the death time to no more than the expiry time */
1043
-	time = ktime_get_real_seconds();
1044
-	if (key->revoked_at == 0 || key->revoked_at > time) {
1045
-		key->revoked_at = time;
1046
-		key_schedule_gc(key->revoked_at + key_gc_delay);
1073
+		/* set the death time to no more than the expiry time */
1074
+		time = ktime_get_real_seconds();
1075
+		if (key->revoked_at == 0 || key->revoked_at > time) {
1076
+			key->revoked_at = time;
1077
+			key_schedule_gc(key->revoked_at + key_gc_delay);
1078
+		}
10471079 	}
10481080 
10491081 	up_write(&key->sem);
....@@ -1065,8 +1097,10 @@
10651097 
10661098 	if (!test_bit(KEY_FLAG_INVALIDATED, &key->flags)) {
10671099 		down_write_nested(&key->sem, 1);
1068
-		if (!test_and_set_bit(KEY_FLAG_INVALIDATED, &key->flags))
1100
+		if (!test_and_set_bit(KEY_FLAG_INVALIDATED, &key->flags)) {
1101
+			notify_key(key, NOTIFY_KEY_INVALIDATED, 0);
10691102 			key_schedule_gc_links();
1103
+		}
10701104 		up_write(&key->sem);
10711105 	}
10721106 }