1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/* Userspace key control operations
3	*
4	* Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
5	* Written by David Howells (dhowells@redhat.com)
6	*/
7
8	#include <linux/init.h>
9	#include <linux/sched.h>
10	#include <linux/sched/task.h>
11	#include <linux/slab.h>
12	#include <linux/syscalls.h>
13	#include <linux/key.h>
14	#include <linux/keyctl.h>
15	#include <linux/fs.h>
16	#include <linux/capability.h>
17	#include <linux/cred.h>
18	#include <linux/string.h>
19	#include <linux/err.h>
20	#include <linux/vmalloc.h>
21	#include <linux/security.h>
22	#include <linux/uio.h>
23	#include <linux/uaccess.h>
24	#include <keys/request_key_auth-type.h>
25	#include "internal.h"
26
27	#define KEY_MAX_DESC_SIZE 4096
28
29	static const unsigned char keyrings_capabilities[2] = {
30	[0] = (KEYCTL_CAPS0_CAPABILITIES |
31	(IS_ENABLED(CONFIG_PERSISTENT_KEYRINGS) ? KEYCTL_CAPS0_PERSISTENT_KEYRINGS : 0) |
32	(IS_ENABLED(CONFIG_KEY_DH_OPERATIONS) ? KEYCTL_CAPS0_DIFFIE_HELLMAN : 0) |
33	(IS_ENABLED(CONFIG_ASYMMETRIC_KEY_TYPE) ? KEYCTL_CAPS0_PUBLIC_KEY : 0) |
34	(IS_ENABLED(CONFIG_BIG_KEYS) ? KEYCTL_CAPS0_BIG_KEY : 0) |
35	KEYCTL_CAPS0_INVALIDATE |
36	KEYCTL_CAPS0_RESTRICT_KEYRING |
37	KEYCTL_CAPS0_MOVE
38	),
39	[1] = (KEYCTL_CAPS1_NS_KEYRING_NAME |
40	KEYCTL_CAPS1_NS_KEY_TAG |
41	(IS_ENABLED(CONFIG_KEY_NOTIFICATIONS) ? KEYCTL_CAPS1_NOTIFICATIONS : 0)
42	),
43	};
44
45	static int key_get_type_from_user(char *type,
46	const char __user *_type,
47	unsigned len)
48	{
49	int ret;
50
51	ret = strncpy_from_user(dst: type, src: _type, count: len);
52	if (ret < 0)
53	return ret;
54	if (ret == 0 || ret >= len)
55	return -EINVAL;
56	if (type[0] == '.')
57	return -EPERM;
58	type[len - 1] = '\0';
59	return 0;
60	}
61
62	/*
63	* Extract the description of a new key from userspace and either add it as a
64	* new key to the specified keyring or update a matching key in that keyring.
65	*
66	* If the description is NULL or an empty string, the key type is asked to
67	* generate one from the payload.
68	*
69	* The keyring must be writable so that we can attach the key to it.
70	*
71	* If successful, the new key's serial number is returned, otherwise an error
72	* code is returned.
73	*/
74	SYSCALL_DEFINE5(add_key, const char __user *, _type,
75	const char __user *, _description,
76	const void __user *, _payload,
77	size_t, plen,
78	key_serial_t, ringid)
79	{
80	key_ref_t keyring_ref, key_ref;
81	char type[32], *description;
82	void *payload;
83	long ret;
84
85	ret = -EINVAL;
86	if (plen > 1024 * 1024 - 1)
87	goto error;
88
89	/* draw all the data into kernel space */
90	ret = key_get_type_from_user(type, _type, len: sizeof(type));
91	if (ret < 0)
92	goto error;
93
94	description = NULL;
95	if (_description) {
96	description = strndup_user(_description, KEY_MAX_DESC_SIZE);
97	if (IS_ERR(ptr: description)) {
98	ret = PTR_ERR(ptr: description);
99	goto error;
100	}
101	if (!*description) {
102	kfree(objp: description);
103	description = NULL;
104	} else if ((description[0] == '.') &&
105	(strncmp(type, "keyring", 7) == 0)) {
106	ret = -EPERM;
107	goto error2;
108	}
109	}
110
111	/* pull the payload in if one was supplied */
112	payload = NULL;
113
114	if (plen) {
115	ret = -ENOMEM;
116	payload = kvmalloc(size: plen, GFP_KERNEL);
117	if (!payload)
118	goto error2;
119
120	ret = -EFAULT;
121	if (copy_from_user(to: payload, from: _payload, n: plen) != 0)
122	goto error3;
123	}
124
125	/* find the target keyring (which must be writable) */
126	keyring_ref = lookup_user_key(id: ringid, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_WRITE);
127	if (IS_ERR(ptr: keyring_ref)) {
128	ret = PTR_ERR(ptr: keyring_ref);
129	goto error3;
130	}
131
132	/* create or update the requested key and add it to the target
133	* keyring */
134	key_ref = key_create_or_update(keyring: keyring_ref, type, description,
135	payload, plen, KEY_PERM_UNDEF,
136	KEY_ALLOC_IN_QUOTA);
137	if (!IS_ERR(ptr: key_ref)) {
138	ret = key_ref_to_ptr(key_ref)->serial;
139	key_ref_put(key_ref);
140	}
141	else {
142	ret = PTR_ERR(ptr: key_ref);
143	}
144
145	key_ref_put(key_ref: keyring_ref);
146	error3:
147	kvfree_sensitive(addr: payload, len: plen);
148	error2:
149	kfree(objp: description);
150	error:
151	return ret;
152	}
153
154	/*
155	* Search the process keyrings and keyring trees linked from those for a
156	* matching key. Keyrings must have appropriate Search permission to be
157	* searched.
158	*
159	* If a key is found, it will be attached to the destination keyring if there's
160	* one specified and the serial number of the key will be returned.
161	*
162	* If no key is found, /sbin/request-key will be invoked if _callout_info is
163	* non-NULL in an attempt to create a key. The _callout_info string will be
164	* passed to /sbin/request-key to aid with completing the request. If the
165	* _callout_info string is "" then it will be changed to "-".
166	*/
167	SYSCALL_DEFINE4(request_key, const char __user *, _type,
168	const char __user *, _description,
169	const char __user *, _callout_info,
170	key_serial_t, destringid)
171	{
172	struct key_type *ktype;
173	struct key *key;
174	key_ref_t dest_ref;
175	size_t callout_len;
176	char type[32], *description, *callout_info;
177	long ret;
178
179	/* pull the type into kernel space */
180	ret = key_get_type_from_user(type, _type, len: sizeof(type));
181	if (ret < 0)
182	goto error;
183
184	/* pull the description into kernel space */
185	description = strndup_user(_description, KEY_MAX_DESC_SIZE);
186	if (IS_ERR(ptr: description)) {
187	ret = PTR_ERR(ptr: description);
188	goto error;
189	}
190
191	/* pull the callout info into kernel space */
192	callout_info = NULL;
193	callout_len = 0;
194	if (_callout_info) {
195	callout_info = strndup_user(_callout_info, PAGE_SIZE);
196	if (IS_ERR(ptr: callout_info)) {
197	ret = PTR_ERR(ptr: callout_info);
198	goto error2;
199	}
200	callout_len = strlen(callout_info);
201	}
202
203	/* get the destination keyring if specified */
204	dest_ref = NULL;
205	if (destringid) {
206	dest_ref = lookup_user_key(id: destringid, flags: KEY_LOOKUP_CREATE,
207	need_perm: KEY_NEED_WRITE);
208	if (IS_ERR(ptr: dest_ref)) {
209	ret = PTR_ERR(ptr: dest_ref);
210	goto error3;
211	}
212	}
213
214	/* find the key type */
215	ktype = key_type_lookup(type);
216	if (IS_ERR(ptr: ktype)) {
217	ret = PTR_ERR(ptr: ktype);
218	goto error4;
219	}
220
221	/* do the search */
222	key = request_key_and_link(type: ktype, description, NULL, callout_info,
223	callout_len, NULL, dest_keyring: key_ref_to_ptr(key_ref: dest_ref),
224	KEY_ALLOC_IN_QUOTA);
225	if (IS_ERR(ptr: key)) {
226	ret = PTR_ERR(ptr: key);
227	goto error5;
228	}
229
230	/* wait for the key to finish being constructed */
231	ret = wait_for_key_construction(key, intr: 1);
232	if (ret < 0)
233	goto error6;
234
235	ret = key->serial;
236
237	error6:
238	key_put(key);
239	error5:
240	key_type_put(ktype);
241	error4:
242	key_ref_put(key_ref: dest_ref);
243	error3:
244	kfree(objp: callout_info);
245	error2:
246	kfree(objp: description);
247	error:
248	return ret;
249	}
250
251	/*
252	* Get the ID of the specified process keyring.
253	*
254	* The requested keyring must have search permission to be found.
255	*
256	* If successful, the ID of the requested keyring will be returned.
257	*/
258	long keyctl_get_keyring_ID(key_serial_t id, int create)
259	{
260	key_ref_t key_ref;
261	unsigned long lflags;
262	long ret;
263
264	lflags = create ? KEY_LOOKUP_CREATE : 0;
265	key_ref = lookup_user_key(id, flags: lflags, need_perm: KEY_NEED_SEARCH);
266	if (IS_ERR(ptr: key_ref)) {
267	ret = PTR_ERR(ptr: key_ref);
268	goto error;
269	}
270
271	ret = key_ref_to_ptr(key_ref)->serial;
272	key_ref_put(key_ref);
273	error:
274	return ret;
275	}
276
277	/*
278	* Join a (named) session keyring.
279	*
280	* Create and join an anonymous session keyring or join a named session
281	* keyring, creating it if necessary. A named session keyring must have Search
282	* permission for it to be joined. Session keyrings without this permit will
283	* be skipped over. It is not permitted for userspace to create or join
284	* keyrings whose name begin with a dot.
285	*
286	* If successful, the ID of the joined session keyring will be returned.
287	*/
288	long keyctl_join_session_keyring(const char __user *_name)
289	{
290	char *name;
291	long ret;
292
293	/* fetch the name from userspace */
294	name = NULL;
295	if (_name) {
296	name = strndup_user(_name, KEY_MAX_DESC_SIZE);
297	if (IS_ERR(ptr: name)) {
298	ret = PTR_ERR(ptr: name);
299	goto error;
300	}
301
302	ret = -EPERM;
303	if (name[0] == '.')
304	goto error_name;
305	}
306
307	/* join the session */
308	ret = join_session_keyring(name);
309	error_name:
310	kfree(objp: name);
311	error:
312	return ret;
313	}
314
315	/*
316	* Update a key's data payload from the given data.
317	*
318	* The key must grant the caller Write permission and the key type must support
319	* updating for this to work. A negative key can be positively instantiated
320	* with this call.
321	*
322	* If successful, 0 will be returned. If the key type does not support
323	* updating, then -EOPNOTSUPP will be returned.
324	*/
325	long keyctl_update_key(key_serial_t id,
326	const void __user *_payload,
327	size_t plen)
328	{
329	key_ref_t key_ref;
330	void *payload;
331	long ret;
332
333	ret = -EINVAL;
334	if (plen > PAGE_SIZE)
335	goto error;
336
337	/* pull the payload in if one was supplied */
338	payload = NULL;
339	if (plen) {
340	ret = -ENOMEM;
341	payload = kvmalloc(size: plen, GFP_KERNEL);
342	if (!payload)
343	goto error;
344
345	ret = -EFAULT;
346	if (copy_from_user(to: payload, from: _payload, n: plen) != 0)
347	goto error2;
348	}
349
350	/* find the target key (which must be writable) */
351	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_NEED_WRITE);
352	if (IS_ERR(ptr: key_ref)) {
353	ret = PTR_ERR(ptr: key_ref);
354	goto error2;
355	}
356
357	/* update the key */
358	ret = key_update(key: key_ref, payload, plen);
359
360	key_ref_put(key_ref);
361	error2:
362	kvfree_sensitive(addr: payload, len: plen);
363	error:
364	return ret;
365	}
366
367	/*
368	* Revoke a key.
369	*
370	* The key must be grant the caller Write or Setattr permission for this to
371	* work. The key type should give up its quota claim when revoked. The key
372	* and any links to the key will be automatically garbage collected after a
373	* certain amount of time (/proc/sys/kernel/keys/gc_delay).
374	*
375	* Keys with KEY_FLAG_KEEP set should not be revoked.
376	*
377	* If successful, 0 is returned.
378	*/
379	long keyctl_revoke_key(key_serial_t id)
380	{
381	key_ref_t key_ref;
382	struct key *key;
383	long ret;
384
385	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_NEED_WRITE);
386	if (IS_ERR(ptr: key_ref)) {
387	ret = PTR_ERR(ptr: key_ref);
388	if (ret != -EACCES)
389	goto error;
390	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_NEED_SETATTR);
391	if (IS_ERR(ptr: key_ref)) {
392	ret = PTR_ERR(ptr: key_ref);
393	goto error;
394	}
395	}
396
397	key = key_ref_to_ptr(key_ref);
398	ret = 0;
399	if (test_bit(KEY_FLAG_KEEP, &key->flags))
400	ret = -EPERM;
401	else
402	key_revoke(key);
403
404	key_ref_put(key_ref);
405	error:
406	return ret;
407	}
408
409	/*
410	* Invalidate a key.
411	*
412	* The key must be grant the caller Invalidate permission for this to work.
413	* The key and any links to the key will be automatically garbage collected
414	* immediately.
415	*
416	* Keys with KEY_FLAG_KEEP set should not be invalidated.
417	*
418	* If successful, 0 is returned.
419	*/
420	long keyctl_invalidate_key(key_serial_t id)
421	{
422	key_ref_t key_ref;
423	struct key *key;
424	long ret;
425
426	kenter("%d", id);
427
428	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_NEED_SEARCH);
429	if (IS_ERR(ptr: key_ref)) {
430	ret = PTR_ERR(ptr: key_ref);
431
432	/* Root is permitted to invalidate certain special keys */
433	if (capable(CAP_SYS_ADMIN)) {
434	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_SYSADMIN_OVERRIDE);
435	if (IS_ERR(ptr: key_ref))
436	goto error;
437	if (test_bit(KEY_FLAG_ROOT_CAN_INVAL,
438	&key_ref_to_ptr(key_ref)->flags))
439	goto invalidate;
440	goto error_put;
441	}
442
443	goto error;
444	}
445
446	invalidate:
447	key = key_ref_to_ptr(key_ref);
448	ret = 0;
449	if (test_bit(KEY_FLAG_KEEP, &key->flags))
450	ret = -EPERM;
451	else
452	key_invalidate(key);
453	error_put:
454	key_ref_put(key_ref);
455	error:
456	kleave(" = %ld", ret);
457	return ret;
458	}
459
460	/*
461	* Clear the specified keyring, creating an empty process keyring if one of the
462	* special keyring IDs is used.
463	*
464	* The keyring must grant the caller Write permission and not have
465	* KEY_FLAG_KEEP set for this to work. If successful, 0 will be returned.
466	*/
467	long keyctl_keyring_clear(key_serial_t ringid)
468	{
469	key_ref_t keyring_ref;
470	struct key *keyring;
471	long ret;
472
473	keyring_ref = lookup_user_key(id: ringid, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_WRITE);
474	if (IS_ERR(ptr: keyring_ref)) {
475	ret = PTR_ERR(ptr: keyring_ref);
476
477	/* Root is permitted to invalidate certain special keyrings */
478	if (capable(CAP_SYS_ADMIN)) {
479	keyring_ref = lookup_user_key(id: ringid, flags: 0,
480	need_perm: KEY_SYSADMIN_OVERRIDE);
481	if (IS_ERR(ptr: keyring_ref))
482	goto error;
483	if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR,
484	&key_ref_to_ptr(keyring_ref)->flags))
485	goto clear;
486	goto error_put;
487	}
488
489	goto error;
490	}
491
492	clear:
493	keyring = key_ref_to_ptr(key_ref: keyring_ref);
494	if (test_bit(KEY_FLAG_KEEP, &keyring->flags))
495	ret = -EPERM;
496	else
497	ret = keyring_clear(keyring);
498	error_put:
499	key_ref_put(key_ref: keyring_ref);
500	error:
501	return ret;
502	}
503
504	/*
505	* Create a link from a keyring to a key if there's no matching key in the
506	* keyring, otherwise replace the link to the matching key with a link to the
507	* new key.
508	*
509	* The key must grant the caller Link permission and the keyring must grant
510	* the caller Write permission. Furthermore, if an additional link is created,
511	* the keyring's quota will be extended.
512	*
513	* If successful, 0 will be returned.
514	*/
515	long keyctl_keyring_link(key_serial_t id, key_serial_t ringid)
516	{
517	key_ref_t keyring_ref, key_ref;
518	long ret;
519
520	keyring_ref = lookup_user_key(id: ringid, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_WRITE);
521	if (IS_ERR(ptr: keyring_ref)) {
522	ret = PTR_ERR(ptr: keyring_ref);
523	goto error;
524	}
525
526	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_LINK);
527	if (IS_ERR(ptr: key_ref)) {
528	ret = PTR_ERR(ptr: key_ref);
529	goto error2;
530	}
531
532	ret = key_link(keyring: key_ref_to_ptr(key_ref: keyring_ref), key: key_ref_to_ptr(key_ref));
533
534	key_ref_put(key_ref);
535	error2:
536	key_ref_put(key_ref: keyring_ref);
537	error:
538	return ret;
539	}
540
541	/*
542	* Unlink a key from a keyring.
543	*
544	* The keyring must grant the caller Write permission for this to work; the key
545	* itself need not grant the caller anything. If the last link to a key is
546	* removed then that key will be scheduled for destruction.
547	*
548	* Keys or keyrings with KEY_FLAG_KEEP set should not be unlinked.
549	*
550	* If successful, 0 will be returned.
551	*/
552	long keyctl_keyring_unlink(key_serial_t id, key_serial_t ringid)
553	{
554	key_ref_t keyring_ref, key_ref;
555	struct key *keyring, *key;
556	long ret;
557
558	keyring_ref = lookup_user_key(id: ringid, flags: 0, need_perm: KEY_NEED_WRITE);
559	if (IS_ERR(ptr: keyring_ref)) {
560	ret = PTR_ERR(ptr: keyring_ref);
561	goto error;
562	}
563
564	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_PARTIAL, need_perm: KEY_NEED_UNLINK);
565	if (IS_ERR(ptr: key_ref)) {
566	ret = PTR_ERR(ptr: key_ref);
567	goto error2;
568	}
569
570	keyring = key_ref_to_ptr(key_ref: keyring_ref);
571	key = key_ref_to_ptr(key_ref);
572	if (test_bit(KEY_FLAG_KEEP, &keyring->flags) &&
573	test_bit(KEY_FLAG_KEEP, &key->flags))
574	ret = -EPERM;
575	else
576	ret = key_unlink(keyring, key);
577
578	key_ref_put(key_ref);
579	error2:
580	key_ref_put(key_ref: keyring_ref);
581	error:
582	return ret;
583	}
584
585	/*
586	* Move a link to a key from one keyring to another, displacing any matching
587	* key from the destination keyring.
588	*
589	* The key must grant the caller Link permission and both keyrings must grant
590	* the caller Write permission. There must also be a link in the from keyring
591	* to the key. If both keyrings are the same, nothing is done.
592	*
593	* If successful, 0 will be returned.
594	*/
595	long keyctl_keyring_move(key_serial_t id, key_serial_t from_ringid,
596	key_serial_t to_ringid, unsigned int flags)
597	{
598	key_ref_t key_ref, from_ref, to_ref;
599	long ret;
600
601	if (flags & ~KEYCTL_MOVE_EXCL)
602	return -EINVAL;
603
604	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_LINK);
605	if (IS_ERR(ptr: key_ref))
606	return PTR_ERR(ptr: key_ref);
607
608	from_ref = lookup_user_key(id: from_ringid, flags: 0, need_perm: KEY_NEED_WRITE);
609	if (IS_ERR(ptr: from_ref)) {
610	ret = PTR_ERR(ptr: from_ref);
611	goto error2;
612	}
613
614	to_ref = lookup_user_key(id: to_ringid, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_WRITE);
615	if (IS_ERR(ptr: to_ref)) {
616	ret = PTR_ERR(ptr: to_ref);
617	goto error3;
618	}
619
620	ret = key_move(key: key_ref_to_ptr(key_ref), from_keyring: key_ref_to_ptr(key_ref: from_ref),
621	to_keyring: key_ref_to_ptr(key_ref: to_ref), flags);
622
623	key_ref_put(key_ref: to_ref);
624	error3:
625	key_ref_put(key_ref: from_ref);
626	error2:
627	key_ref_put(key_ref);
628	return ret;
629	}
630
631	/*
632	* Return a description of a key to userspace.
633	*
634	* The key must grant the caller View permission for this to work.
635	*
636	* If there's a buffer, we place up to buflen bytes of data into it formatted
637	* in the following way:
638	*
639	* type;uid;gid;perm;description<NUL>
640	*
641	* If successful, we return the amount of description available, irrespective
642	* of how much we may have copied into the buffer.
643	*/
644	long keyctl_describe_key(key_serial_t keyid,
645	char __user *buffer,
646	size_t buflen)
647	{
648	struct key *key, *instkey;
649	key_ref_t key_ref;
650	char *infobuf;
651	long ret;
652	int desclen, infolen;
653
654	key_ref = lookup_user_key(id: keyid, flags: KEY_LOOKUP_PARTIAL, need_perm: KEY_NEED_VIEW);
655	if (IS_ERR(ptr: key_ref)) {
656	/* viewing a key under construction is permitted if we have the
657	* authorisation token handy */
658	if (PTR_ERR(ptr: key_ref) == -EACCES) {
659	instkey = key_get_instantiation_authkey(target_id: keyid);
660	if (!IS_ERR(ptr: instkey)) {
661	key_put(key: instkey);
662	key_ref = lookup_user_key(id: keyid,
663	flags: KEY_LOOKUP_PARTIAL,
664	need_perm: KEY_AUTHTOKEN_OVERRIDE);
665	if (!IS_ERR(ptr: key_ref))
666	goto okay;
667	}
668	}
669
670	ret = PTR_ERR(ptr: key_ref);
671	goto error;
672	}
673
674	okay:
675	key = key_ref_to_ptr(key_ref);
676	desclen = strlen(key->description);
677
678	/* calculate how much information we're going to return */
679	ret = -ENOMEM;
680	infobuf = kasprintf(GFP_KERNEL,
681	fmt: "%s;%d;%d;%08x;",
682	key->type->name,
683	from_kuid_munged(current_user_ns(), uid: key->uid),
684	from_kgid_munged(current_user_ns(), gid: key->gid),
685	key->perm);
686	if (!infobuf)
687	goto error2;
688	infolen = strlen(infobuf);
689	ret = infolen + desclen + 1;
690
691	/* consider returning the data */
692	if (buffer && buflen >= ret) {
693	if (copy_to_user(to: buffer, from: infobuf, n: infolen) != 0 ||
694	copy_to_user(to: buffer + infolen, from: key->description,
695	n: desclen + 1) != 0)
696	ret = -EFAULT;
697	}
698
699	kfree(objp: infobuf);
700	error2:
701	key_ref_put(key_ref);
702	error:
703	return ret;
704	}
705
706	/*
707	* Search the specified keyring and any keyrings it links to for a matching
708	* key. Only keyrings that grant the caller Search permission will be searched
709	* (this includes the starting keyring). Only keys with Search permission can
710	* be found.
711	*
712	* If successful, the found key will be linked to the destination keyring if
713	* supplied and the key has Link permission, and the found key ID will be
714	* returned.
715	*/
716	long keyctl_keyring_search(key_serial_t ringid,
717	const char __user *_type,
718	const char __user *_description,
719	key_serial_t destringid)
720	{
721	struct key_type *ktype;
722	key_ref_t keyring_ref, key_ref, dest_ref;
723	char type[32], *description;
724	long ret;
725
726	/* pull the type and description into kernel space */
727	ret = key_get_type_from_user(type, _type, len: sizeof(type));
728	if (ret < 0)
729	goto error;
730
731	description = strndup_user(_description, KEY_MAX_DESC_SIZE);
732	if (IS_ERR(ptr: description)) {
733	ret = PTR_ERR(ptr: description);
734	goto error;
735	}
736
737	/* get the keyring at which to begin the search */
738	keyring_ref = lookup_user_key(id: ringid, flags: 0, need_perm: KEY_NEED_SEARCH);
739	if (IS_ERR(ptr: keyring_ref)) {
740	ret = PTR_ERR(ptr: keyring_ref);
741	goto error2;
742	}
743
744	/* get the destination keyring if specified */
745	dest_ref = NULL;
746	if (destringid) {
747	dest_ref = lookup_user_key(id: destringid, flags: KEY_LOOKUP_CREATE,
748	need_perm: KEY_NEED_WRITE);
749	if (IS_ERR(ptr: dest_ref)) {
750	ret = PTR_ERR(ptr: dest_ref);
751	goto error3;
752	}
753	}
754
755	/* find the key type */
756	ktype = key_type_lookup(type);
757	if (IS_ERR(ptr: ktype)) {
758	ret = PTR_ERR(ptr: ktype);
759	goto error4;
760	}
761
762	/* do the search */
763	key_ref = keyring_search(keyring: keyring_ref, type: ktype, description, recurse: true);
764	if (IS_ERR(ptr: key_ref)) {
765	ret = PTR_ERR(ptr: key_ref);
766
767	/* treat lack or presence of a negative key the same */
768	if (ret == -EAGAIN)
769	ret = -ENOKEY;
770	goto error5;
771	}
772
773	/* link the resulting key to the destination keyring if we can */
774	if (dest_ref) {
775	ret = key_permission(key_ref, need_perm: KEY_NEED_LINK);
776	if (ret < 0)
777	goto error6;
778
779	ret = key_link(keyring: key_ref_to_ptr(key_ref: dest_ref), key: key_ref_to_ptr(key_ref));
780	if (ret < 0)
781	goto error6;
782	}
783
784	ret = key_ref_to_ptr(key_ref)->serial;
785
786	error6:
787	key_ref_put(key_ref);
788	error5:
789	key_type_put(ktype);
790	error4:
791	key_ref_put(key_ref: dest_ref);
792	error3:
793	key_ref_put(key_ref: keyring_ref);
794	error2:
795	kfree(objp: description);
796	error:
797	return ret;
798	}
799
800	/*
801	* Call the read method
802	*/
803	static long __keyctl_read_key(struct key *key, char *buffer, size_t buflen)
804	{
805	long ret;
806
807	down_read(sem: &key->sem);
808	ret = key_validate(key);
809	if (ret == 0)
810	ret = key->type->read(key, buffer, buflen);
811	up_read(sem: &key->sem);
812	return ret;
813	}
814
815	/*
816	* Read a key's payload.
817	*
818	* The key must either grant the caller Read permission, or it must grant the
819	* caller Search permission when searched for from the process keyrings.
820	*
821	* If successful, we place up to buflen bytes of data into the buffer, if one
822	* is provided, and return the amount of data that is available in the key,
823	* irrespective of how much we copied into the buffer.
824	*/
825	long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
826	{
827	struct key *key;
828	key_ref_t key_ref;
829	long ret;
830	char *key_data = NULL;
831	size_t key_data_len;
832
833	/* find the key first */
834	key_ref = lookup_user_key(id: keyid, flags: 0, need_perm: KEY_DEFER_PERM_CHECK);
835	if (IS_ERR(ptr: key_ref)) {
836	ret = -ENOKEY;
837	goto out;
838	}
839
840	key = key_ref_to_ptr(key_ref);
841
842	ret = key_read_state(key);
843	if (ret < 0)
844	goto key_put_out; /* Negatively instantiated */
845
846	/* see if we can read it directly */
847	ret = key_permission(key_ref, need_perm: KEY_NEED_READ);
848	if (ret == 0)
849	goto can_read_key;
850	if (ret != -EACCES)
851	goto key_put_out;
852
853	/* we can't; see if it's searchable from this process's keyrings
854	* - we automatically take account of the fact that it may be
855	* dangling off an instantiation key
856	*/
857	if (!is_key_possessed(key_ref)) {
858	ret = -EACCES;
859	goto key_put_out;
860	}
861
862	/* the key is probably readable - now try to read it */
863	can_read_key:
864	if (!key->type->read) {
865	ret = -EOPNOTSUPP;
866	goto key_put_out;
867	}
868
869	if (!buffer || !buflen) {
870	/* Get the key length from the read method */
871	ret = __keyctl_read_key(key, NULL, buflen: 0);
872	goto key_put_out;
873	}
874
875	/*
876	* Read the data with the semaphore held (since we might sleep)
877	* to protect against the key being updated or revoked.
878	*
879	* Allocating a temporary buffer to hold the keys before
880	* transferring them to user buffer to avoid potential
881	* deadlock involving page fault and mmap_lock.
882	*
883	* key_data_len = (buflen <= PAGE_SIZE)
884	* ? buflen : actual length of key data
885	*
886	* This prevents allocating arbitrary large buffer which can
887	* be much larger than the actual key length. In the latter case,
888	* at least 2 passes of this loop is required.
889	*/
890	key_data_len = (buflen <= PAGE_SIZE) ? buflen : 0;
891	for (;;) {
892	if (key_data_len) {
893	key_data = kvmalloc(size: key_data_len, GFP_KERNEL);
894	if (!key_data) {
895	ret = -ENOMEM;
896	goto key_put_out;
897	}
898	}
899
900	ret = __keyctl_read_key(key, buffer: key_data, buflen: key_data_len);
901
902	/*
903	* Read methods will just return the required length without
904	* any copying if the provided length isn't large enough.
905	*/
906	if (ret <= 0 || ret > buflen)
907	break;
908
909	/*
910	* The key may change (unlikely) in between 2 consecutive
911	* __keyctl_read_key() calls. In this case, we reallocate
912	* a larger buffer and redo the key read when
913	* key_data_len < ret <= buflen.
914	*/
915	if (ret > key_data_len) {
916	if (unlikely(key_data))
917	kvfree_sensitive(addr: key_data, len: key_data_len);
918	key_data_len = ret;
919	continue; /* Allocate buffer */
920	}
921
922	if (copy_to_user(to: buffer, from: key_data, n: ret))
923	ret = -EFAULT;
924	break;
925	}
926	kvfree_sensitive(addr: key_data, len: key_data_len);
927
928	key_put_out:
929	key_put(key);
930	out:
931	return ret;
932	}
933
934	/*
935	* Change the ownership of a key
936	*
937	* The key must grant the caller Setattr permission for this to work, though
938	* the key need not be fully instantiated yet. For the UID to be changed, or
939	* for the GID to be changed to a group the caller is not a member of, the
940	* caller must have sysadmin capability. If either uid or gid is -1 then that
941	* attribute is not changed.
942	*
943	* If the UID is to be changed, the new user must have sufficient quota to
944	* accept the key. The quota deduction will be removed from the old user to
945	* the new user should the attribute be changed.
946	*
947	* If successful, 0 will be returned.
948	*/
949	long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
950	{
951	struct key_user *newowner, *zapowner = NULL;
952	struct key *key;
953	key_ref_t key_ref;
954	long ret;
955	kuid_t uid;
956	kgid_t gid;
957
958	uid = make_kuid(current_user_ns(), uid: user);
959	gid = make_kgid(current_user_ns(), gid: group);
960	ret = -EINVAL;
961	if ((user != (uid_t) -1) && !uid_valid(uid))
962	goto error;
963	if ((group != (gid_t) -1) && !gid_valid(gid))
964	goto error;
965
966	ret = 0;
967	if (user == (uid_t) -1 && group == (gid_t) -1)
968	goto error;
969
970	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
971	need_perm: KEY_NEED_SETATTR);
972	if (IS_ERR(ptr: key_ref)) {
973	ret = PTR_ERR(ptr: key_ref);
974	goto error;
975	}
976
977	key = key_ref_to_ptr(key_ref);
978
979	/* make the changes with the locks held to prevent chown/chown races */
980	ret = -EACCES;
981	down_write(sem: &key->sem);
982
983	{
984	bool is_privileged_op = false;
985
986	/* only the sysadmin can chown a key to some other UID */
987	if (user != (uid_t) -1 && !uid_eq(left: key->uid, right: uid))
988	is_privileged_op = true;
989
990	/* only the sysadmin can set the key's GID to a group other
991	* than one of those that the current process subscribes to */
992	if (group != (gid_t) -1 && !gid_eq(left: gid, right: key->gid) && !in_group_p(gid))
993	is_privileged_op = true;
994
995	if (is_privileged_op && !capable(CAP_SYS_ADMIN))
996	goto error_put;
997	}
998
999	/* change the UID */
1000	if (user != (uid_t) -1 && !uid_eq(left: uid, right: key->uid)) {
1001	ret = -ENOMEM;
1002	newowner = key_user_lookup(uid);
1003	if (!newowner)
1004	goto error_put;
1005
1006	/* transfer the quota burden to the new user */
1007	if (test_bit(KEY_FLAG_IN_QUOTA, &key->flags)) {
1008	unsigned maxkeys = uid_eq(left: uid, GLOBAL_ROOT_UID) ?
1009	key_quota_root_maxkeys : key_quota_maxkeys;
1010	unsigned maxbytes = uid_eq(left: uid, GLOBAL_ROOT_UID) ?
1011	key_quota_root_maxbytes : key_quota_maxbytes;
1012
1013	spin_lock(lock: &newowner->lock);
1014	if (newowner->qnkeys + 1 > maxkeys ||
1015	newowner->qnbytes + key->quotalen > maxbytes ||
1016	newowner->qnbytes + key->quotalen <
1017	newowner->qnbytes)
1018	goto quota_overrun;
1019
1020	newowner->qnkeys++;
1021	newowner->qnbytes += key->quotalen;
1022	spin_unlock(lock: &newowner->lock);
1023
1024	spin_lock(lock: &key->user->lock);
1025	key->user->qnkeys--;
1026	key->user->qnbytes -= key->quotalen;
1027	spin_unlock(lock: &key->user->lock);
1028	}
1029
1030	atomic_dec(v: &key->user->nkeys);
1031	atomic_inc(v: &newowner->nkeys);
1032
1033	if (key->state != KEY_IS_UNINSTANTIATED) {
1034	atomic_dec(v: &key->user->nikeys);
1035	atomic_inc(v: &newowner->nikeys);
1036	}
1037
1038	zapowner = key->user;
1039	key->user = newowner;
1040	key->uid = uid;
1041	}
1042
1043	/* change the GID */
1044	if (group != (gid_t) -1)
1045	key->gid = gid;
1046
1047	notify_key(key, subtype: NOTIFY_KEY_SETATTR, aux: 0);
1048	ret = 0;
1049
1050	error_put:
1051	up_write(sem: &key->sem);
1052	key_put(key);
1053	if (zapowner)
1054	key_user_put(user: zapowner);
1055	error:
1056	return ret;
1057
1058	quota_overrun:
1059	spin_unlock(lock: &newowner->lock);
1060	zapowner = newowner;
1061	ret = -EDQUOT;
1062	goto error_put;
1063	}
1064
1065	/*
1066	* Change the permission mask on a key.
1067	*
1068	* The key must grant the caller Setattr permission for this to work, though
1069	* the key need not be fully instantiated yet. If the caller does not have
1070	* sysadmin capability, it may only change the permission on keys that it owns.
1071	*/
1072	long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
1073	{
1074	struct key *key;
1075	key_ref_t key_ref;
1076	long ret;
1077
1078	ret = -EINVAL;
1079	if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
1080	goto error;
1081
1082	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
1083	need_perm: KEY_NEED_SETATTR);
1084	if (IS_ERR(ptr: key_ref)) {
1085	ret = PTR_ERR(ptr: key_ref);
1086	goto error;
1087	}
1088
1089	key = key_ref_to_ptr(key_ref);
1090
1091	/* make the changes with the locks held to prevent chown/chmod races */
1092	ret = -EACCES;
1093	down_write(sem: &key->sem);
1094
1095	/* if we're not the sysadmin, we can only change a key that we own */
1096	if (uid_eq(left: key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) {
1097	key->perm = perm;
1098	notify_key(key, subtype: NOTIFY_KEY_SETATTR, aux: 0);
1099	ret = 0;
1100	}
1101
1102	up_write(sem: &key->sem);
1103	key_put(key);
1104	error:
1105	return ret;
1106	}
1107
1108	/*
1109	* Get the destination keyring for instantiation and check that the caller has
1110	* Write permission on it.
1111	*/
1112	static long get_instantiation_keyring(key_serial_t ringid,
1113	struct request_key_auth *rka,
1114	struct key **_dest_keyring)
1115	{
1116	key_ref_t dkref;
1117
1118	*_dest_keyring = NULL;
1119
1120	/* just return a NULL pointer if we weren't asked to make a link */
1121	if (ringid == 0)
1122	return 0;
1123
1124	/* if a specific keyring is nominated by ID, then use that */
1125	if (ringid > 0) {
1126	dkref = lookup_user_key(id: ringid, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_WRITE);
1127	if (IS_ERR(ptr: dkref))
1128	return PTR_ERR(ptr: dkref);
1129	*_dest_keyring = key_ref_to_ptr(key_ref: dkref);
1130	return 0;
1131	}
1132
1133	if (ringid == KEY_SPEC_REQKEY_AUTH_KEY)
1134	return -EINVAL;
1135
1136	/* otherwise specify the destination keyring recorded in the
1137	* authorisation key (any KEY_SPEC_*_KEYRING) */
1138	if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
1139	*_dest_keyring = key_get(key: rka->dest_keyring);
1140	return 0;
1141	}
1142
1143	return -ENOKEY;
1144	}
1145
1146	/*
1147	* Change the request_key authorisation key on the current process.
1148	*/
1149	static int keyctl_change_reqkey_auth(struct key *key)
1150	{
1151	struct cred *new;
1152
1153	new = prepare_creds();
1154	if (!new)
1155	return -ENOMEM;
1156
1157	key_put(key: new->request_key_auth);
1158	new->request_key_auth = key_get(key);
1159
1160	return commit_creds(new);
1161	}
1162
1163	/*
1164	* Instantiate a key with the specified payload and link the key into the
1165	* destination keyring if one is given.
1166	*
1167	* The caller must have the appropriate instantiation permit set for this to
1168	* work (see keyctl_assume_authority). No other permissions are required.
1169	*
1170	* If successful, 0 will be returned.
1171	*/
1172	static long keyctl_instantiate_key_common(key_serial_t id,
1173	struct iov_iter *from,
1174	key_serial_t ringid)
1175	{
1176	const struct cred *cred = current_cred();
1177	struct request_key_auth *rka;
1178	struct key *instkey, *dest_keyring;
1179	size_t plen = from ? iov_iter_count(i: from) : 0;
1180	void *payload;
1181	long ret;
1182
1183	kenter("%d,,%zu,%d", id, plen, ringid);
1184
1185	if (!plen)
1186	from = NULL;
1187
1188	ret = -EINVAL;
1189	if (plen > 1024 * 1024 - 1)
1190	goto error;
1191
1192	/* the appropriate instantiation authorisation key must have been
1193	* assumed before calling this */
1194	ret = -EPERM;
1195	instkey = cred->request_key_auth;
1196	if (!instkey)
1197	goto error;
1198
1199	rka = instkey->payload.data[0];
1200	if (rka->target_key->serial != id)
1201	goto error;
1202
1203	/* pull the payload in if one was supplied */
1204	payload = NULL;
1205
1206	if (from) {
1207	ret = -ENOMEM;
1208	payload = kvmalloc(size: plen, GFP_KERNEL);
1209	if (!payload)
1210	goto error;
1211
1212	ret = -EFAULT;
1213	if (!copy_from_iter_full(addr: payload, bytes: plen, i: from))
1214	goto error2;
1215	}
1216
1217	/* find the destination keyring amongst those belonging to the
1218	* requesting task */
1219	ret = get_instantiation_keyring(ringid, rka, dest_keyring: &dest_keyring);
1220	if (ret < 0)
1221	goto error2;
1222
1223	/* instantiate the key and link it into a keyring */
1224	ret = key_instantiate_and_link(key: rka->target_key, data: payload, datalen: plen,
1225	keyring: dest_keyring, authkey: instkey);
1226
1227	key_put(key: dest_keyring);
1228
1229	/* discard the assumed authority if it's just been disabled by
1230	* instantiation of the key */
1231	if (ret == 0)
1232	keyctl_change_reqkey_auth(NULL);
1233
1234	error2:
1235	kvfree_sensitive(addr: payload, len: plen);
1236	error:
1237	return ret;
1238	}
1239
1240	/*
1241	* Instantiate a key with the specified payload and link the key into the
1242	* destination keyring if one is given.
1243	*
1244	* The caller must have the appropriate instantiation permit set for this to
1245	* work (see keyctl_assume_authority). No other permissions are required.
1246	*
1247	* If successful, 0 will be returned.
1248	*/
1249	long keyctl_instantiate_key(key_serial_t id,
1250	const void __user *_payload,
1251	size_t plen,
1252	key_serial_t ringid)
1253	{
1254	if (_payload && plen) {
1255	struct iovec iov;
1256	struct iov_iter from;
1257	int ret;
1258
1259	ret = import_single_range(ITER_SOURCE, buf: (void __user *)_payload, len: plen,
1260	iov: &iov, i: &from);
1261	if (unlikely(ret))
1262	return ret;
1263
1264	return keyctl_instantiate_key_common(id, from: &from, ringid);
1265	}
1266
1267	return keyctl_instantiate_key_common(id, NULL, ringid);
1268	}
1269
1270	/*
1271	* Instantiate a key with the specified multipart payload and link the key into
1272	* the destination keyring if one is given.
1273	*
1274	* The caller must have the appropriate instantiation permit set for this to
1275	* work (see keyctl_assume_authority). No other permissions are required.
1276	*
1277	* If successful, 0 will be returned.
1278	*/
1279	long keyctl_instantiate_key_iov(key_serial_t id,
1280	const struct iovec __user *_payload_iov,
1281	unsigned ioc,
1282	key_serial_t ringid)
1283	{
1284	struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
1285	struct iov_iter from;
1286	long ret;
1287
1288	if (!_payload_iov)
1289	ioc = 0;
1290
1291	ret = import_iovec(ITER_SOURCE, uvec: _payload_iov, nr_segs: ioc,
1292	ARRAY_SIZE(iovstack), iovp: &iov, i: &from);
1293	if (ret < 0)
1294	return ret;
1295	ret = keyctl_instantiate_key_common(id, from: &from, ringid);
1296	kfree(objp: iov);
1297	return ret;
1298	}
1299
1300	/*
1301	* Negatively instantiate the key with the given timeout (in seconds) and link
1302	* the key into the destination keyring if one is given.
1303	*
1304	* The caller must have the appropriate instantiation permit set for this to
1305	* work (see keyctl_assume_authority). No other permissions are required.
1306	*
1307	* The key and any links to the key will be automatically garbage collected
1308	* after the timeout expires.
1309	*
1310	* Negative keys are used to rate limit repeated request_key() calls by causing
1311	* them to return -ENOKEY until the negative key expires.
1312	*
1313	* If successful, 0 will be returned.
1314	*/
1315	long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
1316	{
1317	return keyctl_reject_key(id, timeout, ENOKEY, ringid);
1318	}
1319
1320	/*
1321	* Negatively instantiate the key with the given timeout (in seconds) and error
1322	* code and link the key into the destination keyring if one is given.
1323	*
1324	* The caller must have the appropriate instantiation permit set for this to
1325	* work (see keyctl_assume_authority). No other permissions are required.
1326	*
1327	* The key and any links to the key will be automatically garbage collected
1328	* after the timeout expires.
1329	*
1330	* Negative keys are used to rate limit repeated request_key() calls by causing
1331	* them to return the specified error code until the negative key expires.
1332	*
1333	* If successful, 0 will be returned.
1334	*/
1335	long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,
1336	key_serial_t ringid)
1337	{
1338	const struct cred *cred = current_cred();
1339	struct request_key_auth *rka;
1340	struct key *instkey, *dest_keyring;
1341	long ret;
1342
1343	kenter("%d,%u,%u,%d", id, timeout, error, ringid);
1344
1345	/* must be a valid error code and mustn't be a kernel special */
1346	if (error <= 0 ||
1347	error >= MAX_ERRNO ||
1348	error == ERESTARTSYS ||
1349	error == ERESTARTNOINTR ||
1350	error == ERESTARTNOHAND ||
1351	error == ERESTART_RESTARTBLOCK)
1352	return -EINVAL;
1353
1354	/* the appropriate instantiation authorisation key must have been
1355	* assumed before calling this */
1356	ret = -EPERM;
1357	instkey = cred->request_key_auth;
1358	if (!instkey)
1359	goto error;
1360
1361	rka = instkey->payload.data[0];
1362	if (rka->target_key->serial != id)
1363	goto error;
1364
1365	/* find the destination keyring if present (which must also be
1366	* writable) */
1367	ret = get_instantiation_keyring(ringid, rka, dest_keyring: &dest_keyring);
1368	if (ret < 0)
1369	goto error;
1370
1371	/* instantiate the key and link it into a keyring */
1372	ret = key_reject_and_link(key: rka->target_key, timeout, error,
1373	keyring: dest_keyring, authkey: instkey);
1374
1375	key_put(key: dest_keyring);
1376
1377	/* discard the assumed authority if it's just been disabled by
1378	* instantiation of the key */
1379	if (ret == 0)
1380	keyctl_change_reqkey_auth(NULL);
1381
1382	error:
1383	return ret;
1384	}
1385
1386	/*
1387	* Read or set the default keyring in which request_key() will cache keys and
1388	* return the old setting.
1389	*
1390	* If a thread or process keyring is specified then it will be created if it
1391	* doesn't yet exist. The old setting will be returned if successful.
1392	*/
1393	long keyctl_set_reqkey_keyring(int reqkey_defl)
1394	{
1395	struct cred *new;
1396	int ret, old_setting;
1397
1398	old_setting = current_cred_xxx(jit_keyring);
1399
1400	if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
1401	return old_setting;
1402
1403	new = prepare_creds();
1404	if (!new)
1405	return -ENOMEM;
1406
1407	switch (reqkey_defl) {
1408	case KEY_REQKEY_DEFL_THREAD_KEYRING:
1409	ret = install_thread_keyring_to_cred(new);
1410	if (ret < 0)
1411	goto error;
1412	goto set;
1413
1414	case KEY_REQKEY_DEFL_PROCESS_KEYRING:
1415	ret = install_process_keyring_to_cred(new);
1416	if (ret < 0)
1417	goto error;
1418	goto set;
1419
1420	case KEY_REQKEY_DEFL_DEFAULT:
1421	case KEY_REQKEY_DEFL_SESSION_KEYRING:
1422	case KEY_REQKEY_DEFL_USER_KEYRING:
1423	case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
1424	case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
1425	goto set;
1426
1427	case KEY_REQKEY_DEFL_NO_CHANGE:
1428	case KEY_REQKEY_DEFL_GROUP_KEYRING:
1429	default:
1430	ret = -EINVAL;
1431	goto error;
1432	}
1433
1434	set:
1435	new->jit_keyring = reqkey_defl;
1436	commit_creds(new);
1437	return old_setting;
1438	error:
1439	abort_creds(new);
1440	return ret;
1441	}
1442
1443	/*
1444	* Set or clear the timeout on a key.
1445	*
1446	* Either the key must grant the caller Setattr permission or else the caller
1447	* must hold an instantiation authorisation token for the key.
1448	*
1449	* The timeout is either 0 to clear the timeout, or a number of seconds from
1450	* the current time. The key and any links to the key will be automatically
1451	* garbage collected after the timeout expires.
1452	*
1453	* Keys with KEY_FLAG_KEEP set should not be timed out.
1454	*
1455	* If successful, 0 is returned.
1456	*/
1457	long keyctl_set_timeout(key_serial_t id, unsigned timeout)
1458	{
1459	struct key *key, *instkey;
1460	key_ref_t key_ref;
1461	long ret;
1462
1463	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
1464	need_perm: KEY_NEED_SETATTR);
1465	if (IS_ERR(ptr: key_ref)) {
1466	/* setting the timeout on a key under construction is permitted
1467	* if we have the authorisation token handy */
1468	if (PTR_ERR(ptr: key_ref) == -EACCES) {
1469	instkey = key_get_instantiation_authkey(target_id: id);
1470	if (!IS_ERR(ptr: instkey)) {
1471	key_put(key: instkey);
1472	key_ref = lookup_user_key(id,
1473	flags: KEY_LOOKUP_PARTIAL,
1474	need_perm: KEY_AUTHTOKEN_OVERRIDE);
1475	if (!IS_ERR(ptr: key_ref))
1476	goto okay;
1477	}
1478	}
1479
1480	ret = PTR_ERR(ptr: key_ref);
1481	goto error;
1482	}
1483
1484	okay:
1485	key = key_ref_to_ptr(key_ref);
1486	ret = 0;
1487	if (test_bit(KEY_FLAG_KEEP, &key->flags)) {
1488	ret = -EPERM;
1489	} else {
1490	key_set_timeout(key, timeout);
1491	notify_key(key, subtype: NOTIFY_KEY_SETATTR, aux: 0);
1492	}
1493	key_put(key);
1494
1495	error:
1496	return ret;
1497	}
1498
1499	/*
1500	* Assume (or clear) the authority to instantiate the specified key.
1501	*
1502	* This sets the authoritative token currently in force for key instantiation.
1503	* This must be done for a key to be instantiated. It has the effect of making
1504	* available all the keys from the caller of the request_key() that created a
1505	* key to request_key() calls made by the caller of this function.
1506	*
1507	* The caller must have the instantiation key in their process keyrings with a
1508	* Search permission grant available to the caller.
1509	*
1510	* If the ID given is 0, then the setting will be cleared and 0 returned.
1511	*
1512	* If the ID given has a matching an authorisation key, then that key will be
1513	* set and its ID will be returned. The authorisation key can be read to get
1514	* the callout information passed to request_key().
1515	*/
1516	long keyctl_assume_authority(key_serial_t id)
1517	{
1518	struct key *authkey;
1519	long ret;
1520
1521	/* special key IDs aren't permitted */
1522	ret = -EINVAL;
1523	if (id < 0)
1524	goto error;
1525
1526	/* we divest ourselves of authority if given an ID of 0 */
1527	if (id == 0) {
1528	ret = keyctl_change_reqkey_auth(NULL);
1529	goto error;
1530	}
1531
1532	/* attempt to assume the authority temporarily granted to us whilst we
1533	* instantiate the specified key
1534	* - the authorisation key must be in the current task's keyrings
1535	* somewhere
1536	*/
1537	authkey = key_get_instantiation_authkey(target_id: id);
1538	if (IS_ERR(ptr: authkey)) {
1539	ret = PTR_ERR(ptr: authkey);
1540	goto error;
1541	}
1542
1543	ret = keyctl_change_reqkey_auth(key: authkey);
1544	if (ret == 0)
1545	ret = authkey->serial;
1546	key_put(key: authkey);
1547	error:
1548	return ret;
1549	}
1550
1551	/*
1552	* Get a key's the LSM security label.
1553	*
1554	* The key must grant the caller View permission for this to work.
1555	*
1556	* If there's a buffer, then up to buflen bytes of data will be placed into it.
1557	*
1558	* If successful, the amount of information available will be returned,
1559	* irrespective of how much was copied (including the terminal NUL).
1560	*/
1561	long keyctl_get_security(key_serial_t keyid,
1562	char __user *buffer,
1563	size_t buflen)
1564	{
1565	struct key *key, *instkey;
1566	key_ref_t key_ref;
1567	char *context;
1568	long ret;
1569
1570	key_ref = lookup_user_key(id: keyid, flags: KEY_LOOKUP_PARTIAL, need_perm: KEY_NEED_VIEW);
1571	if (IS_ERR(ptr: key_ref)) {
1572	if (PTR_ERR(ptr: key_ref) != -EACCES)
1573	return PTR_ERR(ptr: key_ref);
1574
1575	/* viewing a key under construction is also permitted if we
1576	* have the authorisation token handy */
1577	instkey = key_get_instantiation_authkey(target_id: keyid);
1578	if (IS_ERR(ptr: instkey))
1579	return PTR_ERR(ptr: instkey);
1580	key_put(key: instkey);
1581
1582	key_ref = lookup_user_key(id: keyid, flags: KEY_LOOKUP_PARTIAL,
1583	need_perm: KEY_AUTHTOKEN_OVERRIDE);
1584	if (IS_ERR(ptr: key_ref))
1585	return PTR_ERR(ptr: key_ref);
1586	}
1587
1588	key = key_ref_to_ptr(key_ref);
1589	ret = security_key_getsecurity(key, buffer: &context);
1590	if (ret == 0) {
1591	/* if no information was returned, give userspace an empty
1592	* string */
1593	ret = 1;
1594	if (buffer && buflen > 0 &&
1595	copy_to_user(to: buffer, from: "", n: 1) != 0)
1596	ret = -EFAULT;
1597	} else if (ret > 0) {
1598	/* return as much data as there's room for */
1599	if (buffer && buflen > 0) {
1600	if (buflen > ret)
1601	buflen = ret;
1602
1603	if (copy_to_user(to: buffer, from: context, n: buflen) != 0)
1604	ret = -EFAULT;
1605	}
1606
1607	kfree(objp: context);
1608	}
1609
1610	key_ref_put(key_ref);
1611	return ret;
1612	}
1613
1614	/*
1615	* Attempt to install the calling process's session keyring on the process's
1616	* parent process.
1617	*
1618	* The keyring must exist and must grant the caller LINK permission, and the
1619	* parent process must be single-threaded and must have the same effective
1620	* ownership as this process and mustn't be SUID/SGID.
1621	*
1622	* The keyring will be emplaced on the parent when it next resumes userspace.
1623	*
1624	* If successful, 0 will be returned.
1625	*/
1626	long keyctl_session_to_parent(void)
1627	{
1628	struct task_struct *me, *parent;
1629	const struct cred *mycred, *pcred;
1630	struct callback_head *newwork, *oldwork;
1631	key_ref_t keyring_r;
1632	struct cred *cred;
1633	int ret;
1634
1635	keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, flags: 0, need_perm: KEY_NEED_LINK);
1636	if (IS_ERR(ptr: keyring_r))
1637	return PTR_ERR(ptr: keyring_r);
1638
1639	ret = -ENOMEM;
1640
1641	/* our parent is going to need a new cred struct, a new tgcred struct
1642	* and new security data, so we allocate them here to prevent ENOMEM in
1643	* our parent */
1644	cred = cred_alloc_blank();
1645	if (!cred)
1646	goto error_keyring;
1647	newwork = &cred->rcu;
1648
1649	cred->session_keyring = key_ref_to_ptr(key_ref: keyring_r);
1650	keyring_r = NULL;
1651	init_task_work(twork: newwork, func: key_change_session_keyring);
1652
1653	me = current;
1654	rcu_read_lock();
1655	write_lock_irq(&tasklist_lock);
1656
1657	ret = -EPERM;
1658	oldwork = NULL;
1659	parent = rcu_dereference_protected(me->real_parent,
1660	lockdep_is_held(&tasklist_lock));
1661
1662	/* the parent mustn't be init and mustn't be a kernel thread */
1663	if (parent->pid <= 1 || !parent->mm)
1664	goto unlock;
1665
1666	/* the parent must be single threaded */
1667	if (!thread_group_empty(p: parent))
1668	goto unlock;
1669
1670	/* the parent and the child must have different session keyrings or
1671	* there's no point */
1672	mycred = current_cred();
1673	pcred = __task_cred(parent);
1674	if (mycred == pcred ||
1675	mycred->session_keyring == pcred->session_keyring) {
1676	ret = 0;
1677	goto unlock;
1678	}
1679
1680	/* the parent must have the same effective ownership and mustn't be
1681	* SUID/SGID */
1682	if (!uid_eq(left: pcred->uid, right: mycred->euid) ||
1683	!uid_eq(left: pcred->euid, right: mycred->euid) ||
1684	!uid_eq(left: pcred->suid, right: mycred->euid) ||
1685	!gid_eq(left: pcred->gid, right: mycred->egid) ||
1686	!gid_eq(left: pcred->egid, right: mycred->egid) ||
1687	!gid_eq(left: pcred->sgid, right: mycred->egid))
1688	goto unlock;
1689
1690	/* the keyrings must have the same UID */
1691	if ((pcred->session_keyring &&
1692	!uid_eq(left: pcred->session_keyring->uid, right: mycred->euid)) ||
1693	!uid_eq(left: mycred->session_keyring->uid, right: mycred->euid))
1694	goto unlock;
1695
1696	/* cancel an already pending keyring replacement */
1697	oldwork = task_work_cancel(parent, key_change_session_keyring);
1698
1699	/* the replacement session keyring is applied just prior to userspace
1700	* restarting */
1701	ret = task_work_add(task: parent, twork: newwork, mode: TWA_RESUME);
1702	if (!ret)
1703	newwork = NULL;
1704	unlock:
1705	write_unlock_irq(&tasklist_lock);
1706	rcu_read_unlock();
1707	if (oldwork)
1708	put_cred(container_of(oldwork, struct cred, rcu));
1709	if (newwork)
1710	put_cred(cred);
1711	return ret;
1712
1713	error_keyring:
1714	key_ref_put(key_ref: keyring_r);
1715	return ret;
1716	}
1717
1718	/*
1719	* Apply a restriction to a given keyring.
1720	*
1721	* The caller must have Setattr permission to change keyring restrictions.
1722	*
1723	* The requested type name may be a NULL pointer to reject all attempts
1724	* to link to the keyring. In this case, _restriction must also be NULL.
1725	* Otherwise, both _type and _restriction must be non-NULL.
1726	*
1727	* Returns 0 if successful.
1728	*/
1729	long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
1730	const char __user *_restriction)
1731	{
1732	key_ref_t key_ref;
1733	char type[32];
1734	char *restriction = NULL;
1735	long ret;
1736
1737	key_ref = lookup_user_key(id, flags: 0, need_perm: KEY_NEED_SETATTR);
1738	if (IS_ERR(ptr: key_ref))
1739	return PTR_ERR(ptr: key_ref);
1740
1741	ret = -EINVAL;
1742	if (_type) {
1743	if (!_restriction)
1744	goto error;
1745
1746	ret = key_get_type_from_user(type, _type, len: sizeof(type));
1747	if (ret < 0)
1748	goto error;
1749
1750	restriction = strndup_user(_restriction, PAGE_SIZE);
1751	if (IS_ERR(ptr: restriction)) {
1752	ret = PTR_ERR(ptr: restriction);
1753	goto error;
1754	}
1755	} else {
1756	if (_restriction)
1757	goto error;
1758	}
1759
1760	ret = keyring_restrict(keyring: key_ref, type: _type ? type : NULL, restriction);
1761	kfree(objp: restriction);
1762	error:
1763	key_ref_put(key_ref);
1764	return ret;
1765	}
1766
1767	#ifdef CONFIG_KEY_NOTIFICATIONS
1768	/*
1769	* Watch for changes to a key.
1770	*
1771	* The caller must have View permission to watch a key or keyring.
1772	*/
1773	long keyctl_watch_key(key_serial_t id, int watch_queue_fd, int watch_id)
1774	{
1775	struct watch_queue *wqueue;
1776	struct watch_list *wlist = NULL;
1777	struct watch *watch = NULL;
1778	struct key *key;
1779	key_ref_t key_ref;
1780	long ret;
1781
1782	if (watch_id < -1 || watch_id > 0xff)
1783	return -EINVAL;
1784
1785	key_ref = lookup_user_key(id, flags: KEY_LOOKUP_CREATE, need_perm: KEY_NEED_VIEW);
1786	if (IS_ERR(ptr: key_ref))
1787	return PTR_ERR(ptr: key_ref);
1788	key = key_ref_to_ptr(key_ref);
1789
1790	wqueue = get_watch_queue(watch_queue_fd);
1791	if (IS_ERR(ptr: wqueue)) {
1792	ret = PTR_ERR(ptr: wqueue);
1793	goto err_key;
1794	}
1795
1796	if (watch_id >= 0) {
1797	ret = -ENOMEM;
1798	if (!key->watchers) {
1799	wlist = kzalloc(size: sizeof(*wlist), GFP_KERNEL);
1800	if (!wlist)
1801	goto err_wqueue;
1802	init_watch_list(wlist, NULL);
1803	}
1804
1805	watch = kzalloc(size: sizeof(*watch), GFP_KERNEL);
1806	if (!watch)
1807	goto err_wlist;
1808
1809	init_watch(watch, wqueue);
1810	watch->id = key->serial;
1811	watch->info_id = (u32)watch_id << WATCH_INFO_ID__SHIFT;
1812
1813	ret = security_watch_key(key);
1814	if (ret < 0)
1815	goto err_watch;
1816
1817	down_write(sem: &key->sem);
1818	if (!key->watchers) {
1819	key->watchers = wlist;
1820	wlist = NULL;
1821	}
1822
1823	ret = add_watch_to_object(watch, key->watchers);
1824	up_write(sem: &key->sem);
1825
1826	if (ret == 0)
1827	watch = NULL;
1828	} else {
1829	ret = -EBADSLT;
1830	if (key->watchers) {
1831	down_write(sem: &key->sem);
1832	ret = remove_watch_from_object(key->watchers,
1833	wqueue, key_serial(key),
1834	false);
1835	up_write(sem: &key->sem);
1836	}
1837	}
1838
1839	err_watch:
1840	kfree(objp: watch);
1841	err_wlist:
1842	kfree(objp: wlist);
1843	err_wqueue:
1844	put_watch_queue(wqueue);
1845	err_key:
1846	key_put(key);
1847	return ret;
1848	}
1849	#endif /* CONFIG_KEY_NOTIFICATIONS */
1850
1851	/*
1852	* Get keyrings subsystem capabilities.
1853	*/
1854	long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen)
1855	{
1856	size_t size = buflen;
1857
1858	if (size > 0) {
1859	if (size > sizeof(keyrings_capabilities))
1860	size = sizeof(keyrings_capabilities);
1861	if (copy_to_user(to: _buffer, from: keyrings_capabilities, n: size) != 0)
1862	return -EFAULT;
1863	if (size < buflen &&
1864	clear_user(to: _buffer + size, n: buflen - size) != 0)
1865	return -EFAULT;
1866	}
1867
1868	return sizeof(keyrings_capabilities);
1869	}
1870
1871	/*
1872	* The key control system call
1873	*/
1874	SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1875	unsigned long, arg4, unsigned long, arg5)
1876	{
1877	switch (option) {
1878	case KEYCTL_GET_KEYRING_ID:
1879	return keyctl_get_keyring_ID(id: (key_serial_t) arg2,
1880	create: (int) arg3);
1881
1882	case KEYCTL_JOIN_SESSION_KEYRING:
1883	return keyctl_join_session_keyring(name: (const char __user *) arg2);
1884
1885	case KEYCTL_UPDATE:
1886	return keyctl_update_key(id: (key_serial_t) arg2,
1887	payload: (const void __user *) arg3,
1888	plen: (size_t) arg4);
1889
1890	case KEYCTL_REVOKE:
1891	return keyctl_revoke_key(id: (key_serial_t) arg2);
1892
1893	case KEYCTL_DESCRIBE:
1894	return keyctl_describe_key(keyid: (key_serial_t) arg2,
1895	buffer: (char __user *) arg3,
1896	buflen: (unsigned) arg4);
1897
1898	case KEYCTL_CLEAR:
1899	return keyctl_keyring_clear(ringid: (key_serial_t) arg2);
1900
1901	case KEYCTL_LINK:
1902	return keyctl_keyring_link(id: (key_serial_t) arg2,
1903	ringid: (key_serial_t) arg3);
1904
1905	case KEYCTL_UNLINK:
1906	return keyctl_keyring_unlink(id: (key_serial_t) arg2,
1907	ringid: (key_serial_t) arg3);
1908
1909	case KEYCTL_SEARCH:
1910	return keyctl_keyring_search(ringid: (key_serial_t) arg2,
1911	type: (const char __user *) arg3,
1912	description: (const char __user *) arg4,
1913	destringid: (key_serial_t) arg5);
1914
1915	case KEYCTL_READ:
1916	return keyctl_read_key(keyid: (key_serial_t) arg2,
1917	buffer: (char __user *) arg3,
1918	buflen: (size_t) arg4);
1919
1920	case KEYCTL_CHOWN:
1921	return keyctl_chown_key(id: (key_serial_t) arg2,
1922	user: (uid_t) arg3,
1923	group: (gid_t) arg4);
1924
1925	case KEYCTL_SETPERM:
1926	return keyctl_setperm_key(id: (key_serial_t) arg2,
1927	perm: (key_perm_t) arg3);
1928
1929	case KEYCTL_INSTANTIATE:
1930	return keyctl_instantiate_key(id: (key_serial_t) arg2,
1931	payload: (const void __user *) arg3,
1932	plen: (size_t) arg4,
1933	ringid: (key_serial_t) arg5);
1934
1935	case KEYCTL_NEGATE:
1936	return keyctl_negate_key(id: (key_serial_t) arg2,
1937	timeout: (unsigned) arg3,
1938	ringid: (key_serial_t) arg4);
1939
1940	case KEYCTL_SET_REQKEY_KEYRING:
1941	return keyctl_set_reqkey_keyring(reqkey_defl: arg2);
1942
1943	case KEYCTL_SET_TIMEOUT:
1944	return keyctl_set_timeout(id: (key_serial_t) arg2,
1945	timeout: (unsigned) arg3);
1946
1947	case KEYCTL_ASSUME_AUTHORITY:
1948	return keyctl_assume_authority(id: (key_serial_t) arg2);
1949
1950	case KEYCTL_GET_SECURITY:
1951	return keyctl_get_security(keyid: (key_serial_t) arg2,
1952	buffer: (char __user *) arg3,
1953	buflen: (size_t) arg4);
1954
1955	case KEYCTL_SESSION_TO_PARENT:
1956	return keyctl_session_to_parent();
1957
1958	case KEYCTL_REJECT:
1959	return keyctl_reject_key(id: (key_serial_t) arg2,
1960	timeout: (unsigned) arg3,
1961	error: (unsigned) arg4,
1962	ringid: (key_serial_t) arg5);
1963
1964	case KEYCTL_INSTANTIATE_IOV:
1965	return keyctl_instantiate_key_iov(
1966	id: (key_serial_t) arg2,
1967	payload_iov: (const struct iovec __user *) arg3,
1968	ioc: (unsigned) arg4,
1969	ringid: (key_serial_t) arg5);
1970
1971	case KEYCTL_INVALIDATE:
1972	return keyctl_invalidate_key(id: (key_serial_t) arg2);
1973
1974	case KEYCTL_GET_PERSISTENT:
1975	return keyctl_get_persistent((uid_t)arg2, (key_serial_t)arg3);
1976
1977	case KEYCTL_DH_COMPUTE:
1978	return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2,
1979	(char __user *) arg3, (size_t) arg4,
1980	(struct keyctl_kdf_params __user *) arg5);
1981
1982	case KEYCTL_RESTRICT_KEYRING:
1983	return keyctl_restrict_keyring(id: (key_serial_t) arg2,
1984	type: (const char __user *) arg3,
1985	restriction: (const char __user *) arg4);
1986
1987	case KEYCTL_PKEY_QUERY:
1988	if (arg3 != 0)
1989	return -EINVAL;
1990	return keyctl_pkey_query((key_serial_t)arg2,
1991	(const char __user *)arg4,
1992	(struct keyctl_pkey_query __user *)arg5);
1993
1994	case KEYCTL_PKEY_ENCRYPT:
1995	case KEYCTL_PKEY_DECRYPT:
1996	case KEYCTL_PKEY_SIGN:
1997	return keyctl_pkey_e_d_s(
1998	option,
1999	(const struct keyctl_pkey_params __user *)arg2,
2000	(const char __user *)arg3,
2001	(const void __user *)arg4,
2002	(void __user *)arg5);
2003
2004	case KEYCTL_PKEY_VERIFY:
2005	return keyctl_pkey_verify(
2006	(const struct keyctl_pkey_params __user *)arg2,
2007	(const char __user *)arg3,
2008	(const void __user *)arg4,
2009	(const void __user *)arg5);
2010
2011	case KEYCTL_MOVE:
2012	return keyctl_keyring_move(id: (key_serial_t)arg2,
2013	from_ringid: (key_serial_t)arg3,
2014	to_ringid: (key_serial_t)arg4,
2015	flags: (unsigned int)arg5);
2016
2017	case KEYCTL_CAPABILITIES:
2018	return keyctl_capabilities(buffer: (unsigned char __user *)arg2, buflen: (size_t)arg3);
2019
2020	case KEYCTL_WATCH_KEY:
2021	return keyctl_watch_key(id: (key_serial_t)arg2, watch_queue_fd: (int)arg3, watch_id: (int)arg4);
2022
2023	default:
2024	return -EOPNOTSUPP;
2025	}
2026	}
2027