Lines Matching full:key
2 /* Request a key from userspace
7 * See Documentation/security/keys/request-key.rst
20 #define key_negative_timeout 60 /* default timeout on a negative key's existence */
22 static struct key *check_cached_key(struct keyring_search_context *ctx) in check_cached_key()
25 struct key *key = current->cached_requested_key; in check_cached_key() local
27 if (key && in check_cached_key()
28 ctx->match_data.cmp(key, &ctx->match_data) && in check_cached_key()
29 !(key->flags & ((1 << KEY_FLAG_INVALIDATED) | in check_cached_key()
31 return key_get(key); in check_cached_key()
36 static void cache_requested_key(struct key *key) in cache_requested_key() argument
41 /* Do not cache key if it is a kernel thread */ in cache_requested_key()
44 t->cached_requested_key = key_get(key); in cache_requested_key()
51 * complete_request_key - Complete the construction of a key.
52 * @authkey: The authorisation key.
55 * Complete the attempt to construct a key. The key will be negated
56 * if an error is indicated. The authorisation key will be revoked
59 void complete_request_key(struct key *authkey, int error) in complete_request_key()
62 struct key *key = rka->target_key; in complete_request_key() local
64 kenter("%d{%d},%d", authkey->serial, key->serial, error); in complete_request_key()
67 key_negate_and_link(key, key_negative_timeout, NULL, authkey); in complete_request_key()
82 struct key *keyring = info->data; in umh_keys_init()
92 struct key *keyring = info->data; in umh_keys_cleanup()
100 struct key *session_keyring, int wait) in call_usermodehelper_keys()
115 * Request userspace finish the construction of a key
116 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"
118 static int call_sbin_request_key(struct key *authkey, void *aux) in call_sbin_request_key()
120 static char const request_key[] = "/sbin/request-key"; in call_sbin_request_key()
124 struct key *key = rka->target_key, *keyring, *session, *user_session; in call_sbin_request_key() local
130 kenter("{%d},{%d},%s", key->serial, authkey->serial, rka->op); in call_sbin_request_key()
137 sprintf(desc, "_req.%u", key->serial); in call_sbin_request_key()
149 /* attach the auth key to the session keyring */ in call_sbin_request_key()
158 /* we say which key is under construction */ in call_sbin_request_key()
159 sprintf(key_str, "%d", key->serial); in call_sbin_request_key()
201 if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags) || in call_sbin_request_key()
202 key_validate(key) < 0) in call_sbin_request_key()
205 /* ignore any errors from userspace if the key was in call_sbin_request_key()
222 * Call out to userspace for key construction.
224 * Program failure is ignored in favour of key status.
226 static int construct_key(struct key *key, const void *callout_info, in construct_key() argument
228 struct key *dest_keyring) in construct_key()
231 struct key *authkey; in construct_key()
234 kenter("%d,%p,%zu,%p", key->serial, callout_info, callout_len, aux); in construct_key()
236 /* allocate an authorisation key */ in construct_key()
237 authkey = request_key_auth_new(key, "create", callout_info, callout_len, in construct_key()
244 if (key->type->request_key) in construct_key()
245 actor = key->type->request_key; in construct_key()
265 static int construct_get_dest_keyring(struct key **_dest_keyring) in construct_get_dest_keyring()
269 struct key *dest_keyring = *_dest_keyring, *authkey; in construct_get_dest_keyring()
344 * that /sbin/request-key can itself use request_key() to add in construct_get_dest_keyring()
363 * Allocate a new key in under-construction state and attempt to link it in to
366 * May return a key that's already under construction instead if there was a
370 struct key *dest_keyring, in construct_alloc_key()
373 struct key **_key) in construct_alloc_key()
376 struct key *key; in construct_alloc_key() local
395 key = key_alloc(ctx->index_key.type, ctx->index_key.description, in construct_alloc_key()
398 if (IS_ERR(key)) in construct_alloc_key()
401 set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags); in construct_alloc_key()
412 /* attach the key to the destination keyring under lock, but we do need in construct_alloc_key()
424 __key_link(dest_keyring, key, &edit); in construct_alloc_key()
430 *_key = key; in construct_alloc_key()
431 kleave(" = 0 [%d]", key_serial(key)); in construct_alloc_key()
434 /* the key is now present - we tell the caller that we found it by in construct_alloc_key()
437 key_put(key); in construct_alloc_key()
439 key = key_ref_to_ptr(key_ref); in construct_alloc_key()
441 ret = __key_link_check_live_key(dest_keyring, key); in construct_alloc_key()
443 __key_link(dest_keyring, key, &edit); in construct_alloc_key()
449 *_key = key; in construct_alloc_key()
450 kleave(" = -EINPROGRESS [%d]", key_serial(key)); in construct_alloc_key()
455 key_put(key); in construct_alloc_key()
463 key_put(key); in construct_alloc_key()
469 kleave(" = %ld", PTR_ERR(key)); in construct_alloc_key()
470 return PTR_ERR(key); in construct_alloc_key()
474 * Commence key construction.
476 static struct key *construct_key_and_link(struct keyring_search_context *ctx, in construct_key_and_link()
480 struct key *dest_keyring, in construct_key_and_link()
484 struct key *key; in construct_key_and_link() local
502 ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); in construct_key_and_link()
506 ret = construct_key(key, callout_info, callout_len, aux, in construct_key_and_link()
519 kleave(" = key %d", key_serial(key)); in construct_key_and_link()
520 return key; in construct_key_and_link()
523 key_negate_and_link(key, key_negative_timeout, NULL, NULL); in construct_key_and_link()
524 key_put(key); in construct_key_and_link()
533 * request_key_and_link - Request a key and cache it in a keyring.
534 * @type: The type of key we want.
535 * @description: The searchable description of the key.
536 * @domain_tag: The domain in which the key operates.
540 * @dest_keyring: Where to cache the key.
543 * A key matching the specified criteria (type, description, domain_tag) is
545 * incremented if found. Otherwise, if callout_info is not NULL, a key will be
549 * If successfully found or created, the key will be linked to the destination
552 * Returns a pointer to the key if successful; -EACCES, -ENOKEY, -EKEYREVOKED
553 * or -EKEYEXPIRED if an inaccessible, negative, revoked or expired key was
554 * found; -ENOKEY if no key was found and no @callout_info was given; -EDQUOT
555 * if insufficient key quota was available to create a new key; or -ENOMEM if
558 * If the returned key was created, then it may still be under construction,
561 struct key *request_key_and_link(struct key_type *type, in request_key_and_link()
567 struct key *dest_keyring, in request_key_and_link()
583 struct key *key; in request_key_and_link() local
594 key = ERR_PTR(ret); in request_key_and_link()
599 key = check_cached_key(&ctx); in request_key_and_link()
600 if (key) in request_key_and_link()
603 /* search all the process keyrings for a key */ in request_key_and_link()
614 key = ERR_PTR(ret); in request_key_and_link()
619 key = key_ref_to_ptr(key_ref); in request_key_and_link()
621 ret = key_link(dest_keyring, key); in request_key_and_link()
623 key_put(key); in request_key_and_link()
624 key = ERR_PTR(ret); in request_key_and_link()
629 /* Only cache the key on immediate success */ in request_key_and_link()
630 cache_requested_key(key); in request_key_and_link()
632 key = ERR_CAST(key_ref); in request_key_and_link()
636 key = ERR_PTR(-ENOKEY); in request_key_and_link()
640 key = construct_key_and_link(&ctx, callout_info, callout_len, in request_key_and_link()
648 kleave(" = %p", key); in request_key_and_link()
649 return key; in request_key_and_link()
653 * wait_for_key_construction - Wait for construction of a key to complete
654 * @key: The key being waited for.
657 * Wait for a key to finish being constructed.
660 * if the key was negated; or -EKEYREVOKED or -EKEYEXPIRED if the key was
663 int wait_for_key_construction(struct key *key, bool intr) in wait_for_key_construction() argument
667 ret = wait_on_bit(&key->flags, KEY_FLAG_USER_CONSTRUCT, in wait_for_key_construction()
671 ret = key_read_state(key); in wait_for_key_construction()
674 return key_validate(key); in wait_for_key_construction()
679 * request_key_tag - Request a key and wait for construction
680 * @type: Type of key.
681 * @description: The searchable description of the key.
682 * @domain_tag: The domain in which the key operates.
685 * As for request_key_and_link() except that it does not add the returned key
693 struct key *request_key_tag(struct key_type *type, in request_key_tag()
698 struct key *key; in request_key_tag() local
704 key = request_key_and_link(type, description, domain_tag, in request_key_tag()
707 if (!IS_ERR(key)) { in request_key_tag()
708 ret = wait_for_key_construction(key, false); in request_key_tag()
710 key_put(key); in request_key_tag()
714 return key; in request_key_tag()
719 * request_key_with_auxdata - Request a key with auxiliary data for the upcaller
720 * @type: The type of key we want.
721 * @description: The searchable description of the key.
722 * @domain_tag: The domain in which the key operates.
727 * As for request_key_and_link() except that it does not add the returned key
733 struct key *request_key_with_auxdata(struct key_type *type, in request_key_with_auxdata()
740 struct key *key; in request_key_with_auxdata() local
743 key = request_key_and_link(type, description, domain_tag, in request_key_with_auxdata()
746 if (!IS_ERR(key)) { in request_key_with_auxdata()
747 ret = wait_for_key_construction(key, false); in request_key_with_auxdata()
749 key_put(key); in request_key_with_auxdata()
753 return key; in request_key_with_auxdata()
758 * request_key_rcu - Request key from RCU-read-locked context
759 * @type: The type of key we want.
760 * @description: The name of the key we want.
761 * @domain_tag: The domain in which the key operates.
763 * Request a key from a context that we may not sleep in (such as RCU-mode
766 * Return a pointer to the found key if successful, -ENOKEY if we couldn't find
767 * a key or some other error if the key found was unsuitable or inaccessible.
769 struct key *request_key_rcu(struct key_type *type, in request_key_rcu()
785 struct key *key; in request_key_rcu() local
790 key = check_cached_key(&ctx); in request_key_rcu()
791 if (key) in request_key_rcu()
792 return key; in request_key_rcu()
794 /* search all the process keyrings for a key */ in request_key_rcu()
797 key = ERR_CAST(key_ref); in request_key_rcu()
799 key = ERR_PTR(-ENOKEY); in request_key_rcu()
801 key = key_ref_to_ptr(key_ref); in request_key_rcu()
802 cache_requested_key(key); in request_key_rcu()
805 kleave(" = %p", key); in request_key_rcu()
806 return key; in request_key_rcu()