1 /*
2 * Copyright (c) 2014-2015 Dmitry V. Levin <ldv@altlinux.org>
3 * Copyright (c) 2014-2018 The strace developers.
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include "defs.h"
30
31 #include "keyctl_kdf_params.h"
32 #include "print_fields.h"
33
34 typedef int32_t key_serial_t;
35
36 #include "xlat/key_spec.h"
37
38 struct keyctl_dh_params {
39 int32_t private;
40 int32_t prime;
41 int32_t base;
42 };
43
44 static void
print_keyring_serial_number(key_serial_t id)45 print_keyring_serial_number(key_serial_t id)
46 {
47 printxval_d(key_spec, id, NULL);
48 }
49
SYS_FUNC(add_key)50 SYS_FUNC(add_key)
51 {
52 /* type */
53 printstr(tcp, tcp->u_arg[0]);
54 /* description */
55 tprints(", ");
56 printstr(tcp, tcp->u_arg[1]);
57 /* payload */
58 tprints(", ");
59 printstrn(tcp, tcp->u_arg[2], tcp->u_arg[3]);
60 /* payload length */
61 tprintf(", %" PRI_klu ", ", tcp->u_arg[3]);
62 /* keyring serial number */
63 print_keyring_serial_number(tcp->u_arg[4]);
64
65 return RVAL_DECODED;
66 }
67
SYS_FUNC(request_key)68 SYS_FUNC(request_key)
69 {
70 /* type */
71 printstr(tcp, tcp->u_arg[0]);
72 /* description */
73 tprints(", ");
74 printstr(tcp, tcp->u_arg[1]);
75 /* callout_info */
76 tprints(", ");
77 printstr(tcp, tcp->u_arg[2]);
78 /* keyring serial number */
79 tprints(", ");
80 print_keyring_serial_number(tcp->u_arg[3]);
81
82 return RVAL_DECODED;
83 }
84
85 static void
keyctl_get_keyring_id(struct tcb * tcp,key_serial_t id,int create)86 keyctl_get_keyring_id(struct tcb *tcp, key_serial_t id, int create)
87 {
88 print_keyring_serial_number(id);
89 tprintf(", %d", create);
90 }
91
92 static void
keyctl_update_key(struct tcb * tcp,key_serial_t id,kernel_ulong_t addr,kernel_ulong_t len)93 keyctl_update_key(struct tcb *tcp, key_serial_t id, kernel_ulong_t addr,
94 kernel_ulong_t len)
95 {
96 print_keyring_serial_number(id);
97 tprints(", ");
98 printstrn(tcp, addr, len);
99 tprintf(", %llu", zero_extend_signed_to_ull(len));
100 }
101
102 static void
keyctl_handle_key_key(struct tcb * tcp,key_serial_t id1,key_serial_t id2)103 keyctl_handle_key_key(struct tcb *tcp, key_serial_t id1, key_serial_t id2)
104 {
105 print_keyring_serial_number(id1);
106 tprints(", ");
107 print_keyring_serial_number(id2);
108 }
109
110 static void
keyctl_read_key(struct tcb * tcp,key_serial_t id,kernel_ulong_t addr,kernel_ulong_t len,bool has_nul)111 keyctl_read_key(struct tcb *tcp, key_serial_t id, kernel_ulong_t addr,
112 kernel_ulong_t len, bool has_nul)
113 {
114 if (entering(tcp)) {
115 print_keyring_serial_number(id);
116 tprints(", ");
117 } else {
118 if (syserror(tcp))
119 printaddr(addr);
120 else {
121 kernel_ulong_t rval = (tcp->u_rval >= 0) &&
122 ((kernel_ulong_t) tcp->u_rval > len) ? len :
123 (kernel_ulong_t) tcp->u_rval;
124 printstr_ex(tcp, addr, rval, has_nul ?
125 QUOTE_OMIT_TRAILING_0 : 0);
126 }
127 tprintf(", %llu", zero_extend_signed_to_ull(len));
128 }
129 }
130
131 static void
keyctl_keyring_search(struct tcb * tcp,key_serial_t id1,kernel_ulong_t addr1,kernel_ulong_t addr2,key_serial_t id2)132 keyctl_keyring_search(struct tcb *tcp, key_serial_t id1, kernel_ulong_t addr1,
133 kernel_ulong_t addr2, key_serial_t id2)
134 {
135 print_keyring_serial_number(id1);
136 tprints(", ");
137 printstr(tcp, addr1);
138 tprints(", ");
139 printstr(tcp, addr2);
140 tprints(", ");
141 print_keyring_serial_number(id2);
142 }
143
144 static void
keyctl_chown_key(struct tcb * tcp,key_serial_t id,unsigned user,unsigned group)145 keyctl_chown_key(struct tcb *tcp, key_serial_t id, unsigned user,
146 unsigned group)
147 {
148 print_keyring_serial_number(id);
149 printuid(", ", user);
150 printuid(", ", group);
151 }
152
153 static void
keyctl_instantiate_key(struct tcb * tcp,key_serial_t id1,kernel_ulong_t addr,kernel_ulong_t len,key_serial_t id2)154 keyctl_instantiate_key(struct tcb *tcp, key_serial_t id1, kernel_ulong_t addr,
155 kernel_ulong_t len, key_serial_t id2)
156 {
157 print_keyring_serial_number(id1);
158 tprints(", ");
159 printstrn(tcp, addr, len);
160 tprintf(", %llu, ", zero_extend_signed_to_ull(len));
161 print_keyring_serial_number(id2);
162 }
163
164 static void
keyctl_instantiate_key_iov(struct tcb * tcp,key_serial_t id1,kernel_ulong_t addr,kernel_ulong_t len,key_serial_t id2)165 keyctl_instantiate_key_iov(struct tcb *tcp, key_serial_t id1,
166 kernel_ulong_t addr, kernel_ulong_t len,
167 key_serial_t id2)
168 {
169 print_keyring_serial_number(id1);
170 tprints(", ");
171 tprint_iov(tcp, len, addr, IOV_DECODE_STR);
172 tprintf(", %llu, ", zero_extend_signed_to_ull(len));
173 print_keyring_serial_number(id2);
174 }
175
176 static void
keyctl_negate_key(struct tcb * tcp,key_serial_t id1,unsigned timeout,key_serial_t id2)177 keyctl_negate_key(struct tcb *tcp, key_serial_t id1, unsigned timeout,
178 key_serial_t id2)
179 {
180 print_keyring_serial_number(id1);
181 tprintf(", %u, ", timeout);
182 print_keyring_serial_number(id2);
183 }
184
185 static void
keyctl_reject_key(struct tcb * tcp,key_serial_t id1,unsigned timeout,unsigned error,key_serial_t id2)186 keyctl_reject_key(struct tcb *tcp, key_serial_t id1, unsigned timeout,
187 unsigned error, key_serial_t id2)
188 {
189 const char *err_str = err_name(error);
190
191 print_keyring_serial_number(id1);
192 tprintf(", %u, ", timeout);
193 print_xlat_ex(error, err_str, XLAT_STYLE_FMT_U);
194 tprints(", ");
195 print_keyring_serial_number(id2);
196 }
197
198 static void
keyctl_set_timeout(struct tcb * tcp,key_serial_t id,unsigned timeout)199 keyctl_set_timeout(struct tcb *tcp, key_serial_t id, unsigned timeout)
200 {
201 print_keyring_serial_number(id);
202 tprintf(", %u", timeout);
203 }
204
205 static void
keyctl_get_persistent(struct tcb * tcp,unsigned uid,key_serial_t id)206 keyctl_get_persistent(struct tcb *tcp, unsigned uid, key_serial_t id)
207 {
208 printuid("", uid);
209 tprints(", ");
210 print_keyring_serial_number(id);
211 }
212
213 #include "xlat/key_perms.h"
214
215 static void
keyctl_setperm_key(struct tcb * tcp,key_serial_t id,uint32_t perm)216 keyctl_setperm_key(struct tcb *tcp, key_serial_t id, uint32_t perm)
217 {
218 print_keyring_serial_number(id);
219 tprints(", ");
220 printflags(key_perms, perm, "KEY_???");
221 }
222
223 static void
print_dh_params(struct tcb * tcp,kernel_ulong_t addr)224 print_dh_params(struct tcb *tcp, kernel_ulong_t addr)
225 {
226 struct keyctl_dh_params params;
227
228 if (umove_or_printaddr(tcp, addr, ¶ms))
229 return;
230
231 tprints("{private=");
232 print_keyring_serial_number(params.private);
233 tprints(", prime=");
234 print_keyring_serial_number(params.prime);
235 tprints(", base=");
236 print_keyring_serial_number(params.base);
237 tprints("}");
238 }
239
240 static void
keyctl_dh_compute(struct tcb * tcp,kernel_ulong_t params,kernel_ulong_t buf,kernel_ulong_t len,kernel_ulong_t kdf_addr)241 keyctl_dh_compute(struct tcb *tcp, kernel_ulong_t params, kernel_ulong_t buf,
242 kernel_ulong_t len, kernel_ulong_t kdf_addr)
243 {
244 if (entering(tcp)) {
245 print_dh_params(tcp, params);
246 tprints(", ");
247 } else {
248 struct strace_keyctl_kdf_params kdf;
249
250 if (syserror(tcp)) {
251 printaddr(buf);
252 } else {
253 kernel_ulong_t rval = (tcp->u_rval >= 0) &&
254 ((kernel_ulong_t) tcp->u_rval > len) ? len :
255 (kernel_ulong_t) tcp->u_rval;
256 printstrn(tcp, buf, rval);
257 }
258 tprintf(", %llu, ", zero_extend_signed_to_ull(len));
259
260 if (fetch_keyctl_kdf_params(tcp, kdf_addr, &kdf)) {
261 printaddr(kdf_addr);
262 } else {
263 size_t i;
264
265 PRINT_FIELD_STR("{", kdf, hashname, tcp);
266
267 /*
268 * Kernel doesn't touch otherinfo
269 * if otherinfolen is zero.
270 */
271 if (kdf.otherinfolen)
272 PRINT_FIELD_STRN(", ", kdf, otherinfo,
273 kdf.otherinfolen, tcp);
274 else
275 PRINT_FIELD_PTR(", ", kdf, otherinfo);
276
277 PRINT_FIELD_U(", ", kdf, otherinfolen);
278
279 /* Some future-proofing */
280 for (i = 0; i < ARRAY_SIZE(kdf.__spare); i++) {
281 if (kdf.__spare[i])
282 break;
283 }
284
285 if (i < ARRAY_SIZE(kdf.__spare)) {
286 tprints(", __spare=[");
287
288 for (i = 0; i < ARRAY_SIZE(kdf.__spare); i++) {
289 if (i)
290 tprints(", ");
291
292 tprintf("%#x", kdf.__spare[i]);
293 }
294
295 tprints("]");
296 }
297
298 tprints("}");
299 }
300 }
301 }
302
303 static void
keyctl_restrict_keyring(struct tcb * const tcp,const key_serial_t id,const kernel_ulong_t addr1,const kernel_ulong_t addr2)304 keyctl_restrict_keyring(struct tcb *const tcp,
305 const key_serial_t id,
306 const kernel_ulong_t addr1,
307 const kernel_ulong_t addr2)
308 {
309 print_keyring_serial_number(id);
310 tprints(", ");
311 printstr(tcp, addr1);
312 tprints(", ");
313 printstr(tcp, addr2);
314 }
315
316 #include "xlat/key_reqkeys.h"
317 #include "xlat/keyctl_commands.h"
318
SYS_FUNC(keyctl)319 SYS_FUNC(keyctl)
320 {
321 int cmd = tcp->u_arg[0];
322 kernel_ulong_t arg2 = tcp->u_arg[1];
323 kernel_ulong_t arg3 = tcp->u_arg[2];
324 kernel_ulong_t arg4 = tcp->u_arg[3];
325 kernel_ulong_t arg5 = tcp->u_arg[4];
326
327 if (entering(tcp)) {
328 printxval(keyctl_commands, cmd, "KEYCTL_???");
329
330 /*
331 * For now, KEYCTL_SESSION_TO_PARENT is the only cmd without
332 * arguments.
333 */
334 if (cmd != KEYCTL_SESSION_TO_PARENT)
335 tprints(", ");
336 }
337
338 switch (cmd) {
339 case KEYCTL_GET_KEYRING_ID:
340 keyctl_get_keyring_id(tcp, arg2, arg3);
341 break;
342
343 case KEYCTL_JOIN_SESSION_KEYRING:
344 printstr(tcp, arg2);
345 break;
346
347 case KEYCTL_UPDATE:
348 keyctl_update_key(tcp, arg2, arg3, arg4);
349 break;
350
351 case KEYCTL_REVOKE:
352 case KEYCTL_CLEAR:
353 case KEYCTL_INVALIDATE:
354 case KEYCTL_ASSUME_AUTHORITY:
355 print_keyring_serial_number(arg2);
356 break;
357
358 case KEYCTL_LINK:
359 case KEYCTL_UNLINK:
360 keyctl_handle_key_key(tcp, arg2, arg3);
361 break;
362
363 case KEYCTL_DESCRIBE:
364 case KEYCTL_READ:
365 case KEYCTL_GET_SECURITY:
366 keyctl_read_key(tcp, arg2, arg3, arg4, cmd != KEYCTL_READ);
367 return 0;
368
369 case KEYCTL_SEARCH:
370 keyctl_keyring_search(tcp, arg2, arg3, arg4, arg5);
371 break;
372
373 case KEYCTL_CHOWN:
374 keyctl_chown_key(tcp, arg2, arg3, arg4);
375 break;
376
377 case KEYCTL_SETPERM:
378 keyctl_setperm_key(tcp, arg2, arg3);
379 break;
380
381 case KEYCTL_INSTANTIATE:
382 keyctl_instantiate_key(tcp, arg2, arg3, arg4, arg5);
383 break;
384
385 case KEYCTL_NEGATE:
386 keyctl_negate_key(tcp, arg2, arg3, arg4);
387 break;
388
389 case KEYCTL_SET_REQKEY_KEYRING:
390 printxvals_ex((int) arg2, "KEY_REQKEY_DEFL_???",
391 XLAT_STYLE_FMT_D, key_reqkeys, NULL);
392 break;
393
394 case KEYCTL_SET_TIMEOUT:
395 keyctl_set_timeout(tcp, arg2, arg3);
396 break;
397
398 case KEYCTL_SESSION_TO_PARENT:
399 break;
400
401 case KEYCTL_REJECT:
402 keyctl_reject_key(tcp, arg2, arg3, arg4, arg5);
403 break;
404
405 case KEYCTL_INSTANTIATE_IOV:
406 keyctl_instantiate_key_iov(tcp, arg2, arg3, arg4, arg5);
407 break;
408
409 case KEYCTL_GET_PERSISTENT:
410 keyctl_get_persistent(tcp, arg2, arg3);
411 break;
412
413 case KEYCTL_DH_COMPUTE:
414 keyctl_dh_compute(tcp, arg2, arg3, arg4, arg5);
415 return 0;
416
417 case KEYCTL_RESTRICT_KEYRING:
418 keyctl_restrict_keyring(tcp, arg2, arg3, arg4);
419 break;
420
421 default:
422 tprintf("%#" PRI_klx ", %#" PRI_klx
423 ", %#" PRI_klx ", %#" PRI_klx,
424 arg2, arg3, arg4, arg5);
425 break;
426 }
427
428 return RVAL_DECODED;
429 }
430