1 /* request_key.c: request a key from userspace
3 * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/sched.h>
14 #include <linux/kmod.h>
15 #include <linux/err.h>
18 struct key_construction {
19 struct list_head link; /* link in construction queue */
20 struct key *key; /* key being constructed */
23 /* when waiting for someone else's keys, you get added to this */
24 DECLARE_WAIT_QUEUE_HEAD(request_key_conswq);
26 /*****************************************************************************/
28 * request userspace finish the construction of a key
29 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring> <info>"
30 * - if callout_info is an empty string, it'll be rendered as a "-" instead
32 static int call_request_key(struct key *key,
34 const char *callout_info)
36 struct task_struct *tsk = current;
37 char *argv[10], *envp[3], uid_str[12], gid_str[12];
38 char key_str[12], keyring_str[3][12];
41 /* record the UID and GID */
42 sprintf(uid_str, "%d", current->fsuid);
43 sprintf(gid_str, "%d", current->fsgid);
45 /* we say which key is under construction */
46 sprintf(key_str, "%d", key->serial);
48 /* we specify the process's default keyrings */
50 sprintf(keyring_str[0], "%d",
51 tsk->thread_keyring ? tsk->thread_keyring->serial : 0);
52 sprintf(keyring_str[1], "%d",
53 tsk->process_keyring ? tsk->process_keyring->serial : 0);
54 sprintf(keyring_str[2], "%d",
55 (tsk->session_keyring ?
56 tsk->session_keyring->serial :
57 tsk->user->session_keyring->serial));
60 /* set up a minimal environment */
63 envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
66 /* set up the argument list */
68 argv[i++] = "/sbin/request-key";
69 argv[i++] = (char *) op;
73 argv[i++] = keyring_str[0];
74 argv[i++] = keyring_str[1];
75 argv[i++] = keyring_str[2];
76 argv[i++] = callout_info[0] ? (char *) callout_info : "-";
80 return call_usermodehelper(argv[0], argv, envp, 1);
82 } /* end call_request_key() */
84 /*****************************************************************************/
86 * call out to userspace for the key
87 * - called with the construction sem held, but the sem is dropped here
88 * - we ignore program failure and go on key status instead
90 static struct key *__request_key_construction(struct key_type *type,
91 const char *description,
92 const char *callout_info)
94 struct key_construction cons;
99 /* create a key and add it to the queue */
100 key = key_alloc(type, description,
101 current->fsuid, current->fsgid, KEY_USR_ALL, 0);
105 write_lock(&key->lock);
106 key->flags |= KEY_FLAG_USER_CONSTRUCT;
107 write_unlock(&key->lock);
110 list_add_tail(&cons.link, &key->user->consq);
112 /* we drop the construction sem here on behalf of the caller */
113 up_write(&key_construction_sem);
116 ret = call_request_key(key, "create", callout_info);
120 /* if the key wasn't instantiated, then we want to give an error */
122 if (!(key->flags & KEY_FLAG_INSTANTIATED))
125 down_write(&key_construction_sem);
126 list_del(&cons.link);
127 up_write(&key_construction_sem);
129 /* also give an error if the key was negatively instantiated */
131 if (key->flags & KEY_FLAG_NEGATIVE) {
133 key = ERR_PTR(-ENOKEY);
140 /* it wasn't instantiated
141 * - remove from construction queue
142 * - mark the key as dead
145 down_write(&key_construction_sem);
147 list_del(&cons.link);
149 write_lock(&key->lock);
150 key->flags &= ~KEY_FLAG_USER_CONSTRUCT;
152 /* check it didn't get instantiated between the check and the down */
153 if (!(key->flags & KEY_FLAG_INSTANTIATED)) {
154 key->flags |= KEY_FLAG_INSTANTIATED | KEY_FLAG_NEGATIVE;
158 write_unlock(&key->lock);
159 up_write(&key_construction_sem);
162 goto check_not_negative; /* surprisingly, the key got
165 /* set the timeout and store in the session keyring if we can */
166 now = current_kernel_time();
167 key->expiry = now.tv_sec + key_negative_timeout;
169 if (current->session_keyring)
170 key_link(current->session_keyring, key);
173 /* notify anyone who was waiting */
174 wake_up_all(&request_key_conswq);
180 up_write(&key_construction_sem);
183 } /* end __request_key_construction() */
185 /*****************************************************************************/
187 * call out to userspace to request the key
188 * - we check the construction queue first to see if an appropriate key is
189 * already being constructed by userspace
191 static struct key *request_key_construction(struct key_type *type,
192 const char *description,
193 struct key_user *user,
194 const char *callout_info)
196 struct key_construction *pcons;
197 struct key *key, *ckey;
199 DECLARE_WAITQUEUE(myself, current);
201 /* see if there's such a key under construction already */
202 down_write(&key_construction_sem);
204 list_for_each_entry(pcons, &user->consq, link) {
207 if (ckey->type != type)
210 if (type->match(ckey, description))
211 goto found_key_under_construction;
214 /* see about getting userspace to construct the key */
215 key = __request_key_construction(type, description, callout_info);
219 /* someone else has the same key under construction
220 * - we want to keep an eye on their key
222 found_key_under_construction:
223 atomic_inc(&ckey->usage);
224 up_write(&key_construction_sem);
226 /* wait for the key to be completed one way or another */
227 add_wait_queue(&request_key_conswq, &myself);
230 set_current_state(TASK_UNINTERRUPTIBLE);
231 if (!(ckey->flags & KEY_FLAG_USER_CONSTRUCT))
236 set_current_state(TASK_RUNNING);
237 remove_wait_queue(&request_key_conswq, &myself);
239 /* we'll need to search this process's keyrings to see if the key is
240 * now there since we can't automatically assume it's also available
245 key = NULL; /* request a retry */
248 } /* end request_key_construction() */
250 /*****************************************************************************/
253 * - search the process's keyrings
254 * - check the list of keys being created or updated
255 * - call out to userspace for a key if requested (supplementary info can be
258 struct key *request_key(struct key_type *type,
259 const char *description,
260 const char *callout_info)
262 struct key_user *user;
265 /* search all the process keyrings for a key */
266 key = search_process_keyrings_aux(type, description, type->match);
268 if (PTR_ERR(key) == -EAGAIN) {
269 /* the search failed, but the keyrings were searchable, so we
270 * should consult userspace if we can */
271 key = ERR_PTR(-ENOKEY);
275 /* - get hold of the user's construction queue */
276 user = key_user_lookup(current->fsuid);
278 key = ERR_PTR(PTR_ERR(user));
283 /* ask userspace (returns NULL if it waited on a key
284 * being constructed) */
285 key = request_key_construction(type, description,
290 /* someone else made the key we want, so we need to
291 * search again as it might now be available to us */
292 key = search_process_keyrings_aux(type, description,
294 if (PTR_ERR(key) != -EAGAIN)
304 } /* end request_key() */
306 EXPORT_SYMBOL(request_key);
308 /*****************************************************************************/
312 int key_validate(struct key *key)
318 /* check it's still accessible */
320 if (key->flags & (KEY_FLAG_REVOKED | KEY_FLAG_DEAD))
323 /* check it hasn't expired */
326 now = current_kernel_time();
327 if (now.tv_sec >= key->expiry)
335 } /* end key_validate() */
337 EXPORT_SYMBOL(key_validate);