internal.h 9.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279
  1. /* Authentication token and access key management internal defs
  2. *
  3. * Copyright (C) 2003-5, 2007 Red Hat, Inc. All Rights Reserved.
  4. * Written by David Howells (dhowells@redhat.com)
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. */
  11. #ifndef _INTERNAL_H
  12. #define _INTERNAL_H
  13. #include <linux/sched.h>
  14. #include <linux/key-type.h>
  15. #include <linux/task_work.h>
  16. struct iovec;
  17. #ifdef __KDEBUG
  18. #define kenter(FMT, ...) \
  19. printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
  20. #define kleave(FMT, ...) \
  21. printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
  22. #define kdebug(FMT, ...) \
  23. printk(KERN_DEBUG " "FMT"\n", ##__VA_ARGS__)
  24. #else
  25. #define kenter(FMT, ...) \
  26. no_printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
  27. #define kleave(FMT, ...) \
  28. no_printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
  29. #define kdebug(FMT, ...) \
  30. no_printk(KERN_DEBUG FMT"\n", ##__VA_ARGS__)
  31. #endif
  32. extern struct key_type key_type_dead;
  33. extern struct key_type key_type_user;
  34. extern struct key_type key_type_logon;
  35. /*****************************************************************************/
  36. /*
  37. * Keep track of keys for a user.
  38. *
  39. * This needs to be separate to user_struct to avoid a refcount-loop
  40. * (user_struct pins some keyrings which pin this struct).
  41. *
  42. * We also keep track of keys under request from userspace for this UID here.
  43. */
  44. struct key_user {
  45. struct rb_node node;
  46. struct mutex cons_lock; /* construction initiation lock */
  47. spinlock_t lock;
  48. atomic_t usage; /* for accessing qnkeys & qnbytes */
  49. atomic_t nkeys; /* number of keys */
  50. atomic_t nikeys; /* number of instantiated keys */
  51. kuid_t uid;
  52. int qnkeys; /* number of keys allocated to this user */
  53. int qnbytes; /* number of bytes allocated to this user */
  54. };
  55. extern struct rb_root key_user_tree;
  56. extern spinlock_t key_user_lock;
  57. extern struct key_user root_key_user;
  58. extern struct key_user *key_user_lookup(kuid_t uid);
  59. extern void key_user_put(struct key_user *user);
  60. /*
  61. * Key quota limits.
  62. * - root has its own separate limits to everyone else
  63. */
  64. extern unsigned key_quota_root_maxkeys;
  65. extern unsigned key_quota_root_maxbytes;
  66. extern unsigned key_quota_maxkeys;
  67. extern unsigned key_quota_maxbytes;
  68. #define KEYQUOTA_LINK_BYTES 4 /* a link in a keyring is worth 4 bytes */
  69. extern struct kmem_cache *key_jar;
  70. extern struct rb_root key_serial_tree;
  71. extern spinlock_t key_serial_lock;
  72. extern struct mutex key_construction_mutex;
  73. extern wait_queue_head_t request_key_conswq;
  74. extern struct key_type *key_type_lookup(const char *type);
  75. extern void key_type_put(struct key_type *ktype);
  76. extern int __key_link_begin(struct key *keyring,
  77. const struct keyring_index_key *index_key,
  78. struct assoc_array_edit **_edit);
  79. extern int __key_link_check_live_key(struct key *keyring, struct key *key);
  80. extern void __key_link(struct key *key, struct assoc_array_edit **_edit);
  81. extern void __key_link_end(struct key *keyring,
  82. const struct keyring_index_key *index_key,
  83. struct assoc_array_edit *edit);
  84. extern key_ref_t find_key_to_update(key_ref_t keyring_ref,
  85. const struct keyring_index_key *index_key);
  86. extern struct key *keyring_search_instkey(struct key *keyring,
  87. key_serial_t target_id);
  88. extern int iterate_over_keyring(const struct key *keyring,
  89. int (*func)(const struct key *key, void *data),
  90. void *data);
  91. struct keyring_search_context {
  92. struct keyring_index_key index_key;
  93. const struct cred *cred;
  94. struct key_match_data match_data;
  95. unsigned flags;
  96. #define KEYRING_SEARCH_NO_STATE_CHECK 0x0001 /* Skip state checks */
  97. #define KEYRING_SEARCH_DO_STATE_CHECK 0x0002 /* Override NO_STATE_CHECK */
  98. #define KEYRING_SEARCH_NO_UPDATE_TIME 0x0004 /* Don't update times */
  99. #define KEYRING_SEARCH_NO_CHECK_PERM 0x0008 /* Don't check permissions */
  100. #define KEYRING_SEARCH_DETECT_TOO_DEEP 0x0010 /* Give an error on excessive depth */
  101. #define KEYRING_SEARCH_SKIP_EXPIRED 0x0020 /* Ignore expired keys (intention to replace) */
  102. int (*iterator)(const void *object, void *iterator_data);
  103. /* Internal stuff */
  104. int skipped_ret;
  105. bool possessed;
  106. key_ref_t result;
  107. struct timespec now;
  108. };
  109. extern bool key_default_cmp(const struct key *key,
  110. const struct key_match_data *match_data);
  111. extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
  112. struct keyring_search_context *ctx);
  113. extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx);
  114. extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx);
  115. extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
  116. extern int install_user_keyrings(void);
  117. extern int install_thread_keyring_to_cred(struct cred *);
  118. extern int install_process_keyring_to_cred(struct cred *);
  119. extern int install_session_keyring_to_cred(struct cred *, struct key *);
  120. extern struct key *request_key_and_link(struct key_type *type,
  121. const char *description,
  122. const void *callout_info,
  123. size_t callout_len,
  124. void *aux,
  125. struct key *dest_keyring,
  126. unsigned long flags);
  127. extern bool lookup_user_key_possessed(const struct key *key,
  128. const struct key_match_data *match_data);
  129. extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
  130. key_perm_t perm);
  131. #define KEY_LOOKUP_CREATE 0x01
  132. #define KEY_LOOKUP_PARTIAL 0x02
  133. #define KEY_LOOKUP_FOR_UNLINK 0x04
  134. extern long join_session_keyring(const char *name);
  135. extern void key_change_session_keyring(struct callback_head *twork);
  136. extern struct work_struct key_gc_work;
  137. extern unsigned key_gc_delay;
  138. extern void keyring_gc(struct key *keyring, time_t limit);
  139. extern void key_schedule_gc(time_t gc_at);
  140. extern void key_schedule_gc_links(void);
  141. extern void key_gc_keytype(struct key_type *ktype);
  142. extern int key_task_permission(const key_ref_t key_ref,
  143. const struct cred *cred,
  144. key_perm_t perm);
  145. /*
  146. * Check to see whether permission is granted to use a key in the desired way.
  147. */
  148. static inline int key_permission(const key_ref_t key_ref, unsigned perm)
  149. {
  150. return key_task_permission(key_ref, current_cred(), perm);
  151. }
  152. /*
  153. * Authorisation record for request_key().
  154. */
  155. struct request_key_auth {
  156. struct key *target_key;
  157. struct key *dest_keyring;
  158. const struct cred *cred;
  159. void *callout_info;
  160. size_t callout_len;
  161. pid_t pid;
  162. };
  163. extern struct key_type key_type_request_key_auth;
  164. extern struct key *request_key_auth_new(struct key *target,
  165. const void *callout_info,
  166. size_t callout_len,
  167. struct key *dest_keyring);
  168. extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
  169. /*
  170. * Determine whether a key is dead.
  171. */
  172. static inline bool key_is_dead(const struct key *key, time_t limit)
  173. {
  174. return
  175. key->flags & ((1 << KEY_FLAG_DEAD) |
  176. (1 << KEY_FLAG_INVALIDATED)) ||
  177. (key->expiry > 0 && key->expiry <= limit);
  178. }
  179. /*
  180. * keyctl() functions
  181. */
  182. extern long keyctl_get_keyring_ID(key_serial_t, int);
  183. extern long keyctl_join_session_keyring(const char __user *);
  184. extern long keyctl_update_key(key_serial_t, const void __user *, size_t);
  185. extern long keyctl_revoke_key(key_serial_t);
  186. extern long keyctl_keyring_clear(key_serial_t);
  187. extern long keyctl_keyring_link(key_serial_t, key_serial_t);
  188. extern long keyctl_keyring_unlink(key_serial_t, key_serial_t);
  189. extern long keyctl_describe_key(key_serial_t, char __user *, size_t);
  190. extern long keyctl_keyring_search(key_serial_t, const char __user *,
  191. const char __user *, key_serial_t);
  192. extern long keyctl_read_key(key_serial_t, char __user *, size_t);
  193. extern long keyctl_chown_key(key_serial_t, uid_t, gid_t);
  194. extern long keyctl_setperm_key(key_serial_t, key_perm_t);
  195. extern long keyctl_instantiate_key(key_serial_t, const void __user *,
  196. size_t, key_serial_t);
  197. extern long keyctl_negate_key(key_serial_t, unsigned, key_serial_t);
  198. extern long keyctl_set_reqkey_keyring(int);
  199. extern long keyctl_set_timeout(key_serial_t, unsigned);
  200. extern long keyctl_assume_authority(key_serial_t);
  201. extern long keyctl_get_security(key_serial_t keyid, char __user *buffer,
  202. size_t buflen);
  203. extern long keyctl_session_to_parent(void);
  204. extern long keyctl_reject_key(key_serial_t, unsigned, unsigned, key_serial_t);
  205. extern long keyctl_instantiate_key_iov(key_serial_t,
  206. const struct iovec __user *,
  207. unsigned, key_serial_t);
  208. extern long keyctl_invalidate_key(key_serial_t);
  209. struct iov_iter;
  210. extern long keyctl_instantiate_key_common(key_serial_t,
  211. struct iov_iter *,
  212. key_serial_t);
  213. #ifdef CONFIG_PERSISTENT_KEYRINGS
  214. extern long keyctl_get_persistent(uid_t, key_serial_t);
  215. extern unsigned persistent_keyring_expiry;
  216. #else
  217. static inline long keyctl_get_persistent(uid_t uid, key_serial_t destring)
  218. {
  219. return -EOPNOTSUPP;
  220. }
  221. #endif
  222. /*
  223. * Debugging key validation
  224. */
  225. #ifdef KEY_DEBUGGING
  226. extern void __key_check(const struct key *);
  227. static inline void key_check(const struct key *key)
  228. {
  229. if (key && (IS_ERR(key) || key->magic != KEY_DEBUG_MAGIC))
  230. __key_check(key);
  231. }
  232. #else
  233. #define key_check(key) do {} while(0)
  234. #endif
  235. #endif /* _INTERNAL_H */