Branch data     Line data    Source code

       1                 :            : /* Key permission checking
       2                 :            :  *
       3                 :            :  * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
       4                 :            :  * Written by David Howells (dhowells@redhat.com)
       5                 :            :  *
       6                 :            :  * This program is free software; you can redistribute it and/or
       7                 :            :  * modify it under the terms of the GNU General Public License
       8                 :            :  * as published by the Free Software Foundation; either version
       9                 :            :  * 2 of the License, or (at your option) any later version.
      10                 :            :  */
      11                 :            : 
      12                 :            : #include <linux/module.h>
      13                 :            : #include <linux/security.h>
      14                 :            : #include "internal.h"
      15                 :            : 
      16                 :            : /**
      17                 :            :  * key_task_permission - Check a key can be used
      18                 :            :  * @key_ref: The key to check.
      19                 :            :  * @cred: The credentials to use.
      20                 :            :  * @perm: The permissions to check for.
      21                 :            :  *
      22                 :            :  * Check to see whether permission is granted to use a key in the desired way,
      23                 :            :  * but permit the security modules to override.
      24                 :            :  *
      25                 :            :  * The caller must hold either a ref on cred or must hold the RCU readlock.
      26                 :            :  *
      27                 :            :  * Returns 0 if successful, -EACCES if access is denied based on the
      28                 :            :  * permissions bits or the LSM check.
      29                 :            :  */
      30                 :          0 : int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
      31                 :            :                         key_perm_t perm)
      32                 :            : {
      33                 :            :         struct key *key;
      34                 :            :         key_perm_t kperm;
      35                 :            :         int ret;
      36                 :            : 
      37                 :            :         key = key_ref_to_ptr(key_ref);
      38                 :            : 
      39                 :            :         /* use the second 8-bits of permissions for keys the caller owns */
      40         [ +  - ]:          4 :         if (uid_eq(key->uid, cred->fsuid)) {
      41                 :          4 :                 kperm = key->perm >> 16;
      42                 :          4 :                 goto use_these_perms;
      43                 :            :         }
      44                 :            : 
      45                 :            :         /* use the third 8-bits of permissions for keys the caller has a group
      46                 :            :          * membership in common with */
      47 [ #  # ][ #  # ]:          0 :         if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) {
      48         [ #  # ]:          0 :                 if (gid_eq(key->gid, cred->fsgid)) {
      49                 :          0 :                         kperm = key->perm >> 8;
      50                 :          0 :                         goto use_these_perms;
      51                 :            :                 }
      52                 :            : 
      53                 :          0 :                 ret = groups_search(cred->group_info, key->gid);
      54         [ #  # ]:          0 :                 if (ret) {
      55                 :          0 :                         kperm = key->perm >> 8;
      56                 :          0 :                         goto use_these_perms;
      57                 :            :                 }
      58                 :            :         }
      59                 :            : 
      60                 :            :         /* otherwise use the least-significant 8-bits */
      61                 :          0 :         kperm = key->perm;
      62                 :            : 
      63                 :            : use_these_perms:
      64                 :            : 
      65                 :            :         /* use the top 8-bits of permissions for keys the caller possesses
      66                 :            :          * - possessor permissions are additive with other permissions
      67                 :            :          */
      68         [ +  - ]:          4 :         if (is_key_possessed(key_ref))
      69                 :          4 :                 kperm |= key->perm >> 24;
      70                 :            : 
      71                 :          4 :         kperm = kperm & perm & KEY_ALL;
      72                 :            : 
      73         [ +  - ]:          4 :         if (kperm != perm)
      74                 :            :                 return -EACCES;
      75                 :            : 
      76                 :            :         /* let LSM be the final arbiter */
      77                 :          4 :         return security_key_permission(key_ref, cred, perm);
      78                 :            : }
      79                 :            : EXPORT_SYMBOL(key_task_permission);
      80                 :            : 
      81                 :            : /**
      82                 :            :  * key_validate - Validate a key.
      83                 :            :  * @key: The key to be validated.
      84                 :            :  *
      85                 :            :  * Check that a key is valid, returning 0 if the key is okay, -ENOKEY if the
      86                 :            :  * key is invalidated, -EKEYREVOKED if the key's type has been removed or if
      87                 :            :  * the key has been revoked or -EKEYEXPIRED if the key has expired.
      88                 :            :  */
      89                 :          0 : int key_validate(const struct key *key)
      90                 :            : {
      91                 :          2 :         unsigned long flags = key->flags;
      92                 :            : 
      93         [ +  - ]:          2 :         if (flags & (1 << KEY_FLAG_INVALIDATED))
      94                 :            :                 return -ENOKEY;
      95                 :            : 
      96                 :            :         /* check it's still accessible */
      97         [ +  - ]:          2 :         if (flags & ((1 << KEY_FLAG_REVOKED) |
      98                 :            :                      (1 << KEY_FLAG_DEAD)))
      99                 :            :                 return -EKEYREVOKED;
     100                 :            : 
     101                 :            :         /* check it hasn't expired */
     102         [ -  + ]:          2 :         if (key->expiry) {
     103                 :          0 :                 struct timespec now = current_kernel_time();
     104         [ #  # ]:          2 :                 if (now.tv_sec >= key->expiry)
     105                 :          0 :                         return -EKEYEXPIRED;
     106                 :            :         }
     107                 :            : 
     108                 :            :         return 0;
     109                 :            : }
     110                 :            : EXPORT_SYMBOL(key_validate);