2007-11-05 22:38:08 +08:00
|
|
|
/*
|
|
|
|
* fs/cifs/cifs_spnego.c -- SPNEGO upcall management for CIFS
|
|
|
|
*
|
|
|
|
* Copyright (c) 2007 Red Hat, Inc.
|
|
|
|
* Author(s): Jeff Layton (jlayton@redhat.com)
|
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU Lesser General Public License as published
|
|
|
|
* by the Free Software Foundation; either version 2.1 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
|
|
|
|
* the GNU Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public License
|
|
|
|
* along with this library; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/list.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 16:04:11 +08:00
|
|
|
#include <linux/slab.h>
|
2007-11-05 22:38:08 +08:00
|
|
|
#include <linux/string.h>
|
|
|
|
#include <keys/user-type.h>
|
|
|
|
#include <linux/key-type.h>
|
2016-05-18 07:20:13 +08:00
|
|
|
#include <linux/keyctl.h>
|
2009-06-02 18:55:20 +08:00
|
|
|
#include <linux/inet.h>
|
2007-11-05 22:38:08 +08:00
|
|
|
#include "cifsglob.h"
|
|
|
|
#include "cifs_spnego.h"
|
|
|
|
#include "cifs_debug.h"
|
2016-05-18 07:20:13 +08:00
|
|
|
#include "cifsproto.h"
|
|
|
|
static const struct cred *spnego_cred;
|
2007-11-05 22:38:08 +08:00
|
|
|
|
keys: Replace uid/gid/perm permissions checking with an ACL
Replace the uid/gid/perm permissions checking on a key with an ACL to allow
the SETATTR and SEARCH permissions to be split. This will also allow a
greater range of subjects to represented.
============
WHY DO THIS?
============
The problem is that SETATTR and SEARCH cover a slew of actions, not all of
which should be grouped together.
For SETATTR, this includes actions that are about controlling access to a
key:
(1) Changing a key's ownership.
(2) Changing a key's security information.
(3) Setting a keyring's restriction.
And actions that are about managing a key's lifetime:
(4) Setting an expiry time.
(5) Revoking a key.
and (proposed) managing a key as part of a cache:
(6) Invalidating a key.
Managing a key's lifetime doesn't really have anything to do with
controlling access to that key.
Expiry time is awkward since it's more about the lifetime of the content
and so, in some ways goes better with WRITE permission. It can, however,
be set unconditionally by a process with an appropriate authorisation token
for instantiating a key, and can also be set by the key type driver when a
key is instantiated, so lumping it with the access-controlling actions is
probably okay.
As for SEARCH permission, that currently covers:
(1) Finding keys in a keyring tree during a search.
(2) Permitting keyrings to be joined.
(3) Invalidation.
But these don't really belong together either, since these actions really
need to be controlled separately.
Finally, there are number of special cases to do with granting the
administrator special rights to invalidate or clear keys that I would like
to handle with the ACL rather than key flags and special checks.
===============
WHAT IS CHANGED
===============
The SETATTR permission is split to create two new permissions:
(1) SET_SECURITY - which allows the key's owner, group and ACL to be
changed and a restriction to be placed on a keyring.
(2) REVOKE - which allows a key to be revoked.
The SEARCH permission is split to create:
(1) SEARCH - which allows a keyring to be search and a key to be found.
(2) JOIN - which allows a keyring to be joined as a session keyring.
(3) INVAL - which allows a key to be invalidated.
The WRITE permission is also split to create:
(1) WRITE - which allows a key's content to be altered and links to be
added, removed and replaced in a keyring.
(2) CLEAR - which allows a keyring to be cleared completely. This is
split out to make it possible to give just this to an administrator.
(3) REVOKE - see above.
Keys acquire ACLs which consist of a series of ACEs, and all that apply are
unioned together. An ACE specifies a subject, such as:
(*) Possessor - permitted to anyone who 'possesses' a key
(*) Owner - permitted to the key owner
(*) Group - permitted to the key group
(*) Everyone - permitted to everyone
Note that 'Other' has been replaced with 'Everyone' on the assumption that
you wouldn't grant a permit to 'Other' that you wouldn't also grant to
everyone else.
Further subjects may be made available by later patches.
The ACE also specifies a permissions mask. The set of permissions is now:
VIEW Can view the key metadata
READ Can read the key content
WRITE Can update/modify the key content
SEARCH Can find the key by searching/requesting
LINK Can make a link to the key
SET_SECURITY Can change owner, ACL, expiry
INVAL Can invalidate
REVOKE Can revoke
JOIN Can join this keyring
CLEAR Can clear this keyring
The KEYCTL_SETPERM function is then deprecated.
The KEYCTL_SET_TIMEOUT function then is permitted if SET_SECURITY is set,
or if the caller has a valid instantiation auth token.
The KEYCTL_INVALIDATE function then requires INVAL.
The KEYCTL_REVOKE function then requires REVOKE.
The KEYCTL_JOIN_SESSION_KEYRING function then requires JOIN to join an
existing keyring.
The JOIN permission is enabled by default for session keyrings and manually
created keyrings only.
======================
BACKWARD COMPATIBILITY
======================
To maintain backward compatibility, KEYCTL_SETPERM will translate the
permissions mask it is given into a new ACL for a key - unless
KEYCTL_SET_ACL has been called on that key, in which case an error will be
returned.
It will convert possessor, owner, group and other permissions into separate
ACEs, if each portion of the mask is non-zero.
SETATTR permission turns on all of INVAL, REVOKE and SET_SECURITY. WRITE
permission turns on WRITE, REVOKE and, if a keyring, CLEAR. JOIN is turned
on if a keyring is being altered.
The KEYCTL_DESCRIBE function translates the ACL back into a permissions
mask to return depending on possessor, owner, group and everyone ACEs.
It will make the following mappings:
(1) INVAL, JOIN -> SEARCH
(2) SET_SECURITY -> SETATTR
(3) REVOKE -> WRITE if SETATTR isn't already set
(4) CLEAR -> WRITE
Note that the value subsequently returned by KEYCTL_DESCRIBE may not match
the value set with KEYCTL_SETATTR.
=======
TESTING
=======
This passes the keyutils testsuite for all but a couple of tests:
(1) tests/keyctl/dh_compute/badargs: The first wrong-key-type test now
returns EOPNOTSUPP rather than ENOKEY as READ permission isn't removed
if the type doesn't have ->read(). You still can't actually read the
key.
(2) tests/keyctl/permitting/valid: The view-other-permissions test doesn't
work as Other has been replaced with Everyone in the ACL.
Signed-off-by: David Howells <dhowells@redhat.com>
2019-06-28 06:03:07 +08:00
|
|
|
static struct key_acl cifs_spnego_key_acl = {
|
|
|
|
.usage = REFCOUNT_INIT(1),
|
|
|
|
.nr_ace = 2,
|
|
|
|
.possessor_viewable = true,
|
|
|
|
.aces = {
|
|
|
|
KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
|
|
|
|
KEY_OWNER_ACE(KEY_ACE_VIEW),
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
static struct key_acl cifs_spnego_keyring_acl = {
|
|
|
|
.usage = REFCOUNT_INIT(1),
|
|
|
|
.nr_ace = 2,
|
|
|
|
.aces = {
|
|
|
|
KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
|
|
|
|
KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_CLEAR),
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
2007-11-05 22:38:08 +08:00
|
|
|
/* create a new cifs key */
|
|
|
|
static int
|
2012-09-13 20:06:29 +08:00
|
|
|
cifs_spnego_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
|
2007-11-05 22:38:08 +08:00
|
|
|
{
|
|
|
|
char *payload;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
ret = -ENOMEM;
|
2013-03-12 00:22:32 +08:00
|
|
|
payload = kmemdup(prep->data, prep->datalen, GFP_KERNEL);
|
2007-11-05 22:38:08 +08:00
|
|
|
if (!payload)
|
|
|
|
goto error;
|
|
|
|
|
|
|
|
/* attach the data */
|
2015-10-21 21:04:48 +08:00
|
|
|
key->payload.data[0] = payload;
|
2007-11-05 22:38:08 +08:00
|
|
|
ret = 0;
|
|
|
|
|
|
|
|
error:
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
cifs_spnego_key_destroy(struct key *key)
|
|
|
|
{
|
2015-10-21 21:04:48 +08:00
|
|
|
kfree(key->payload.data[0]);
|
2007-11-05 22:38:08 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* keytype for CIFS spnego keys
|
|
|
|
*/
|
|
|
|
struct key_type cifs_spnego_key_type = {
|
|
|
|
.name = "cifs.spnego",
|
|
|
|
.instantiate = cifs_spnego_key_instantiate,
|
|
|
|
.destroy = cifs_spnego_key_destroy,
|
|
|
|
.describe = user_describe,
|
|
|
|
};
|
|
|
|
|
2008-09-24 01:23:09 +08:00
|
|
|
/* length of longest version string e.g. strlen("ver=0xFF") */
|
|
|
|
#define MAX_VER_STR_LEN 8
|
|
|
|
|
|
|
|
/* length of longest security mechanism name, eg in future could have
|
|
|
|
* strlen(";sec=ntlmsspi") */
|
|
|
|
#define MAX_MECH_STR_LEN 13
|
|
|
|
|
|
|
|
/* strlen of "host=" */
|
|
|
|
#define HOST_KEY_LEN 5
|
|
|
|
|
|
|
|
/* strlen of ";ip4=" or ";ip6=" */
|
|
|
|
#define IP_KEY_LEN 5
|
|
|
|
|
|
|
|
/* strlen of ";uid=0x" */
|
|
|
|
#define UID_KEY_LEN 7
|
|
|
|
|
2010-08-03 22:19:50 +08:00
|
|
|
/* strlen of ";creduid=0x" */
|
|
|
|
#define CREDUID_KEY_LEN 11
|
|
|
|
|
2008-09-24 01:23:09 +08:00
|
|
|
/* strlen of ";user=" */
|
|
|
|
#define USER_KEY_LEN 6
|
|
|
|
|
2009-07-10 08:02:48 +08:00
|
|
|
/* strlen of ";pid=0x" */
|
|
|
|
#define PID_KEY_LEN 7
|
|
|
|
|
2007-11-05 22:38:08 +08:00
|
|
|
/* get a key struct with a SPNEGO security blob, suitable for session setup */
|
|
|
|
struct key *
|
2011-05-27 12:34:02 +08:00
|
|
|
cifs_get_spnego_key(struct cifs_ses *sesInfo)
|
2007-11-05 22:38:08 +08:00
|
|
|
{
|
|
|
|
struct TCP_Server_Info *server = sesInfo->server;
|
2010-12-14 00:08:35 +08:00
|
|
|
struct sockaddr_in *sa = (struct sockaddr_in *) &server->dstaddr;
|
|
|
|
struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *) &server->dstaddr;
|
2007-11-05 22:38:08 +08:00
|
|
|
char *description, *dp;
|
|
|
|
size_t desc_len;
|
|
|
|
struct key *spnego_key;
|
2007-11-17 06:23:17 +08:00
|
|
|
const char *hostname = server->hostname;
|
2016-05-18 07:20:13 +08:00
|
|
|
const struct cred *saved_cred;
|
2007-11-05 22:38:08 +08:00
|
|
|
|
2008-08-02 01:54:32 +08:00
|
|
|
/* length of fields (with semicolons): ver=0xyz ip4=ipaddress
|
|
|
|
host=hostname sec=mechanism uid=0xFF user=username */
|
|
|
|
desc_len = MAX_VER_STR_LEN +
|
2008-09-24 01:23:09 +08:00
|
|
|
HOST_KEY_LEN + strlen(hostname) +
|
2009-06-02 18:55:20 +08:00
|
|
|
IP_KEY_LEN + INET6_ADDRSTRLEN +
|
2008-08-02 01:54:32 +08:00
|
|
|
MAX_MECH_STR_LEN +
|
2008-09-24 01:23:09 +08:00
|
|
|
UID_KEY_LEN + (sizeof(uid_t) * 2) +
|
2010-08-03 22:19:50 +08:00
|
|
|
CREDUID_KEY_LEN + (sizeof(uid_t) * 2) +
|
2009-07-10 08:02:48 +08:00
|
|
|
PID_KEY_LEN + (sizeof(pid_t) * 2) + 1;
|
2008-08-02 01:54:32 +08:00
|
|
|
|
2012-01-18 05:09:15 +08:00
|
|
|
if (sesInfo->user_name)
|
|
|
|
desc_len += USER_KEY_LEN + strlen(sesInfo->user_name);
|
|
|
|
|
2007-11-05 22:38:08 +08:00
|
|
|
spnego_key = ERR_PTR(-ENOMEM);
|
|
|
|
description = kzalloc(desc_len, GFP_KERNEL);
|
|
|
|
if (description == NULL)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
dp = description;
|
|
|
|
/* start with version and hostname portion of UNC string */
|
|
|
|
spnego_key = ERR_PTR(-EINVAL);
|
2007-11-17 02:32:52 +08:00
|
|
|
sprintf(dp, "ver=0x%x;host=%s;", CIFS_SPNEGO_UPCALL_VERSION,
|
2007-11-05 22:38:08 +08:00
|
|
|
hostname);
|
|
|
|
dp = description + strlen(description);
|
|
|
|
|
|
|
|
/* add the server address */
|
2010-12-14 00:08:35 +08:00
|
|
|
if (server->dstaddr.ss_family == AF_INET)
|
|
|
|
sprintf(dp, "ip4=%pI4", &sa->sin_addr);
|
|
|
|
else if (server->dstaddr.ss_family == AF_INET6)
|
|
|
|
sprintf(dp, "ip6=%pI6", &sa6->sin6_addr);
|
2007-11-05 22:38:08 +08:00
|
|
|
else
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
dp = description + strlen(description);
|
|
|
|
|
2008-08-20 03:35:33 +08:00
|
|
|
/* for now, only sec=krb5 and sec=mskrb5 are valid */
|
2010-04-24 19:57:49 +08:00
|
|
|
if (server->sec_kerberos)
|
2007-11-05 22:38:08 +08:00
|
|
|
sprintf(dp, ";sec=krb5");
|
2010-04-24 19:57:49 +08:00
|
|
|
else if (server->sec_mskerberos)
|
2008-08-20 03:35:33 +08:00
|
|
|
sprintf(dp, ";sec=mskrb5");
|
2018-10-29 02:13:23 +08:00
|
|
|
else {
|
|
|
|
cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
|
|
|
|
sprintf(dp, ";sec=krb5");
|
|
|
|
}
|
2007-11-05 22:38:08 +08:00
|
|
|
|
2007-11-09 00:13:31 +08:00
|
|
|
dp = description + strlen(description);
|
2013-02-06 18:30:39 +08:00
|
|
|
sprintf(dp, ";uid=0x%x",
|
|
|
|
from_kuid_munged(&init_user_ns, sesInfo->linux_uid));
|
2007-11-09 00:13:31 +08:00
|
|
|
|
2010-07-20 06:00:17 +08:00
|
|
|
dp = description + strlen(description);
|
2013-02-06 18:30:39 +08:00
|
|
|
sprintf(dp, ";creduid=0x%x",
|
|
|
|
from_kuid_munged(&init_user_ns, sesInfo->cred_uid));
|
2010-07-20 06:00:17 +08:00
|
|
|
|
2012-01-18 05:09:15 +08:00
|
|
|
if (sesInfo->user_name) {
|
|
|
|
dp = description + strlen(description);
|
|
|
|
sprintf(dp, ";user=%s", sesInfo->user_name);
|
|
|
|
}
|
2008-04-02 21:33:47 +08:00
|
|
|
|
2009-07-10 08:02:48 +08:00
|
|
|
dp = description + strlen(description);
|
|
|
|
sprintf(dp, ";pid=0x%x", current->pid);
|
|
|
|
|
2013-05-05 11:12:25 +08:00
|
|
|
cifs_dbg(FYI, "key description = %s\n", description);
|
2016-05-18 07:20:13 +08:00
|
|
|
saved_cred = override_creds(spnego_cred);
|
keys: Replace uid/gid/perm permissions checking with an ACL
Replace the uid/gid/perm permissions checking on a key with an ACL to allow
the SETATTR and SEARCH permissions to be split. This will also allow a
greater range of subjects to represented.
============
WHY DO THIS?
============
The problem is that SETATTR and SEARCH cover a slew of actions, not all of
which should be grouped together.
For SETATTR, this includes actions that are about controlling access to a
key:
(1) Changing a key's ownership.
(2) Changing a key's security information.
(3) Setting a keyring's restriction.
And actions that are about managing a key's lifetime:
(4) Setting an expiry time.
(5) Revoking a key.
and (proposed) managing a key as part of a cache:
(6) Invalidating a key.
Managing a key's lifetime doesn't really have anything to do with
controlling access to that key.
Expiry time is awkward since it's more about the lifetime of the content
and so, in some ways goes better with WRITE permission. It can, however,
be set unconditionally by a process with an appropriate authorisation token
for instantiating a key, and can also be set by the key type driver when a
key is instantiated, so lumping it with the access-controlling actions is
probably okay.
As for SEARCH permission, that currently covers:
(1) Finding keys in a keyring tree during a search.
(2) Permitting keyrings to be joined.
(3) Invalidation.
But these don't really belong together either, since these actions really
need to be controlled separately.
Finally, there are number of special cases to do with granting the
administrator special rights to invalidate or clear keys that I would like
to handle with the ACL rather than key flags and special checks.
===============
WHAT IS CHANGED
===============
The SETATTR permission is split to create two new permissions:
(1) SET_SECURITY - which allows the key's owner, group and ACL to be
changed and a restriction to be placed on a keyring.
(2) REVOKE - which allows a key to be revoked.
The SEARCH permission is split to create:
(1) SEARCH - which allows a keyring to be search and a key to be found.
(2) JOIN - which allows a keyring to be joined as a session keyring.
(3) INVAL - which allows a key to be invalidated.
The WRITE permission is also split to create:
(1) WRITE - which allows a key's content to be altered and links to be
added, removed and replaced in a keyring.
(2) CLEAR - which allows a keyring to be cleared completely. This is
split out to make it possible to give just this to an administrator.
(3) REVOKE - see above.
Keys acquire ACLs which consist of a series of ACEs, and all that apply are
unioned together. An ACE specifies a subject, such as:
(*) Possessor - permitted to anyone who 'possesses' a key
(*) Owner - permitted to the key owner
(*) Group - permitted to the key group
(*) Everyone - permitted to everyone
Note that 'Other' has been replaced with 'Everyone' on the assumption that
you wouldn't grant a permit to 'Other' that you wouldn't also grant to
everyone else.
Further subjects may be made available by later patches.
The ACE also specifies a permissions mask. The set of permissions is now:
VIEW Can view the key metadata
READ Can read the key content
WRITE Can update/modify the key content
SEARCH Can find the key by searching/requesting
LINK Can make a link to the key
SET_SECURITY Can change owner, ACL, expiry
INVAL Can invalidate
REVOKE Can revoke
JOIN Can join this keyring
CLEAR Can clear this keyring
The KEYCTL_SETPERM function is then deprecated.
The KEYCTL_SET_TIMEOUT function then is permitted if SET_SECURITY is set,
or if the caller has a valid instantiation auth token.
The KEYCTL_INVALIDATE function then requires INVAL.
The KEYCTL_REVOKE function then requires REVOKE.
The KEYCTL_JOIN_SESSION_KEYRING function then requires JOIN to join an
existing keyring.
The JOIN permission is enabled by default for session keyrings and manually
created keyrings only.
======================
BACKWARD COMPATIBILITY
======================
To maintain backward compatibility, KEYCTL_SETPERM will translate the
permissions mask it is given into a new ACL for a key - unless
KEYCTL_SET_ACL has been called on that key, in which case an error will be
returned.
It will convert possessor, owner, group and other permissions into separate
ACEs, if each portion of the mask is non-zero.
SETATTR permission turns on all of INVAL, REVOKE and SET_SECURITY. WRITE
permission turns on WRITE, REVOKE and, if a keyring, CLEAR. JOIN is turned
on if a keyring is being altered.
The KEYCTL_DESCRIBE function translates the ACL back into a permissions
mask to return depending on possessor, owner, group and everyone ACEs.
It will make the following mappings:
(1) INVAL, JOIN -> SEARCH
(2) SET_SECURITY -> SETATTR
(3) REVOKE -> WRITE if SETATTR isn't already set
(4) CLEAR -> WRITE
Note that the value subsequently returned by KEYCTL_DESCRIBE may not match
the value set with KEYCTL_SETATTR.
=======
TESTING
=======
This passes the keyutils testsuite for all but a couple of tests:
(1) tests/keyctl/dh_compute/badargs: The first wrong-key-type test now
returns EOPNOTSUPP rather than ENOKEY as READ permission isn't removed
if the type doesn't have ->read(). You still can't actually read the
key.
(2) tests/keyctl/permitting/valid: The view-other-permissions test doesn't
work as Other has been replaced with Everyone in the ACL.
Signed-off-by: David Howells <dhowells@redhat.com>
2019-06-28 06:03:07 +08:00
|
|
|
spnego_key = request_key(&cifs_spnego_key_type, description, "",
|
|
|
|
&cifs_spnego_key_acl);
|
2016-05-18 07:20:13 +08:00
|
|
|
revert_creds(saved_cred);
|
2007-11-05 22:38:08 +08:00
|
|
|
|
2007-12-31 08:51:45 +08:00
|
|
|
#ifdef CONFIG_CIFS_DEBUG2
|
2007-11-05 22:38:08 +08:00
|
|
|
if (cifsFYI && !IS_ERR(spnego_key)) {
|
2015-10-21 21:04:48 +08:00
|
|
|
struct cifs_spnego_msg *msg = spnego_key->payload.data[0];
|
2008-02-05 23:51:24 +08:00
|
|
|
cifs_dump_mem("SPNEGO reply blob:", msg->data, min(1024U,
|
2007-12-31 08:51:45 +08:00
|
|
|
msg->secblob_len + msg->sesskey_len));
|
2007-11-05 22:38:08 +08:00
|
|
|
}
|
2007-12-31 08:51:45 +08:00
|
|
|
#endif /* CONFIG_CIFS_DEBUG2 */
|
2007-11-05 22:38:08 +08:00
|
|
|
|
|
|
|
out:
|
|
|
|
kfree(description);
|
|
|
|
return spnego_key;
|
|
|
|
}
|
2016-05-18 07:20:13 +08:00
|
|
|
|
|
|
|
int
|
|
|
|
init_cifs_spnego(void)
|
|
|
|
{
|
|
|
|
struct cred *cred;
|
|
|
|
struct key *keyring;
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
cifs_dbg(FYI, "Registering the %s key type\n",
|
|
|
|
cifs_spnego_key_type.name);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Create an override credential set with special thread keyring for
|
|
|
|
* spnego upcalls.
|
|
|
|
*/
|
|
|
|
|
|
|
|
cred = prepare_kernel_cred(NULL);
|
|
|
|
if (!cred)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
keyring = keyring_alloc(".cifs_spnego",
|
|
|
|
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
|
keys: Replace uid/gid/perm permissions checking with an ACL
Replace the uid/gid/perm permissions checking on a key with an ACL to allow
the SETATTR and SEARCH permissions to be split. This will also allow a
greater range of subjects to represented.
============
WHY DO THIS?
============
The problem is that SETATTR and SEARCH cover a slew of actions, not all of
which should be grouped together.
For SETATTR, this includes actions that are about controlling access to a
key:
(1) Changing a key's ownership.
(2) Changing a key's security information.
(3) Setting a keyring's restriction.
And actions that are about managing a key's lifetime:
(4) Setting an expiry time.
(5) Revoking a key.
and (proposed) managing a key as part of a cache:
(6) Invalidating a key.
Managing a key's lifetime doesn't really have anything to do with
controlling access to that key.
Expiry time is awkward since it's more about the lifetime of the content
and so, in some ways goes better with WRITE permission. It can, however,
be set unconditionally by a process with an appropriate authorisation token
for instantiating a key, and can also be set by the key type driver when a
key is instantiated, so lumping it with the access-controlling actions is
probably okay.
As for SEARCH permission, that currently covers:
(1) Finding keys in a keyring tree during a search.
(2) Permitting keyrings to be joined.
(3) Invalidation.
But these don't really belong together either, since these actions really
need to be controlled separately.
Finally, there are number of special cases to do with granting the
administrator special rights to invalidate or clear keys that I would like
to handle with the ACL rather than key flags and special checks.
===============
WHAT IS CHANGED
===============
The SETATTR permission is split to create two new permissions:
(1) SET_SECURITY - which allows the key's owner, group and ACL to be
changed and a restriction to be placed on a keyring.
(2) REVOKE - which allows a key to be revoked.
The SEARCH permission is split to create:
(1) SEARCH - which allows a keyring to be search and a key to be found.
(2) JOIN - which allows a keyring to be joined as a session keyring.
(3) INVAL - which allows a key to be invalidated.
The WRITE permission is also split to create:
(1) WRITE - which allows a key's content to be altered and links to be
added, removed and replaced in a keyring.
(2) CLEAR - which allows a keyring to be cleared completely. This is
split out to make it possible to give just this to an administrator.
(3) REVOKE - see above.
Keys acquire ACLs which consist of a series of ACEs, and all that apply are
unioned together. An ACE specifies a subject, such as:
(*) Possessor - permitted to anyone who 'possesses' a key
(*) Owner - permitted to the key owner
(*) Group - permitted to the key group
(*) Everyone - permitted to everyone
Note that 'Other' has been replaced with 'Everyone' on the assumption that
you wouldn't grant a permit to 'Other' that you wouldn't also grant to
everyone else.
Further subjects may be made available by later patches.
The ACE also specifies a permissions mask. The set of permissions is now:
VIEW Can view the key metadata
READ Can read the key content
WRITE Can update/modify the key content
SEARCH Can find the key by searching/requesting
LINK Can make a link to the key
SET_SECURITY Can change owner, ACL, expiry
INVAL Can invalidate
REVOKE Can revoke
JOIN Can join this keyring
CLEAR Can clear this keyring
The KEYCTL_SETPERM function is then deprecated.
The KEYCTL_SET_TIMEOUT function then is permitted if SET_SECURITY is set,
or if the caller has a valid instantiation auth token.
The KEYCTL_INVALIDATE function then requires INVAL.
The KEYCTL_REVOKE function then requires REVOKE.
The KEYCTL_JOIN_SESSION_KEYRING function then requires JOIN to join an
existing keyring.
The JOIN permission is enabled by default for session keyrings and manually
created keyrings only.
======================
BACKWARD COMPATIBILITY
======================
To maintain backward compatibility, KEYCTL_SETPERM will translate the
permissions mask it is given into a new ACL for a key - unless
KEYCTL_SET_ACL has been called on that key, in which case an error will be
returned.
It will convert possessor, owner, group and other permissions into separate
ACEs, if each portion of the mask is non-zero.
SETATTR permission turns on all of INVAL, REVOKE and SET_SECURITY. WRITE
permission turns on WRITE, REVOKE and, if a keyring, CLEAR. JOIN is turned
on if a keyring is being altered.
The KEYCTL_DESCRIBE function translates the ACL back into a permissions
mask to return depending on possessor, owner, group and everyone ACEs.
It will make the following mappings:
(1) INVAL, JOIN -> SEARCH
(2) SET_SECURITY -> SETATTR
(3) REVOKE -> WRITE if SETATTR isn't already set
(4) CLEAR -> WRITE
Note that the value subsequently returned by KEYCTL_DESCRIBE may not match
the value set with KEYCTL_SETATTR.
=======
TESTING
=======
This passes the keyutils testsuite for all but a couple of tests:
(1) tests/keyctl/dh_compute/badargs: The first wrong-key-type test now
returns EOPNOTSUPP rather than ENOKEY as READ permission isn't removed
if the type doesn't have ->read(). You still can't actually read the
key.
(2) tests/keyctl/permitting/valid: The view-other-permissions test doesn't
work as Other has been replaced with Everyone in the ACL.
Signed-off-by: David Howells <dhowells@redhat.com>
2019-06-28 06:03:07 +08:00
|
|
|
&cifs_spnego_keyring_acl,
|
2016-05-18 07:20:13 +08:00
|
|
|
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
|
|
|
|
if (IS_ERR(keyring)) {
|
|
|
|
ret = PTR_ERR(keyring);
|
|
|
|
goto failed_put_cred;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = register_key_type(&cifs_spnego_key_type);
|
|
|
|
if (ret < 0)
|
|
|
|
goto failed_put_key;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* instruct request_key() to use this special keyring as a cache for
|
|
|
|
* the results it looks up
|
|
|
|
*/
|
|
|
|
set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags);
|
|
|
|
cred->thread_keyring = keyring;
|
|
|
|
cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
|
|
|
|
spnego_cred = cred;
|
|
|
|
|
|
|
|
cifs_dbg(FYI, "cifs spnego keyring: %d\n", key_serial(keyring));
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
failed_put_key:
|
|
|
|
key_put(keyring);
|
|
|
|
failed_put_cred:
|
|
|
|
put_cred(cred);
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
|
|
|
exit_cifs_spnego(void)
|
|
|
|
{
|
|
|
|
key_revoke(spnego_cred->thread_keyring);
|
|
|
|
unregister_key_type(&cifs_spnego_key_type);
|
|
|
|
put_cred(spnego_cred);
|
|
|
|
cifs_dbg(FYI, "Unregistered %s key type\n", cifs_spnego_key_type.name);
|
|
|
|
}
|