2 * kernel keyring utilities
4 * Copyright (C) 2016-2023 Red Hat, Inc. All rights reserved.
5 * Copyright (C) 2016-2023 Ondrej Kozina
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version 2
10 * of the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 #include <sys/syscall.h>
28 #include "libcryptsetup.h"
29 #include "libcryptsetup_macros.h"
30 #include "utils_keyring.h"
32 #ifndef HAVE_KEY_SERIAL_T
33 #define HAVE_KEY_SERIAL_T
34 typedef int32_t key_serial_t;
41 const char *type_name;
43 { LOGON_KEY, "logon" },
47 #include <linux/keyctl.h>
50 static key_serial_t request_key(const char *type,
51 const char *description,
52 const char *callout_info,
55 return syscall(__NR_request_key, type, description, callout_info, keyring);
59 static key_serial_t add_key(const char *type,
60 const char *description,
65 return syscall(__NR_add_key, type, description, payload, plen, keyring);
69 static long keyctl_read(key_serial_t key, char *buffer, size_t buflen)
71 return syscall(__NR_keyctl, KEYCTL_READ, key, buffer, buflen);
75 static long keyctl_revoke(key_serial_t key)
77 return syscall(__NR_keyctl, KEYCTL_REVOKE, key);
81 static long keyctl_unlink(key_serial_t key, key_serial_t keyring)
83 return syscall(__NR_keyctl, KEYCTL_UNLINK, key, keyring);
87 int keyring_check(void)
90 /* logon type key descriptions must be in format "prefix:description" */
91 return syscall(__NR_request_key, "logon", "dummy", NULL, 0) == -1l && errno != ENOSYS;
97 int keyring_add_key_in_thread_keyring(key_type_t ktype, const char *key_desc, const void *key, size_t key_size)
101 const char *type_name = key_type_name(ktype);
103 if (!type_name || !key_desc)
106 kid = add_key(type_name, key_desc, key, key_size, KEY_SPEC_THREAD_KEYRING);
116 /* currently used in client utilities only */
117 int keyring_add_key_in_user_keyring(key_type_t ktype, const char *key_desc, const void *key, size_t key_size)
119 #ifdef KERNEL_KEYRING
120 const char *type_name = key_type_name(ktype);
123 if (!type_name || !key_desc)
126 kid = add_key(type_name, key_desc, key, key_size, KEY_SPEC_USER_KEYRING);
136 /* alias for the same code */
137 int keyring_get_key(const char *key_desc,
141 return keyring_get_passphrase(key_desc, key, key_size);
144 int keyring_get_passphrase(const char *key_desc,
146 size_t *passphrase_len)
148 #ifdef KERNEL_KEYRING
156 kid = request_key(key_type_name(USER_KEY), key_desc, NULL, 0);
157 while (kid < 0 && errno == EINTR);
162 /* just get payload size */
163 ret = keyctl_read(kid, NULL, 0);
166 buf = crypt_safe_alloc(len);
170 /* retrieve actual payload data */
171 ret = keyctl_read(kid, buf, len);
176 crypt_safe_free(buf);
181 *passphrase_len = len;
189 static int keyring_revoke_and_unlink_key_type(const char *type_name, const char *key_desc)
191 #ifdef KERNEL_KEYRING
194 if (!type_name || !key_desc)
198 kid = request_key(type_name, key_desc, NULL, 0);
199 while (kid < 0 && errno == EINTR);
204 if (keyctl_revoke(kid))
208 * best effort only. the key could have been linked
209 * in some other keyring and its payload is now
212 keyctl_unlink(kid, KEY_SPEC_THREAD_KEYRING);
213 keyctl_unlink(kid, KEY_SPEC_PROCESS_KEYRING);
214 keyctl_unlink(kid, KEY_SPEC_USER_KEYRING);
222 const char *key_type_name(key_type_t type)
224 #ifdef KERNEL_KEYRING
227 for (i = 0; i < ARRAY_SIZE(key_types); i++)
228 if (type == key_types[i].type)
229 return key_types[i].type_name;
234 int keyring_revoke_and_unlink_key(key_type_t ktype, const char *key_desc)
236 return keyring_revoke_and_unlink_key_type(key_type_name(ktype), key_desc);