security/keys/process_keys.c

   1 /* Management of a process's keyrings
   2  *
   3  * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/sched.h>
  15 #include <linux/keyctl.h>
  16 #include <linux/fs.h>
  17 #include <linux/err.h>
  18 #include <linux/mutex.h>
  19 #include <linux/security.h>
  20 #include <linux/user_namespace.h>
  21 #include <asm/uaccess.h>
  22 #include "internal.h"
  23
  24 /* session keyring create vs join semaphore */
  25 static DEFINE_MUTEX(key_session_mutex);
  26
  27 /* user keyring creation semaphore */
  28 static DEFINE_MUTEX(key_user_keyring_mutex);
  29
  30 /* the root user's tracking struct */
  31 struct key_user root_key_user = {
  32         .usage          = ATOMIC_INIT(3),
  33         .cons_lock      = __MUTEX_INITIALIZER(root_key_user.cons_lock),
  34         .lock           = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
  35         .nkeys          = ATOMIC_INIT(2),
  36         .nikeys         = ATOMIC_INIT(2),
  37         .uid            = 0,
  38         .user_ns        = &init_user_ns,
  39 };
  40
  41 /*
  42  * install user and user session keyrings for a particular UID
  43  */
  44 int install_user_keyrings(void)
  45 {
  46         struct user_struct *user;
  47         const struct cred *cred;
  48         struct key *uid_keyring, *session_keyring;
  49         char buf[20];
  50         int ret;
  51
  52         cred = current_cred();
  53         user = cred->user;
  54
  55         kenter("%p{%u}", user, user->uid);
  56
  57         if (user->uid_keyring) {
  58                 kleave(" = 0 [exist]");
  59                 return 0;
  60         }
  61
  62         mutex_lock(&key_user_keyring_mutex);
  63         ret = 0;
  64
  65         if (!user->uid_keyring) {
  66                 /* get the UID-specific keyring
  67                  * - there may be one in existence already as it may have been
  68                  *   pinned by a session, but the user_struct pointing to it
  69                  *   may have been destroyed by setuid */
  70                 sprintf(buf, "_uid.%u", user->uid);
  71
  72                 uid_keyring = find_keyring_by_name(buf, true);
  73                 if (IS_ERR(uid_keyring)) {
  74                         uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
  75                                                     cred, KEY_ALLOC_IN_QUOTA,
  76                                                     NULL);
  77                         if (IS_ERR(uid_keyring)) {
  78                                 ret = PTR_ERR(uid_keyring);
  79                                 goto error;
  80                         }
  81                 }
  82
  83                 /* get a default session keyring (which might also exist
  84                  * already) */
  85                 sprintf(buf, "_uid_ses.%u", user->uid);
  86
  87                 session_keyring = find_keyring_by_name(buf, true);
  88                 if (IS_ERR(session_keyring)) {
  89                         session_keyring =
  90                                 keyring_alloc(buf, user->uid, (gid_t) -1,
  91                                               cred, KEY_ALLOC_IN_QUOTA, NULL);
  92                         if (IS_ERR(session_keyring)) {
  93                                 ret = PTR_ERR(session_keyring);
  94                                 goto error_release;
  95                         }
  96
  97                         /* we install a link from the user session keyring to
  98                          * the user keyring */
  99                         ret = key_link(session_keyring, uid_keyring);
 100                         if (ret < 0)
 101                                 goto error_release_both;
 102                 }
 103
 104                 /* install the keyrings */
 105                 user->uid_keyring = uid_keyring;
 106                 user->session_keyring = session_keyring;
 107         }
 108
 109         mutex_unlock(&key_user_keyring_mutex);
 110         kleave(" = 0");
 111         return 0;
 112
 113 error_release_both:
 114         key_put(session_keyring);
 115 error_release:
 116         key_put(uid_keyring);
 117 error:
 118         mutex_unlock(&key_user_keyring_mutex);
 119         kleave(" = %d", ret);
 120         return ret;
 121 }
 122
 123 /*
 124  * install a fresh thread keyring directly to new credentials
 125  */
 126 int install_thread_keyring_to_cred(struct cred *new)
 127 {
 128         struct key *keyring;
 129
 130         keyring = keyring_alloc("_tid", new->uid, new->gid, new,
 131                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
 132         if (IS_ERR(keyring))
 133                 return PTR_ERR(keyring);
 134
 135         new->thread_keyring = keyring;
 136         return 0;
 137 }
 138
 139 /*
 140  * install a fresh thread keyring, discarding the old one
 141  */
 142 static int install_thread_keyring(void)
 143 {
 144         struct cred *new;
 145         int ret;
 146
 147         new = prepare_creds();
 148         if (!new)
 149                 return -ENOMEM;
 150
 151         BUG_ON(new->thread_keyring);
 152
 153         ret = install_thread_keyring_to_cred(new);
 154         if (ret < 0) {
 155                 abort_creds(new);
 156                 return ret;
 157         }
 158
 159         return commit_creds(new);
 160 }
 161
 162 /*
 163  * install a process keyring directly to a credentials struct
 164  * - returns -EEXIST if there was already a process keyring, 0 if one installed,
 165  *   and other -ve on any other error
 166  */
 167 int install_process_keyring_to_cred(struct cred *new)
 168 {
 169         struct key *keyring;
 170         int ret;
 171
 172         if (new->tgcred->process_keyring)
 173                 return -EEXIST;
 174
 175         keyring = keyring_alloc("_pid", new->uid, new->gid,
 176                                 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
 177         if (IS_ERR(keyring))
 178                 return PTR_ERR(keyring);
 179
 180         spin_lock_irq(&new->tgcred->lock);
 181         if (!new->tgcred->process_keyring) {
 182                 new->tgcred->process_keyring = keyring;
 183                 keyring = NULL;
 184                 ret = 0;
 185         } else {
 186                 ret = -EEXIST;
 187         }
 188         spin_unlock_irq(&new->tgcred->lock);
 189         key_put(keyring);
 190         return ret;
 191 }
 192
 193 /*
 194  * make sure a process keyring is installed
 195  * - we
 196  */
 197 static int install_process_keyring(void)
 198 {
 199         struct cred *new;
 200         int ret;
 201
 202         new = prepare_creds();
 203         if (!new)
 204                 return -ENOMEM;
 205
 206         ret = install_process_keyring_to_cred(new);
 207         if (ret < 0) {
 208                 abort_creds(new);
 209                 return ret != -EEXIST ? ret : 0;
 210         }
 211
 212         return commit_creds(new);
 213 }
 214
 215 /*
 216  * install a session keyring directly to a credentials struct
 217  */
 218 int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 219 {
 220         unsigned long flags;
 221         struct key *old;
 222
 223         might_sleep();
 224
 225         /* create an empty session keyring */
 226         if (!keyring) {
 227                 flags = KEY_ALLOC_QUOTA_OVERRUN;
 228                 if (cred->tgcred->session_keyring)
 229                         flags = KEY_ALLOC_IN_QUOTA;
 230
 231                 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
 232                                         cred, flags, NULL);
 233                 if (IS_ERR(keyring))
 234                         return PTR_ERR(keyring);
 235         } else {
 236                 atomic_inc(&keyring->usage);
 237         }
 238
 239         /* install the keyring */
 240         spin_lock_irq(&cred->tgcred->lock);
 241         old = cred->tgcred->session_keyring;
 242         rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
 243         spin_unlock_irq(&cred->tgcred->lock);
 244
 245         /* we're using RCU on the pointer, but there's no point synchronising
 246          * on it if it didn't previously point to anything */
 247         if (old) {
 248                 synchronize_rcu();
 249                 key_put(old);
 250         }
 251
 252         return 0;
 253 }
 254
 255 /*
 256  * install a session keyring, discarding the old one
 257  * - if a keyring is not supplied, an empty one is invented
 258  */
 259 static int install_session_keyring(struct key *keyring)
 260 {
 261         struct cred *new;
 262         int ret;
 263
 264         new = prepare_creds();
 265         if (!new)
 266                 return -ENOMEM;
 267
 268         ret = install_session_keyring_to_cred(new, NULL);
 269         if (ret < 0) {
 270                 abort_creds(new);
 271                 return ret;
 272         }
 273
 274         return commit_creds(new);
 275 }
 276
 277 /*
 278  * the filesystem user ID changed
 279  */
 280 void key_fsuid_changed(struct task_struct *tsk)
 281 {
 282         /* update the ownership of the thread keyring */
 283         BUG_ON(!tsk->cred);
 284         if (tsk->cred->thread_keyring) {
 285                 down_write(&tsk->cred->thread_keyring->sem);
 286                 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
 287                 up_write(&tsk->cred->thread_keyring->sem);
 288         }
 289 }
 290
 291 /*
 292  * the filesystem group ID changed
 293  */
 294 void key_fsgid_changed(struct task_struct *tsk)
 295 {
 296         /* update the ownership of the thread keyring */
 297         BUG_ON(!tsk->cred);
 298         if (tsk->cred->thread_keyring) {
 299                 down_write(&tsk->cred->thread_keyring->sem);
 300                 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
 301                 up_write(&tsk->cred->thread_keyring->sem);
 302         }
 303 }
 304
 305 /*
 306  * search only my process keyrings for the first matching key
 307  * - we use the supplied match function to see if the description (or other
 308  *   feature of interest) matches
 309  * - we return -EAGAIN if we didn't find any matching key
 310  * - we return -ENOKEY if we found only negative matching keys
 311  */
 312 key_ref_t search_my_process_keyrings(struct key_type *type,
 313                                      const void *description,
 314                                      key_match_func_t match,
 315                                      const struct cred *cred)
 316 {
 317         key_ref_t key_ref, ret, err;
 318
 319         /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
 320          * searchable, but we failed to find a key or we found a negative key;
 321          * otherwise we want to return a sample error (probably -EACCES) if
 322          * none of the keyrings were searchable
 323          *
 324          * in terms of priority: success > -ENOKEY > -EAGAIN > other error
 325          */
 326         key_ref = NULL;
 327         ret = NULL;
 328         err = ERR_PTR(-EAGAIN);
 329
 330         /* search the thread keyring first */
 331         if (cred->thread_keyring) {
 332                 key_ref = keyring_search_aux(
 333                         make_key_ref(cred->thread_keyring, 1),
 334                         cred, type, description, match);
 335                 if (!IS_ERR(key_ref))
 336                         goto found;
 337
 338                 switch (PTR_ERR(key_ref)) {
 339                 case -EAGAIN: /* no key */
 340                         if (ret)
 341                                 break;
 342                 case -ENOKEY: /* negative key */
 343                         ret = key_ref;
 344                         break;
 345                 default:
 346                         err = key_ref;
 347                         break;
 348                 }
 349         }
 350
 351         /* search the process keyring second */
 352         if (cred->tgcred->process_keyring) {
 353                 key_ref = keyring_search_aux(
 354                         make_key_ref(cred->tgcred->process_keyring, 1),
 355                         cred, type, description, match);
 356                 if (!IS_ERR(key_ref))
 357                         goto found;
 358
 359                 switch (PTR_ERR(key_ref)) {
 360                 case -EAGAIN: /* no key */
 361                         if (ret)
 362                                 break;
 363                 case -ENOKEY: /* negative key */
 364                         ret = key_ref;
 365                         break;
 366                 default:
 367                         err = key_ref;
 368                         break;
 369                 }
 370         }
 371
 372         /* search the session keyring */
 373         if (cred->tgcred->session_keyring) {
 374                 rcu_read_lock();
 375                 key_ref = keyring_search_aux(
 376                         make_key_ref(rcu_dereference(
 377                                              cred->tgcred->session_keyring),
 378                                      1),
 379                         cred, type, description, match);
 380                 rcu_read_unlock();
 381
 382                 if (!IS_ERR(key_ref))
 383                         goto found;
 384
 385                 switch (PTR_ERR(key_ref)) {
 386                 case -EAGAIN: /* no key */
 387                         if (ret)
 388                                 break;
 389                 case -ENOKEY: /* negative key */
 390                         ret = key_ref;
 391                         break;
 392                 default:
 393                         err = key_ref;
 394                         break;
 395                 }
 396         }
 397         /* or search the user-session keyring */
 398         else if (cred->user->session_keyring) {
 399                 key_ref = keyring_search_aux(
 400                         make_key_ref(cred->user->session_keyring, 1),
 401                         cred, type, description, match);
 402                 if (!IS_ERR(key_ref))
 403                         goto found;
 404
 405                 switch (PTR_ERR(key_ref)) {
 406                 case -EAGAIN: /* no key */
 407                         if (ret)
 408                                 break;
 409                 case -ENOKEY: /* negative key */
 410                         ret = key_ref;
 411                         break;
 412                 default:
 413                         err = key_ref;
 414                         break;
 415                 }
 416         }
 417
 418         /* no key - decide on the error we're going to go for */
 419         key_ref = ret ? ret : err;
 420
 421 found:
 422         return key_ref;
 423 }
 424
 425 /*
 426  * search the process keyrings for the first matching key
 427  * - we use the supplied match function to see if the description (or other
 428  *   feature of interest) matches
 429  * - we return -EAGAIN if we didn't find any matching key
 430  * - we return -ENOKEY if we found only negative matching keys
 431  */
 432 key_ref_t search_process_keyrings(struct key_type *type,
 433                                   const void *description,
 434                                   key_match_func_t match,
 435                                   const struct cred *cred)
 436 {
 437         struct request_key_auth *rka;
 438         key_ref_t key_ref, ret = ERR_PTR(-EACCES), err;
 439
 440         might_sleep();
 441
 442         key_ref = search_my_process_keyrings(type, description, match, cred);
 443         if (!IS_ERR(key_ref))
 444                 goto found;
 445         err = key_ref;
 446
 447         /* if this process has an instantiation authorisation key, then we also
 448          * search the keyrings of the process mentioned there
 449          * - we don't permit access to request_key auth keys via this method
 450          */
 451         if (cred->request_key_auth &&
 452             cred == current_cred() &&
 453             type != &key_type_request_key_auth
 454             ) {
 455                 /* defend against the auth key being revoked */
 456                 down_read(&cred->request_key_auth->sem);
 457
 458                 if (key_validate(cred->request_key_auth) == 0) {
 459                         rka = cred->request_key_auth->payload.data;
 460
 461                         key_ref = search_process_keyrings(type, description,
 462                                                           match, rka->cred);
 463
 464                         up_read(&cred->request_key_auth->sem);
 465
 466                         if (!IS_ERR(key_ref))
 467                                 goto found;
 468
 469                         ret = key_ref;
 470                 } else {
 471                         up_read(&cred->request_key_auth->sem);
 472                 }
 473         }
 474
 475         /* no key - decide on the error we're going to go for */
 476         if (err == ERR_PTR(-ENOKEY) || ret == ERR_PTR(-ENOKEY))
 477                 key_ref = ERR_PTR(-ENOKEY);
 478         else if (err == ERR_PTR(-EACCES))
 479                 key_ref = ret;
 480         else
 481                 key_ref = err;
 482
 483 found:
 484         return key_ref;
 485 }
 486
 487 /*
 488  * see if the key we're looking at is the target key
 489  */
 490 int lookup_user_key_possessed(const struct key *key, const void *target)
 491 {
 492         return key == target;
 493 }
 494
 495 /*
 496  * lookup a key given a key ID from userspace with a given permissions mask
 497  * - don't create special keyrings unless so requested
 498  * - partially constructed keys aren't found unless requested
 499  */
 500 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
 501                           key_perm_t perm)
 502 {
 503         struct request_key_auth *rka;
 504         const struct cred *cred;
 505         struct key *key;
 506         key_ref_t key_ref, skey_ref;
 507         int ret;
 508
 509 try_again:
 510         cred = get_current_cred();
 511         key_ref = ERR_PTR(-ENOKEY);
 512
 513         switch (id) {
 514         case KEY_SPEC_THREAD_KEYRING:
 515                 if (!cred->thread_keyring) {
 516                         if (!(lflags & KEY_LOOKUP_CREATE))
 517                                 goto error;
 518
 519                         ret = install_thread_keyring();
 520                         if (ret < 0) {
 521                                 key_ref = ERR_PTR(ret);
 522                                 goto error;
 523                         }
 524                         goto reget_creds;
 525                 }
 526
 527                 key = cred->thread_keyring;
 528                 atomic_inc(&key->usage);
 529                 key_ref = make_key_ref(key, 1);
 530                 break;
 531
 532         case KEY_SPEC_PROCESS_KEYRING:
 533                 if (!cred->tgcred->process_keyring) {
 534                         if (!(lflags & KEY_LOOKUP_CREATE))
 535                                 goto error;
 536
 537                         ret = install_process_keyring();
 538                         if (ret < 0) {
 539                                 key_ref = ERR_PTR(ret);
 540                                 goto error;
 541                         }
 542                         goto reget_creds;
 543                 }
 544
 545                 key = cred->tgcred->process_keyring;
 546                 atomic_inc(&key->usage);
 547                 key_ref = make_key_ref(key, 1);
 548                 break;
 549
 550         case KEY_SPEC_SESSION_KEYRING:
 551                 if (!cred->tgcred->session_keyring) {
 552                         /* always install a session keyring upon access if one
 553                          * doesn't exist yet */
 554                         ret = install_user_keyrings();
 555                         if (ret < 0)
 556                                 goto error;
 557                         ret = install_session_keyring(
 558                                 cred->user->session_keyring);
 559
 560                         if (ret < 0)
 561                                 goto error;
 562                         goto reget_creds;
 563                 }
 564
 565                 rcu_read_lock();
 566                 key = rcu_dereference(cred->tgcred->session_keyring);
 567                 atomic_inc(&key->usage);
 568                 rcu_read_unlock();
 569                 key_ref = make_key_ref(key, 1);
 570                 break;
 571
 572         case KEY_SPEC_USER_KEYRING:
 573                 if (!cred->user->uid_keyring) {
 574                         ret = install_user_keyrings();
 575                         if (ret < 0)
 576                                 goto error;
 577                 }
 578
 579                 key = cred->user->uid_keyring;
 580                 atomic_inc(&key->usage);
 581                 key_ref = make_key_ref(key, 1);
 582                 break;
 583
 584         case KEY_SPEC_USER_SESSION_KEYRING:
 585                 if (!cred->user->session_keyring) {
 586                         ret = install_user_keyrings();
 587                         if (ret < 0)
 588                                 goto error;
 589                 }
 590
 591                 key = cred->user->session_keyring;
 592                 atomic_inc(&key->usage);
 593                 key_ref = make_key_ref(key, 1);
 594                 break;
 595
 596         case KEY_SPEC_GROUP_KEYRING:
 597                 /* group keyrings are not yet supported */
 598                 key_ref = ERR_PTR(-EINVAL);
 599                 goto error;
 600
 601         case KEY_SPEC_REQKEY_AUTH_KEY:
 602                 key = cred->request_key_auth;
 603                 if (!key)
 604                         goto error;
 605
 606                 atomic_inc(&key->usage);
 607                 key_ref = make_key_ref(key, 1);
 608                 break;
 609
 610         case KEY_SPEC_REQUESTOR_KEYRING:
 611                 if (!cred->request_key_auth)
 612                         goto error;
 613
 614                 down_read(&cred->request_key_auth->sem);
 615                 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
 616                         key_ref = ERR_PTR(-EKEYREVOKED);
 617                         key = NULL;
 618                 } else {
 619                         rka = cred->request_key_auth->payload.data;
 620                         key = rka->dest_keyring;
 621                         atomic_inc(&key->usage);
 622                 }
 623                 up_read(&cred->request_key_auth->sem);
 624                 if (!key)
 625                         goto error;
 626                 key_ref = make_key_ref(key, 1);
 627                 break;
 628
 629         default:
 630                 key_ref = ERR_PTR(-EINVAL);
 631                 if (id < 1)
 632                         goto error;
 633
 634                 key = key_lookup(id);
 635                 if (IS_ERR(key)) {
 636                         key_ref = ERR_CAST(key);
 637                         goto error;
 638                 }
 639
 640                 key_ref = make_key_ref(key, 0);
 641
 642                 /* check to see if we possess the key */
 643                 skey_ref = search_process_keyrings(key->type, key,
 644                                                    lookup_user_key_possessed,
 645                                                    cred);
 646
 647                 if (!IS_ERR(skey_ref)) {
 648                         key_put(key);
 649                         key_ref = skey_ref;
 650                 }
 651
 652                 break;
 653         }
 654
 655         /* unlink does not use the nominated key in any way, so can skip all
 656          * the permission checks as it is only concerned with the keyring */
 657         if (lflags & KEY_LOOKUP_FOR_UNLINK) {
 658                 ret = 0;
 659                 goto error;
 660         }
 661
 662         if (!(lflags & KEY_LOOKUP_PARTIAL)) {
 663                 ret = wait_for_key_construction(key, true);
 664                 switch (ret) {
 665                 case -ERESTARTSYS:
 666                         goto invalid_key;
 667                 default:
 668                         if (perm)
 669                                 goto invalid_key;
 670                 case 0:
 671                         break;
 672                 }
 673         } else if (perm) {
 674                 ret = key_validate(key);
 675                 if (ret < 0)
 676                         goto invalid_key;
 677         }
 678
 679         ret = -EIO;
 680         if (!(lflags & KEY_LOOKUP_PARTIAL) &&
 681             !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 682                 goto invalid_key;
 683
 684         /* check the permissions */
 685         ret = key_task_permission(key_ref, cred, perm);
 686         if (ret < 0)
 687                 goto invalid_key;
 688
 689 error:
 690         put_cred(cred);
 691         return key_ref;
 692
 693 invalid_key:
 694         key_ref_put(key_ref);
 695         key_ref = ERR_PTR(ret);
 696         goto error;
 697
 698         /* if we attempted to install a keyring, then it may have caused new
 699          * creds to be installed */
 700 reget_creds:
 701         put_cred(cred);
 702         goto try_again;
 703 }
 704
 705 /*
 706  * join the named keyring as the session keyring if possible, or attempt to
 707  * create a new one of that name if not
 708  * - if the name is NULL, an empty anonymous keyring is installed instead
 709  * - named session keyring joining is done with a semaphore held
 710  */
 711 long join_session_keyring(const char *name)
 712 {
 713         const struct cred *old;
 714         struct cred *new;
 715         struct key *keyring;
 716         long ret, serial;
 717
 718         /* only permit this if there's a single thread in the thread group -
 719          * this avoids us having to adjust the creds on all threads and risking
 720          * ENOMEM */
 721         if (!current_is_single_threaded())
 722                 return -EMLINK;
 723
 724         new = prepare_creds();
 725         if (!new)
 726                 return -ENOMEM;
 727         old = current_cred();
 728
 729         /* if no name is provided, install an anonymous keyring */
 730         if (!name) {
 731                 ret = install_session_keyring_to_cred(new, NULL);
 732                 if (ret < 0)
 733                         goto error;
 734
 735                 serial = new->tgcred->session_keyring->serial;
 736                 ret = commit_creds(new);
 737                 if (ret == 0)
 738                         ret = serial;
 739                 goto okay;
 740         }
 741
 742         /* allow the user to join or create a named keyring */
 743         mutex_lock(&key_session_mutex);
 744
 745         /* look for an existing keyring of this name */
 746         keyring = find_keyring_by_name(name, false);
 747         if (PTR_ERR(keyring) == -ENOKEY) {
 748                 /* not found - try and create a new one */
 749                 keyring = keyring_alloc(name, old->uid, old->gid, old,
 750                                         KEY_ALLOC_IN_QUOTA, NULL);
 751                 if (IS_ERR(keyring)) {
 752                         ret = PTR_ERR(keyring);
 753                         goto error2;
 754                 }
 755         } else if (IS_ERR(keyring)) {
 756                 ret = PTR_ERR(keyring);
 757                 goto error2;
 758         }
 759
 760         /* we've got a keyring - now to install it */
 761         ret = install_session_keyring_to_cred(new, keyring);
 762         if (ret < 0)
 763                 goto error2;
 764
 765         commit_creds(new);
 766         mutex_unlock(&key_session_mutex);
 767
 768         ret = keyring->serial;
 769         key_put(keyring);
 770 okay:
 771         return ret;
 772
 773 error2:
 774         mutex_unlock(&key_session_mutex);
 775 error:
 776         abort_creds(new);
 777         return ret;
 778 }
 779
 780 /*
 781  * Replace a process's session keyring when that process resumes userspace on
 782  * behalf of one of its children
 783  */
 784 void key_replace_session_keyring(void)
 785 {
 786         const struct cred *old;
 787         struct cred *new;
 788
 789         if (!current->replacement_session_keyring)
 790                 return;
 791
 792         write_lock_irq(&tasklist_lock);
 793         new = current->replacement_session_keyring;
 794         current->replacement_session_keyring = NULL;
 795         write_unlock_irq(&tasklist_lock);
 796
 797         if (!new)
 798                 return;
 799
 800         old = current_cred();
 801         new->  uid      = old->  uid;
 802         new-> euid      = old-> euid;
 803         new-> suid      = old-> suid;
 804         new->fsuid      = old->fsuid;
 805         new->  gid      = old->  gid;
 806         new-> egid      = old-> egid;
 807         new-> sgid      = old-> sgid;
 808         new->fsgid      = old->fsgid;
 809         new->user       = get_uid(old->user);
 810         new->group_info = get_group_info(old->group_info);
 811
 812         new->securebits = old->securebits;
 813         new->cap_inheritable    = old->cap_inheritable;
 814         new->cap_permitted      = old->cap_permitted;
 815         new->cap_effective      = old->cap_effective;
 816         new->cap_bset           = old->cap_bset;
 817
 818         new->jit_keyring        = old->jit_keyring;
 819         new->thread_keyring     = key_get(old->thread_keyring);
 820         new->tgcred->tgid       = old->tgcred->tgid;
 821         new->tgcred->process_keyring = key_get(old->tgcred->process_keyring);
 822
 823         security_transfer_creds(new, old);
 824
 825         commit_creds(new);
 826 }