SAFE public projects git trees. - safe/jmp/linux-2.6/blob - security/keys/process_keys.c

   1 /* Management of a process's keyrings
   2  *
   3  * Copyright (C) 2004-2005, 2008 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/init.h>
  14 #include <linux/sched.h>
  15 #include <linux/slab.h>
  16 #include <linux/keyctl.h>
  17 #include <linux/fs.h>
  18 #include <linux/err.h>
  19 #include <linux/mutex.h>
  20 #include <linux/security.h>
  21 #include <linux/user_namespace.h>
  22 #include <asm/uaccess.h>
  23 #include "internal.h"
  24
  25 /* session keyring create vs join semaphore */
  26 static DEFINE_MUTEX(key_session_mutex);
  27
  28 /* user keyring creation semaphore */
  29 static DEFINE_MUTEX(key_user_keyring_mutex);
  30
  31 /* the root user's tracking struct */
  32 struct key_user root_key_user = {
  33         .usage          = ATOMIC_INIT(3),
  34         .cons_lock      = __MUTEX_INITIALIZER(root_key_user.cons_lock),
  35         .lock           = __SPIN_LOCK_UNLOCKED(root_key_user.lock),
  36         .nkeys          = ATOMIC_INIT(2),
  37         .nikeys         = ATOMIC_INIT(2),
  38         .uid            = 0,
  39         .user_ns        = &init_user_ns,
  40 };
  41
  42 /*****************************************************************************/
  43 /*
  44  * install user and user session keyrings for a particular UID
  45  */
  46 int install_user_keyrings(void)
  47 {
  48         struct user_struct *user;
  49         const struct cred *cred;
  50         struct key *uid_keyring, *session_keyring;
  51         char buf[20];
  52         int ret;
  53
  54         cred = current_cred();
  55         user = cred->user;
  56
  57         kenter("%p{%u}", user, user->uid);
  58
  59         if (user->uid_keyring) {
  60                 kleave(" = 0 [exist]");
  61                 return 0;
  62         }
  63
  64         mutex_lock(&key_user_keyring_mutex);
  65         ret = 0;
  66
  67         if (!user->uid_keyring) {
  68                 /* get the UID-specific keyring
  69                  * - there may be one in existence already as it may have been
  70                  *   pinned by a session, but the user_struct pointing to it
  71                  *   may have been destroyed by setuid */
  72                 sprintf(buf, "_uid.%u", user->uid);
  73
  74                 uid_keyring = find_keyring_by_name(buf, true);
  75                 if (IS_ERR(uid_keyring)) {
  76                         uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
  77                                                     cred, KEY_ALLOC_IN_QUOTA,
  78                                                     NULL);
  79                         if (IS_ERR(uid_keyring)) {
  80                                 ret = PTR_ERR(uid_keyring);
  81                                 goto error;
  82                         }
  83                 }
  84
  85                 /* get a default session keyring (which might also exist
  86                  * already) */
  87                 sprintf(buf, "_uid_ses.%u", user->uid);
  88
  89                 session_keyring = find_keyring_by_name(buf, true);
  90                 if (IS_ERR(session_keyring)) {
  91                         session_keyring =
  92                                 keyring_alloc(buf, user->uid, (gid_t) -1,
  93                                               cred, KEY_ALLOC_IN_QUOTA, NULL);
  94                         if (IS_ERR(session_keyring)) {
  95                                 ret = PTR_ERR(session_keyring);
  96                                 goto error_release;
  97                         }
  98
  99                         /* we install a link from the user session keyring to
 100                          * the user keyring */
 101                         ret = key_link(session_keyring, uid_keyring);
 102                         if (ret < 0)
 103                                 goto error_release_both;
 104                 }
 105
 106                 /* install the keyrings */
 107                 user->uid_keyring = uid_keyring;
 108                 user->session_keyring = session_keyring;
 109         }
 110
 111         mutex_unlock(&key_user_keyring_mutex);
 112         kleave(" = 0");
 113         return 0;
 114
 115 error_release_both:
 116         key_put(session_keyring);
 117 error_release:
 118         key_put(uid_keyring);
 119 error:
 120         mutex_unlock(&key_user_keyring_mutex);
 121         kleave(" = %d", ret);
 122         return ret;
 123 }
 124
 125 /*
 126  * install a fresh thread keyring directly to new credentials
 127  */
 128 int install_thread_keyring_to_cred(struct cred *new)
 129 {
 130         struct key *keyring;
 131
 132         keyring = keyring_alloc("_tid", new->uid, new->gid, new,
 133                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
 134         if (IS_ERR(keyring))
 135                 return PTR_ERR(keyring);
 136
 137         new->thread_keyring = keyring;
 138         return 0;
 139 }
 140
 141 /*
 142  * install a fresh thread keyring, discarding the old one
 143  */
 144 static int install_thread_keyring(void)
 145 {
 146         struct cred *new;
 147         int ret;
 148
 149         new = prepare_creds();
 150         if (!new)
 151                 return -ENOMEM;
 152
 153         BUG_ON(new->thread_keyring);
 154
 155         ret = install_thread_keyring_to_cred(new);
 156         if (ret < 0) {
 157                 abort_creds(new);
 158                 return ret;
 159         }
 160
 161         return commit_creds(new);
 162 }
 163
 164 /*
 165  * install a process keyring directly to a credentials struct
 166  * - returns -EEXIST if there was already a process keyring, 0 if one installed,
 167  *   and other -ve on any other error
 168  */
 169 int install_process_keyring_to_cred(struct cred *new)
 170 {
 171         struct key *keyring;
 172         int ret;
 173
 174         if (new->tgcred->process_keyring)
 175                 return -EEXIST;
 176
 177         keyring = keyring_alloc("_pid", new->uid, new->gid,
 178                                 new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
 179         if (IS_ERR(keyring))
 180                 return PTR_ERR(keyring);
 181
 182         spin_lock_irq(&new->tgcred->lock);
 183         if (!new->tgcred->process_keyring) {
 184                 new->tgcred->process_keyring = keyring;
 185                 keyring = NULL;
 186                 ret = 0;
 187         } else {
 188                 ret = -EEXIST;
 189         }
 190         spin_unlock_irq(&new->tgcred->lock);
 191         key_put(keyring);
 192         return ret;
 193 }
 194
 195 /*
 196  * make sure a process keyring is installed
 197  * - we
 198  */
 199 static int install_process_keyring(void)
 200 {
 201         struct cred *new;
 202         int ret;
 203
 204         new = prepare_creds();
 205         if (!new)
 206                 return -ENOMEM;
 207
 208         ret = install_process_keyring_to_cred(new);
 209         if (ret < 0) {
 210                 abort_creds(new);
 211                 return ret != -EEXIST ?: 0;
 212         }
 213
 214         return commit_creds(new);
 215 }
 216
 217 /*
 218  * install a session keyring directly to a credentials struct
 219  */
 220 static int install_session_keyring_to_cred(struct cred *cred,
 221                                            struct key *keyring)
 222 {
 223         unsigned long flags;
 224         struct key *old;
 225
 226         might_sleep();
 227
 228         /* create an empty session keyring */
 229         if (!keyring) {
 230                 flags = KEY_ALLOC_QUOTA_OVERRUN;
 231                 if (cred->tgcred->session_keyring)
 232                         flags = KEY_ALLOC_IN_QUOTA;
 233
 234                 keyring = keyring_alloc("_ses", cred->uid, cred->gid,
 235                                         cred, flags, NULL);
 236                 if (IS_ERR(keyring))
 237                         return PTR_ERR(keyring);
 238         } else {
 239                 atomic_inc(&keyring->usage);
 240         }
 241
 242         /* install the keyring */
 243         spin_lock_irq(&cred->tgcred->lock);
 244         old = cred->tgcred->session_keyring;
 245         rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
 246         spin_unlock_irq(&cred->tgcred->lock);
 247
 248         /* we're using RCU on the pointer, but there's no point synchronising
 249          * on it if it didn't previously point to anything */
 250         if (old) {
 251                 synchronize_rcu();
 252                 key_put(old);
 253         }
 254
 255         return 0;
 256 }
 257
 258 /*
 259  * install a session keyring, discarding the old one
 260  * - if a keyring is not supplied, an empty one is invented
 261  */
 262 static int install_session_keyring(struct key *keyring)
 263 {
 264         struct cred *new;
 265         int ret;
 266
 267         new = prepare_creds();
 268         if (!new)
 269                 return -ENOMEM;
 270
 271         ret = install_session_keyring_to_cred(new, NULL);
 272         if (ret < 0) {
 273                 abort_creds(new);
 274                 return ret;
 275         }
 276
 277         return commit_creds(new);
 278 }
 279
 280 /*****************************************************************************/
 281 /*
 282  * the filesystem user ID changed
 283  */
 284 void key_fsuid_changed(struct task_struct *tsk)
 285 {
 286         /* update the ownership of the thread keyring */
 287         BUG_ON(!tsk->cred);
 288         if (tsk->cred->thread_keyring) {
 289                 down_write(&tsk->cred->thread_keyring->sem);
 290                 tsk->cred->thread_keyring->uid = tsk->cred->fsuid;
 291                 up_write(&tsk->cred->thread_keyring->sem);
 292         }
 293
 294 } /* end key_fsuid_changed() */
 295
 296 /*****************************************************************************/
 297 /*
 298  * the filesystem group ID changed
 299  */
 300 void key_fsgid_changed(struct task_struct *tsk)
 301 {
 302         /* update the ownership of the thread keyring */
 303         BUG_ON(!tsk->cred);
 304         if (tsk->cred->thread_keyring) {
 305                 down_write(&tsk->cred->thread_keyring->sem);
 306                 tsk->cred->thread_keyring->gid = tsk->cred->fsgid;
 307                 up_write(&tsk->cred->thread_keyring->sem);
 308         }
 309
 310 } /* end key_fsgid_changed() */
 311
 312 /*****************************************************************************/
 313 /*
 314  * search the process keyrings for the first matching key
 315  * - we use the supplied match function to see if the description (or other
 316  *   feature of interest) matches
 317  * - we return -EAGAIN if we didn't find any matching key
 318  * - we return -ENOKEY if we found only negative matching keys
 319  */
 320 key_ref_t search_process_keyrings(struct key_type *type,
 321                                   const void *description,
 322                                   key_match_func_t match,
 323                                   const struct cred *cred)
 324 {
 325         struct request_key_auth *rka;
 326         key_ref_t key_ref, ret, err;
 327
 328         might_sleep();
 329
 330         /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
 331          * searchable, but we failed to find a key or we found a negative key;
 332          * otherwise we want to return a sample error (probably -EACCES) if
 333          * none of the keyrings were searchable
 334          *
 335          * in terms of priority: success > -ENOKEY > -EAGAIN > other error
 336          */
 337         key_ref = NULL;
 338         ret = NULL;
 339         err = ERR_PTR(-EAGAIN);
 340
 341         /* search the thread keyring first */
 342         if (cred->thread_keyring) {
 343                 key_ref = keyring_search_aux(
 344                         make_key_ref(cred->thread_keyring, 1),
 345                         cred, type, description, match);
 346                 if (!IS_ERR(key_ref))
 347                         goto found;
 348
 349                 switch (PTR_ERR(key_ref)) {
 350                 case -EAGAIN: /* no key */
 351                         if (ret)
 352                                 break;
 353                 case -ENOKEY: /* negative key */
 354                         ret = key_ref;
 355                         break;
 356                 default:
 357                         err = key_ref;
 358                         break;
 359                 }
 360         }
 361
 362         /* search the process keyring second */
 363         if (cred->tgcred->process_keyring) {
 364                 key_ref = keyring_search_aux(
 365                         make_key_ref(cred->tgcred->process_keyring, 1),
 366                         cred, type, description, match);
 367                 if (!IS_ERR(key_ref))
 368                         goto found;
 369
 370                 switch (PTR_ERR(key_ref)) {
 371                 case -EAGAIN: /* no key */
 372                         if (ret)
 373                                 break;
 374                 case -ENOKEY: /* negative key */
 375                         ret = key_ref;
 376                         break;
 377                 default:
 378                         err = key_ref;
 379                         break;
 380                 }
 381         }
 382
 383         /* search the session keyring */
 384         if (cred->tgcred->session_keyring) {
 385                 rcu_read_lock();
 386                 key_ref = keyring_search_aux(
 387                         make_key_ref(rcu_dereference(
 388                                              cred->tgcred->session_keyring),
 389                                      1),
 390                         cred, type, description, match);
 391                 rcu_read_unlock();
 392
 393                 if (!IS_ERR(key_ref))
 394                         goto found;
 395
 396                 switch (PTR_ERR(key_ref)) {
 397                 case -EAGAIN: /* no key */
 398                         if (ret)
 399                                 break;
 400                 case -ENOKEY: /* negative key */
 401                         ret = key_ref;
 402                         break;
 403                 default:
 404                         err = key_ref;
 405                         break;
 406                 }
 407         }
 408         /* or search the user-session keyring */
 409         else if (cred->user->session_keyring) {
 410                 key_ref = keyring_search_aux(
 411                         make_key_ref(cred->user->session_keyring, 1),
 412                         cred, type, description, match);
 413                 if (!IS_ERR(key_ref))
 414                         goto found;
 415
 416                 switch (PTR_ERR(key_ref)) {
 417                 case -EAGAIN: /* no key */
 418                         if (ret)
 419                                 break;
 420                 case -ENOKEY: /* negative key */
 421                         ret = key_ref;
 422                         break;
 423                 default:
 424                         err = key_ref;
 425                         break;
 426                 }
 427         }
 428
 429         /* if this process has an instantiation authorisation key, then we also
 430          * search the keyrings of the process mentioned there
 431          * - we don't permit access to request_key auth keys via this method
 432          */
 433         if (cred->request_key_auth &&
 434             cred == current_cred() &&
 435             type != &key_type_request_key_auth
 436             ) {
 437                 /* defend against the auth key being revoked */
 438                 down_read(&cred->request_key_auth->sem);
 439
 440                 if (key_validate(cred->request_key_auth) == 0) {
 441                         rka = cred->request_key_auth->payload.data;
 442
 443                         key_ref = search_process_keyrings(type, description,
 444                                                           match, rka->cred);
 445
 446                         up_read(&cred->request_key_auth->sem);
 447
 448                         if (!IS_ERR(key_ref))
 449                                 goto found;
 450
 451                         switch (PTR_ERR(key_ref)) {
 452                         case -EAGAIN: /* no key */
 453                                 if (ret)
 454                                         break;
 455                         case -ENOKEY: /* negative key */
 456                                 ret = key_ref;
 457                                 break;
 458                         default:
 459                                 err = key_ref;
 460                                 break;
 461                         }
 462                 } else {
 463                         up_read(&cred->request_key_auth->sem);
 464                 }
 465         }
 466
 467         /* no key - decide on the error we're going to go for */
 468         key_ref = ret ? ret : err;
 469
 470 found:
 471         return key_ref;
 472
 473 } /* end search_process_keyrings() */
 474
 475 /*****************************************************************************/
 476 /*
 477  * see if the key we're looking at is the target key
 478  */
 479 static int lookup_user_key_possessed(const struct key *key, const void *target)
 480 {
 481         return key == target;
 482
 483 } /* end lookup_user_key_possessed() */
 484
 485 /*****************************************************************************/
 486 /*
 487  * lookup a key given a key ID from userspace with a given permissions mask
 488  * - don't create special keyrings unless so requested
 489  * - partially constructed keys aren't found unless requested
 490  */
 491 key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
 492                           key_perm_t perm)
 493 {
 494         struct request_key_auth *rka;
 495         const struct cred *cred;
 496         struct key *key;
 497         key_ref_t key_ref, skey_ref;
 498         int ret;
 499
 500 try_again:
 501         cred = get_current_cred();
 502         key_ref = ERR_PTR(-ENOKEY);
 503
 504         switch (id) {
 505         case KEY_SPEC_THREAD_KEYRING:
 506                 if (!cred->thread_keyring) {
 507                         if (!(lflags & KEY_LOOKUP_CREATE))
 508                                 goto error;
 509
 510                         ret = install_thread_keyring();
 511                         if (ret < 0) {
 512                                 key = ERR_PTR(ret);
 513                                 goto error;
 514                         }
 515                         goto reget_creds;
 516                 }
 517
 518                 key = cred->thread_keyring;
 519                 atomic_inc(&key->usage);
 520                 key_ref = make_key_ref(key, 1);
 521                 break;
 522
 523         case KEY_SPEC_PROCESS_KEYRING:
 524                 if (!cred->tgcred->process_keyring) {
 525                         if (!(lflags & KEY_LOOKUP_CREATE))
 526                                 goto error;
 527
 528                         ret = install_process_keyring();
 529                         if (ret < 0) {
 530                                 key = ERR_PTR(ret);
 531                                 goto error;
 532                         }
 533                         goto reget_creds;
 534                 }
 535
 536                 key = cred->tgcred->process_keyring;
 537                 atomic_inc(&key->usage);
 538                 key_ref = make_key_ref(key, 1);
 539                 break;
 540
 541         case KEY_SPEC_SESSION_KEYRING:
 542                 if (!cred->tgcred->session_keyring) {
 543                         /* always install a session keyring upon access if one
 544                          * doesn't exist yet */
 545                         ret = install_user_keyrings();
 546                         if (ret < 0)
 547                                 goto error;
 548                         ret = install_session_keyring(
 549                                 cred->user->session_keyring);
 550
 551                         if (ret < 0)
 552                                 goto error;
 553                         goto reget_creds;
 554                 }
 555
 556                 rcu_read_lock();
 557                 key = rcu_dereference(cred->tgcred->session_keyring);
 558                 atomic_inc(&key->usage);
 559                 rcu_read_unlock();
 560                 key_ref = make_key_ref(key, 1);
 561                 break;
 562
 563         case KEY_SPEC_USER_KEYRING:
 564                 if (!cred->user->uid_keyring) {
 565                         ret = install_user_keyrings();
 566                         if (ret < 0)
 567                                 goto error;
 568                 }
 569
 570                 key = cred->user->uid_keyring;
 571                 atomic_inc(&key->usage);
 572                 key_ref = make_key_ref(key, 1);
 573                 break;
 574
 575         case KEY_SPEC_USER_SESSION_KEYRING:
 576                 if (!cred->user->session_keyring) {
 577                         ret = install_user_keyrings();
 578                         if (ret < 0)
 579                                 goto error;
 580                 }
 581
 582                 key = cred->user->session_keyring;
 583                 atomic_inc(&key->usage);
 584                 key_ref = make_key_ref(key, 1);
 585                 break;
 586
 587         case KEY_SPEC_GROUP_KEYRING:
 588                 /* group keyrings are not yet supported */
 589                 key = ERR_PTR(-EINVAL);
 590                 goto error;
 591
 592         case KEY_SPEC_REQKEY_AUTH_KEY:
 593                 key = cred->request_key_auth;
 594                 if (!key)
 595                         goto error;
 596
 597                 atomic_inc(&key->usage);
 598                 key_ref = make_key_ref(key, 1);
 599                 break;
 600
 601         case KEY_SPEC_REQUESTOR_KEYRING:
 602                 if (!cred->request_key_auth)
 603                         goto error;
 604
 605                 down_read(&cred->request_key_auth->sem);
 606                 if (cred->request_key_auth->flags & KEY_FLAG_REVOKED) {
 607                         key_ref = ERR_PTR(-EKEYREVOKED);
 608                         key = NULL;
 609                 } else {
 610                         rka = cred->request_key_auth->payload.data;
 611                         key = rka->dest_keyring;
 612                         atomic_inc(&key->usage);
 613                 }
 614                 up_read(&cred->request_key_auth->sem);
 615                 if (!key)
 616                         goto error;
 617                 key_ref = make_key_ref(key, 1);
 618                 break;
 619
 620         default:
 621                 key_ref = ERR_PTR(-EINVAL);
 622                 if (id < 1)
 623                         goto error;
 624
 625                 key = key_lookup(id);
 626                 if (IS_ERR(key)) {
 627                         key_ref = ERR_CAST(key);
 628                         goto error;
 629                 }
 630
 631                 key_ref = make_key_ref(key, 0);
 632
 633                 /* check to see if we possess the key */
 634                 skey_ref = search_process_keyrings(key->type, key,
 635                                                    lookup_user_key_possessed,
 636                                                    cred);
 637
 638                 if (!IS_ERR(skey_ref)) {
 639                         key_put(key);
 640                         key_ref = skey_ref;
 641                 }
 642
 643                 break;
 644         }
 645
 646         /* unlink does not use the nominated key in any way, so can skip all
 647          * the permission checks as it is only concerned with the keyring */
 648         if (lflags & KEY_LOOKUP_FOR_UNLINK) {
 649                 ret = 0;
 650                 goto error;
 651         }
 652
 653         if (!(lflags & KEY_LOOKUP_PARTIAL)) {
 654                 ret = wait_for_key_construction(key, true);
 655                 switch (ret) {
 656                 case -ERESTARTSYS:
 657                         goto invalid_key;
 658                 default:
 659                         if (perm)
 660                                 goto invalid_key;
 661                 case 0:
 662                         break;
 663                 }
 664         } else if (perm) {
 665                 ret = key_validate(key);
 666                 if (ret < 0)
 667                         goto invalid_key;
 668         }
 669
 670         ret = -EIO;
 671         if (!(lflags & KEY_LOOKUP_PARTIAL) &&
 672             !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 673                 goto invalid_key;
 674
 675         /* check the permissions */
 676         ret = key_task_permission(key_ref, cred, perm);
 677         if (ret < 0)
 678                 goto invalid_key;
 679
 680 error:
 681         put_cred(cred);
 682         return key_ref;
 683
 684 invalid_key:
 685         key_ref_put(key_ref);
 686         key_ref = ERR_PTR(ret);
 687         goto error;
 688
 689         /* if we attempted to install a keyring, then it may have caused new
 690          * creds to be installed */
 691 reget_creds:
 692         put_cred(cred);
 693         goto try_again;
 694
 695 } /* end lookup_user_key() */
 696
 697 /*****************************************************************************/
 698 /*
 699  * join the named keyring as the session keyring if possible, or attempt to
 700  * create a new one of that name if not
 701  * - if the name is NULL, an empty anonymous keyring is installed instead
 702  * - named session keyring joining is done with a semaphore held
 703  */
 704 long join_session_keyring(const char *name)
 705 {
 706         const struct cred *old;
 707         struct cred *new;
 708         struct key *keyring;
 709         long ret, serial;
 710
 711         /* only permit this if there's a single thread in the thread group -
 712          * this avoids us having to adjust the creds on all threads and risking
 713          * ENOMEM */
 714         if (!current_is_single_threaded())
 715                 return -EMLINK;
 716
 717         new = prepare_creds();
 718         if (!new)
 719                 return -ENOMEM;
 720         old = current_cred();
 721
 722         /* if no name is provided, install an anonymous keyring */
 723         if (!name) {
 724                 ret = install_session_keyring_to_cred(new, NULL);
 725                 if (ret < 0)
 726                         goto error;
 727
 728                 serial = new->tgcred->session_keyring->serial;
 729                 ret = commit_creds(new);
 730                 if (ret == 0)
 731                         ret = serial;
 732                 goto okay;
 733         }
 734
 735         /* allow the user to join or create a named keyring */
 736         mutex_lock(&key_session_mutex);
 737
 738         /* look for an existing keyring of this name */
 739         keyring = find_keyring_by_name(name, false);
 740         if (PTR_ERR(keyring) == -ENOKEY) {
 741                 /* not found - try and create a new one */
 742                 keyring = keyring_alloc(name, old->uid, old->gid, old,
 743                                         KEY_ALLOC_IN_QUOTA, NULL);
 744                 if (IS_ERR(keyring)) {
 745                         ret = PTR_ERR(keyring);
 746                         goto error2;
 747                 }
 748         } else if (IS_ERR(keyring)) {
 749                 ret = PTR_ERR(keyring);
 750                 goto error2;
 751         }
 752
 753         /* we've got a keyring - now to install it */
 754         ret = install_session_keyring_to_cred(new, keyring);
 755         if (ret < 0)
 756                 goto error2;
 757
 758         commit_creds(new);
 759         mutex_unlock(&key_session_mutex);
 760
 761         ret = keyring->serial;
 762         key_put(keyring);
 763 okay:
 764         return ret;
 765
 766 error2:
 767         mutex_unlock(&key_session_mutex);
 768 error:
 769         abort_creds(new);
 770         return ret;
 771 }
 772
 773 /*
 774  * Replace a process's session keyring when that process resumes userspace on
 775  * behalf of one of its children
 776  */
 777 void key_replace_session_keyring(void)
 778 {
 779         const struct cred *old;
 780         struct cred *new;
 781
 782         if (!current->replacement_session_keyring)
 783                 return;
 784
 785         write_lock_irq(&tasklist_lock);
 786         new = current->replacement_session_keyring;
 787         current->replacement_session_keyring = NULL;
 788         write_unlock_irq(&tasklist_lock);
 789
 790         if (!new)
 791                 return;
 792
 793         old = current_cred();
 794         new->  uid      = old->  uid;
 795         new-> euid      = old-> euid;
 796         new-> suid      = old-> suid;
 797         new->fsuid      = old->fsuid;
 798         new->  gid      = old->  gid;
 799         new-> egid      = old-> egid;
 800         new-> sgid      = old-> sgid;
 801         new->fsgid      = old->fsgid;
 802         new->user       = get_uid(old->user);
 803         new->group_info = get_group_info(old->group_info);
 804
 805         new->securebits = old->securebits;
 806         new->cap_inheritable    = old->cap_inheritable;
 807         new->cap_permitted      = old->cap_permitted;
 808         new->cap_effective      = old->cap_effective;
 809         new->cap_bset           = old->cap_bset;
 810
 811         new->jit_keyring        = old->jit_keyring;
 812         new->thread_keyring     = key_get(old->thread_keyring);
 813         new->tgcred->tgid       = old->tgcred->tgid;
 814         new->tgcred->process_keyring = key_get(old->tgcred->process_keyring);
 815
 816         security_transfer_creds(new, old);
 817
 818         commit_creds(new);
 819 }