| Message ID | 20221118211624.19298-2-prestwoj@gmail.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Crypto operations by key ID | expand |
Hi James, On 11/18/22 15:16, James Prestwood wrote: > Search for a key by type, keyring name, and description. Returns the > key ID or an error if not found. > --- > ell/ell.sym | 1 + > ell/key.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ > ell/key.h | 3 +++ > 3 files changed, 50 insertions(+) > <snip> > @@ -283,6 +303,32 @@ static bool setup_internal_keyring(void) > return true; > } > > +LIB_EXPORT int32_t l_key_search(enum l_key_type type, const char *keyring, How likely are we to search some custom keyring? Wouldn't we generally be searching a user/default user session keyrings? > + const char *description) > +{ > + long keyring_id; > + long key_id; > + > + if (unlikely((size_t)type >= L_ARRAY_SIZE(key_type_names))) > + return -EINVAL; > + > + if (unlikely(!keyring || !description)) > + return -EINVAL; > + > + /* Find the ID of the keyring */ > + keyring_id = kernel_key_request("keyring", keyring); > + if (keyring_id < 0) > + return -ENOENT; > + > + /* Search for the key by type/description */ > + key_id = kernel_key_search(keyring_id, key_type_names[type], > + description); > + if (key_id < 0) > + return -ENOENT; > + > + return key_id; > +} > + > LIB_EXPORT struct l_key *l_key_new(enum l_key_type type, const void *payload, > size_t payload_length) > { Regards, -Denis
Hi James, >>> +LIB_EXPORT int32_t l_key_search(enum l_key_type type, const char >>> *keyring, >> >> How likely are we to search some custom keyring? Wouldn't we >> generally be >> searching a user/default user session keyrings? > > I was just leaning on the side of flexibility. I don't really care > either way but figured an extra argument was fine even if we end up > calling it with "user". So this function would perform some sort of !strcmp conversion between "user" and KEY_SPEC_USER_KEYRING? That's fine I suppose. Alternatively you can ignore that for now and if you really need to search keyrings that are not "standard", then one can introduce l_keyring_search() or something later. Regards, -Denis
On Tue, 2022-11-22 at 10:43 -0600, Denis Kenzior wrote: > Hi James, > > On 11/18/22 15:16, James Prestwood wrote: > > Search for a key by type, keyring name, and description. Returns > > the > > key ID or an error if not found. > > --- > > ell/ell.sym | 1 + > > ell/key.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ > > ell/key.h | 3 +++ > > 3 files changed, 50 insertions(+) > > > > <snip> > > > @@ -283,6 +303,32 @@ static bool setup_internal_keyring(void) > > return true; > > } > > > > +LIB_EXPORT int32_t l_key_search(enum l_key_type type, const char > > *keyring, > > How likely are we to search some custom keyring? Wouldn't we > generally be > searching a user/default user session keyrings? I was just leaning on the side of flexibility. I don't really care either way but figured an extra argument was fine even if we end up calling it with "user". > > > + const char *description) > > +{ > > + long keyring_id; > > + long key_id; > > + > > + if (unlikely((size_t)type >= L_ARRAY_SIZE(key_type_names))) > > + return -EINVAL; > > + > > + if (unlikely(!keyring || !description)) > > + return -EINVAL; > > + > > + /* Find the ID of the keyring */ > > + keyring_id = kernel_key_request("keyring", keyring); > > + if (keyring_id < 0) > > + return -ENOENT; > > + > > + /* Search for the key by type/description */ > > + key_id = kernel_key_search(keyring_id, > > key_type_names[type], > > + description); > > + if (key_id < 0) > > + return -ENOENT; > > + > > + return key_id; > > +} > > + > > LIB_EXPORT struct l_key *l_key_new(enum l_key_type type, const > > void *payload, > > size_t payload_length) > > { > > Regards, > -Denis
On Tue, 2022-11-22 at 11:09 -0600, Denis Kenzior wrote: > Hi James, > > > > > +LIB_EXPORT int32_t l_key_search(enum l_key_type type, const > > > > char > > > > *keyring, > > > > > > How likely are we to search some custom keyring? Wouldn't we > > > generally be > > > searching a user/default user session keyrings? > > > > I was just leaning on the side of flexibility. I don't really care > > either way but figured an extra argument was fine even if we end up > > calling it with "user". > > So this function would perform some sort of !strcmp conversion > between "user" > and KEY_SPEC_USER_KEYRING? That's fine I suppose. Ah, I kinda overlooked the fact the user keyring is actually named something like "_uid.foo". And in theory "user" could be an actual custom keyring... So defaulting to KEYS_SPEC_USER_KEYRING seems like the most logical option, and if we need custom keyrings we could add l_keyring_search(). > > Regards, > -Denis
diff --git a/ell/ell.sym b/ell/ell.sym index 6df9024..414b288 100644 --- a/ell/ell.sym +++ b/ell/ell.sym @@ -387,6 +387,7 @@ global: l_key_decrypt; l_key_sign; l_key_verify; + l_key_search; l_keyring_new; l_keyring_restrict; l_keyring_free; diff --git a/ell/key.c b/ell/key.c index 24374a5..5a82531 100644 --- a/ell/key.c +++ b/ell/key.c @@ -270,6 +270,26 @@ static long kernel_key_verify(int32_t serial, return result >= 0 ? result : -errno; } +static long kernel_key_request(const char *type, const char *description) +{ + long result; + + result = syscall(__NR_request_key, type, description, NULL, 0); + + return result >= 0 ? result : -errno; +} + +static long kernel_key_search(int32_t keyring_id, const char *type, + const char *description) +{ + long result; + + result = syscall(__NR_keyctl, KEYCTL_SEARCH, keyring_id, type, + description, 0); + + return result >= 0 ? result : -errno; +} + static bool setup_internal_keyring(void) { internal_keyring = kernel_add_key("keyring", "ell-internal", NULL, 0, @@ -283,6 +303,32 @@ static bool setup_internal_keyring(void) return true; } +LIB_EXPORT int32_t l_key_search(enum l_key_type type, const char *keyring, + const char *description) +{ + long keyring_id; + long key_id; + + if (unlikely((size_t)type >= L_ARRAY_SIZE(key_type_names))) + return -EINVAL; + + if (unlikely(!keyring || !description)) + return -EINVAL; + + /* Find the ID of the keyring */ + keyring_id = kernel_key_request("keyring", keyring); + if (keyring_id < 0) + return -ENOENT; + + /* Search for the key by type/description */ + key_id = kernel_key_search(keyring_id, key_type_names[type], + description); + if (key_id < 0) + return -ENOENT; + + return key_id; +} + LIB_EXPORT struct l_key *l_key_new(enum l_key_type type, const void *payload, size_t payload_length) { diff --git a/ell/key.h b/ell/key.h index 6897105..5fe8e00 100644 --- a/ell/key.h +++ b/ell/key.h @@ -62,6 +62,9 @@ enum l_key_cipher_type { struct l_key *l_key_new(enum l_key_type type, const void *payload, size_t payload_length); +int32_t l_key_search(enum l_key_type type, const char *keyring, + const char *description); + void l_key_free(struct l_key *key); void l_key_free_norevoke(struct l_key *key);