Linux keyring_search密钥环搜索与key_ref_validate

Linux keyring_search密钥环搜索与key_ref_validate

内核密钥管理框架的主搜索接口是keyring_search，定义在security/keys/keyring.c中。该函数在指定密钥环及其链接的子密钥环中递归查找匹配特定描述和类型的密钥。

函数原型及参数说明：

key_ref_t keyring_search(key_ref_t keyring_ref, struct key_type *type,
const char *description, bool recurse)
{
struct key *keyring;
key_ref_t key_ref;
bool possessed;

keyring = key_ref_to_ptr(keyring_ref);
possessed = is_key_possessed(keyring_ref);

if (!(keyring->flags & ((1 << KEY_FLAG_SET) |
(1 << KEY_FLAG_ROOT_CAN_CLEAR))))
return ERR_PTR(-ENOKEY);

rcu_read_lock();
if (recurse)
key_ref = search_rcu(keyring, type, description, possessed,
KEYRING_SEARCH_DO_STATE_CHECK);
else
key_ref = search_link_rcu(keyring, type, description, possessed,
KEYRING_SEARCH_DO_STATE_CHECK);
rcu_read_unlock();

if (IS_ERR(key_ref))
return key_ref;

return key_ref;
}

search_rcu是递归搜索的核心实现，在RCU读锁保护下遍历密钥环的链接链表：

static key_ref_t search_rcu(struct key *keyring, struct key_type *type,
const char *description, bool possessed,
unsigned int flags)
{
struct keyring_search_context ctx = {
.index_key.type = type,
.index_key.description = description,
.index_key.desc_len = strlen(description),
.possessed = possessed,
.flags = flags,
.skip = NULL,
.matched_key_ref = NULL,
.result = ERR_PTR(-EAGAIN),
};
int ret;

ret = keyring_search_rcu(keyring, &ctx);
if (ret < 0)
return ERR_PTR(ret);
return ctx.result;
}

搜索上下文struct keyring_search_context携带索引匹配参数：

struct keyring_search_context {
struct keyring_index_key index_key;
const struct cred *cred;
key_perm_t permit;
int (*match)(const struct key *key, const struct keyring_index_key *index_key);
bool possessed;
unsigned int flags;
struct key *skip;
key_ref_t result;
};

keyring_search_rcu对密钥环的keyring_assoc_array进行递归遍历：

static int keyring_search_rcu(struct key *keyring, struct keyring_search_context *ctx)
{
struct keyring_assoc *assoc;
struct key *key;
int ret;

assoc = rcu_dereference(keyring->assoc_array);
if (!assoc)
return -ENOKEY;

ret = assoc_array_find(&assoc->array,
&keyring_assoc_ops,
&ctx->index_key);
if (ret == 0)
return -ENOKEY;

key = keyring_ptr_to_key(keyring, assoc);
if (!key)
return -ENOKEY;

ctx->result = make_key_ref(key, ctx->possessed);
return 0;
}

当搜索命中后，key_ref_validate对返回的key_ref进行权限和状态检查：

key_ref_t key_ref_validate(key_ref_t key_ref, unsigned long op)
{
struct key *key = key_ref_to_ptr(key_ref);
key_perm_t perm;
int ret;

if (!key)
return ERR_PTR(-ENOKEY);

ret = key_validate(key);
if (ret < 0)
return ERR_PTR(ret);

perm = key_permission(key_ref, op);
if (perm)
return ERR_PTR(perm);

if (test_bit(KEY_FLAG_BUILTIN, &key->flags))
return key_ref;

return key_ref;
}

key_validate检查密钥的生命周期状态：

int key_validate(const struct key *key)
{
if (test_bit(KEY_FLAG_DEAD, &key->flags) ||
test_bit(KEY_FLAG_INVALIDATED, &key->flags))
return -ENOKEY;

if (test_bit(KEY_FLAG_REVOKED, &key->flags))
return -EKEYREVOKED;

if (key->expiry && key->expiry <= ktime_get_real_seconds())
return -EKEYEXPIRED;

return 0;
}

key_permission根据操作码(op)检查访问权限：

int key_permission(key_ref_t key_ref, unsigned long op)
{
struct key *key = key_ref_to_ptr(key_ref);
kuid_t uid;
unsigned long perm;
bool possessed = is_key_possessed(key_ref);

if (test_bit(KEY_FLAG_ROOT_CAN_CLEAR, &key->flags) && capable(CAP_SYS_ADMIN))
goto ok;

uid = current_fsuid();
if (uid_eq(key->uid, uid)) {
perm = KEY_POS_SEE | KEY_POS_READ | KEY_POS_WRITE |
KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
} else if (uid_eq(key->uid, GLOBAL_ROOT_UID)) {
perm = KEY_USR_SEE | KEY_USR_READ | KEY_USR_WRITE |
KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
} else {
if (in_group_p(key->gid))
perm = KEY_GRP_ALL;
else
perm = KEY_OTH_ALL;
}

if (possessed)
perm &= KEY_POSS_ALL;

if ((perm & op) != op)
return -EACCES;
ok:
return 0;
}

实际的keyring搜索使用标记包含了KEYRING_SEARCH_DO_STATE_CHECK标志，它控制是否在搜索时跳过过期或被撤销的密钥。搜索过程中调用keyring_match检查description精确匹配。

keyring_search的典型使用场景：

static int verify_signature_with_keyring(struct key *keyring,
struct public_key_signature *sig)
{
key_ref_t key_ref;
struct key *key;
int ret;

key_ref = keyring_search(make_key_ref(keyring, true),
&key_type_asymmetric,
sig->key_id->data,
true);
if (IS_ERR(key_ref))
return PTR_ERR(key_ref);

key_ref = key_ref_validate(key_ref, KEY_NEED_SEARCH);
if (IS_ERR(key_ref))
return PTR_ERR(key_ref);

key = key_ref_to_ptr(key_ref);
ret = verify_signature(key, sig);
key_put(key);
return ret;
}

密钥环搜索从指定keyref开始，recurse=true时递归遍历嵌套密钥环。搜索优先级按assoc_array的排序规则，遍历所有匹配项，返回第一个符合条件的结果。