armbian/linux-cix
0
0
Fork 0
mirror of https://github.com/armbian/linux-cix.git synced 2026-01-06 12:30:45 -08:00
Code Issues Packages Projects Releases Wiki Activity

Revert "Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs"

Browse Source 
This reverts merge 0f75ef6a9c (and thus
effectively commits

   7a1ade8475 ("keys: Provide KEYCTL_GRANT_PERMISSION")
   2e12256b9a ("keys: Replace uid/gid/perm permissions checking with an ACL")

that the merge brought in).

It turns out that it breaks booting with an encrypted volume, and Eric
biggers reports that it also breaks the fscrypt tests [1] and loading of
in-kernel X.509 certificates [2].

The root cause of all the breakage is likely the same, but David Howells
is off email so rather than try to work it out it's getting reverted in
order to not impact the rest of the merge window.

 [1] https://lore.kernel.org/lkml/20190710011559.GA7973@sol.localdomain/
 [2] https://lore.kernel.org/lkml/20190710013225.GB7973@sol.localdomain/

Link: https://lore.kernel.org/lkml/CAHk-=wjxoeMJfeBahnWH=9zShKp2bsVy527vo3_y8HfOdhwAAw@mail.gmail.com/
Reported-by: Eric Biggers <ebiggers@kernel.org>
Cc: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Linus Torvalds
2019-07-10 18:43:43 -07:00
parent e9a83bd232
commit 028db3e290
46 changed files with 325 additions and 992 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
Documentation/security/keys/core.rst
View File

@@ -57,9 +57,9 @@ Each key has a number of attributes:
type provides an operation to perform a match between the description on a
key and a criterion string.
* Each key has an owner user ID, a group ID and an ACL. These are used to
control what a process may do to a key from userspace, and whether a
kernel service will be able to find the key.
* Each key has an owner user ID, a group ID and a permissions mask. These
are used to control what a process may do to a key from userspace, and
whether a kernel service will be able to find the key.
* Each key can be set to expire at a specific time by the key type's
instantiation function. Keys can also be immortal.
@@ -198,110 +198,43 @@ The key service provides a number of features besides keys:
Key Access Permissions
======================
Keys have an owner user ID, a group ID and an ACL. The ACL is made up of a
sequence of ACEs that each contain three elements:
Keys have an owner user ID, a group access ID, and a permissions mask. The mask
has up to eight bits each for possessor, user, group and other access. Only
six of each set of eight bits are defined. These permissions granted are:
* The type of subject.
* The subject.
* View
These two together indicate the subject to whom the permits are granted.
The type can be one of:
This permits a key or keyring's attributes to be viewed - including key
type and description.
* ``KEY_ACE_SUBJ_STANDARD``
* Read
The subject is a standard 'macro' type. The subject can be one of:
This permits a key's payload to be viewed or a keyring's list of linked
keys.
* ``KEY_ACE_EVERYONE``
* Write
The permits are granted to everyone. It replaces the old 'other'
type on the assumption that you wouldn't grant a permission to other
that you you wouldn't grant to everyone else.
This permits a key's payload to be instantiated or updated, or it allows a
link to be added to or removed from a keyring.
* ``KEY_ACE_OWNER``
* Search
The permits are granted to the owner of the key (key->uid).
This permits keyrings to be searched and keys to be found. Searches can
only recurse into nested keyrings that have search permission set.
* ``KEY_ACE_GROUP``
* Link
The permits are granted to the key's group (key->gid).
This permits a key or keyring to be linked to. To create a link from a
keyring to a key, a process must have Write permission on the keyring and
Link permission on the key.
* ``KEY_ACE_POSSESSOR``
* Set Attribute
The permits are granted to anyone who possesses the key.
* The set of permits granted to the subject. These include:
* ``KEY_ACE_VIEW``
This permits a key or keyring's attributes to be viewed - including the
key type and description.
* ``KEY_ACE_READ``
This permits a key's payload to be viewed or a keyring's list of linked
keys.
* ``KEY_ACE_WRITE``
This permits a key's payload to be instantiated or updated, or it allows
a link to be added to or removed from a keyring.
* ``KEY_ACE_SEARCH``
This permits keyrings to be searched and keys to be found. Searches can
only recurse into nested keyrings that have search permission set.
* ``KEY_ACE_LINK``
This permits a key or keyring to be linked to. To create a link from a
keyring to a key, a process must have Write permission on the keyring
and Link permission on the key.
* ``KEY_ACE_SET_SECURITY``
This permits a key's UID, GID and permissions mask to be changed.
* ``KEY_ACE_INVAL``
This permits a key to be invalidated with KEYCTL_INVALIDATE.
* ``KEY_ACE_REVOKE``
This permits a key to be revoked with KEYCTL_REVOKE.
* ``KEY_ACE_JOIN``
This permits a keyring to be joined as a session by
KEYCTL_JOIN_SESSION_KEYRING or KEYCTL_SESSION_TO_PARENT.
* ``KEY_ACE_CLEAR``
This permits a keyring to be cleared.
This permits a key's UID, GID and permissions mask to be changed.
For changing the ownership, group ID or permissions mask, being the owner of
the key or having the sysadmin capability is sufficient.
The legacy KEYCTL_SETPERM and KEYCTL_DESCRIBE functions can only see/generate
View, Read, Write, Search, Link and SetAttr permits, and do this for each of
possessor, user, group and other permission sets as a 32-bit flag mask. These
will be approximated/inferred:
SETPERM Permit Implied ACE Permit
=============== =======================
Search Inval, Join
Write Revoke, Clear
Setattr Set Security, Revoke
ACE Permit Described as
=============== =======================
Inval Search
Join Search
Revoke Write (unless Setattr)
Clear write
Set Security Setattr
'Other' will be approximated as/inferred from the 'Everyone' subject.
SELinux Support
===============
@@ -1151,8 +1084,7 @@ payload contents" for more information.
struct key *request_key(const struct key_type *type,
const char *description,
const char *callout_info,
struct key_acl *acl);
const char *callout_info);
This is used to request a key or keyring with a description that matches
the description specified according to the key type's match_preparse()
@@ -1167,8 +1099,6 @@ payload contents" for more information.
If successful, the key will have been attached to the default keyring for
implicitly obtained request-key keys, as set by KEYCTL_SET_REQKEY_KEYRING.
If a key is created, it will be given the specified ACL.
See also Documentation/security/keys/request-key.rst.
@@ -1177,8 +1107,7 @@ payload contents" for more information.
struct key *request_key_tag(const struct key_type *type,
const char *description,
struct key_tag *domain_tag,
const char *callout_info,
struct key_acl *acl);
const char *callout_info);
This is identical to request_key(), except that a domain tag may be
specifies that causes search algorithm to only match keys matching that
@@ -1193,8 +1122,7 @@ payload contents" for more information.
struct key_tag *domain_tag,
const void *callout_info,
size_t callout_len,
void *aux,
struct key_acl *acl);
void *aux);
This is identical to request_key_tag(), except that the auxiliary data is
passed to the key_type->request_key() op if it exists, and the
@@ -1267,7 +1195,7 @@ payload contents" for more information.
struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
const struct cred *cred,
struct key_acl *acl,
key_perm_t perm,
struct key_restriction *restrict_link,
unsigned long flags,
struct key *dest);

9
Documentation/security/keys/request-key.rst
View File

@@ -11,16 +11,14 @@ The process starts by either the kernel requesting a service by calling
struct key *request_key(const struct key_type *type,
const char *description,
const char *callout_info,
struct key_acl *acl);
const char *callout_info);
or::
struct key *request_key_tag(const struct key_type *type,
const char *description,
const struct key_tag *domain_tag,
const char *callout_info,
struct key_acl *acl);
const char *callout_info);
or::
@@ -29,8 +27,7 @@ or::
const struct key_tag *domain_tag,
const char *callout_info,
size_t callout_len,
void *aux,
struct key_acl *acl);
void *aux);
or::

7
certs/blacklist.c
View File

@@ -89,7 +89,8 @@ int mark_hash_blacklisted(const char *hash)
hash,
NULL,
0,
&internal_key_acl,
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW),
KEY_ALLOC_NOT_IN_QUOTA |
KEY_ALLOC_BUILT_IN);
if (IS_ERR(key)) {
@@ -148,7 +149,9 @@ static int __init blacklist_init(void)
keyring_alloc(".blacklist",
KUIDT_INIT(0), KGIDT_INIT(0),
current_cred(),
&internal_keyring_acl,
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ |
KEY_USR_SEARCH,
KEY_ALLOC_NOT_IN_QUOTA |
KEY_FLAG_KEEP,
NULL, NULL);

12
certs/system_keyring.c
View File

@@ -99,7 +99,9 @@ static __init int system_trusted_keyring_init(void)
builtin_trusted_keys =
keyring_alloc(".builtin_trusted_keys",
KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
&internal_key_acl, KEY_ALLOC_NOT_IN_QUOTA,
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
KEY_ALLOC_NOT_IN_QUOTA,
NULL, NULL);
if (IS_ERR(builtin_trusted_keys))
panic("Can't allocate builtin trusted keyring\n");
@@ -108,7 +110,10 @@ static __init int system_trusted_keyring_init(void)
secondary_trusted_keys =
keyring_alloc(".secondary_trusted_keys",
KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
&internal_writable_keyring_acl, KEY_ALLOC_NOT_IN_QUOTA,
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH |
KEY_USR_WRITE),
KEY_ALLOC_NOT_IN_QUOTA,
get_builtin_and_secondary_restriction(),
NULL);
if (IS_ERR(secondary_trusted_keys))
@@ -158,7 +163,8 @@ static __init int load_system_certificate_list(void)
NULL,
p,
plen,
&internal_key_acl,
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ),
KEY_ALLOC_NOT_IN_QUOTA |
KEY_ALLOC_BUILT_IN |
KEY_ALLOC_BYPASS_RESTRICTION);

2
drivers/md/dm-crypt.c
View File

@@ -2035,7 +2035,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
return -ENOMEM;
key = request_key(key_string[0] == 'l' ? &key_type_logon : &key_type_user,
key_desc + 1, NULL, NULL);
key_desc + 1, NULL);
if (IS_ERR(key)) {
kzfree(new_key_string);
return PTR_ERR(key);

2
drivers/nvdimm/security.c
View File

@@ -55,7 +55,7 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
struct device *dev = &nvdimm->dev;
sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id);
key = request_key(&key_type_encrypted, desc, "", NULL);
key = request_key(&key_type_encrypted, desc, "");
if (IS_ERR(key)) {
if (PTR_ERR(key) == -ENOKEY)
dev_dbg(dev, "request_key() found no key\n");

2
fs/afs/security.c
View File

@@ -28,7 +28,7 @@ struct key *afs_request_key(struct afs_cell *cell)
_debug("key %s", cell->anonymous_key->description);
key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
NULL, NULL);
NULL);
if (IS_ERR(key)) {
if (PTR_ERR(key) != -ENOKEY) {
_leave(" = %ld", PTR_ERR(key));

25
fs/cifs/cifs_spnego.c
View File

@@ -32,25 +32,6 @@
#include "cifsproto.h"
static const struct cred *spnego_cred;
static struct key_acl cifs_spnego_key_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.possessor_viewable = true,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
KEY_OWNER_ACE(KEY_ACE_VIEW),
}
};
static struct key_acl cifs_spnego_keyring_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_CLEAR),
}
};
/* create a new cifs key */
static int
cifs_spnego_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
@@ -189,8 +170,7 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
cifs_dbg(FYI, "key description = %s\n", description);
saved_cred = override_creds(spnego_cred);
spnego_key = request_key(&cifs_spnego_key_type, description, "",
&cifs_spnego_key_acl);
spnego_key = request_key(&cifs_spnego_key_type, description, "");
revert_creds(saved_cred);
#ifdef CONFIG_CIFS_DEBUG2
@@ -227,7 +207,8 @@ init_cifs_spnego(void)
keyring = keyring_alloc(".cifs_spnego",
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
&cifs_spnego_keyring_acl,
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ,
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
if (IS_ERR(keyring)) {
ret = PTR_ERR(keyring);

28
fs/cifs/cifsacl.c
View File

@@ -33,25 +33,6 @@
#include "cifsproto.h"
#include "cifs_debug.h"
static struct key_acl cifs_idmap_key_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.possessor_viewable = true,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
KEY_OWNER_ACE(KEY_ACE_VIEW),
}
};
static struct key_acl cifs_idmap_keyring_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
}
};
/* security id for everyone/world system group */
static const struct cifs_sid sid_everyone = {
1, 1, {0, 0, 0, 0, 0, 1}, {0} };
@@ -317,8 +298,7 @@ id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid)
rc = 0;
saved_cred = override_creds(root_cred);
sidkey = request_key(&cifs_idmap_key_type, desc, "",
&cifs_idmap_key_acl);
sidkey = request_key(&cifs_idmap_key_type, desc, "");
if (IS_ERR(sidkey)) {
rc = -EINVAL;
cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n",
@@ -423,8 +403,7 @@ try_upcall_to_get_id:
return -ENOMEM;
saved_cred = override_creds(root_cred);
sidkey = request_key(&cifs_idmap_key_type, sidstr, "",
&cifs_idmap_key_acl);
sidkey = request_key(&cifs_idmap_key_type, sidstr, "");
if (IS_ERR(sidkey)) {
rc = -EINVAL;
cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n",
@@ -502,7 +481,8 @@ init_cifs_idmap(void)
keyring = keyring_alloc(".cifs_idmap",
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
&cifs_idmap_keyring_acl,
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ,
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
if (IS_ERR(keyring)) {
ret = PTR_ERR(keyring);

4
fs/cifs/connect.c
View File

@@ -2992,7 +2992,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
}
cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
key = request_key(&key_type_logon, desc, "", NULL);
key = request_key(&key_type_logon, desc, "");
if (IS_ERR(key)) {
if (!ses->domainName) {
cifs_dbg(FYI, "domainName is NULL\n");
@@ -3003,7 +3003,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
/* didn't work, try to find a domain key */
sprintf(desc, "cifs:d:%s", ses->domainName);
cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
key = request_key(&key_type_logon, desc, "", NULL);
key = request_key(&key_type_logon, desc, "");
if (IS_ERR(key)) {
rc = PTR_ERR(key);
goto out_err;

2
fs/crypto/keyinfo.c
View File

@@ -92,7 +92,7 @@ find_and_lock_process_key(const char *prefix,
if (!description)
return ERR_PTR(-ENOMEM);
key = request_key(&key_type_logon, description, NULL, NULL);
key = request_key(&key_type_logon, description, NULL);
kfree(description);
if (IS_ERR(key))
return key;

2
fs/ecryptfs/ecryptfs_kernel.h
View File

@@ -91,7 +91,7 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
static inline struct key *ecryptfs_get_encrypted_key(char *sig)
{
return request_key(&key_type_encrypted, sig, NULL, NULL);
return request_key(&key_type_encrypted, sig, NULL);
}
#else

2
fs/ecryptfs/keystore.c
View File

@@ -1610,7 +1610,7 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
{
int rc = 0;
(*auth_tok_key) = request_key(&key_type_user, sig, NULL, NULL);
(*auth_tok_key) = request_key(&key_type_user, sig, NULL);
if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
(*auth_tok_key) = ecryptfs_get_encrypted_key(sig);
if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {

2
fs/fscache/object-list.c
View File

@@ -317,7 +317,7 @@ static void fscache_objlist_config(struct fscache_objlist_data *data)
const char *buf;
int len;
key = request_key(&key_type_user, "fscache:objlist", NULL, NULL);
key = request_key(&key_type_user, "fscache:objlist", NULL);
if (IS_ERR(key))
goto no_config;

30
fs/nfs/nfs4idmap.c
View File

@@ -72,25 +72,6 @@ struct idmap {
const struct cred *cred;
};
static struct key_acl nfs_idmap_key_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.possessor_viewable = true,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
KEY_OWNER_ACE(KEY_ACE_VIEW),
}
};
static struct key_acl nfs_idmap_keyring_acl = {
.usage = REFCOUNT_INIT(1),
.nr_ace = 2,
.aces = {
KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
}
};
static struct user_namespace *idmap_userns(const struct idmap *idmap)
{
if (idmap && idmap->cred)
@@ -227,7 +208,8 @@ int nfs_idmap_init(void)
keyring = keyring_alloc(".id_resolver",
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
&nfs_idmap_keyring_acl,
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ,
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
if (IS_ERR(keyring)) {
ret = PTR_ERR(keyring);
@@ -305,13 +287,11 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
return ERR_PTR(ret);
if (!idmap->cred || idmap->cred->user_ns == &init_user_ns)
rkey = request_key(&key_type_id_resolver, desc, "",
&nfs_idmap_key_acl);
rkey = request_key(&key_type_id_resolver, desc, "");
if (IS_ERR(rkey)) {
mutex_lock(&idmap->idmap_mutex);
rkey = request_key_with_auxdata(&key_type_id_resolver_legacy,
desc, NULL, "", 0, idmap,
&nfs_idmap_key_acl);
desc, NULL, "", 0, idmap);
mutex_unlock(&idmap->idmap_mutex);
}
if (!IS_ERR(rkey))
@@ -340,6 +320,8 @@ static ssize_t nfs_idmap_get_key(const char *name, size_t namelen,
}
rcu_read_lock();
rkey->perm |= KEY_USR_VIEW;
ret = key_validate(rkey);
if (ret < 0)
goto out_up;

2
fs/ubifs/auth.c
View File

@@ -227,7 +227,7 @@ int ubifs_init_authentication(struct ubifs_info *c)
snprintf(hmac_name, CRYPTO_MAX_ALG_NAME, "hmac(%s)",
c->auth_hash_name);
keyring_key = request_key(&key_type_logon, c->auth_key_name, NULL, NULL);
keyring_key = request_key(&key_type_logon, c->auth_key_name, NULL);
if (IS_ERR(keyring_key)) {
ubifs_err(c, "Failed to request key: %ld",

121
include/linux/key.h
View File

@@ -27,15 +27,50 @@
/* key handle serial number */
typedef int32_t key_serial_t;
/* key handle permissions mask */
typedef uint32_t key_perm_t;
struct key;
struct net;
#ifdef CONFIG_KEYS
#include <linux/keyctl.h>
#undef KEY_DEBUGGING
#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */
#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */
#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */
#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */
#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */
#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */
#define KEY_POS_ALL 0x3f000000
#define KEY_USR_VIEW 0x00010000 /* user permissions... */
#define KEY_USR_READ 0x00020000
#define KEY_USR_WRITE 0x00040000
#define KEY_USR_SEARCH 0x00080000
#define KEY_USR_LINK 0x00100000
#define KEY_USR_SETATTR 0x00200000
#define KEY_USR_ALL 0x003f0000
#define KEY_GRP_VIEW 0x00000100 /* group permissions... */
#define KEY_GRP_READ 0x00000200
#define KEY_GRP_WRITE 0x00000400
#define KEY_GRP_SEARCH 0x00000800
#define KEY_GRP_LINK 0x00001000
#define KEY_GRP_SETATTR 0x00002000
#define KEY_GRP_ALL 0x00003f00
#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */
#define KEY_OTH_READ 0x00000002
#define KEY_OTH_WRITE 0x00000004
#define KEY_OTH_SEARCH 0x00000008
#define KEY_OTH_LINK 0x00000010
#define KEY_OTH_SETATTR 0x00000020
#define KEY_OTH_ALL 0x0000003f
#define KEY_PERM_UNDEF 0xffffffff
struct seq_file;
struct user_struct;
struct signal_struct;
@@ -78,36 +113,6 @@ union key_payload {
void *data[4];
};
struct key_ace {
unsigned int type;
unsigned int perm;
union {
kuid_t uid;
kgid_t gid;
unsigned int subject_id;
};
};
struct key_acl {
refcount_t usage;
unsigned short nr_ace;
bool possessor_viewable;
struct rcu_head rcu;
struct key_ace aces[];
};
#define KEY_POSSESSOR_ACE(perms) { \
.type = KEY_ACE_SUBJ_STANDARD, \
.perm = perms, \
.subject_id = KEY_ACE_POSSESSOR \
}
#define KEY_OWNER_ACE(perms) { \
.type = KEY_ACE_SUBJ_STANDARD, \
.perm = perms, \
.subject_id = KEY_ACE_OWNER \
}
/*****************************************************************************/
/*
* key reference with possession attribute handling
@@ -174,7 +179,6 @@ struct key {
struct rw_semaphore sem; /* change vs change sem */
struct key_user *user; /* owner of this key */
void *security; /* security data for this key */
struct key_acl __rcu *acl;
union {
time64_t expiry; /* time at which key expires (or 0) */
time64_t revoked_at; /* time at which key was revoked */
@@ -182,6 +186,7 @@ struct key {
time64_t last_used_at; /* last time used for LRU keyring discard */
kuid_t uid;
kgid_t gid;
key_perm_t perm; /* access permissions */
unsigned short quotalen; /* length added to quota */
unsigned short datalen; /* payload data length
* - may not match RCU dereferenced payload
@@ -205,7 +210,6 @@ struct key {
#define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */
#define KEY_FLAG_KEEP 8 /* set if key should not be removed */
#define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */
#define KEY_FLAG_HAS_ACL 10 /* Set if KEYCTL_SETACL called on key */
/* the key type and key description string
* - the desc is used to match a key against search criteria
@@ -254,7 +258,7 @@ extern struct key *key_alloc(struct key_type *type,
const char *desc,
kuid_t uid, kgid_t gid,
const struct cred *cred,
struct key_acl *acl,
key_perm_t perm,
unsigned long flags,
struct key_restriction *restrict_link);
@@ -291,8 +295,7 @@ static inline void key_ref_put(key_ref_t key_ref)
extern struct key *request_key_tag(struct key_type *type,
const char *description,
struct key_tag *domain_tag,
const char *callout_info,
struct key_acl *acl);
const char *callout_info);
extern struct key *request_key_rcu(struct key_type *type,
const char *description,
@@ -303,24 +306,21 @@ extern struct key *request_key_with_auxdata(struct key_type *type,
struct key_tag *domain_tag,
const void *callout_info,
size_t callout_len,
void *aux,
struct key_acl *acl);
void *aux);
/**
* request_key - Request a key and wait for construction
* @type: Type of key.
* @description: The searchable description of the key.
* @callout_info: The data to pass to the instantiation upcall (or NULL).
* @acl: The ACL to attach to a new key (or NULL).
*
* As for request_key_tag(), but with the default global domain tag.
*/
static inline struct key *request_key(struct key_type *type,
const char *description,
const char *callout_info,
struct key_acl *acl)
const char *callout_info)
{
return request_key_tag(type, description, NULL, callout_info, acl);
return request_key_tag(type, description, NULL, callout_info);
}
#ifdef CONFIG_NET
@@ -330,7 +330,6 @@ static inline struct key *request_key(struct key_type *type,
* @description: The searchable description of the key.
* @net: The network namespace that is the key's domain of operation.
* @callout_info: The data to pass to the instantiation upcall (or NULL).
* @acl: The ACL to attach to a new key (or NULL).
*
* As for request_key() except that it does not add the returned key to a
* keyring if found, new keys are always allocated in the user's quota, the
@@ -340,8 +339,8 @@ static inline struct key *request_key(struct key_type *type,
* Furthermore, it then works as wait_for_key_construction() to wait for the
* completion of keys undergoing construction with a non-interruptible wait.
*/
#define request_key_net(type, description, net, callout_info, acl) \
request_key_tag(type, description, net->key_domain, callout_info, acl);
#define request_key_net(type, description, net, callout_info) \
request_key_tag(type, description, net->key_domain, callout_info);
#endif /* CONFIG_NET */
extern int wait_for_key_construction(struct key *key, bool intr);
@@ -353,7 +352,7 @@ extern key_ref_t key_create_or_update(key_ref_t keyring,
const char *description,
const void *payload,
size_t plen,
struct key_acl *acl,
key_perm_t perm,
unsigned long flags);
extern int key_update(key_ref_t key,
@@ -373,7 +372,7 @@ extern int key_unlink(struct key *keyring,
extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
const struct cred *cred,
struct key_acl *acl,
key_perm_t perm,
unsigned long flags,
struct key_restriction *restrict_link,
struct key *dest);
@@ -406,29 +405,19 @@ static inline key_serial_t key_serial(const struct key *key)
extern void key_set_timeout(struct key *, unsigned);
extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
u32 desired_perm);
key_perm_t perm);
extern void key_free_user_ns(struct user_namespace *);
/*
* The permissions required on a key that we're looking up.
*/
#define KEY_NEED_VIEW 0x001 /* Require permission to view attributes */
#define KEY_NEED_READ 0x002 /* Require permission to read content */
#define KEY_NEED_WRITE 0x004 /* Require permission to update / modify */
#define KEY_NEED_SEARCH 0x008 /* Require permission to search (keyring) or find (key) */
#define KEY_NEED_LINK 0x010 /* Require permission to link */
#define KEY_NEED_SETSEC 0x020 /* Require permission to set owner, group, ACL */
#define KEY_NEED_INVAL 0x040 /* Require permission to invalidate key */
#define KEY_NEED_REVOKE 0x080 /* Require permission to revoke key */
#define KEY_NEED_JOIN 0x100 /* Require permission to join keyring as session */
#define KEY_NEED_CLEAR 0x200 /* Require permission to clear a keyring */
#define KEY_NEED_ALL 0x3ff
#define OLD_KEY_NEED_SETATTR 0x20 /* Used to be Require permission to change attributes */
extern struct key_acl internal_key_acl;
extern struct key_acl internal_keyring_acl;
extern struct key_acl internal_writable_keyring_acl;
#define KEY_NEED_VIEW 0x01 /* Require permission to view attributes */
#define KEY_NEED_READ 0x02 /* Require permission to read content */
#define KEY_NEED_WRITE 0x04 /* Require permission to update / modify */
#define KEY_NEED_SEARCH 0x08 /* Require permission to search (keyring) or find (key) */
#define KEY_NEED_LINK 0x10 /* Require permission to link */
#define KEY_NEED_SETATTR 0x20 /* Require permission to change attributes */
#define KEY_NEED_ALL 0x3f /* All the above permissions */
static inline short key_read_state(const struct key *key)
{

65
include/uapi/linux/keyctl.h
View File

@@ -15,69 +15,6 @@
#include <linux/types.h>
/*
* Keyring permission grant definitions
*/
enum key_ace_subject_type {
KEY_ACE_SUBJ_STANDARD = 0, /* subject is one of key_ace_standard_subject */
nr__key_ace_subject_type
};
enum key_ace_standard_subject {
KEY_ACE_EVERYONE = 0, /* Everyone, including owner and group */
KEY_ACE_GROUP = 1, /* The key's group */
KEY_ACE_OWNER = 2, /* The owner of the key */
KEY_ACE_POSSESSOR = 3, /* Any process that possesses of the key */
nr__key_ace_standard_subject
};
#define KEY_ACE_VIEW 0x00000001 /* Can describe the key */
#define KEY_ACE_READ 0x00000002 /* Can read the key content */
#define KEY_ACE_WRITE 0x00000004 /* Can update/modify the key content */
#define KEY_ACE_SEARCH 0x00000008 /* Can find the key by search */
#define KEY_ACE_LINK 0x00000010 /* Can make a link to the key */
#define KEY_ACE_SET_SECURITY 0x00000020 /* Can set owner, group, ACL */
#define KEY_ACE_INVAL 0x00000040 /* Can invalidate the key */
#define KEY_ACE_REVOKE 0x00000080 /* Can revoke the key */
#define KEY_ACE_JOIN 0x00000100 /* Can join keyring */
#define KEY_ACE_CLEAR 0x00000200 /* Can clear keyring */
#define KEY_ACE__PERMS 0xffffffff
/*
* Old-style permissions mask, deprecated in favour of ACL.
*/
#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */
#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */
#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */
#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */
#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */
#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */
#define KEY_POS_ALL 0x3f000000
#define KEY_USR_VIEW 0x00010000 /* user permissions... */
#define KEY_USR_READ 0x00020000
#define KEY_USR_WRITE 0x00040000
#define KEY_USR_SEARCH 0x00080000
#define KEY_USR_LINK 0x00100000
#define KEY_USR_SETATTR 0x00200000
#define KEY_USR_ALL 0x003f0000
#define KEY_GRP_VIEW 0x00000100 /* group permissions... */
#define KEY_GRP_READ 0x00000200
#define KEY_GRP_WRITE 0x00000400
#define KEY_GRP_SEARCH 0x00000800
#define KEY_GRP_LINK 0x00001000
#define KEY_GRP_SETATTR 0x00002000
#define KEY_GRP_ALL 0x00003f00
#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */
#define KEY_OTH_READ 0x00000002
#define KEY_OTH_WRITE 0x00000004
#define KEY_OTH_SEARCH 0x00000008
#define KEY_OTH_LINK 0x00000010
#define KEY_OTH_SETATTR 0x00000020
#define KEY_OTH_ALL 0x0000003f
/* special process keyring shortcut IDs */
#define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */
#define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */
@@ -132,7 +69,6 @@ enum key_ace_standard_subject {
#define KEYCTL_RESTRICT_KEYRING 29 /* Restrict keys allowed to link to a keyring */
#define KEYCTL_MOVE 30 /* Move keys between keyrings */
#define KEYCTL_CAPABILITIES 31 /* Find capabilities of keyrings subsystem */
#define KEYCTL_GRANT_PERMISSION 32 /* Grant a permit to a key */
/* keyctl structures */
struct keyctl_dh_params {
@@ -194,6 +130,5 @@ struct keyctl_pkey_params {
#define KEYCTL_CAPS0_MOVE 0x80 /* KEYCTL_MOVE supported */
#define KEYCTL_CAPS1_NS_KEYRING_NAME 0x01 /* Keyring names are per-user_namespace */
#define KEYCTL_CAPS1_NS_KEY_TAG 0x02 /* Key indexing can include a namespace tag */
#define KEYCTL_CAPS1_ACL_ALTERABLE 0x04 /* Keys have internal ACL that can be altered */
#endif /* _LINUX_KEYCTL_H */

2
lib/digsig.c
View File

@@ -224,7 +224,7 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen,
else
key = key_ref_to_ptr(kref);
} else {
key = request_key(&key_type_user, name, NULL, NULL);
key = request_key(&key_type_user, name, NULL);
}
if (IS_ERR(key)) {
pr_err("key not found, id: %s\n", name);

2
net/ceph/ceph_common.c
View File

@@ -306,7 +306,7 @@ static int get_secret(struct ceph_crypto_key *dst, const char *name) {
int err = 0;
struct ceph_crypto_key *ckey;
ukey = request_key(&key_type_ceph, name, NULL, NULL);
ukey = request_key(&key_type_ceph, name, NULL);
if (IS_ERR(ukey)) {
/* request_key errors don't map nicely to mount(2)
errors; don't even try, but still printk */

Some files were not shown because too many files have changed in this diff Show More