lkml.org 
[lkml]   [2005]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Keyrings] [PATCH] Keys: Add LSM hooks for key management
On Thu, 6 Oct 2005, David Howells wrote:

> > > Should I expand the permissions mask to include a setattr?
> >
> > Possibly for setperm and chown.
>
> For setperm?

It changes an attribute of a key, for which you have DAC checks, therefore
you could assume that we'd also want MAC checks.

> > > > All users of key_permission() need to propagate the error code from the
> > > > LSM back to the user.
> > >
> > > Really? Why?
> >
> > Because the LSM has final say on the error code returned to the caller.
> > If the LSM runs out of memory, for example, it's silly to return -EACCES.
> >
> > > Note that the fact that key_permission() fails for a key is sometimes
> > > ignored, such as when I'm doing a search and one potentially matching key
> > > fails, but a subsequent matching key passes.
> >
> > Ok, that sounds like an internal issue to be resolved, ensuring that if
> > you are returning to the caller, the LSM's error code is returned.
>
> But which LSM error code?
>
> Let me explain what I mean:

[snipped]

Thanks for the detailed explanation.

Not sure yet how we'll avoid generating spurious SELinux denial messages.

> Only if all these fail does the whole thing fail with the highest priority
> error. Note that several errors may have come from LSM.
>
> The error priority should be:
>
> EKEYREVOKED > EKEYEXPIRED > ENOKEY
>
> EACCES/EPERM should only really be returned on a direct keyring search where
> the basal keyring doesn't have Search permission.

Ok, if a failure of this nature is generated by an LSM, we need to return
the LSM's error code (e.g. ask the LSM for search permission and it
returns -ENOMEM).

> The fact that I couldn't find a key because I didn't have permission to find
> it probably shouldn't cause an immediate abort of the search with an error, or
> any error other than ENOKEY/EKEYREVOKED/EKEYEXPIRED, unless I'm not permitted
> to request a new key.

Ok.


- James
--
James Morris
<jmorris@namei.org>
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-10-06 18:16    [W:0.151 / U:1.132 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site