Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH] keyring: Incorrect permissions checking in __keyring_search_one() | Date | Mon, 10 Mar 2008 12:25:21 +0000 |
| |
Arun Raghavan <arunsr@cse.iitk.ac.in> wrote:
> The __keyring_search_one() function currently has 2 issues with regards > to permissions: > > 1. It does not check for KEY_SEARCH on the keyring before performing a > search
That is correct. This is used by key_create_or_update() to check to see whether there's a key in the current keyring that it can update rather than adding a new key entirely. key_create_or_update() mustn't be bound by KEY_SEARCH permission, and similarly the target key doesn't require KEY_SEARCH permission either; the control here is whether or not the target key has KEY_WRITE permission.
> 2. It accepts a "perm" parameter to check whether a given key in the > keyring may be returned.
The "perm" parameter is superfluous given that nothing else now calls this function.
David
| |