lkml.org 
[lkml]   [2008]   [Mar]   [7]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    DateFri, 07 Mar 2008 10:32:23 +0530
    FromArun Raghavan <>
    Subject[PATCH] keyring: Allow clients to set key perms in key_create_or_update()
    Hello,
    The key_create_or_update() function provided by the keyring code has a
    default set of permissions that are always applied to the key when
    created. This might not be desirable to all clients.
    
    Here's a patch that adds a "perm" parameter to the function to address
    this, which can be set to KEY_PERM_UNDEF to revert to the current behaviour.
    
    Cheers,
    Arun
    
    [please CC me on replies -- I'm not on the LKML)
    [sorry if this turns up in your inbox twice]
    diff --git a/include/linux/key.h b/include/linux/key.h
    index a70b8a8..5b09ad6 100644
    --- a/include/linux/key.h
    +++ b/include/linux/key.h
    @@ -67,6 +67,8 @@ struct key;
     #define KEY_OTH_SETATTR	0x00000020
     #define KEY_OTH_ALL	0x0000003f
     
    +#define KEY_PERM_UNDEF	0xffffffff
    +
     struct seq_file;
     struct user_struct;
     struct signal_struct;
    @@ -229,6 +231,7 @@ extern key_ref_t key_create_or_update(key_ref_t keyring,
     				      const char *description,
     				      const void *payload,
     				      size_t plen,
    +				      key_perm_t perm,
     				      unsigned long flags);
     
     extern int key_update(key_ref_t key,
    diff --git a/security/keys/key.c b/security/keys/key.c
    index fdd5ca6..ca1d921 100644
    --- a/security/keys/key.c
    +++ b/security/keys/key.c
    @@ -757,11 +757,11 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
     			       const char *description,
     			       const void *payload,
     			       size_t plen,
    +			       key_perm_t perm,
     			       unsigned long flags)
     {
     	struct key_type *ktype;
     	struct key *keyring, *key = NULL;
    -	key_perm_t perm;
     	key_ref_t key_ref;
     	int ret;
     
    @@ -806,15 +806,17 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
     			goto found_matching_key;
     	}
     
    -	/* decide on the permissions we want */
    -	perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
    -	perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
    +	/* if the client doesn't provide, decide on the permissions we want */
    +	if (perm == KEY_PERM_UNDEF) {
    +		perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
    +		perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
     
    -	if (ktype->read)
    -		perm |= KEY_POS_READ | KEY_USR_READ;
    +		if (ktype->read)
    +			perm |= KEY_POS_READ | KEY_USR_READ;
     
    -	if (ktype == &key_type_keyring || ktype->update)
    -		perm |= KEY_USR_WRITE;
    +		if (ktype == &key_type_keyring || ktype->update)
    +			perm |= KEY_USR_WRITE;
    +	}
     
     	/* allocate a new key */
     	key = key_alloc(ktype, description, current->fsuid, current->fsgid,
    diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
    index d9ca15c..90ba663 100644
    --- a/security/keys/keyctl.c
    +++ b/security/keys/keyctl.c
    @@ -102,7 +102,8 @@ asmlinkage long sys_add_key(const char __user *_type,
     	/* create or update the requested key and add it to the target
     	 * keyring */
     	key_ref = key_create_or_update(keyring_ref, type, description,
    -				       payload, plen, KEY_ALLOC_IN_QUOTA);
    +				       payload, plen, KEY_PERM_UNDEF,
    +				       KEY_ALLOC_IN_QUOTA);
     	if (!IS_ERR(key_ref)) {
     		ret = key_ref_to_ptr(key_ref)->serial;
     		key_ref_put(key_ref);
    
    [unhandled content-type:application/pgp-signature]
    \
     
     \ /
      Last update: 2008-03-07 06:05    [from the cache]
    ©2003-2008