lkml.org 
[lkml]   [2011]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH 5/5] eCryptfs: write lock requested keys
Date
A requested key is write locked in order to prevent modifications on the
authentication token while it is being used.

Signed-off-by: Roberto Sassu <roberto.sassu@polito.it>
---
fs/ecryptfs/keystore.c | 23 ++++++++++++++++++-----
fs/ecryptfs/main.c | 4 +++-
2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index d066217..3eac4ba 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -428,6 +428,7 @@ ecryptfs_find_global_auth_tok_for_sig(
if (rc)
goto out;

+ down_write(&(walker->global_auth_tok_key->sem));
rc = ecryptfs_verify_auth_tok_from_key(
walker->global_auth_tok_key, auth_tok);
if (rc) {
@@ -435,6 +436,7 @@ ecryptfs_find_global_auth_tok_for_sig(
"Invalidating auth tok with sig = [%s]\n",
sig);
walker->flags |= ECRYPTFS_AUTH_TOK_INVALID;
+ up_write(&(walker->global_auth_tok_key->sem));
key_put(walker->global_auth_tok_key);
walker->global_auth_tok_key = NULL;
mount_crypt_stat->num_global_auth_toks--;
@@ -786,8 +788,10 @@ out_free_unlock:
out_unlock:
mutex_unlock(s->tfm_mutex);
out:
- if (auth_tok_key)
+ if (auth_tok_key) {
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
+ }
kfree(s);
return rc;
}
@@ -1025,8 +1029,10 @@ out:
(*filename_size) = 0;
(*filename) = NULL;
}
- if (auth_tok_key)
+ if (auth_tok_key) {
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
+ }
kfree(s);
return rc;
}
@@ -1589,9 +1595,10 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
(*auth_tok_key) = NULL;
goto out;
}
-
+ down_write(&(*auth_tok_key)->sem);
rc = ecryptfs_verify_auth_tok_from_key(*auth_tok_key, auth_tok);
if (rc) {
+ up_write(&(*auth_tok_key)->sem);
key_put(*auth_tok_key);
(*auth_tok_key) = NULL;
goto out;
@@ -1844,6 +1851,7 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
find_next_matching_auth_tok:
found_auth_tok = 0;
if (auth_tok_key) {
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
auth_tok_key = NULL;
}
@@ -1930,8 +1938,10 @@ found_matching_auth_tok:
out_wipe_list:
wipe_auth_tok_list(&auth_tok_list);
out:
- if (auth_tok_key)
+ if (auth_tok_key) {
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
+ }
return rc;
}

@@ -2428,6 +2438,7 @@ ecryptfs_generate_key_packet_set(char *dest_base,
rc = -EINVAL;
goto out_release_key;
}
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
}
if (!auth_tok_count) {
@@ -2444,8 +2455,10 @@ ecryptfs_generate_key_packet_set(char *dest_base,
rc = -EIO;
}
out_release_key:
- if (rc)
+ if (rc) {
+ up_write(&(auth_tok_key->sem));
key_put(auth_tok_key);
+ }
out_free:
kmem_cache_free(ecryptfs_key_record_cache, key_rec);
out:
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index f079473..ada50a3 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -256,8 +256,10 @@ static int ecryptfs_init_global_auth_toks(
"option: [%s]\n", global_auth_tok->sig);
global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;
goto out;
- } else
+ } else {
global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;
+ up_write(&(global_auth_tok->global_auth_tok_key)->sem);
+ }
}
out:
return rc;
--
1.7.4
[unhandled content-type:application/x-pkcs7-signature]
\
 
 \ /
  Last update: 2011-03-17 12:53    [W:0.326 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site