summaryrefslogtreecommitdiffstats
path: root/security/keys/process_keys.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2013-09-24 11:35:13 +0200
committerDavid Howells <dhowells@redhat.com>2013-09-24 11:35:13 +0200
commit61ea0c0ba904a55f55317d850c1072ff7835ac92 (patch)
tree259f6872bc88d1cb4e94e405d5273c6dbc678175 /security/keys/process_keys.c
parentselinux: add Paul Moore as a SELinux maintainer (diff)
downloadlinux-61ea0c0ba904a55f55317d850c1072ff7835ac92.tar.xz
linux-61ea0c0ba904a55f55317d850c1072ff7835ac92.zip
KEYS: Skip key state checks when checking for possession
Skip key state checks (invalidation, revocation and expiration) when checking for possession. Without this, keys that have been marked invalid, revoked keys and expired keys are not given a possession attribute - which means the possessor is not granted any possession permits and cannot do anything with them unless they also have one a user, group or other permit. This causes failures in the keyutils test suite's revocation and expiration tests now that commit 96b5c8fea6c0861621051290d705ec2e971963f1 reduced the initial permissions granted to a key. The failures are due to accesses to revoked and expired keys being given EACCES instead of EKEYREVOKED or EKEYEXPIRED. Signed-off-by: David Howells <dhowells@redhat.com>
Diffstat (limited to 'security/keys/process_keys.c')
-rw-r--r--security/keys/process_keys.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 42defae1e161..a3410d605849 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -440,6 +440,7 @@ found:
key_ref_t search_process_keyrings(struct key_type *type,
const void *description,
key_match_func_t match,
+ bool no_state_check,
const struct cred *cred)
{
struct request_key_auth *rka;
@@ -448,7 +449,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
might_sleep();
key_ref = search_my_process_keyrings(type, description, match,
- false, cred);
+ no_state_check, cred);
if (!IS_ERR(key_ref))
goto found;
err = key_ref;
@@ -468,7 +469,8 @@ key_ref_t search_process_keyrings(struct key_type *type,
rka = cred->request_key_auth->payload.data;
key_ref = search_process_keyrings(type, description,
- match, rka->cred);
+ match, no_state_check,
+ rka->cred);
up_read(&cred->request_key_auth->sem);
@@ -675,7 +677,7 @@ try_again:
/* check to see if we possess the key */
skey_ref = search_process_keyrings(key->type, key,
lookup_user_key_possessed,
- cred);
+ true, cred);
if (!IS_ERR(skey_ref)) {
key_put(key);