Commit 5ac7eace authored by David Howells's avatar David Howells
Browse files

KEYS: Add a facility to restrict new links into a keyring 



Add a facility whereby proposed new links to be added to a keyring can be
vetted, permitting them to be rejected if necessary.  This can be used to
block public keys from which the signature cannot be verified or for which
the signature verification fails.  It could also be used to provide
blacklisting.

This affects operations like add_key(), KEYCTL_LINK and KEYCTL_INSTANTIATE.

To this end:

 (1) A function pointer is added to the key struct that, if set, points to
     the vetting function.  This is called as:

	int (*restrict_link)(struct key *keyring,
			     const struct key_type *key_type,
			     unsigned long key_flags,
			     const union key_payload *key_payload),

     where 'keyring' will be the keyring being added to, key_type and
     key_payload will describe the key being added and key_flags[*] can be
     AND'ed with KEY_FLAG_TRUSTED.

     [*] This parameter will be removed in a later patch when
     	 KEY_FLAG_TRUSTED is removed.

     The function should return 0 to allow the link to take place or an
     error (typically -ENOKEY, -ENOPKG or -EKEYREJECTED) to reject the
     link.

     The pointer should not be set directly, but rather should be set
     through keyring_alloc().

     Note that if called during add_key(), preparse is called before this
     method, but a key isn't actually allocated until after this function
     is called.

 (2) KEY_ALLOC_BYPASS_RESTRICTION is added.  This can be passed to
     key_create_or_update() or key_instantiate_and_link() to bypass the
     restriction check.

 (3) KEY_FLAG_TRUSTED_ONLY is removed.  The entire contents of a keyring
     with this restriction emplaced can be considered 'trustworthy' by
     virtue of being in the keyring when that keyring is consulted.

 (4) key_alloc() and keyring_alloc() take an extra argument that will be
     used to set restrict_link in the new key.  This ensures that the
     pointer is set before the key is published, thus preventing a window
     of unrestrictedness.  Normally this argument will be NULL.

 (5) As a temporary affair, keyring_restrict_trusted_only() is added.  It
     should be passed to keyring_alloc() as the extra argument instead of
     setting KEY_FLAG_TRUSTED_ONLY on a keyring.  This will be replaced in
     a later patch with functions that look in the appropriate places for
     authoritative keys.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
parent bda850cd

Documentation/security/keys.txt

+22 −0
Original line number Diff line number Diff line
@@ -999,6 +999,10 @@ payload contents" for more information. 
	struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,

				  const struct cred *cred,

				  key_perm_t perm,

				  int (*restrict_link)(struct key *,

						       const struct key_type *,

						       unsigned long,

						       const union key_payload *),

				  unsigned long flags,

				  struct key *dest);
@@ -1010,6 +1014,24 @@ payload contents" for more information. 
    KEY_ALLOC_NOT_IN_QUOTA in flags if the keyring shouldn't be accounted

    towards the user's quota).  Error ENOMEM can also be returned.



    If restrict_link not NULL, it should point to a function that will be

    called each time an attempt is made to link a key into the new keyring.

    This function is called to check whether a key may be added into the keying

    or not.  Callers of key_create_or_update() within the kernel can pass

    KEY_ALLOC_BYPASS_RESTRICTION to suppress the check.  An example of using

    this is to manage rings of cryptographic keys that are set up when the

    kernel boots where userspace is also permitted to add keys - provided they

    can be verified by a key the kernel already has.



    When called, the restriction function will be passed the keyring being

    added to, the key flags value and the type and payload of the key being

    added.  Note that when a new key is being created, this is called between

    payload preparsing and actual key creation.  The function should return 0

    to allow the link or an error to reject it.



    A convenience function, restrict_link_reject, exists to always return

    -EPERM to in this case.





(*) To check the validity of a key, this function can be called:

certs/system_keyring.c

+4 −4
Original line number Diff line number Diff line
@@ -36,11 +36,10 @@ static __init int system_trusted_keyring_init(void) 
			      KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),

			      ((KEY_POS_ALL & ~KEY_POS_SETATTR) |

			      KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),

			      KEY_ALLOC_NOT_IN_QUOTA, NULL);

			      KEY_ALLOC_NOT_IN_QUOTA,

			      keyring_restrict_trusted_only, NULL);

	if (IS_ERR(system_trusted_keyring))

		panic("Can't allocate system trusted keyring\n");



	set_bit(KEY_FLAG_TRUSTED_ONLY, &system_trusted_keyring->flags);

	return 0;

}
@@ -85,7 +84,8 @@ static __init int load_system_certificate_list(void) 
					   KEY_USR_VIEW | KEY_USR_READ),

					   KEY_ALLOC_NOT_IN_QUOTA |

					   KEY_ALLOC_TRUSTED |

					   KEY_ALLOC_BUILT_IN);

					   KEY_ALLOC_BUILT_IN |

					   KEY_ALLOC_BYPASS_RESTRICTION);

		if (IS_ERR(key)) {

			pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",

			       PTR_ERR(key));

fs/cifs/cifsacl.c

+1 −1
Original line number Diff line number Diff line
@@ -360,7 +360,7 @@ init_cifs_idmap(void) 
				GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,

				(KEY_POS_ALL & ~KEY_POS_SETATTR) |

				KEY_USR_VIEW | KEY_USR_READ,

				KEY_ALLOC_NOT_IN_QUOTA, NULL);

				KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

fs/nfs/nfs4idmap.c

+1 −1
Original line number Diff line number Diff line
@@ -201,7 +201,7 @@ int nfs_idmap_init(void) 
				GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,

				(KEY_POS_ALL & ~KEY_POS_SETATTR) |

				KEY_USR_VIEW | KEY_USR_READ,

				KEY_ALLOC_NOT_IN_QUOTA, NULL);

				KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

include/linux/key.h

+43 −10
Original line number Diff line number Diff line
@@ -174,10 +174,9 @@ struct key { 
#define KEY_FLAG_ROOT_CAN_CLEAR	6	/* set if key can be cleared by root without permission */

#define KEY_FLAG_INVALIDATED	7	/* set if key has been invalidated */

#define KEY_FLAG_TRUSTED	8	/* set if key is trusted */

#define KEY_FLAG_TRUSTED_ONLY	9	/* set if keyring only accepts links to trusted keys */

#define KEY_FLAG_BUILTIN	10	/* set if key is builtin */

#define KEY_FLAG_ROOT_CAN_INVAL	11	/* set if key can be invalidated by root without permission */

#define KEY_FLAG_KEEP		12	/* set if key should not be removed */

#define KEY_FLAG_BUILTIN	9	/* set if key is built in to the kernel */

#define KEY_FLAG_ROOT_CAN_INVAL	10	/* set if key can be invalidated by root without permission */

#define KEY_FLAG_KEEP		11	/* set if key should not be removed */



	/* the key type and key description string

	 * - the desc is used to match a key against search criteria
@@ -205,6 +204,21 @@ struct key { 
		};

		int reject_error;

	};



	/* This is set on a keyring to restrict the addition of a link to a key

	 * to it.  If this method isn't provided then it is assumed that the

	 * keyring is open to any addition.  It is ignored for non-keyring

	 * keys.

	 *

	 * This is intended for use with rings of trusted keys whereby addition

	 * to the keyring needs to be controlled.  KEY_ALLOC_BYPASS_RESTRICTION

	 * overrides this, allowing the kernel to add extra keys without

	 * restriction.

	 */

	int (*restrict_link)(struct key *keyring,

			     const struct key_type *type,

			     unsigned long flags,

			     const union key_payload *payload);

};



extern struct key *key_alloc(struct key_type *type,
@@ -212,7 +226,11 @@ extern struct key *key_alloc(struct key_type *type, 
			     kuid_t uid, kgid_t gid,

			     const struct cred *cred,

			     key_perm_t perm,

			     unsigned long flags);

			     unsigned long flags,

			     int (*restrict_link)(struct key *,

						  const struct key_type *,

						  unsigned long,

						  const union key_payload *));





#define KEY_ALLOC_IN_QUOTA		0x0000	/* add to quota, reject if would overrun */
@@ -220,6 +238,7 @@ extern struct key *key_alloc(struct key_type *type, 
#define KEY_ALLOC_NOT_IN_QUOTA		0x0002	/* not in quota */

#define KEY_ALLOC_TRUSTED		0x0004	/* Key should be flagged as trusted */

#define KEY_ALLOC_BUILT_IN		0x0008	/* Key is built into kernel */

#define KEY_ALLOC_BYPASS_RESTRICTION	0x0010	/* Override the check on restricted keyrings */



extern void key_revoke(struct key *key);

extern void key_invalidate(struct key *key);
@@ -288,8 +307,22 @@ extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid 
				 const struct cred *cred,

				 key_perm_t perm,

				 unsigned long flags,

				 int (*restrict_link)(struct key *,

						      const struct key_type *,

						      unsigned long,

						      const union key_payload *),

				 struct key *dest);



extern int keyring_restrict_trusted_only(struct key *keyring,

					 const struct key_type *type,

					 unsigned long,

					 const union key_payload *payload);



extern int restrict_link_reject(struct key *keyring,

				const struct key_type *type,

				unsigned long flags,

				const union key_payload *payload);



extern int keyring_clear(struct key *keyring);



extern key_ref_t keyring_search(key_ref_t keyring,

CRA Git | Maintained and supported by SUSTech CRA and CCSE