Commit 685bfd2c authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

umh: creds: convert call_usermodehelper_keys() to use subprocess_info->init() 



call_usermodehelper_keys() uses call_usermodehelper_setkeys() to change
subprocess_info->cred in advance.  Now that we have info->init() we can
change this code to set tgcred->session_keyring in context of execing
kernel thread.

Note: since currently call_usermodehelper_keys() is never called with
UMH_NO_WAIT, call_usermodehelper_keys()->key_get() and umh_keys_cleanup()
are not really needed, we could rely on install_session_keyring_to_cred()
which does key_get() on success.

Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Acked-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 898b374a

include/linux/kmod.h

+0 −17
Original line number Diff line number Diff line
@@ -72,8 +72,6 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv, 
						  char **envp, gfp_t gfp_mask);



/* Set various pieces of state into the subprocess_info structure */

void call_usermodehelper_setkeys(struct subprocess_info *info,

				 struct key *session_keyring);

void call_usermodehelper_setfns(struct subprocess_info *info,

		    int (*init)(struct subprocess_info *info),

		    void (*cleanup)(struct subprocess_info *info),
@@ -112,21 +110,6 @@ call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait) 
				       NULL, NULL, NULL);

}



static inline int

call_usermodehelper_keys(char *path, char **argv, char **envp,

			 struct key *session_keyring, enum umh_wait wait)

{

	struct subprocess_info *info;

	gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;



	info = call_usermodehelper_setup(path, argv, envp, gfp_mask);

	if (info == NULL)

		return -ENOMEM;



	call_usermodehelper_setkeys(info, session_keyring);

	return call_usermodehelper_exec(info, wait);

}



extern void usermodehelper_init(void);



extern int usermodehelper_disable(void);

kernel/kmod.c

+0 −18
Original line number Diff line number Diff line
@@ -366,24 +366,6 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv, 
}

EXPORT_SYMBOL(call_usermodehelper_setup);



/**

 * call_usermodehelper_setkeys - set the session keys for usermode helper

 * @info: a subprocess_info returned by call_usermodehelper_setup

 * @session_keyring: the session keyring for the process

 */

void call_usermodehelper_setkeys(struct subprocess_info *info,

				 struct key *session_keyring)

{

#ifdef CONFIG_KEYS

	struct thread_group_cred *tgcred = info->cred->tgcred;

	key_put(tgcred->session_keyring);

	tgcred->session_keyring = key_get(session_keyring);

#else

	BUG();

#endif

}

EXPORT_SYMBOL(call_usermodehelper_setkeys);



/**

 * call_usermodehelper_setfns - set a cleanup/init function

 * @info: a subprocess_info returned by call_usermodehelper_setup

security/keys/internal.h

+1 −0
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check); 
extern int install_user_keyrings(void);

extern int install_thread_keyring_to_cred(struct cred *);

extern int install_process_keyring_to_cred(struct cred *);

extern int install_session_keyring_to_cred(struct cred *, struct key *);



extern struct key *request_key_and_link(struct key_type *type,

					const char *description,

security/keys/process_keys.c

+1 −2
Original line number Diff line number Diff line
@@ -216,8 +216,7 @@ static int install_process_keyring(void) 
/*

 * install a session keyring directly to a credentials struct

 */

static int install_session_keyring_to_cred(struct cred *cred,

					   struct key *keyring)

int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)

{

	unsigned long flags;

	struct key *old;

security/keys/request_key.c

+32 −0
Original line number Diff line number Diff line
@@ -58,6 +58,38 @@ void complete_request_key(struct key_construction *cons, int error) 
}

EXPORT_SYMBOL(complete_request_key);



static int umh_keys_init(struct subprocess_info *info)

{

	struct cred *cred = (struct cred*)current_cred();

	struct key *keyring = info->data;

	/*

	 * This is called in context of freshly forked kthread before

	 * kernel_execve(), we can just change our ->session_keyring.

	 */

	return install_session_keyring_to_cred(cred, keyring);

}



static void umh_keys_cleanup(struct subprocess_info *info)

{

	struct key *keyring = info->data;

	key_put(keyring);

}



static int call_usermodehelper_keys(char *path, char **argv, char **envp,

			 struct key *session_keyring, enum umh_wait wait)

{

	gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;

	struct subprocess_info *info =

		call_usermodehelper_setup(path, argv, envp, gfp_mask);



	if (!info)

		return -ENOMEM;



	call_usermodehelper_setfns(info, umh_keys_init, umh_keys_cleanup,

					key_get(session_keyring));

	return call_usermodehelper_exec(info, wait);

}



/*

 * request userspace finish the construction of a key

 * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"

CRA Git | Maintained and supported by SUSTech CRA and CCSE