Commit 78b7280c authored by David Howells's avatar David Howells Committed by James Morris
Browse files

KEYS: Improve /proc/keys 



Improve /proc/keys by:

 (1) Don't attempt to summarise the payload of a negated key.  It won't have
     one.  To this end, a helper function - key_is_instantiated() has been
     added that allows the caller to find out whether the key is positively
     instantiated (as opposed to being uninstantiated or negatively
     instantiated).

 (2) Do show keys that are negative, expired or revoked rather than hiding
     them.  This requires an override flag (no_state_check) to be passed to
     search_my_process_keyrings() and keyring_search_aux() to suppress this
     check.

     Without this, keys that are possessed by the caller, but only grant
     permissions to the caller if possessed are skipped as the possession check
     fails.

     Keys that are visible due to user, group or other checks are visible with
     or without this patch.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent c151694b

include/linux/key.h

+13 −0
Original line number Diff line number Diff line
@@ -276,6 +276,19 @@ static inline key_serial_t key_serial(struct key *key) 
	return key ? key->serial : 0;

}



/**

 * key_is_instantiated - Determine if a key has been positively instantiated

 * @key: The key to check.

 *

 * Return true if the specified key has been positively instantiated, false

 * otherwise.

 */

static inline bool key_is_instantiated(const struct key *key)

{

	return test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&

		!test_bit(KEY_FLAG_NEGATIVE, &key->flags);

}



#define rcu_dereference_key(KEY)					\

	(rcu_dereference_protected((KEY)->payload.rcudata,		\

				   rwsem_is_locked(&((struct key *)(KEY))->sem)))

net/dns_resolver/dns_key.c

+6 −4
Original line number Diff line number Diff line
@@ -212,11 +212,13 @@ static void dns_resolver_describe(const struct key *key, struct seq_file *m) 
	int err = key->type_data.x[0];



	seq_puts(m, key->description);

	if (key_is_instantiated(key)) {

		if (err)

			seq_printf(m, ": %d", err);

		else

			seq_printf(m, ": %u", key->datalen);

	}

}



/*

 * read the DNS data

security/keys/internal.h

+3 −1
Original line number Diff line number Diff line
@@ -109,11 +109,13 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
				    const struct cred *cred,

				    struct key_type *type,

				    const void *description,

				    key_match_func_t match);

				    key_match_func_t match,

				    bool no_state_check);



extern key_ref_t search_my_process_keyrings(struct key_type *type,

					    const void *description,

					    key_match_func_t match,

					    bool no_state_check,

					    const struct cred *cred);

extern key_ref_t search_process_keyrings(struct key_type *type,

					 const void *description,

security/keys/keyring.c

+24 −13
Original line number Diff line number Diff line
@@ -176,6 +176,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m) 
	else

		seq_puts(m, "[anon]");



	if (key_is_instantiated(keyring)) {

		rcu_read_lock();

		klist = rcu_dereference(keyring->payload.subscriptions);

		if (klist)
@@ -184,6 +185,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m) 
			seq_puts(m, ": empty");

		rcu_read_unlock();

	}

}



/*

 * Read a list of key IDs from the keyring's contents in binary form
@@ -271,6 +273,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, 
 * @type: The type of key to search for.

 * @description: Parameter for @match.

 * @match: Function to rule on whether or not a key is the one required.

 * @no_state_check: Don't check if a matching key is bad

 *

 * Search the supplied keyring tree for a key that matches the criteria given.

 * The root keyring and any linked keyrings must grant Search permission to the
@@ -303,7 +306,8 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
			     const struct cred *cred,

			     struct key_type *type,

			     const void *description,

			     key_match_func_t match)

			     key_match_func_t match,

			     bool no_state_check)

{

	struct {

		struct keyring_list *keylist;
@@ -345,6 +349,8 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
	kflags = keyring->flags;

	if (keyring->type == type && match(keyring, description)) {

		key = keyring;

		if (no_state_check)

			goto found;



		/* check it isn't negative and hasn't expired or been

		 * revoked */
@@ -384,11 +390,13 @@ descend: 
			continue;



		/* skip revoked keys and expired keys */

		if (!no_state_check) {

			if (kflags & (1 << KEY_FLAG_REVOKED))

				continue;



			if (key->expiry && now.tv_sec >= key->expiry)

				continue;

		}



		/* keys that don't match */

		if (!match(key, description))
@@ -399,6 +407,9 @@ descend: 
					cred, KEY_SEARCH) < 0)

			continue;



		if (no_state_check)

			goto found;



		/* we set a different error code if we pass a negative key */

		if (kflags & (1 << KEY_FLAG_NEGATIVE)) {

			err = key->type_data.reject_error;
@@ -478,7 +489,7 @@ key_ref_t keyring_search(key_ref_t keyring, 
		return ERR_PTR(-ENOKEY);



	return keyring_search_aux(keyring, current->cred,

				  type, description, type->match);

				  type, description, type->match, false);

}

EXPORT_SYMBOL(keyring_search);

security/keys/proc.c

+1 −1
Original line number Diff line number Diff line
@@ -199,7 +199,7 @@ static int proc_keys_show(struct seq_file *m, void *v) 
	if (key->perm & KEY_POS_VIEW) {

		skey_ref = search_my_process_keyrings(key->type, key,

						      lookup_user_key_possessed,

						      cred);

						      true, cred);

		if (!IS_ERR(skey_ref)) {

			key_ref_put(skey_ref);

			key_ref = make_key_ref(key, 1);

CRA Git | Maintained and supported by SUSTech CRA and CCSE