Commit aaf66c88 authored by Mat Martineau's avatar Mat Martineau
Browse files

KEYS: Split role of the keyring pointer for keyring restrict functions 



The first argument to the restrict_link_func_t functions was a keyring
pointer. These functions are called by the key subsystem with this
argument set to the destination keyring, but restrict_link_by_signature
expects a pointer to the relevant trusted keyring.

Restrict functions may need something other than a single struct key
pointer to allow or reject key linkage, so the data used to make that
decision (such as the trust keyring) is moved to a new, fourth
argument. The first argument is now always the destination keyring.

Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
parent 469ff8f7

Documentation/security/keys.txt

+4 −4
Original line number Diff line number Diff line
@@ -1054,10 +1054,10 @@ payload contents" for more information. 
    can be verified by a key the kernel already has.



    When called, the restriction function will be passed the keyring being

    added to, the key flags value and the type and payload of the key being

    added.  Note that when a new key is being created, this is called between

    payload preparsing and actual key creation.  The function should return 0

    to allow the link or an error to reject it.

    added to, the key type, the payload of the key being added, and data to be

    used in the restriction check.  Note that when a new key is being created,

    this is called between payload preparsing and actual key creation.  The

    function should return 0 to allow the link or an error to reject it.



    A convenience function, restrict_link_reject, exists to always return

    -EPERM to in this case.

certs/system_keyring.c

+11 −7
Original line number Diff line number Diff line
@@ -32,11 +32,13 @@ extern __initconst const unsigned long system_certificate_list_size; 
 * Restrict the addition of keys into a keyring based on the key-to-be-added

 * being vouched for by a key in the built in system keyring.

 */

int restrict_link_by_builtin_trusted(struct key *keyring,

int restrict_link_by_builtin_trusted(struct key *dest_keyring,

				     const struct key_type *type,

				     const union key_payload *payload)

				     const union key_payload *payload,

				     struct key *restriction_key)

{

	return restrict_link_by_signature(builtin_trusted_keys, type, payload);

	return restrict_link_by_signature(dest_keyring, type, payload,

					  builtin_trusted_keys);

}



#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
@@ -49,20 +51,22 @@ int restrict_link_by_builtin_trusted(struct key *keyring, 
 * keyrings.

 */

int restrict_link_by_builtin_and_secondary_trusted(

	struct key *keyring,

	struct key *dest_keyring,

	const struct key_type *type,

	const union key_payload *payload)

	const union key_payload *payload,

	struct key *restrict_key)

{

	/* If we have a secondary trusted keyring, then that contains a link

	 * through to the builtin keyring and the search will follow that link.

	 */

	if (type == &key_type_keyring &&

	    keyring == secondary_trusted_keys &&

	    dest_keyring == secondary_trusted_keys &&

	    payload == &builtin_trusted_keys->payload)

		/* Allow the builtin keyring to be added to the secondary */

		return 0;



	return restrict_link_by_signature(secondary_trusted_keys, type, payload);

	return restrict_link_by_signature(dest_keyring, type, payload,

					  secondary_trusted_keys);

}

#endif

crypto/asymmetric_keys/restrict.c

+5 −3
Original line number Diff line number Diff line
@@ -56,9 +56,10 @@ __setup("ca_keys=", ca_keys_setup); 


/**

 * restrict_link_by_signature - Restrict additions to a ring of public keys

 * @trust_keyring: A ring of keys that can be used to vouch for the new cert.

 * @dest_keyring: Keyring being linked to.

 * @type: The type of key being added.

 * @payload: The payload of the new key.

 * @trust_keyring: A ring of keys that can be used to vouch for the new cert.

 *

 * Check the new certificate against the ones in the trust keyring.  If one of

 * those is the signing key and validates the new certificate, then mark the
@@ -69,9 +70,10 @@ __setup("ca_keys=", ca_keys_setup); 
 * signature check fails or the key is blacklisted and some other error if

 * there is a matching certificate but the signature check cannot be performed.

 */

int restrict_link_by_signature(struct key *trust_keyring,

int restrict_link_by_signature(struct key *dest_keyring,

			       const struct key_type *type,

			       const union key_payload *payload)

			       const union key_payload *payload,

			       struct key *trust_keyring)

{

	const struct public_key_signature *sig;

	struct key *key;

include/crypto/public_key.h

+3 −2
Original line number Diff line number Diff line
@@ -50,9 +50,10 @@ struct key; 
struct key_type;

union key_payload;



extern int restrict_link_by_signature(struct key *trust_keyring,

extern int restrict_link_by_signature(struct key *dest_keyring,

				      const struct key_type *type,

				      const union key_payload *payload);

				      const union key_payload *payload,

				      struct key *trust_keyring);



extern int verify_signature(const struct key *key,

			    const struct public_key_signature *sig);

include/keys/system_keyring.h

+4 −2
Original line number Diff line number Diff line
@@ -18,7 +18,8 @@ 


extern int restrict_link_by_builtin_trusted(struct key *keyring,

					    const struct key_type *type,

					    const union key_payload *payload);

					    const union key_payload *payload,

					    struct key *restriction_key);



#else

#define restrict_link_by_builtin_trusted restrict_link_reject
@@ -28,7 +29,8 @@ extern int restrict_link_by_builtin_trusted(struct key *keyring, 
extern int restrict_link_by_builtin_and_secondary_trusted(

	struct key *keyring,

	const struct key_type *type,

	const union key_payload *payload);

	const union key_payload *payload,

	struct key *restriction_key);

#else

#define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE