Commit c84ca912 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'keys-namespace-20190627' of... 

Merge tag 'keys-namespace-20190627' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Pull keyring namespacing from David Howells:
 "These patches help make keys and keyrings more namespace aware.

  Firstly some miscellaneous patches to make the process easier:

   - Simplify key index_key handling so that the word-sized chunks
     assoc_array requires don't have to be shifted about, making it
     easier to add more bits into the key.

   - Cache the hash value in the key so that we don't have to calculate
     on every key we examine during a search (it involves a bunch of
     multiplications).

   - Allow keying_search() to search non-recursively.

  Then the main patches:

   - Make it so that keyring names are per-user_namespace from the point
     of view of KEYCTL_JOIN_SESSION_KEYRING so that they're not
     accessible cross-user_namespace.

     keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEYRING_NAME for this.

   - Move the user and user-session keyrings to the user_namespace
     rather than the user_struct. This prevents them propagating
     directly across user_namespaces boundaries (ie. the KEY_SPEC_*
     flags will only pick from the current user_namespace).

   - Make it possible to include the target namespace in which the key
     shall operate in the index_key. This will allow the possibility of
     multiple keys with the same description, but different target
     domains to be held in the same keyring.

     keyctl_capabilities() shows KEYCTL_CAPS1_NS_KEY_TAG for this.

   - Make it so that keys are implicitly invalidated by removal of a
     domain tag, causing them to be garbage collected.

   - Institute a network namespace domain tag that allows keys to be
     differentiated by the network namespace in which they operate. New
     keys that are of a type marked 'KEY_TYPE_NET_DOMAIN' are assigned
     the network domain in force when they are created.

   - Make it so that the desired network namespace can be handed down
     into the request_key() mechanism. This allows AFS, NFS, etc. to
     request keys specific to the network namespace of the superblock.

     This also means that the keys in the DNS record cache are
     thenceforth namespaced, provided network filesystems pass the
     appropriate network namespace down into dns_query().

     For DNS, AFS and NFS are good, whilst CIFS and Ceph are not. Other
     cache keyrings, such as idmapper keyrings, also need to set the
     domain tag - for which they need access to the network namespace of
     the superblock"

* tag 'keys-namespace-20190627' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  keys: Pass the network namespace into request_key mechanism
  keys: Network namespace domain tag
  keys: Garbage collect keys for which the domain has been removed
  keys: Include target namespace in match criteria
  keys: Move the user and user-session keyrings to the user_namespace
  keys: Namespace keyring names
  keys: Add a 'recurse' flag for keyring searches
  keys: Cache the hash value to avoid lots of recalculation
  keys: Simplify key description management
parents c236b6dd a58946c1

Documentation/security/keys/core.rst

+28 −10
Original line number Diff line number Diff line
@@ -1102,26 +1102,42 @@ payload contents" for more information. 
    See also Documentation/security/keys/request-key.rst.





 *  To search for a key in a specific domain, call:



	struct key *request_key_tag(const struct key_type *type,

				    const char *description,

				    struct key_tag *domain_tag,

				    const char *callout_info);



    This is identical to request_key(), except that a domain tag may be

    specifies that causes search algorithm to only match keys matching that

    tag.  The domain_tag may be NULL, specifying a global domain that is

    separate from any nominated domain.





 *  To search for a key, passing auxiliary data to the upcaller, call::



	struct key *request_key_with_auxdata(const struct key_type *type,

					     const char *description,

					     struct key_tag *domain_tag,

					     const void *callout_info,

					     size_t callout_len,

					     void *aux);



    This is identical to request_key(), except that the auxiliary data is

    passed to the key_type->request_key() op if it exists, and the callout_info

    is a blob of length callout_len, if given (the length may be 0).

    This is identical to request_key_tag(), except that the auxiliary data is

    passed to the key_type->request_key() op if it exists, and the

    callout_info is a blob of length callout_len, if given (the length may be

    0).





 *  To search for a key under RCU conditions, call::



	struct key *request_key_rcu(const struct key_type *type,

				    const char *description);

				    const char *description,

				    struct key_tag *domain_tag);



    which is similar to request_key() except that it does not check for keys

    that are under construction and it will not call out to userspace to

    which is similar to request_key_tag() except that it does not check for

    keys that are under construction and it will not call out to userspace to

    construct a key if it can't find a match.
@@ -1162,11 +1178,13 @@ payload contents" for more information. 


	key_ref_t keyring_search(key_ref_t keyring_ref,

				 const struct key_type *type,

				 const char *description)

				 const char *description,

				 bool recurse)



    This searches the keyring tree specified for a matching key. Error ENOKEY

    is returned upon failure (use IS_ERR/PTR_ERR to determine). If successful,

    the returned key will need to be released.

    This searches the specified keyring only (recurse == false) or keyring tree

    (recurse == true) specified for a matching key. Error ENOKEY is returned

    upon failure (use IS_ERR/PTR_ERR to determine). If successful, the returned

    key will need to be released.



    The possession attribute from the keyring reference is used to control

    access through the permissions mask and is propagated to the returned key

Documentation/security/keys/request-key.rst

+21 −8
Original line number Diff line number Diff line
@@ -13,10 +13,18 @@ The process starts by either the kernel requesting a service by calling 
				const char *description,

				const char *callout_info);



or::



	struct key *request_key_tag(const struct key_type *type,

				    const char *description,

				    const struct key_tag *domain_tag,

				    const char *callout_info);



or::



	struct key *request_key_with_auxdata(const struct key_type *type,

					     const char *description,

					     const struct key_tag *domain_tag,

					     const char *callout_info,

					     size_t callout_len,

					     void *aux);
@@ -24,7 +32,8 @@ or:: 
or::



	struct key *request_key_rcu(const struct key_type *type,

				    const char *description);

				    const char *description,

				    const struct key_tag *domain_tag);



Or by userspace invoking the request_key system call::
@@ -38,14 +47,18 @@ does not need to link the key to a keyring to prevent it from being immediately 
destroyed.  The kernel interface returns a pointer directly to the key, and

it's up to the caller to destroy the key.



The request_key_with_auxdata() calls is like the in-kernel request_key() call,

except that they permit auxiliary data to be passed to the upcaller (the

default is NULL).  This is only useful for those key types that define their

own upcall mechanism rather than using /sbin/request-key.

The request_key_tag() call is like the in-kernel request_key(), except that it

also takes a domain tag that allows keys to be separated by namespace and

killed off as a group.



The request_key_with_auxdata() calls is like the request_key_tag() call, except

that they permit auxiliary data to be passed to the upcaller (the default is

NULL).  This is only useful for those key types that define their own upcall

mechanism rather than using /sbin/request-key.



The request_key_rcu() call is like the in-kernel request_key() call, except

that it doesn't check for keys that are under construction and doesn't attempt

to construct missing keys.

The request_key_rcu() call is like the request_key_tag() call, except that it

doesn't check for keys that are under construction and doesn't attempt to

construct missing keys.



The userspace interface links the key to a keyring associated with the process

to prevent the key from going away, and returns the serial number of the key to

certs/blacklist.c

+1 −1
Original line number Diff line number Diff line
@@ -124,7 +124,7 @@ int is_hash_blacklisted(const u8 *hash, size_t hash_len, const char *type) 
	*p = 0;



	kref = keyring_search(make_key_ref(blacklist_keyring, true),

			      &key_type_blacklist, buffer);

			      &key_type_blacklist, buffer, false);

	if (!IS_ERR(kref)) {

		key_ref_put(kref);

		ret = -EKEYREJECTED;

crypto/asymmetric_keys/asymmetric_type.c

+1 −1
Original line number Diff line number Diff line
@@ -83,7 +83,7 @@ struct key *find_asymmetric_key(struct key *keyring, 
	pr_debug("Look up: \"%s\"\n", req);



	ref = keyring_search(make_key_ref(keyring, 1),

			     &key_type_asymmetric, req);

			     &key_type_asymmetric, req, true);

	if (IS_ERR(ref))

		pr_debug("Request for key '%s' err %ld\n", req, PTR_ERR(ref));

	kfree(req);

fs/afs/addr_list.c

+2 −2
Original line number Diff line number Diff line
@@ -246,8 +246,8 @@ struct afs_vlserver_list *afs_dns_query(struct afs_cell *cell, time64_t *_expiry 


	_enter("%s", cell->name);



	ret = dns_query("afsdb", cell->name, cell->name_len, "srv=1",

			&result, _expiry, true);

	ret = dns_query(cell->net->net, "afsdb", cell->name, cell->name_len,

			"srv=1", &result, _expiry, true);

	if (ret < 0) {

		_leave(" = %d [dns]", ret);

		return ERR_PTR(ret);

CRA Git | Maintained and supported by SUSTech CRA and CCSE