Commit d44a6274 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'keys-misc-20190619' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs 

Pull misc keyring updates from David Howells:
 "These are some miscellaneous keyrings fixes and improvements:

   - Fix a bunch of warnings from sparse, including missing RCU bits and
     kdoc-function argument mismatches

   - Implement a keyctl to allow a key to be moved from one keyring to
     another, with the option of prohibiting key replacement in the
     destination keyring.

   - Grant Link permission to possessors of request_key_auth tokens so
     that upcall servicing daemons can more easily arrange things such
     that only the necessary auth key is passed to the actual service
     program, and not all the auth keys a daemon might possesss.

   - Improvement in lookup_user_key().

   - Implement a keyctl to allow keyrings subsystem capabilities to be
     queried.

  The keyutils next branch has commits to make available, document and
  test the move-key and capabilities code:

        https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/log

  They're currently on the 'next' branch"

* tag 'keys-misc-20190619' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  keys: Add capability-checking keyctl function
  keys: Reuse keyring_index_key::desc_len in lookup_user_key()
  keys: Grant Link permission to possessers of request_key auth keys
  keys: Add a keyctl to move a key between keyrings
  keys: Hoist locking out of __key_link_begin()
  keys: Break bits out of key_unlink()
  keys: Change keyring_serialise_link_sem to a mutex
  keys: sparse: Fix kdoc mismatches
  keys: sparse: Fix incorrect RCU accesses
  keys: sparse: Fix key_fs[ug]id_changed()
parents 7c0f8963 45e0f30c

Documentation/security/keys/core.rst

+21 −0
Original line number Diff line number Diff line
@@ -577,6 +577,27 @@ The keyctl syscall functions are: 
     added.





  *  Move a key from one keyring to another::



	long keyctl(KEYCTL_MOVE,

		    key_serial_t id,

		    key_serial_t from_ring_id,

		    key_serial_t to_ring_id,

		    unsigned int flags);



     Move the key specified by "id" from the keyring specified by

     "from_ring_id" to the keyring specified by "to_ring_id".  If the two

     keyrings are the same, nothing is done.



     "flags" can have KEYCTL_MOVE_EXCL set in it to cause the operation to fail

     with EEXIST if a matching key exists in the destination keyring, otherwise

     such a key will be replaced.



     A process must have link permission on the key for this function to be

     successful and write permission on both keyrings.  Any errors that can

     occur from KEYCTL_LINK also apply on the destination keyring here.





  *  Unlink a key or keyring from another keyring::



	long keyctl(KEYCTL_UNLINK, key_serial_t keyring, key_serial_t key);

include/linux/key.h

+9 −4
Original line number Diff line number Diff line
@@ -305,6 +305,11 @@ extern int key_update(key_ref_t key, 
extern int key_link(struct key *keyring,

		    struct key *key);



extern int key_move(struct key *key,

		    struct key *from_keyring,

		    struct key *to_keyring,

		    unsigned int flags);



extern int key_unlink(struct key *keyring,

		      struct key *key);
@@ -397,8 +402,8 @@ extern struct ctl_table key_sysctls[]; 
 * the userspace interface

 */

extern int install_thread_keyring_to_cred(struct cred *cred);

extern void key_fsuid_changed(struct task_struct *tsk);

extern void key_fsgid_changed(struct task_struct *tsk);

extern void key_fsuid_changed(struct cred *new_cred);

extern void key_fsgid_changed(struct cred *new_cred);

extern void key_init(void);



#else /* CONFIG_KEYS */
@@ -413,8 +418,8 @@ extern void key_init(void); 
#define make_key_ref(k, p)		NULL

#define key_ref_to_ptr(k)		NULL

#define is_key_possessed(k)		0

#define key_fsuid_changed(t)		do { } while(0)

#define key_fsgid_changed(t)		do { } while(0)

#define key_fsuid_changed(c)		do { } while(0)

#define key_fsgid_changed(c)		do { } while(0)

#define key_init()			do { } while(0)



#endif /* CONFIG_KEYS */

include/uapi/linux/keyctl.h

+17 −0
Original line number Diff line number Diff line
@@ -67,6 +67,8 @@ 
#define KEYCTL_PKEY_SIGN		27	/* Create a public key signature */

#define KEYCTL_PKEY_VERIFY		28	/* Verify a public key signature */

#define KEYCTL_RESTRICT_KEYRING		29	/* Restrict keys allowed to link to a keyring */

#define KEYCTL_MOVE			30	/* Move keys between keyrings */

#define KEYCTL_CAPABILITIES		31	/* Find capabilities of keyrings subsystem */



/* keyctl structures */

struct keyctl_dh_params {
@@ -112,4 +114,19 @@ struct keyctl_pkey_params { 
	__u32		__spare[7];

};



#define KEYCTL_MOVE_EXCL	0x00000001 /* Do not displace from the to-keyring */



/*

 * Capabilities flags.  The capabilities list is an array of 8-bit integers;

 * each integer can carry up to 8 flags.

 */

#define KEYCTL_CAPS0_CAPABILITIES	0x01 /* KEYCTL_CAPABILITIES supported */

#define KEYCTL_CAPS0_PERSISTENT_KEYRINGS 0x02 /* Persistent keyrings enabled */

#define KEYCTL_CAPS0_DIFFIE_HELLMAN	0x04 /* Diffie-Hellman computation enabled */

#define KEYCTL_CAPS0_PUBLIC_KEY		0x08 /* Public key ops enabled */

#define KEYCTL_CAPS0_BIG_KEY		0x10 /* big_key-type enabled */

#define KEYCTL_CAPS0_INVALIDATE		0x20 /* KEYCTL_INVALIDATE supported */

#define KEYCTL_CAPS0_RESTRICT_KEYRING	0x40 /* KEYCTL_RESTRICT_KEYRING supported */

#define KEYCTL_CAPS0_MOVE		0x80 /* KEYCTL_MOVE supported */



#endif /*  _LINUX_KEYCTL_H */

kernel/cred.c

+2 −2
Original line number Diff line number Diff line
@@ -460,9 +460,9 @@ int commit_creds(struct cred *new) 


	/* alter the thread keyring */

	if (!uid_eq(new->fsuid, old->fsuid))

		key_fsuid_changed(task);

		key_fsuid_changed(new);

	if (!gid_eq(new->fsgid, old->fsgid))

		key_fsgid_changed(task);

		key_fsgid_changed(new);



	/* do it

	 * RLIMIT_NPROC limits on user->processes have already been checked

security/keys/compat.c

+6 −0
Original line number Diff line number Diff line
@@ -155,6 +155,12 @@ COMPAT_SYSCALL_DEFINE5(keyctl, u32, option, 
		return keyctl_pkey_verify(compat_ptr(arg2), compat_ptr(arg3),

					  compat_ptr(arg4), compat_ptr(arg5));



	case KEYCTL_MOVE:

		return keyctl_keyring_move(arg2, arg3, arg4, arg5);



	case KEYCTL_CAPABILITIES:

		return keyctl_capabilities(compat_ptr(arg2), arg3);



	default:

		return -EOPNOTSUPP;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE