Commit efba797b authored by Mat Martineau's avatar Mat Martineau
Browse files

KEYS: Add an optional lookup_restriction hook to key_type 



The restrict_link functions used to validate keys as they are linked
to a keyring can be associated with specific key types.  Each key type
may be loaded (or not) at runtime, so lookup of restrict_link
functions needs to be part of the key type implementation to ensure
that the requested keys can be examined.

Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
parent 2b6aa412

Documentation/security/keys.txt

+9 −0
Original line number Diff line number Diff line
@@ -1445,6 +1445,15 @@ The structure has a number of fields, some of which are mandatory: 
     	 The authorisation key.





 (*) struct key_restriction *(*lookup_restriction)(const char *params);



     This optional method is used to enable userspace configuration of keyring

     restrictions. The restriction parameter string (not including the key type

     name) is passed in, and this method returns a pointer to a key_restriction

     structure containing the relevant functions and data to evaluate each

     attempted key link operation. If there is no match, -EINVAL is returned.





============================

REQUEST-KEY CALLBACK SERVICE

============================

include/linux/key-type.h

+8 −0
Original line number Diff line number Diff line
@@ -147,6 +147,14 @@ struct key_type { 
	 */

	request_key_actor_t request_key;



	/* Look up a keyring access restriction (optional)

	 *

	 * - NULL is a valid return value (meaning the requested restriction

	 *   is known but will never block addition of a key)

	 * - should return -EINVAL if the restriction is unknown

	 */

	struct key_restriction *(*lookup_restriction)(const char *params);



	/* internal fields */

	struct list_head	link;		/* link in types list */

	struct lock_class_key	lock_class;	/* key->sem lock class */

CRA Git | Maintained and supported by SUSTech CRA and CCSE