Commit f8aa23a5 authored by David Howells's avatar David Howells
Browse files

KEYS: Use keyring_alloc() to create special keyrings 



Use keyring_alloc() to create special keyrings now that it has a permissions
parameter rather than using key_alloc() + key_instantiate_and_link().

Also document and export keyring_alloc() so that modules can use it too.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 96b5c8fe

Documentation/security/keys.txt

+17 −0
Original line number Diff line number Diff line
@@ -990,6 +990,23 @@ payload contents" for more information. 
    reference pointer if successful.





(*) A keyring can be created by:



	struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,

				  const struct cred *cred,

				  key_perm_t perm,

				  unsigned long flags,

				  struct key *dest);



    This creates a keyring with the given attributes and returns it.  If dest

    is not NULL, the new keyring will be linked into the keyring to which it

    points.  No permission checks are made upon the destination keyring.



    Error EDQUOT can be returned if the keyring would overload the quota (pass

    KEY_ALLOC_NOT_IN_QUOTA in flags if the keyring shouldn't be accounted

    towards the user's quota).  Error ENOMEM can also be returned.





(*) To check the validity of a key, this function can be called:



	int validate_key(struct key *key);

fs/cifs/cifsacl.c

+4 −8
Original line number Diff line number Diff line
@@ -537,19 +537,15 @@ init_cifs_idmap(void) 
	if (!cred)

		return -ENOMEM;



	keyring = key_alloc(&key_type_keyring, ".cifs_idmap", 0, 0, cred,

	keyring = keyring_alloc(".cifs_idmap", 0, 0, cred,

				(KEY_POS_ALL & ~KEY_POS_SETATTR) |

				KEY_USR_VIEW | KEY_USR_READ,

			    KEY_ALLOC_NOT_IN_QUOTA);

				KEY_ALLOC_NOT_IN_QUOTA, NULL);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

	}



	ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);

	if (ret < 0)

		goto failed_put_key;



	ret = register_key_type(&cifs_idmap_key_type);

	if (ret < 0)

		goto failed_put_key;

fs/nfs/idmap.c

+4 −8
Original line number Diff line number Diff line
@@ -192,19 +192,15 @@ static int nfs_idmap_init_keyring(void) 
	if (!cred)

		return -ENOMEM;



	keyring = key_alloc(&key_type_keyring, ".id_resolver", 0, 0, cred,

	keyring = keyring_alloc(".id_resolver", 0, 0, cred,

				(KEY_POS_ALL & ~KEY_POS_SETATTR) |

				KEY_USR_VIEW | KEY_USR_READ,

			     KEY_ALLOC_NOT_IN_QUOTA);

				KEY_ALLOC_NOT_IN_QUOTA, NULL);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

	}



	ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);

	if (ret < 0)

		goto failed_put_key;



	ret = register_key_type(&key_type_id_resolver);

	if (ret < 0)

		goto failed_put_key;

net/dns_resolver/dns_key.c

+5 −8
Original line number Diff line number Diff line
@@ -259,19 +259,15 @@ static int __init init_dns_resolver(void) 
	if (!cred)

		return -ENOMEM;



	keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,

	keyring = keyring_alloc(".dns_resolver", 0, 0, cred,

				(KEY_POS_ALL & ~KEY_POS_SETATTR) |

				KEY_USR_VIEW | KEY_USR_READ,

			    KEY_ALLOC_NOT_IN_QUOTA);

				KEY_ALLOC_NOT_IN_QUOTA, NULL);

	if (IS_ERR(keyring)) {

		ret = PTR_ERR(keyring);

		goto failed_put_cred;

	}



	ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);

	if (ret < 0)

		goto failed_put_key;



	ret = register_key_type(&key_type_dns_resolver);

	if (ret < 0)

		goto failed_put_key;
@@ -303,3 +299,4 @@ static void __exit exit_dns_resolver(void) 
module_init(init_dns_resolver)

module_exit(exit_dns_resolver)

MODULE_LICENSE("GPL");

security/keys/keyring.c

+1 −0
Original line number Diff line number Diff line
@@ -275,6 +275,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, 


	return keyring;

}

EXPORT_SYMBOL(keyring_alloc);



/**

 * keyring_search_aux - Search a keyring tree for a key matching some criteria

CRA Git | Maintained and supported by SUSTech CRA and CCSE