summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2019-07-08 22:56:57 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2019-07-08 22:56:57 -0400
commit0f75ef6a9cff49ff612f7ce0578bced9d0b38325 (patch)
treebdd2a6b7f35695b1d7ab1209efbb40187501fe7d
parentc84ca912b07901be528e5184fd254fca1dddf2ac (diff)
parent7a1ade847596dadc94b37e49f8c03f167fd71748 (diff)
Merge tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
Pull keyring ACL support from David Howells: "This changes the permissions model used by keys and keyrings to be based on an internal ACL by the following means: - Replace the permissions mask internally with an ACL that contains a list of ACEs, each with a specific subject with a permissions mask. Potted default ACLs are available for new keys and keyrings. ACE subjects can be macroised to indicate the UID and GID specified on the key (which remain). Future commits will be able to add additional subject types, such as specific UIDs or domain tags/namespaces. Also split a number of permissions to give finer control. Examples include splitting the revocation permit from the change-attributes permit, thereby allowing someone to be granted permission to revoke a key without allowing them to change the owner; also the ability to join a keyring is split from the ability to link to it, thereby stopping a process accessing a keyring by joining it and thus acquiring use of possessor permits. - Provide a keyctl to allow the granting or denial of one or more permits to a specific subject. Direct access to the ACL is not granted, and the ACL cannot be viewed" * tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Provide KEYCTL_GRANT_PERMISSION keys: Replace uid/gid/perm permissions checking with an ACL
Diffstat
-rw-r--r--Documentation/security/keys/core.rst128
-rw-r--r--Documentation/security/keys/request-key.rst9
-rw-r--r--certs/blacklist.c7
-rw-r--r--certs/system_keyring.c12
-rw-r--r--drivers/md/dm-crypt.c2
-rw-r--r--drivers/nvdimm/security.c2
-rw-r--r--fs/afs/security.c2
-rw-r--r--fs/cifs/cifs_spnego.c25
-rw-r--r--fs/cifs/cifsacl.c28
-rw-r--r--fs/cifs/connect.c4
-rw-r--r--fs/crypto/keyinfo.c2
-rw-r--r--fs/ecryptfs/ecryptfs_kernel.h2
-rw-r--r--fs/ecryptfs/keystore.c2
-rw-r--r--fs/fscache/object-list.c2
-rw-r--r--fs/nfs/nfs4idmap.c30
-rw-r--r--fs/ubifs/auth.c2
-rw-r--r--include/linux/key.h121
-rw-r--r--include/uapi/linux/keyctl.h65
-rw-r--r--lib/digsig.c2
-rw-r--r--net/ceph/ceph_common.c2
-rw-r--r--net/dns_resolver/dns_key.c12
-rw-r--r--net/dns_resolver/dns_query.c15
-rw-r--r--net/rxrpc/key.c19
-rw-r--r--net/wireless/reg.c6
-rw-r--r--security/integrity/digsig.c31
-rw-r--r--security/integrity/digsig_asymmetric.c2
-rw-r--r--security/integrity/evm/evm_crypto.c2
-rw-r--r--security/integrity/ima/ima_mok.c13
-rw-r--r--security/integrity/integrity.h6
-rw-r--r--security/integrity/platform_certs/platform_keyring.c14
-rw-r--r--security/keys/compat.c2
-rw-r--r--security/keys/encrypted-keys/encrypted.c2
-rw-r--r--security/keys/encrypted-keys/masterkey_trusted.c2
-rw-r--r--security/keys/gc.c2
-rw-r--r--security/keys/internal.h16
-rw-r--r--security/keys/key.c29
-rw-r--r--security/keys/keyctl.c104
-rw-r--r--security/keys/keyring.c27
-rw-r--r--security/keys/permission.c361
-rw-r--r--security/keys/persistent.c27
-rw-r--r--security/keys/proc.c22
-rw-r--r--security/keys/process_keys.c86
-rw-r--r--security/keys/request_key.c34
-rw-r--r--security/keys/request_key_auth.c15
-rw-r--r--security/selinux/hooks.c16
-rw-r--r--security/smack/smack_lsm.c3
46 files changed, 992 insertions, 325 deletions
diff --git a/Documentation/security/keys/core.rst b/Documentation/security/keys/core.rst
index 0e74f372e58c..1b3c907980ad 100644
--- a/Documentation/security/keys/core.rst
+++ b/Documentation/security/keys/core.rst
@@ -57,9 +57,9 @@ Each key has a number of attributes:
57 type provides an operation to perform a match between the description on a 57 type provides an operation to perform a match between the description on a
58 key and a criterion string. 58 key and a criterion string.
59 59
60 * Each key has an owner user ID, a group ID and a permissions mask. These 60 * Each key has an owner user ID, a group ID and an ACL. These are used to
61 are used to control what a process may do to a key from userspace, and 61 control what a process may do to a key from userspace, and whether a
62 whether a kernel service will be able to find the key. 62 kernel service will be able to find the key.
63 63
64 * Each key can be set to expire at a specific time by the key type's 64 * Each key can be set to expire at a specific time by the key type's
65 instantiation function. Keys can also be immortal. 65 instantiation function. Keys can also be immortal.
@@ -198,43 +198,110 @@ The key service provides a number of features besides keys:
198Key Access Permissions 198Key Access Permissions
199====================== 199======================
200 200
201Keys have an owner user ID, a group access ID, and a permissions mask. The mask 201Keys have an owner user ID, a group ID and an ACL. The ACL is made up of a
202has up to eight bits each for possessor, user, group and other access. Only 202sequence of ACEs that each contain three elements:
203six of each set of eight bits are defined. These permissions granted are:
204 203
205 * View 204 * The type of subject.
205 * The subject.
206 206
207 This permits a key or keyring's attributes to be viewed - including key 207 These two together indicate the subject to whom the permits are granted.
208 type and description. 208 The type can be one of:
209 209
210 * Read 210 * ``KEY_ACE_SUBJ_STANDARD``
211 211
212 This permits a key's payload to be viewed or a keyring's list of linked 212 The subject is a standard 'macro' type. The subject can be one of:
213 keys. 213
214 * ``KEY_ACE_EVERYONE``
215
216 The permits are granted to everyone. It replaces the old 'other'
217 type on the assumption that you wouldn't grant a permission to other
218 that you you wouldn't grant to everyone else.
219
220 * ``KEY_ACE_OWNER``
221
222 The permits are granted to the owner of the key (key->uid).
223
224 * ``KEY_ACE_GROUP``
225
226 The permits are granted to the key's group (key->gid).
227
228 * ``KEY_ACE_POSSESSOR``
229
230 The permits are granted to anyone who possesses the key.
231
232 * The set of permits granted to the subject. These include:
233
234 * ``KEY_ACE_VIEW``
235
236 This permits a key or keyring's attributes to be viewed - including the
237 key type and description.
238
239 * ``KEY_ACE_READ``
240
241 This permits a key's payload to be viewed or a keyring's list of linked
242 keys.
214 243
215 * Write 244 * ``KEY_ACE_WRITE``
216 245
217 This permits a key's payload to be instantiated or updated, or it allows a 246 This permits a key's payload to be instantiated or updated, or it allows
218 link to be added to or removed from a keyring. 247 a link to be added to or removed from a keyring.
219 248
220 * Search 249 * ``KEY_ACE_SEARCH``
221 250
222 This permits keyrings to be searched and keys to be found. Searches can 251 This permits keyrings to be searched and keys to be found. Searches can
223 only recurse into nested keyrings that have search permission set. 252 only recurse into nested keyrings that have search permission set.
224 253
225 * Link 254 * ``KEY_ACE_LINK``
226 255
227 This permits a key or keyring to be linked to. To create a link from a 256 This permits a key or keyring to be linked to. To create a link from a
228 keyring to a key, a process must have Write permission on the keyring and 257 keyring to a key, a process must have Write permission on the keyring
229 Link permission on the key. 258 and Link permission on the key.
230 259
231 * Set Attribute 260 * ``KEY_ACE_SET_SECURITY``
232 261
233 This permits a key's UID, GID and permissions mask to be changed. 262 This permits a key's UID, GID and permissions mask to be changed.
263
264 * ``KEY_ACE_INVAL``
265
266 This permits a key to be invalidated with KEYCTL_INVALIDATE.
267
268 * ``KEY_ACE_REVOKE``
269
270 This permits a key to be revoked with KEYCTL_REVOKE.
271
272 * ``KEY_ACE_JOIN``
273
274 This permits a keyring to be joined as a session by
275 KEYCTL_JOIN_SESSION_KEYRING or KEYCTL_SESSION_TO_PARENT.
276
277 * ``KEY_ACE_CLEAR``
278
279 This permits a keyring to be cleared.
234 280
235For changing the ownership, group ID or permissions mask, being the owner of 281For changing the ownership, group ID or permissions mask, being the owner of
236the key or having the sysadmin capability is sufficient. 282the key or having the sysadmin capability is sufficient.
237 283
284The legacy KEYCTL_SETPERM and KEYCTL_DESCRIBE functions can only see/generate
285View, Read, Write, Search, Link and SetAttr permits, and do this for each of
286possessor, user, group and other permission sets as a 32-bit flag mask. These
287will be approximated/inferred:
288
289 SETPERM Permit Implied ACE Permit
290 =============== =======================
291 Search Inval, Join
292 Write Revoke, Clear
293 Setattr Set Security, Revoke
294
295 ACE Permit Described as
296 =============== =======================
297 Inval Search
298 Join Search
299 Revoke Write (unless Setattr)
300 Clear write
301 Set Security Setattr
302
303'Other' will be approximated as/inferred from the 'Everyone' subject.
304
238 305
239SELinux Support 306SELinux Support
240=============== 307===============
@@ -1084,7 +1151,8 @@ payload contents" for more information.
1084 1151
1085 struct key *request_key(const struct key_type *type, 1152 struct key *request_key(const struct key_type *type,
1086 const char *description, 1153 const char *description,
1087 const char *callout_info); 1154 const char *callout_info,
1155 struct key_acl *acl);
1088 1156
1089 This is used to request a key or keyring with a description that matches 1157 This is used to request a key or keyring with a description that matches
1090 the description specified according to the key type's match_preparse() 1158 the description specified according to the key type's match_preparse()
@@ -1099,6 +1167,8 @@ payload contents" for more information.
1099 If successful, the key will have been attached to the default keyring for 1167 If successful, the key will have been attached to the default keyring for
1100 implicitly obtained request-key keys, as set by KEYCTL_SET_REQKEY_KEYRING. 1168 implicitly obtained request-key keys, as set by KEYCTL_SET_REQKEY_KEYRING.
1101 1169
1170 If a key is created, it will be given the specified ACL.
1171
1102 See also Documentation/security/keys/request-key.rst. 1172 See also Documentation/security/keys/request-key.rst.
1103 1173
1104 1174
@@ -1107,7 +1177,8 @@ payload contents" for more information.
1107 struct key *request_key_tag(const struct key_type *type, 1177 struct key *request_key_tag(const struct key_type *type,
1108 const char *description, 1178 const char *description,
1109 struct key_tag *domain_tag, 1179 struct key_tag *domain_tag,
1110 const char *callout_info); 1180 const char *callout_info,
1181 struct key_acl *acl);
1111 1182
1112 This is identical to request_key(), except that a domain tag may be 1183 This is identical to request_key(), except that a domain tag may be
1113 specifies that causes search algorithm to only match keys matching that 1184 specifies that causes search algorithm to only match keys matching that
@@ -1122,7 +1193,8 @@ payload contents" for more information.
1122 struct key_tag *domain_tag, 1193 struct key_tag *domain_tag,
1123 const void *callout_info, 1194 const void *callout_info,
1124 size_t callout_len, 1195 size_t callout_len,
1125 void *aux); 1196 void *aux,
1197 struct key_acl *acl);
1126 1198
1127 This is identical to request_key_tag(), except that the auxiliary data is 1199 This is identical to request_key_tag(), except that the auxiliary data is
1128 passed to the key_type->request_key() op if it exists, and the 1200 passed to the key_type->request_key() op if it exists, and the
@@ -1195,7 +1267,7 @@ payload contents" for more information.
1195 1267
1196 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, 1268 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
1197 const struct cred *cred, 1269 const struct cred *cred,
1198 key_perm_t perm, 1270 struct key_acl *acl,
1199 struct key_restriction *restrict_link, 1271 struct key_restriction *restrict_link,
1200 unsigned long flags, 1272 unsigned long flags,
1201 struct key *dest); 1273 struct key *dest);
diff --git a/Documentation/security/keys/request-key.rst b/Documentation/security/keys/request-key.rst
index 35f2296b704a..f356fd06c8d5 100644
--- a/Documentation/security/keys/request-key.rst
+++ b/Documentation/security/keys/request-key.rst
@@ -11,14 +11,16 @@ The process starts by either the kernel requesting a service by calling
11 11
12 struct key *request_key(const struct key_type *type, 12 struct key *request_key(const struct key_type *type,
13 const char *description, 13 const char *description,
14 const char *callout_info); 14 const char *callout_info,
15 struct key_acl *acl);
15 16
16or:: 17or::
17 18
18 struct key *request_key_tag(const struct key_type *type, 19 struct key *request_key_tag(const struct key_type *type,
19 const char *description, 20 const char *description,
20 const struct key_tag *domain_tag, 21 const struct key_tag *domain_tag,
21 const char *callout_info); 22 const char *callout_info,
23 struct key_acl *acl);
22 24
23or:: 25or::
24 26
@@ -27,7 +29,8 @@ or::
27 const struct key_tag *domain_tag, 29 const struct key_tag *domain_tag,
28 const char *callout_info, 30 const char *callout_info,
29 size_t callout_len, 31 size_t callout_len,
30 void *aux); 32 void *aux,
33 struct key_acl *acl);
31 34
32or:: 35or::
33 36
diff --git a/certs/blacklist.c b/certs/blacklist.c
index ec00bf337eb6..93d70b885f8e 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -89,8 +89,7 @@ int mark_hash_blacklisted(const char *hash)
89 hash, 89 hash,
90 NULL, 90 NULL,
91 0, 91 0,
92 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 92 &internal_key_acl,
93 KEY_USR_VIEW),
94 KEY_ALLOC_NOT_IN_QUOTA | 93 KEY_ALLOC_NOT_IN_QUOTA |
95 KEY_ALLOC_BUILT_IN); 94 KEY_ALLOC_BUILT_IN);
96 if (IS_ERR(key)) { 95 if (IS_ERR(key)) {
@@ -149,9 +148,7 @@ static int __init blacklist_init(void)
149 keyring_alloc(".blacklist", 148 keyring_alloc(".blacklist",
150 KUIDT_INIT(0), KGIDT_INIT(0), 149 KUIDT_INIT(0), KGIDT_INIT(0),
151 current_cred(), 150 current_cred(),
152 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 151 &internal_keyring_acl,
153 KEY_USR_VIEW | KEY_USR_READ |
154 KEY_USR_SEARCH,
155 KEY_ALLOC_NOT_IN_QUOTA | 152 KEY_ALLOC_NOT_IN_QUOTA |
156 KEY_FLAG_KEEP, 153 KEY_FLAG_KEEP,
157 NULL, NULL); 154 NULL, NULL);
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 1eba08a1af82..57be78b5fdfc 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -99,9 +99,7 @@ static __init int system_trusted_keyring_init(void)
99 builtin_trusted_keys = 99 builtin_trusted_keys =
100 keyring_alloc(".builtin_trusted_keys", 100 keyring_alloc(".builtin_trusted_keys",
101 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 101 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
102 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 102 &internal_key_acl, KEY_ALLOC_NOT_IN_QUOTA,
103 KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
104 KEY_ALLOC_NOT_IN_QUOTA,
105 NULL, NULL); 103 NULL, NULL);
106 if (IS_ERR(builtin_trusted_keys)) 104 if (IS_ERR(builtin_trusted_keys))
107 panic("Can't allocate builtin trusted keyring\n"); 105 panic("Can't allocate builtin trusted keyring\n");
@@ -110,10 +108,7 @@ static __init int system_trusted_keyring_init(void)
110 secondary_trusted_keys = 108 secondary_trusted_keys =
111 keyring_alloc(".secondary_trusted_keys", 109 keyring_alloc(".secondary_trusted_keys",
112 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 110 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
113 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 111 &internal_writable_keyring_acl, KEY_ALLOC_NOT_IN_QUOTA,
114 KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH |
115 KEY_USR_WRITE),
116 KEY_ALLOC_NOT_IN_QUOTA,
117 get_builtin_and_secondary_restriction(), 112 get_builtin_and_secondary_restriction(),
118 NULL); 113 NULL);
119 if (IS_ERR(secondary_trusted_keys)) 114 if (IS_ERR(secondary_trusted_keys))
@@ -163,8 +158,7 @@ static __init int load_system_certificate_list(void)
163 NULL, 158 NULL,
164 p, 159 p,
165 plen, 160 plen,
166 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 161 &internal_key_acl,
167 KEY_USR_VIEW | KEY_USR_READ),
168 KEY_ALLOC_NOT_IN_QUOTA | 162 KEY_ALLOC_NOT_IN_QUOTA |
169 KEY_ALLOC_BUILT_IN | 163 KEY_ALLOC_BUILT_IN |
170 KEY_ALLOC_BYPASS_RESTRICTION); 164 KEY_ALLOC_BYPASS_RESTRICTION);
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 1b16d34bb785..0fd3ca9bfe54 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2035,7 +2035,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string
2035 return -ENOMEM; 2035 return -ENOMEM;
2036 2036
2037 key = request_key(key_string[0] == 'l' ? &key_type_logon : &key_type_user, 2037 key = request_key(key_string[0] == 'l' ? &key_type_logon : &key_type_user,
2038 key_desc + 1, NULL); 2038 key_desc + 1, NULL, NULL);
2039 if (IS_ERR(key)) { 2039 if (IS_ERR(key)) {
2040 kzfree(new_key_string); 2040 kzfree(new_key_string);
2041 return PTR_ERR(key); 2041 return PTR_ERR(key);
diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c
index a570f2263a42..99a5708b37e3 100644
--- a/drivers/nvdimm/security.c
+++ b/drivers/nvdimm/security.c
@@ -55,7 +55,7 @@ static struct key *nvdimm_request_key(struct nvdimm *nvdimm)
55 struct device *dev = &nvdimm->dev; 55 struct device *dev = &nvdimm->dev;
56 56
57 sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id); 57 sprintf(desc, "%s%s", NVDIMM_PREFIX, nvdimm->dimm_id);
58 key = request_key(&key_type_encrypted, desc, ""); 58 key = request_key(&key_type_encrypted, desc, "", NULL);
59 if (IS_ERR(key)) { 59 if (IS_ERR(key)) {
60 if (PTR_ERR(key) == -ENOKEY) 60 if (PTR_ERR(key) == -ENOKEY)
61 dev_dbg(dev, "request_key() found no key\n"); 61 dev_dbg(dev, "request_key() found no key\n");
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 71e71c07568f..8866703b2e6c 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -28,7 +28,7 @@ struct key *afs_request_key(struct afs_cell *cell)
28 28
29 _debug("key %s", cell->anonymous_key->description); 29 _debug("key %s", cell->anonymous_key->description);
30 key = request_key(&key_type_rxrpc, cell->anonymous_key->description, 30 key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
31 NULL); 31 NULL, NULL);
32 if (IS_ERR(key)) { 32 if (IS_ERR(key)) {
33 if (PTR_ERR(key) != -ENOKEY) { 33 if (PTR_ERR(key) != -ENOKEY) {
34 _leave(" = %ld", PTR_ERR(key)); 34 _leave(" = %ld", PTR_ERR(key));
diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
index 7f01c6e60791..d1b439ad0f1a 100644
--- a/fs/cifs/cifs_spnego.c
+++ b/fs/cifs/cifs_spnego.c
@@ -32,6 +32,25 @@
32#include "cifsproto.h" 32#include "cifsproto.h"
33static const struct cred *spnego_cred; 33static const struct cred *spnego_cred;
34 34
35static struct key_acl cifs_spnego_key_acl = {
36 .usage = REFCOUNT_INIT(1),
37 .nr_ace = 2,
38 .possessor_viewable = true,
39 .aces = {
40 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
41 KEY_OWNER_ACE(KEY_ACE_VIEW),
42 }
43};
44
45static struct key_acl cifs_spnego_keyring_acl = {
46 .usage = REFCOUNT_INIT(1),
47 .nr_ace = 2,
48 .aces = {
49 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
50 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_CLEAR),
51 }
52};
53
35/* create a new cifs key */ 54/* create a new cifs key */
36static int 55static int
37cifs_spnego_key_instantiate(struct key *key, struct key_preparsed_payload *prep) 56cifs_spnego_key_instantiate(struct key *key, struct key_preparsed_payload *prep)
@@ -170,7 +189,8 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
170 189
171 cifs_dbg(FYI, "key description = %s\n", description); 190 cifs_dbg(FYI, "key description = %s\n", description);
172 saved_cred = override_creds(spnego_cred); 191 saved_cred = override_creds(spnego_cred);
173 spnego_key = request_key(&cifs_spnego_key_type, description, ""); 192 spnego_key = request_key(&cifs_spnego_key_type, description, "",
193 &cifs_spnego_key_acl);
174 revert_creds(saved_cred); 194 revert_creds(saved_cred);
175 195
176#ifdef CONFIG_CIFS_DEBUG2 196#ifdef CONFIG_CIFS_DEBUG2
@@ -207,8 +227,7 @@ init_cifs_spnego(void)
207 227
208 keyring = keyring_alloc(".cifs_spnego", 228 keyring = keyring_alloc(".cifs_spnego",
209 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 229 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
210 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 230 &cifs_spnego_keyring_acl,
211 KEY_USR_VIEW | KEY_USR_READ,
212 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 231 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
213 if (IS_ERR(keyring)) { 232 if (IS_ERR(keyring)) {
214 ret = PTR_ERR(keyring); 233 ret = PTR_ERR(keyring);
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 1d377b7f2860..78eed72f3af0 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -33,6 +33,25 @@
33#include "cifsproto.h" 33#include "cifsproto.h"
34#include "cifs_debug.h" 34#include "cifs_debug.h"
35 35
36static struct key_acl cifs_idmap_key_acl = {
37 .usage = REFCOUNT_INIT(1),
38 .nr_ace = 2,
39 .possessor_viewable = true,
40 .aces = {
41 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
42 KEY_OWNER_ACE(KEY_ACE_VIEW),
43 }
44};
45
46static struct key_acl cifs_idmap_keyring_acl = {
47 .usage = REFCOUNT_INIT(1),
48 .nr_ace = 2,
49 .aces = {
50 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
51 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
52 }
53};
54
36/* security id for everyone/world system group */ 55/* security id for everyone/world system group */
37static const struct cifs_sid sid_everyone = { 56static const struct cifs_sid sid_everyone = {
38 1, 1, {0, 0, 0, 0, 0, 1}, {0} }; 57 1, 1, {0, 0, 0, 0, 0, 1}, {0} };
@@ -298,7 +317,8 @@ id_to_sid(unsigned int cid, uint sidtype, struct cifs_sid *ssid)
298 317
299 rc = 0; 318 rc = 0;
300 saved_cred = override_creds(root_cred); 319 saved_cred = override_creds(root_cred);
301 sidkey = request_key(&cifs_idmap_key_type, desc, ""); 320 sidkey = request_key(&cifs_idmap_key_type, desc, "",
321 &cifs_idmap_key_acl);
302 if (IS_ERR(sidkey)) { 322 if (IS_ERR(sidkey)) {
303 rc = -EINVAL; 323 rc = -EINVAL;
304 cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n", 324 cifs_dbg(FYI, "%s: Can't map %cid %u to a SID\n",
@@ -403,7 +423,8 @@ try_upcall_to_get_id:
403 return -ENOMEM; 423 return -ENOMEM;
404 424
405 saved_cred = override_creds(root_cred); 425 saved_cred = override_creds(root_cred);
406 sidkey = request_key(&cifs_idmap_key_type, sidstr, ""); 426 sidkey = request_key(&cifs_idmap_key_type, sidstr, "",
427 &cifs_idmap_key_acl);
407 if (IS_ERR(sidkey)) { 428 if (IS_ERR(sidkey)) {
408 rc = -EINVAL; 429 rc = -EINVAL;
409 cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n", 430 cifs_dbg(FYI, "%s: Can't map SID %s to a %cid\n",
@@ -481,8 +502,7 @@ init_cifs_idmap(void)
481 502
482 keyring = keyring_alloc(".cifs_idmap", 503 keyring = keyring_alloc(".cifs_idmap",
483 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 504 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
484 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 505 &cifs_idmap_keyring_acl,
485 KEY_USR_VIEW | KEY_USR_READ,
486 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 506 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
487 if (IS_ERR(keyring)) { 507 if (IS_ERR(keyring)) {
488 ret = PTR_ERR(keyring); 508 ret = PTR_ERR(keyring);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 8dd6637a3cbb..93f7082daf52 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2992,7 +2992,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
2992 } 2992 }
2993 2993
2994 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc); 2994 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
2995 key = request_key(&key_type_logon, desc, ""); 2995 key = request_key(&key_type_logon, desc, "", NULL);
2996 if (IS_ERR(key)) { 2996 if (IS_ERR(key)) {
2997 if (!ses->domainName) { 2997 if (!ses->domainName) {
2998 cifs_dbg(FYI, "domainName is NULL\n"); 2998 cifs_dbg(FYI, "domainName is NULL\n");
@@ -3003,7 +3003,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
3003 /* didn't work, try to find a domain key */ 3003 /* didn't work, try to find a domain key */
3004 sprintf(desc, "cifs:d:%s", ses->domainName); 3004 sprintf(desc, "cifs:d:%s", ses->domainName);
3005 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc); 3005 cifs_dbg(FYI, "%s: desc=%s\n", __func__, desc);
3006 key = request_key(&key_type_logon, desc, ""); 3006 key = request_key(&key_type_logon, desc, "", NULL);
3007 if (IS_ERR(key)) { 3007 if (IS_ERR(key)) {
3008 rc = PTR_ERR(key); 3008 rc = PTR_ERR(key);
3009 goto out_err; 3009 goto out_err;
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index dcd91a3fbe49..4f85af8ab239 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -92,7 +92,7 @@ find_and_lock_process_key(const char *prefix,
92 if (!description) 92 if (!description)
93 return ERR_PTR(-ENOMEM); 93 return ERR_PTR(-ENOMEM);
94 94
95 key = request_key(&key_type_logon, description, NULL); 95 key = request_key(&key_type_logon, description, NULL, NULL);
96 kfree(description); 96 kfree(description);
97 if (IS_ERR(key)) 97 if (IS_ERR(key))
98 return key; 98 return key;
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 1c1a56be7ea2..67844fe41a61 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -91,7 +91,7 @@ ecryptfs_get_encrypted_key_payload_data(struct key *key)
91 91
92static inline struct key *ecryptfs_get_encrypted_key(char *sig) 92static inline struct key *ecryptfs_get_encrypted_key(char *sig)
93{ 93{
94 return request_key(&key_type_encrypted, sig, NULL); 94 return request_key(&key_type_encrypted, sig, NULL, NULL);
95} 95}
96 96
97#else 97#else
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index 9536e592e25a..ba382f135918 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1610,7 +1610,7 @@ int ecryptfs_keyring_auth_tok_for_sig(struct key **auth_tok_key,
1610{ 1610{
1611 int rc = 0; 1611 int rc = 0;
1612 1612
1613 (*auth_tok_key) = request_key(&key_type_user, sig, NULL); 1613 (*auth_tok_key) = request_key(&key_type_user, sig, NULL, NULL);
1614 if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) { 1614 if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
1615 (*auth_tok_key) = ecryptfs_get_encrypted_key(sig); 1615 (*auth_tok_key) = ecryptfs_get_encrypted_key(sig);
1616 if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) { 1616 if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index 72ebfe578f40..67b7bda5647a 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -317,7 +317,7 @@ static void fscache_objlist_config(struct fscache_objlist_data *data)
317 const char *buf; 317 const char *buf;
318 int len; 318 int len;
319 319
320 key = request_key(&key_type_user, "fscache:objlist", NULL); 320 key = request_key(&key_type_user, "fscache:objlist", NULL, NULL);
321 if (IS_ERR(key)) 321 if (IS_ERR(key))
322 goto no_config; 322 goto no_config;
323 323
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index 1e7296395d71..69679f4f2e6c 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -72,6 +72,25 @@ struct idmap {
72 const struct cred *cred; 72 const struct cred *cred;
73}; 73};
74 74
75static struct key_acl nfs_idmap_key_acl = {
76 .usage = REFCOUNT_INIT(1),
77 .nr_ace = 2,
78 .possessor_viewable = true,
79 .aces = {
80 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
81 KEY_OWNER_ACE(KEY_ACE_VIEW),
82 }
83};
84
85static struct key_acl nfs_idmap_keyring_acl = {
86 .usage = REFCOUNT_INIT(1),
87 .nr_ace = 2,
88 .aces = {
89 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
90 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
91 }
92};
93
75static struct user_namespace *idmap_userns(const struct idmap *idmap) 94static struct user_namespace *idmap_userns(const struct idmap *idmap)
76{ 95{
77 if (idmap && idmap->cred) 96 if (idmap && idmap->cred)
@@ -208,8 +227,7 @@ int nfs_idmap_init(void)
208 227
209 keyring = keyring_alloc(".id_resolver", 228 keyring = keyring_alloc(".id_resolver",
210 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 229 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
211 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 230 &nfs_idmap_keyring_acl,
212 KEY_USR_VIEW | KEY_USR_READ,
213 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 231 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
214 if (IS_ERR(keyring)) { 232 if (IS_ERR(keyring)) {
215 ret = PTR_ERR(keyring); 233 ret = PTR_ERR(keyring);
@@ -287,11 +305,13 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
287 return ERR_PTR(ret); 305 return ERR_PTR(ret);
288 306
289 if (!idmap->cred || idmap->cred->user_ns == &init_user_ns) 307 if (!idmap->cred || idmap->cred->user_ns == &init_user_ns)
290 rkey = request_key(&key_type_id_resolver, desc, ""); 308 rkey = request_key(&key_type_id_resolver, desc, "",
309 &nfs_idmap_key_acl);
291 if (IS_ERR(rkey)) { 310 if (IS_ERR(rkey)) {
292 mutex_lock(&idmap->idmap_mutex); 311 mutex_lock(&idmap->idmap_mutex);
293 rkey = request_key_with_auxdata(&key_type_id_resolver_legacy, 312 rkey = request_key_with_auxdata(&key_type_id_resolver_legacy,
294 desc, NULL, "", 0, idmap); 313 desc, NULL, "", 0, idmap,
314 &nfs_idmap_key_acl);
295 mutex_unlock(&idmap->idmap_mutex); 315 mutex_unlock(&idmap->idmap_mutex);
296 } 316 }
297 if (!IS_ERR(rkey)) 317 if (!IS_ERR(rkey))
@@ -320,8 +340,6 @@ static ssize_t nfs_idmap_get_key(const char *name, size_t namelen,
320 } 340 }
321 341
322 rcu_read_lock(); 342 rcu_read_lock();
323 rkey->perm |= KEY_USR_VIEW;
324
325 ret = key_validate(rkey); 343 ret = key_validate(rkey);
326 if (ret < 0) 344 if (ret < 0)
327 goto out_up; 345 goto out_up;
diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c
index 60f43b93d06e..38718026ad0b 100644
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -227,7 +227,7 @@ int ubifs_init_authentication(struct ubifs_info *c)
227 snprintf(hmac_name, CRYPTO_MAX_ALG_NAME, "hmac(%s)", 227 snprintf(hmac_name, CRYPTO_MAX_ALG_NAME, "hmac(%s)",
228 c->auth_hash_name); 228 c->auth_hash_name);
229 229
230 keyring_key = request_key(&key_type_logon, c->auth_key_name, NULL); 230 keyring_key = request_key(&key_type_logon, c->auth_key_name, NULL, NULL);
231 231
232 if (IS_ERR(keyring_key)) { 232 if (IS_ERR(keyring_key)) {
233 ubifs_err(c, "Failed to request key: %ld", 233 ubifs_err(c, "Failed to request key: %ld",
diff --git a/include/linux/key.h b/include/linux/key.h
index 91f391cd272e..6fef6684501f 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -27,49 +27,14 @@
27/* key handle serial number */ 27/* key handle serial number */
28typedef int32_t key_serial_t; 28typedef int32_t key_serial_t;
29 29
30/* key handle permissions mask */
31typedef uint32_t key_perm_t;
32
33struct key; 30struct key;
34struct net; 31struct net;
35 32
36#ifdef CONFIG_KEYS 33#ifdef CONFIG_KEYS
37 34
38#undef KEY_DEBUGGING 35#include <linux/keyctl.h>
39 36
40#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */ 37#undef KEY_DEBUGGING
41#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */
42#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */
43#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */
44#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */
45#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */
46#define KEY_POS_ALL 0x3f000000
47
48#define KEY_USR_VIEW 0x00010000 /* user permissions... */
49#define KEY_USR_READ 0x00020000
50#define KEY_USR_WRITE 0x00040000
51#define KEY_USR_SEARCH 0x00080000
52#define KEY_USR_LINK 0x00100000
53#define KEY_USR_SETATTR 0x00200000
54#define KEY_USR_ALL 0x003f0000
55
56#define KEY_GRP_VIEW 0x00000100 /* group permissions... */
57#define KEY_GRP_READ 0x00000200
58#define KEY_GRP_WRITE 0x00000400
59#define KEY_GRP_SEARCH 0x00000800
60#define KEY_GRP_LINK 0x00001000
61#define KEY_GRP_SETATTR 0x00002000
62#define KEY_GRP_ALL 0x00003f00
63
64#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */
65#define KEY_OTH_READ 0x00000002
66#define KEY_OTH_WRITE 0x00000004
67#define KEY_OTH_SEARCH 0x00000008
68#define KEY_OTH_LINK 0x00000010
69#define KEY_OTH_SETATTR 0x00000020
70#define KEY_OTH_ALL 0x0000003f
71
72#define KEY_PERM_UNDEF 0xffffffff
73 38
74struct seq_file; 39struct seq_file;
75struct user_struct; 40struct user_struct;
@@ -113,6 +78,36 @@ union key_payload {
113 void *data[4]; 78 void *data[4];
114}; 79};
115 80
81struct key_ace {
82 unsigned int type;
83 unsigned int perm;
84 union {
85 kuid_t uid;
86 kgid_t gid;
87 unsigned int subject_id;
88 };
89};
90
91struct key_acl {
92 refcount_t usage;
93 unsigned short nr_ace;
94 bool possessor_viewable;
95 struct rcu_head rcu;
96 struct key_ace aces[];
97};
98
99#define KEY_POSSESSOR_ACE(perms) { \
100 .type = KEY_ACE_SUBJ_STANDARD, \
101 .perm = perms, \
102 .subject_id = KEY_ACE_POSSESSOR \
103 }
104
105#define KEY_OWNER_ACE(perms) { \
106 .type = KEY_ACE_SUBJ_STANDARD, \
107 .perm = perms, \
108 .subject_id = KEY_ACE_OWNER \
109 }
110
116/*****************************************************************************/ 111/*****************************************************************************/
117/* 112/*
118 * key reference with possession attribute handling 113 * key reference with possession attribute handling
@@ -179,6 +174,7 @@ struct key {
179 struct rw_semaphore sem; /* change vs change sem */ 174 struct rw_semaphore sem; /* change vs change sem */
180 struct key_user *user; /* owner of this key */ 175 struct key_user *user; /* owner of this key */
181 void *security; /* security data for this key */ 176 void *security; /* security data for this key */
177 struct key_acl __rcu *acl;
182 union { 178 union {
183 time64_t expiry; /* time at which key expires (or 0) */ 179 time64_t expiry; /* time at which key expires (or 0) */
184 time64_t revoked_at; /* time at which key was revoked */ 180 time64_t revoked_at; /* time at which key was revoked */
@@ -186,7 +182,6 @@ struct key {
186 time64_t last_used_at; /* last time used for LRU keyring discard */ 182 time64_t last_used_at; /* last time used for LRU keyring discard */
187 kuid_t uid; 183 kuid_t uid;
188 kgid_t gid; 184 kgid_t gid;
189 key_perm_t perm; /* access permissions */
190 unsigned short quotalen; /* length added to quota */ 185 unsigned short quotalen; /* length added to quota */
191 unsigned short datalen; /* payload data length 186 unsigned short datalen; /* payload data length
192 * - may not match RCU dereferenced payload 187 * - may not match RCU dereferenced payload
@@ -210,6 +205,7 @@ struct key {
210#define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */ 205#define KEY_FLAG_ROOT_CAN_INVAL 7 /* set if key can be invalidated by root without permission */
211#define KEY_FLAG_KEEP 8 /* set if key should not be removed */ 206#define KEY_FLAG_KEEP 8 /* set if key should not be removed */
212#define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */ 207#define KEY_FLAG_UID_KEYRING 9 /* set if key is a user or user session keyring */
208#define KEY_FLAG_HAS_ACL 10 /* Set if KEYCTL_SETACL called on key */
213 209
214 /* the key type and key description string 210 /* the key type and key description string
215 * - the desc is used to match a key against search criteria 211 * - the desc is used to match a key against search criteria
@@ -258,7 +254,7 @@ extern struct key *key_alloc(struct key_type *type,
258 const char *desc, 254 const char *desc,
259 kuid_t uid, kgid_t gid, 255 kuid_t uid, kgid_t gid,
260 const struct cred *cred, 256 const struct cred *cred,
261 key_perm_t perm, 257 struct key_acl *acl,
262 unsigned long flags, 258 unsigned long flags,
263 struct key_restriction *restrict_link); 259 struct key_restriction *restrict_link);
264 260
@@ -295,7 +291,8 @@ static inline void key_ref_put(key_ref_t key_ref)
295extern struct key *request_key_tag(struct key_type *type, 291extern struct key *request_key_tag(struct key_type *type,
296 const char *description, 292 const char *description,
297 struct key_tag *domain_tag, 293 struct key_tag *domain_tag,
298 const char *callout_info); 294 const char *callout_info,
295 struct key_acl *acl);
299 296
300extern struct key *request_key_rcu(struct key_type *type, 297extern struct key *request_key_rcu(struct key_type *type,
301 const char *description, 298 const char *description,
@@ -306,21 +303,24 @@ extern struct key *request_key_with_auxdata(struct key_type *type,
306 struct key_tag *domain_tag, 303 struct key_tag *domain_tag,
307 const void *callout_info, 304 const void *callout_info,
308 size_t callout_len, 305 size_t callout_len,
309 void *aux); 306 void *aux,
307 struct key_acl *acl);
310 308
311/** 309/**
312 * request_key - Request a key and wait for construction 310 * request_key - Request a key and wait for construction
313 * @type: Type of key. 311 * @type: Type of key.
314 * @description: The searchable description of the key. 312 * @description: The searchable description of the key.
315 * @callout_info: The data to pass to the instantiation upcall (or NULL). 313 * @callout_info: The data to pass to the instantiation upcall (or NULL).
314 * @acl: The ACL to attach to a new key (or NULL).
316 * 315 *
317 * As for request_key_tag(), but with the default global domain tag. 316 * As for request_key_tag(), but with the default global domain tag.
318 */ 317 */
319static inline struct key *request_key(struct key_type *type, 318static inline struct key *request_key(struct key_type *type,
320 const char *description, 319 const char *description,
321 const char *callout_info) 320 const char *callout_info,
321 struct key_acl *acl)
322{ 322{
323 return request_key_tag(type, description, NULL, callout_info); 323 return request_key_tag(type, description, NULL, callout_info, acl);
324} 324}
325 325
326#ifdef CONFIG_NET 326#ifdef CONFIG_NET
@@ -330,6 +330,7 @@ static inline struct key *request_key(struct key_type *type,
330 * @description: The searchable description of the key. 330 * @description: The searchable description of the key.
331 * @net: The network namespace that is the key's domain of operation. 331 * @net: The network namespace that is the key's domain of operation.
332 * @callout_info: The data to pass to the instantiation upcall (or NULL). 332 * @callout_info: The data to pass to the instantiation upcall (or NULL).
333 * @acl: The ACL to attach to a new key (or NULL).
333 * 334 *
334 * As for request_key() except that it does not add the returned key to a 335 * As for request_key() except that it does not add the returned key to a
335 * keyring if found, new keys are always allocated in the user's quota, the 336 * keyring if found, new keys are always allocated in the user's quota, the
@@ -339,8 +340,8 @@ static inline struct key *request_key(struct key_type *type,
339 * Furthermore, it then works as wait_for_key_construction() to wait for the 340 * Furthermore, it then works as wait_for_key_construction() to wait for the
340 * completion of keys undergoing construction with a non-interruptible wait. 341 * completion of keys undergoing construction with a non-interruptible wait.
341 */ 342 */
342#define request_key_net(type, description, net, callout_info) \ 343#define request_key_net(type, description, net, callout_info, acl) \
343 request_key_tag(type, description, net->key_domain, callout_info); 344 request_key_tag(type, description, net->key_domain, callout_info, acl);
344#endif /* CONFIG_NET */ 345#endif /* CONFIG_NET */
345 346
346extern int wait_for_key_construction(struct key *key, bool intr); 347extern int wait_for_key_construction(struct key *key, bool intr);
@@ -352,7 +353,7 @@ extern key_ref_t key_create_or_update(key_ref_t keyring,
352 const char *description, 353 const char *description,
353 const void *payload, 354 const void *payload,
354 size_t plen, 355 size_t plen,
355 key_perm_t perm, 356 struct key_acl *acl,
356 unsigned long flags); 357 unsigned long flags);
357 358
358extern int key_update(key_ref_t key, 359extern int key_update(key_ref_t key,
@@ -372,7 +373,7 @@ extern int key_unlink(struct key *keyring,
372 373
373extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid, 374extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
374 const struct cred *cred, 375 const struct cred *cred,
375 key_perm_t perm, 376 struct key_acl *acl,
376 unsigned long flags, 377 unsigned long flags,
377 struct key_restriction *restrict_link, 378 struct key_restriction *restrict_link,
378 struct key *dest); 379 struct key *dest);
@@ -405,19 +406,29 @@ static inline key_serial_t key_serial(const struct key *key)
405extern void key_set_timeout(struct key *, unsigned); 406extern void key_set_timeout(struct key *, unsigned);
406 407
407extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, 408extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
408 key_perm_t perm); 409 u32 desired_perm);
409extern void key_free_user_ns(struct user_namespace *); 410extern void key_free_user_ns(struct user_namespace *);
410 411
411/* 412/*
412 * The permissions required on a key that we're looking up. 413 * The permissions required on a key that we're looking up.
413 */ 414 */
414#define KEY_NEED_VIEW 0x01 /* Require permission to view attributes */ 415#define KEY_NEED_VIEW 0x001 /* Require permission to view attributes */
415#define KEY_NEED_READ 0x02 /* Require permission to read content */ 416#define KEY_NEED_READ 0x002 /* Require permission to read content */
416#define KEY_NEED_WRITE 0x04 /* Require permission to update / modify */ 417#define KEY_NEED_WRITE 0x004 /* Require permission to update / modify */
417#define KEY_NEED_SEARCH 0x08 /* Require permission to search (keyring) or find (key) */ 418#define KEY_NEED_SEARCH 0x008 /* Require permission to search (keyring) or find (key) */
418#define KEY_NEED_LINK 0x10 /* Require permission to link */ 419#define KEY_NEED_LINK 0x010 /* Require permission to link */
419#define KEY_NEED_SETATTR 0x20 /* Require permission to change attributes */ 420#define KEY_NEED_SETSEC 0x020 /* Require permission to set owner, group, ACL */
420#define KEY_NEED_ALL 0x3f /* All the above permissions */ 421#define KEY_NEED_INVAL 0x040 /* Require permission to invalidate key */
422#define KEY_NEED_REVOKE 0x080 /* Require permission to revoke key */
423#define KEY_NEED_JOIN 0x100 /* Require permission to join keyring as session */
424#define KEY_NEED_CLEAR 0x200 /* Require permission to clear a keyring */
425#define KEY_NEED_ALL 0x3ff
426
427#define OLD_KEY_NEED_SETATTR 0x20 /* Used to be Require permission to change attributes */
428
429extern struct key_acl internal_key_acl;
430extern struct key_acl internal_keyring_acl;
431extern struct key_acl internal_writable_keyring_acl;
421 432
422static inline short key_read_state(const struct key *key) 433static inline short key_read_state(const struct key *key)
423{ 434{
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index ed3d5893830d..1f7a4e737214 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h
@@ -15,6 +15,69 @@
15 15
16#include <linux/types.h> 16#include <linux/types.h>
17 17
18/*
19 * Keyring permission grant definitions
20 */
21enum key_ace_subject_type {
22 KEY_ACE_SUBJ_STANDARD = 0, /* subject is one of key_ace_standard_subject */
23 nr__key_ace_subject_type
24};
25
26enum key_ace_standard_subject {
27 KEY_ACE_EVERYONE = 0, /* Everyone, including owner and group */
28 KEY_ACE_GROUP = 1, /* The key's group */
29 KEY_ACE_OWNER = 2, /* The owner of the key */
30 KEY_ACE_POSSESSOR = 3, /* Any process that possesses of the key */
31 nr__key_ace_standard_subject
32};
33
34#define KEY_ACE_VIEW 0x00000001 /* Can describe the key */
35#define KEY_ACE_READ 0x00000002 /* Can read the key content */
36#define KEY_ACE_WRITE 0x00000004 /* Can update/modify the key content */
37#define KEY_ACE_SEARCH 0x00000008 /* Can find the key by search */
38#define KEY_ACE_LINK 0x00000010 /* Can make a link to the key */
39#define KEY_ACE_SET_SECURITY 0x00000020 /* Can set owner, group, ACL */
40#define KEY_ACE_INVAL 0x00000040 /* Can invalidate the key */
41#define KEY_ACE_REVOKE 0x00000080 /* Can revoke the key */
42#define KEY_ACE_JOIN 0x00000100 /* Can join keyring */
43#define KEY_ACE_CLEAR 0x00000200 /* Can clear keyring */
44#define KEY_ACE__PERMS 0xffffffff
45
46/*
47 * Old-style permissions mask, deprecated in favour of ACL.
48 */
49#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */
50#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */
51#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */
52#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */
53#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */
54#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */
55#define KEY_POS_ALL 0x3f000000
56
57#define KEY_USR_VIEW 0x00010000 /* user permissions... */
58#define KEY_USR_READ 0x00020000
59#define KEY_USR_WRITE 0x00040000
60#define KEY_USR_SEARCH 0x00080000
61#define KEY_USR_LINK 0x00100000
62#define KEY_USR_SETATTR 0x00200000
63#define KEY_USR_ALL 0x003f0000
64
65#define KEY_GRP_VIEW 0x00000100 /* group permissions... */
66#define KEY_GRP_READ 0x00000200
67#define KEY_GRP_WRITE 0x00000400
68#define KEY_GRP_SEARCH 0x00000800
69#define KEY_GRP_LINK 0x00001000
70#define KEY_GRP_SETATTR 0x00002000
71#define KEY_GRP_ALL 0x00003f00
72
73#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */
74#define KEY_OTH_READ 0x00000002
75#define KEY_OTH_WRITE 0x00000004
76#define KEY_OTH_SEARCH 0x00000008
77#define KEY_OTH_LINK 0x00000010
78#define KEY_OTH_SETATTR 0x00000020
79#define KEY_OTH_ALL 0x0000003f
80
18/* special process keyring shortcut IDs */ 81/* special process keyring shortcut IDs */
19#define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */ 82#define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */
20#define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */ 83#define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */
@@ -69,6 +132,7 @@
69#define KEYCTL_RESTRICT_KEYRING 29 /* Restrict keys allowed to link to a keyring */ 132#define KEYCTL_RESTRICT_KEYRING 29 /* Restrict keys allowed to link to a keyring */
70#define KEYCTL_MOVE 30 /* Move keys between keyrings */ 133#define KEYCTL_MOVE 30 /* Move keys between keyrings */
71#define KEYCTL_CAPABILITIES 31 /* Find capabilities of keyrings subsystem */ 134#define KEYCTL_CAPABILITIES 31 /* Find capabilities of keyrings subsystem */
135#define KEYCTL_GRANT_PERMISSION 32 /* Grant a permit to a key */
72 136
73/* keyctl structures */ 137/* keyctl structures */
74struct keyctl_dh_params { 138struct keyctl_dh_params {
@@ -130,5 +194,6 @@ struct keyctl_pkey_params {
130#define KEYCTL_CAPS0_MOVE 0x80 /* KEYCTL_MOVE supported */ 194#define KEYCTL_CAPS0_MOVE 0x80 /* KEYCTL_MOVE supported */
131#define KEYCTL_CAPS1_NS_KEYRING_NAME 0x01 /* Keyring names are per-user_namespace */ 195#define KEYCTL_CAPS1_NS_KEYRING_NAME 0x01 /* Keyring names are per-user_namespace */
132#define KEYCTL_CAPS1_NS_KEY_TAG 0x02 /* Key indexing can include a namespace tag */ 196#define KEYCTL_CAPS1_NS_KEY_TAG 0x02 /* Key indexing can include a namespace tag */
197#define KEYCTL_CAPS1_ACL_ALTERABLE 0x04 /* Keys have internal ACL that can be altered */
133 198
134#endif /* _LINUX_KEYCTL_H */ 199#endif /* _LINUX_KEYCTL_H */
diff --git a/lib/digsig.c b/lib/digsig.c
index e0627c3e53b2..ab0800f98eaf 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -224,7 +224,7 @@ int digsig_verify(struct key *keyring, const char *sig, int siglen,
224 else 224 else
225 key = key_ref_to_ptr(kref); 225 key = key_ref_to_ptr(kref);
226 } else { 226 } else {
227 key = request_key(&key_type_user, name, NULL); 227 key = request_key(&key_type_user, name, NULL, NULL);
228 } 228 }
229 if (IS_ERR(key)) { 229 if (IS_ERR(key)) {
230 pr_err("key not found, id: %s\n", name); 230 pr_err("key not found, id: %s\n", name);
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 1c811c74bfc0..38de80d01aae 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -306,7 +306,7 @@ static int get_secret(struct ceph_crypto_key *dst, const char *name) {
306 int err = 0; 306 int err = 0;
307 struct ceph_crypto_key *ckey; 307 struct ceph_crypto_key *ckey;
308 308
309 ukey = request_key(&key_type_ceph, name, NULL); 309 ukey = request_key(&key_type_ceph, name, NULL, NULL);
310 if (IS_ERR(ukey)) { 310 if (IS_ERR(ukey)) {
311 /* request_key errors don't map nicely to mount(2) 311 /* request_key errors don't map nicely to mount(2)
312 errors; don't even try, but still printk */ 312 errors; don't even try, but still printk */
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 3e1a90669006..6b201531b165 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -46,6 +46,15 @@ const struct cred *dns_resolver_cache;
46 46
47#define DNS_ERRORNO_OPTION "dnserror" 47#define DNS_ERRORNO_OPTION "dnserror"
48 48
49static struct key_acl dns_keyring_acl = {
50 .usage = REFCOUNT_INIT(1),
51 .nr_ace = 2,
52 .aces = {
53 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
54 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_CLEAR),
55 }
56};
57
49/* 58/*
50 * Preparse instantiation data for a dns_resolver key. 59 * Preparse instantiation data for a dns_resolver key.
51 * 60 *
@@ -343,8 +352,7 @@ static int __init init_dns_resolver(void)
343 352
344 keyring = keyring_alloc(".dns_resolver", 353 keyring = keyring_alloc(".dns_resolver",
345 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 354 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
346 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 355 &dns_keyring_acl,
347 KEY_USR_VIEW | KEY_USR_READ,
348 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 356 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
349 if (IS_ERR(keyring)) { 357 if (IS_ERR(keyring)) {
350 ret = PTR_ERR(keyring); 358 ret = PTR_ERR(keyring);
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index cab4e0df924f..236baf2bfa4c 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -47,6 +47,16 @@
47 47
48#include "internal.h" 48#include "internal.h"
49 49
50static struct key_acl dns_key_acl = {
51 .usage = REFCOUNT_INIT(1),
52 .nr_ace = 2,
53 .possessor_viewable = true,
54 .aces = {
55 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_SEARCH | KEY_ACE_READ),
56 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_INVAL),
57 }
58};
59
50/** 60/**
51 * dns_query - Query the DNS 61 * dns_query - Query the DNS
52 * @net: The network namespace to operate in. 62 * @net: The network namespace to operate in.
@@ -125,7 +135,8 @@ int dns_query(struct net *net,
125 * add_key() to preinstall malicious redirections 135 * add_key() to preinstall malicious redirections
126 */ 136 */
127 saved_cred = override_creds(dns_resolver_cache); 137 saved_cred = override_creds(dns_resolver_cache);
128 rkey = request_key_net(&key_type_dns_resolver, desc, net, options); 138 rkey = request_key_net(&key_type_dns_resolver, desc, net, options,
139 &dns_key_acl);
129 revert_creds(saved_cred); 140 revert_creds(saved_cred);
130 kfree(desc); 141 kfree(desc);
131 if (IS_ERR(rkey)) { 142 if (IS_ERR(rkey)) {
@@ -135,8 +146,6 @@ int dns_query(struct net *net,
135 146
136 down_read(&rkey->sem); 147 down_read(&rkey->sem);
137 set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags); 148 set_bit(KEY_FLAG_ROOT_CAN_INVAL, &rkey->flags);
138 rkey->perm |= KEY_USR_VIEW;
139
140 ret = key_validate(rkey); 149 ret = key_validate(rkey);
141 if (ret < 0) 150 if (ret < 0)
142 goto put; 151 goto put;
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index 6c3f35fac42d..2032f6a8225e 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -23,6 +23,14 @@
23#include <keys/user-type.h> 23#include <keys/user-type.h>
24#include "ar-internal.h" 24#include "ar-internal.h"
25 25
26static struct key_acl rxrpc_null_key_acl = {
27 .usage = REFCOUNT_INIT(1),
28 .nr_ace = 1,
29 .aces = {
30 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_READ),
31 }
32};
33
26static int rxrpc_vet_description_s(const char *); 34static int rxrpc_vet_description_s(const char *);
27static int rxrpc_preparse(struct key_preparsed_payload *); 35static int rxrpc_preparse(struct key_preparsed_payload *);
28static int rxrpc_preparse_s(struct key_preparsed_payload *); 36static int rxrpc_preparse_s(struct key_preparsed_payload *);
@@ -910,7 +918,8 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
910 if (IS_ERR(description)) 918 if (IS_ERR(description))
911 return PTR_ERR(description); 919 return PTR_ERR(description);
912 920
913 key = request_key_net(&key_type_rxrpc, description, sock_net(&rx->sk), NULL); 921 key = request_key_net(&key_type_rxrpc, description, sock_net(&rx->sk),
922 NULL, NULL);
914 if (IS_ERR(key)) { 923 if (IS_ERR(key)) {
915 kfree(description); 924 kfree(description);
916 _leave(" = %ld", PTR_ERR(key)); 925 _leave(" = %ld", PTR_ERR(key));
@@ -941,7 +950,8 @@ int rxrpc_server_keyring(struct rxrpc_sock *rx, char __user *optval,
941 if (IS_ERR(description)) 950 if (IS_ERR(description))
942 return PTR_ERR(description); 951 return PTR_ERR(description);
943 952
944 key = request_key_net(&key_type_keyring, description, sock_net(&rx->sk), NULL); 953 key = request_key_net(&key_type_keyring, description, sock_net(&rx->sk),
954 NULL, NULL);
945 if (IS_ERR(key)) { 955 if (IS_ERR(key)) {
946 kfree(description); 956 kfree(description);
947 _leave(" = %ld", PTR_ERR(key)); 957 _leave(" = %ld", PTR_ERR(key));
@@ -974,7 +984,8 @@ int rxrpc_get_server_data_key(struct rxrpc_connection *conn,
974 _enter(""); 984 _enter("");
975 985
976 key = key_alloc(&key_type_rxrpc, "x", 986 key = key_alloc(&key_type_rxrpc, "x",
977 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 0, 987 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
988 &internal_key_acl,
978 KEY_ALLOC_NOT_IN_QUOTA, NULL); 989 KEY_ALLOC_NOT_IN_QUOTA, NULL);
979 if (IS_ERR(key)) { 990 if (IS_ERR(key)) {
980 _leave(" = -ENOMEM [alloc %ld]", PTR_ERR(key)); 991 _leave(" = -ENOMEM [alloc %ld]", PTR_ERR(key));
@@ -1022,7 +1033,7 @@ struct key *rxrpc_get_null_key(const char *keyname)
1022 1033
1023 key = key_alloc(&key_type_rxrpc, keyname, 1034 key = key_alloc(&key_type_rxrpc, keyname,
1024 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred, 1035 GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
1025 KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA, NULL); 1036 &rxrpc_null_key_acl, KEY_ALLOC_NOT_IN_QUOTA, NULL);
1026 if (IS_ERR(key)) 1037 if (IS_ERR(key))
1027 return key; 1038 return key;
1028 1039
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 4831ad745f91..298fe91557f7 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -741,8 +741,7 @@ static void __init load_keys_from_buffer(const u8 *p, unsigned int buflen)
741 741
742 key = key_create_or_update(make_key_ref(builtin_regdb_keys, 1), 742 key = key_create_or_update(make_key_ref(builtin_regdb_keys, 1),
743 "asymmetric", NULL, p, plen, 743 "asymmetric", NULL, p, plen,
744 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 744 &internal_key_acl,
745 KEY_USR_VIEW | KEY_USR_READ),
746 KEY_ALLOC_NOT_IN_QUOTA | 745 KEY_ALLOC_NOT_IN_QUOTA |
747 KEY_ALLOC_BUILT_IN | 746 KEY_ALLOC_BUILT_IN |
748 KEY_ALLOC_BYPASS_RESTRICTION); 747 KEY_ALLOC_BYPASS_RESTRICTION);
@@ -768,8 +767,7 @@ static int __init load_builtin_regdb_keys(void)
768 builtin_regdb_keys = 767 builtin_regdb_keys =
769 keyring_alloc(".builtin_regdb_keys", 768 keyring_alloc(".builtin_regdb_keys",
770 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 769 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
771 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 770 &internal_keyring_acl,
772 KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
773 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 771 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
774 if (IS_ERR(builtin_regdb_keys)) 772 if (IS_ERR(builtin_regdb_keys))
775 return PTR_ERR(builtin_regdb_keys); 773 return PTR_ERR(builtin_regdb_keys);
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 4582bc26770a..ceb10553a6ba 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -47,7 +47,8 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
47 47
48 if (!keyring[id]) { 48 if (!keyring[id]) {
49 keyring[id] = 49 keyring[id] =
50 request_key(&key_type_keyring, keyring_name[id], NULL); 50 request_key(&key_type_keyring, keyring_name[id],
51 NULL, NULL);
51 if (IS_ERR(keyring[id])) { 52 if (IS_ERR(keyring[id])) {
52 int err = PTR_ERR(keyring[id]); 53 int err = PTR_ERR(keyring[id]);
53 pr_err("no %s keyring: %d\n", keyring_name[id], err); 54 pr_err("no %s keyring: %d\n", keyring_name[id], err);
@@ -69,14 +70,14 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
69 return -EOPNOTSUPP; 70 return -EOPNOTSUPP;
70} 71}
71 72
72static int __integrity_init_keyring(const unsigned int id, key_perm_t perm, 73static int __integrity_init_keyring(const unsigned int id, struct key_acl *acl,
73 struct key_restriction *restriction) 74 struct key_restriction *restriction)
74{ 75{
75 const struct cred *cred = current_cred(); 76 const struct cred *cred = current_cred();
76 int err = 0; 77 int err = 0;
77 78
78 keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0), 79 keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
79 KGIDT_INIT(0), cred, perm, 80 KGIDT_INIT(0), cred, acl,
80 KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL); 81 KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL);
81 if (IS_ERR(keyring[id])) { 82 if (IS_ERR(keyring[id])) {
82 err = PTR_ERR(keyring[id]); 83 err = PTR_ERR(keyring[id]);
@@ -94,10 +95,7 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
94int __init integrity_init_keyring(const unsigned int id) 95int __init integrity_init_keyring(const unsigned int id)
95{ 96{
96 struct key_restriction *restriction; 97 struct key_restriction *restriction;
97 key_perm_t perm; 98 struct key_acl *acl = &internal_keyring_acl;
98
99 perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW
100 | KEY_USR_READ | KEY_USR_SEARCH;
101 99
102 if (id == INTEGRITY_KEYRING_PLATFORM) { 100 if (id == INTEGRITY_KEYRING_PLATFORM) {
103 restriction = NULL; 101 restriction = NULL;
@@ -112,14 +110,14 @@ int __init integrity_init_keyring(const unsigned int id)
112 return -ENOMEM; 110 return -ENOMEM;
113 111
114 restriction->check = restrict_link_to_ima; 112 restriction->check = restrict_link_to_ima;
115 perm |= KEY_USR_WRITE; 113 acl = &internal_writable_keyring_acl;
116 114
117out: 115out:
118 return __integrity_init_keyring(id, perm, restriction); 116 return __integrity_init_keyring(id, acl, restriction);
119} 117}
120 118
121int __init integrity_add_key(const unsigned int id, const void *data, 119static int __init integrity_add_key(const unsigned int id, const void *data,
122 off_t size, key_perm_t perm) 120 off_t size, struct key_acl *acl)
123{ 121{
124 key_ref_t key; 122 key_ref_t key;
125 int rc = 0; 123 int rc = 0;
@@ -128,7 +126,7 @@ int __init integrity_add_key(const unsigned int id, const void *data,
128 return -EINVAL; 126 return -EINVAL;
129 127
130 key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric", 128 key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric",
131 NULL, data, size, perm, 129 NULL, data, size, acl ?: &internal_key_acl,
132 KEY_ALLOC_NOT_IN_QUOTA); 130 KEY_ALLOC_NOT_IN_QUOTA);
133 if (IS_ERR(key)) { 131 if (IS_ERR(key)) {
134 rc = PTR_ERR(key); 132 rc = PTR_ERR(key);
@@ -148,7 +146,6 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
148 void *data; 146 void *data;
149 loff_t size; 147 loff_t size;
150 int rc; 148 int rc;
151 key_perm_t perm;
152 149
153 rc = kernel_read_file_from_path(path, &data, &size, 0, 150 rc = kernel_read_file_from_path(path, &data, &size, 0,
154 READING_X509_CERTIFICATE); 151 READING_X509_CERTIFICATE);
@@ -157,21 +154,19 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
157 return rc; 154 return rc;
158 } 155 }
159 156
160 perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ;
161
162 pr_info("Loading X.509 certificate: %s\n", path); 157 pr_info("Loading X.509 certificate: %s\n", path);
163 rc = integrity_add_key(id, (const void *)data, size, perm); 158 rc = integrity_add_key(id, data, size, NULL);
164 159
165 vfree(data); 160 vfree(data);
166 return rc; 161 return rc;
167} 162}
168 163
169int __init integrity_load_cert(const unsigned int id, const char *source, 164int __init integrity_load_cert(const unsigned int id, const char *source,
170 const void *data, size_t len, key_perm_t perm) 165 const void *data, size_t len, struct key_acl *acl)
171{ 166{
172 if (!data) 167 if (!data)
173 return -EINVAL; 168 return -EINVAL;
174 169
175 pr_info("Loading X.509 certificate: %s\n", source); 170 pr_info("Loading X.509 certificate: %s\n", source);
176 return integrity_add_key(id, data, len, perm); 171 return integrity_add_key(id, data, len, acl);
177} 172}
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 55aec161d0e1..a29df775fdd8 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -53,7 +53,7 @@ static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid)
53 else 53 else
54 key = key_ref_to_ptr(kref); 54 key = key_ref_to_ptr(kref);
55 } else { 55 } else {
56 key = request_key(&key_type_asymmetric, name, NULL); 56 key = request_key(&key_type_asymmetric, name, NULL, NULL);
57 } 57 }
58 58
59 if (IS_ERR(key)) { 59 if (IS_ERR(key)) {
diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index d485f6fc908e..466eebd3b4aa 100644
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -356,7 +356,7 @@ int evm_init_key(void)
356 struct encrypted_key_payload *ekp; 356 struct encrypted_key_payload *ekp;
357 int rc; 357 int rc;
358 358
359 evm_key = request_key(&key_type_encrypted, EVMKEY, NULL); 359 evm_key = request_key(&key_type_encrypted, EVMKEY, NULL, NULL);
360 if (IS_ERR(evm_key)) 360 if (IS_ERR(evm_key))
361 return -ENOENT; 361 return -ENOENT;
362 362
diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
index 36cadadbfba4..b52ae1476ec3 100644
--- a/security/integrity/ima/ima_mok.c
+++ b/security/integrity/ima/ima_mok.c
@@ -16,6 +16,15 @@
16#include <keys/system_keyring.h> 16#include <keys/system_keyring.h>
17 17
18 18
19static struct key_acl integrity_blacklist_keyring_acl = {
20 .usage = REFCOUNT_INIT(1),
21 .nr_ace = 2,
22 .aces = {
23 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
24 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE | KEY_ACE_SEARCH),
25 }
26};
27
19struct key *ima_blacklist_keyring; 28struct key *ima_blacklist_keyring;
20 29
21/* 30/*
@@ -35,9 +44,7 @@ __init int ima_mok_init(void)
35 44
36 ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 45 ima_blacklist_keyring = keyring_alloc(".ima_blacklist",
37 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 46 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
38 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 47 &integrity_blacklist_keyring_acl,
39 KEY_USR_VIEW | KEY_USR_READ |
40 KEY_USR_WRITE | KEY_USR_SEARCH,
41 KEY_ALLOC_NOT_IN_QUOTA, 48 KEY_ALLOC_NOT_IN_QUOTA,
42 restriction, NULL); 49 restriction, NULL);
43 50
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 65377848fbc5..45f4aef83e29 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -12,6 +12,8 @@
12#include <linux/key.h> 12#include <linux/key.h>
13#include <linux/audit.h> 13#include <linux/audit.h>
14 14
15struct key_acl;
16
15/* iint action cache flags */ 17/* iint action cache flags */
16#define IMA_MEASURE 0x00000001 18#define IMA_MEASURE 0x00000001
17#define IMA_MEASURED 0x00000002 19#define IMA_MEASURED 0x00000002
@@ -149,7 +151,7 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
149int __init integrity_init_keyring(const unsigned int id); 151int __init integrity_init_keyring(const unsigned int id);
150int __init integrity_load_x509(const unsigned int id, const char *path); 152int __init integrity_load_x509(const unsigned int id, const char *path);
151int __init integrity_load_cert(const unsigned int id, const char *source, 153int __init integrity_load_cert(const unsigned int id, const char *source,
152 const void *data, size_t len, key_perm_t perm); 154 const void *data, size_t len, struct key_acl *acl);
153#else 155#else
154 156
155static inline int integrity_digsig_verify(const unsigned int id, 157static inline int integrity_digsig_verify(const unsigned int id,
@@ -167,7 +169,7 @@ static inline int integrity_init_keyring(const unsigned int id)
167static inline int __init integrity_load_cert(const unsigned int id, 169static inline int __init integrity_load_cert(const unsigned int id,
168 const char *source, 170 const char *source,
169 const void *data, size_t len, 171 const void *data, size_t len,
170 key_perm_t perm) 172 struct key_acl *acl)
171{ 173{
172 return 0; 174 return 0;
173} 175}
diff --git a/security/integrity/platform_certs/platform_keyring.c b/security/integrity/platform_certs/platform_keyring.c
index bcafd7387729..7646e35f2d91 100644
--- a/security/integrity/platform_certs/platform_keyring.c
+++ b/security/integrity/platform_certs/platform_keyring.c
@@ -14,6 +14,15 @@
14#include <linux/slab.h> 14#include <linux/slab.h>
15#include "../integrity.h" 15#include "../integrity.h"
16 16
17static struct key_acl platform_key_acl = {
18 .usage = REFCOUNT_INIT(1),
19 .nr_ace = 2,
20 .aces = {
21 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_READ),
22 KEY_OWNER_ACE(KEY_ACE_VIEW),
23 }
24};
25
17/** 26/**
18 * add_to_platform_keyring - Add to platform keyring without validation. 27 * add_to_platform_keyring - Add to platform keyring without validation.
19 * @source: Source of key 28 * @source: Source of key
@@ -26,13 +35,10 @@
26void __init add_to_platform_keyring(const char *source, const void *data, 35void __init add_to_platform_keyring(const char *source, const void *data,
27 size_t len) 36 size_t len)
28{ 37{
29 key_perm_t perm;
30 int rc; 38 int rc;
31 39
32 perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;
33
34 rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, data, len, 40 rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, data, len,
35 perm); 41 &platform_key_acl);
36 if (rc) 42 if (rc)
37 pr_info("Error adding keys to platform keyring %s\n", source); 43 pr_info("Error adding keys to platform keyring %s\n", source);
38} 44}
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 9bcc404131aa..b0e59546e7bd 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -157,6 +157,8 @@ COMPAT_SYSCALL_DEFINE5(keyctl, u32, option,
157 157
158 case KEYCTL_MOVE: 158 case KEYCTL_MOVE:
159 return keyctl_keyring_move(arg2, arg3, arg4, arg5); 159 return keyctl_keyring_move(arg2, arg3, arg4, arg5);
160 case KEYCTL_GRANT_PERMISSION:
161 return keyctl_grant_permission(arg2, arg3, arg4, arg5);
160 162
161 case KEYCTL_CAPABILITIES: 163 case KEYCTL_CAPABILITIES:
162 return keyctl_capabilities(compat_ptr(arg2), arg3); 164 return keyctl_capabilities(compat_ptr(arg2), arg3);
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 60720f58cbe0..9df560e477c2 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -304,7 +304,7 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k
304 const struct user_key_payload *upayload; 304 const struct user_key_payload *upayload;
305 struct key *ukey; 305 struct key *ukey;
306 306
307 ukey = request_key(&key_type_user, master_desc, NULL); 307 ukey = request_key(&key_type_user, master_desc, NULL, NULL);
308 if (IS_ERR(ukey)) 308 if (IS_ERR(ukey))
309 goto error; 309 goto error;
310 310
diff --git a/security/keys/encrypted-keys/masterkey_trusted.c b/security/keys/encrypted-keys/masterkey_trusted.c
index c68528aa49c6..d649f2f29475 100644
--- a/security/keys/encrypted-keys/masterkey_trusted.c
+++ b/security/keys/encrypted-keys/masterkey_trusted.c
@@ -30,7 +30,7 @@ struct key *request_trusted_key(const char *trusted_desc,
30 struct trusted_key_payload *tpayload; 30 struct trusted_key_payload *tpayload;
31 struct key *tkey; 31 struct key *tkey;
32 32
33 tkey = request_key(&key_type_trusted, trusted_desc, NULL); 33 tkey = request_key(&key_type_trusted, trusted_desc, NULL, NULL);
34 if (IS_ERR(tkey)) 34 if (IS_ERR(tkey))
35 goto error; 35 goto error;
36 36
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 671dd730ecfc..48c3e124c272 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -151,6 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
151 151
152 key_user_put(key->user); 152 key_user_put(key->user);
153 key_put_tag(key->domain_tag); 153 key_put_tag(key->domain_tag);
154 key_put_acl(rcu_access_pointer(key->acl));
154 kfree(key->description); 155 kfree(key->description);
155 156
156 memzero_explicit(key, sizeof(*key)); 157 memzero_explicit(key, sizeof(*key));
@@ -220,7 +221,6 @@ continue_scanning:
220 if (key->type == key_gc_dead_keytype) { 221 if (key->type == key_gc_dead_keytype) {
221 gc_state |= KEY_GC_FOUND_DEAD_KEY; 222 gc_state |= KEY_GC_FOUND_DEAD_KEY;
222 set_bit(KEY_FLAG_DEAD, &key->flags); 223 set_bit(KEY_FLAG_DEAD, &key->flags);
223 key->perm = 0;
224 goto skip_dead_key; 224 goto skip_dead_key;
225 } else if (key->type == &key_type_keyring && 225 } else if (key->type == &key_type_keyring &&
226 key->restrict_link) { 226 key->restrict_link) {
diff --git a/security/keys/internal.h b/security/keys/internal.h
index c039373488bd..e0c5bb8b1685 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -84,8 +84,11 @@ extern struct rb_root key_serial_tree;
84extern spinlock_t key_serial_lock; 84extern spinlock_t key_serial_lock;
85extern struct mutex key_construction_mutex; 85extern struct mutex key_construction_mutex;
86extern wait_queue_head_t request_key_conswq; 86extern wait_queue_head_t request_key_conswq;
87extern struct key_acl default_key_acl;
88extern struct key_acl joinable_keyring_acl;
87 89
88extern void key_set_index_key(struct keyring_index_key *index_key); 90extern void key_set_index_key(struct keyring_index_key *index_key);
91
89extern struct key_type *key_type_lookup(const char *type); 92extern struct key_type *key_type_lookup(const char *type);
90extern void key_type_put(struct key_type *ktype); 93extern void key_type_put(struct key_type *ktype);
91 94
@@ -156,6 +159,7 @@ extern struct key *request_key_and_link(struct key_type *type,
156 const void *callout_info, 159 const void *callout_info,
157 size_t callout_len, 160 size_t callout_len,
158 void *aux, 161 void *aux,
162 struct key_acl *acl,
159 struct key *dest_keyring, 163 struct key *dest_keyring,
160 unsigned long flags); 164 unsigned long flags);
161 165
@@ -179,7 +183,10 @@ extern void key_gc_keytype(struct key_type *ktype);
179 183
180extern int key_task_permission(const key_ref_t key_ref, 184extern int key_task_permission(const key_ref_t key_ref,
181 const struct cred *cred, 185 const struct cred *cred,
182 key_perm_t perm); 186 u32 desired_perm);
187extern unsigned int key_acl_to_perm(const struct key_acl *acl);
188extern long key_set_acl(struct key *key, struct key_acl *acl);
189extern void key_put_acl(struct key_acl *acl);
183 190
184/* 191/*
185 * Check to see whether permission is granted to use a key in the desired way. 192 * Check to see whether permission is granted to use a key in the desired way.
@@ -226,7 +233,7 @@ extern long keyctl_keyring_search(key_serial_t, const char __user *,
226 const char __user *, key_serial_t); 233 const char __user *, key_serial_t);
227extern long keyctl_read_key(key_serial_t, char __user *, size_t); 234extern long keyctl_read_key(key_serial_t, char __user *, size_t);
228extern long keyctl_chown_key(key_serial_t, uid_t, gid_t); 235extern long keyctl_chown_key(key_serial_t, uid_t, gid_t);
229extern long keyctl_setperm_key(key_serial_t, key_perm_t); 236extern long keyctl_setperm_key(key_serial_t, unsigned int);
230extern long keyctl_instantiate_key(key_serial_t, const void __user *, 237extern long keyctl_instantiate_key(key_serial_t, const void __user *,
231 size_t, key_serial_t); 238 size_t, key_serial_t);
232extern long keyctl_negate_key(key_serial_t, unsigned, key_serial_t); 239extern long keyctl_negate_key(key_serial_t, unsigned, key_serial_t);
@@ -331,6 +338,11 @@ static inline long keyctl_pkey_e_d_s(int op,
331 338
332extern long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen); 339extern long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen);
333 340
341extern long keyctl_grant_permission(key_serial_t keyid,
342 enum key_ace_subject_type type,
343 unsigned int subject,
344 unsigned int perm);
345
334/* 346/*
335 * Debugging key validation 347 * Debugging key validation
336 */ 348 */
diff --git a/security/keys/key.c b/security/keys/key.c
index 764f4c57913e..519211a996e7 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -195,7 +195,7 @@ serial_exists:
195 * @uid: The owner of the new key. 195 * @uid: The owner of the new key.
196 * @gid: The group ID for the new key's group permissions. 196 * @gid: The group ID for the new key's group permissions.
197 * @cred: The credentials specifying UID namespace. 197 * @cred: The credentials specifying UID namespace.
198 * @perm: The permissions mask of the new key. 198 * @acl: The ACL to attach to the new key.
199 * @flags: Flags specifying quota properties. 199 * @flags: Flags specifying quota properties.
200 * @restrict_link: Optional link restriction for new keyrings. 200 * @restrict_link: Optional link restriction for new keyrings.
201 * 201 *
@@ -223,7 +223,7 @@ serial_exists:
223 */ 223 */
224struct key *key_alloc(struct key_type *type, const char *desc, 224struct key *key_alloc(struct key_type *type, const char *desc,
225 kuid_t uid, kgid_t gid, const struct cred *cred, 225 kuid_t uid, kgid_t gid, const struct cred *cred,
226 key_perm_t perm, unsigned long flags, 226 struct key_acl *acl, unsigned long flags,
227 struct key_restriction *restrict_link) 227 struct key_restriction *restrict_link)
228{ 228{
229 struct key_user *user = NULL; 229 struct key_user *user = NULL;
@@ -246,6 +246,9 @@ struct key *key_alloc(struct key_type *type, const char *desc,
246 desclen = strlen(desc); 246 desclen = strlen(desc);
247 quotalen = desclen + 1 + type->def_datalen; 247 quotalen = desclen + 1 + type->def_datalen;
248 248
249 if (!acl)
250 acl = &default_key_acl;
251
249 /* get hold of the key tracking for this user */ 252 /* get hold of the key tracking for this user */
250 user = key_user_lookup(uid); 253 user = key_user_lookup(uid);
251 if (!user) 254 if (!user)
@@ -292,7 +295,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
292 key->datalen = type->def_datalen; 295 key->datalen = type->def_datalen;
293 key->uid = uid; 296 key->uid = uid;
294 key->gid = gid; 297 key->gid = gid;
295 key->perm = perm; 298 refcount_inc(&acl->usage);
299 rcu_assign_pointer(key->acl, acl);
296 key->restrict_link = restrict_link; 300 key->restrict_link = restrict_link;
297 key->last_used_at = ktime_get_real_seconds(); 301 key->last_used_at = ktime_get_real_seconds();
298 302
@@ -787,7 +791,7 @@ error:
787 * @description: The searchable description for the key. 791 * @description: The searchable description for the key.
788 * @payload: The data to use to instantiate or update the key. 792 * @payload: The data to use to instantiate or update the key.
789 * @plen: The length of @payload. 793 * @plen: The length of @payload.
790 * @perm: The permissions mask for a new key. 794 * @acl: The ACL to attach if a key is created.
791 * @flags: The quota flags for a new key. 795 * @flags: The quota flags for a new key.
792 * 796 *
793 * Search the destination keyring for a key of the same description and if one 797 * Search the destination keyring for a key of the same description and if one
@@ -810,7 +814,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
810 const char *description, 814 const char *description,
811 const void *payload, 815 const void *payload,
812 size_t plen, 816 size_t plen,
813 key_perm_t perm, 817 struct key_acl *acl,
814 unsigned long flags) 818 unsigned long flags)
815{ 819{
816 struct keyring_index_key index_key = { 820 struct keyring_index_key index_key = {
@@ -907,22 +911,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
907 goto found_matching_key; 911 goto found_matching_key;
908 } 912 }
909 913
910 /* if the client doesn't provide, decide on the permissions we want */
911 if (perm == KEY_PERM_UNDEF) {
912 perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
913 perm |= KEY_USR_VIEW;
914
915 if (index_key.type->read)
916 perm |= KEY_POS_READ;
917
918 if (index_key.type == &key_type_keyring ||
919 index_key.type->update)
920 perm |= KEY_POS_WRITE;
921 }
922
923 /* allocate a new key */ 914 /* allocate a new key */
924 key = key_alloc(index_key.type, index_key.description, 915 key = key_alloc(index_key.type, index_key.description,
925 cred->fsuid, cred->fsgid, cred, perm, flags, NULL); 916 cred->fsuid, cred->fsgid, cred, acl, flags, NULL);
926 if (IS_ERR(key)) { 917 if (IS_ERR(key)) {
927 key_ref = ERR_CAST(key); 918 key_ref = ERR_CAST(key);
928 goto error_link_end; 919 goto error_link_end;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 9b898c969558..c2dd66d556d4 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -37,7 +37,8 @@ static const unsigned char keyrings_capabilities[2] = {
37 KEYCTL_CAPS0_MOVE 37 KEYCTL_CAPS0_MOVE
38 ), 38 ),
39 [1] = (KEYCTL_CAPS1_NS_KEYRING_NAME | 39 [1] = (KEYCTL_CAPS1_NS_KEYRING_NAME |
40 KEYCTL_CAPS1_NS_KEY_TAG), 40 KEYCTL_CAPS1_NS_KEY_TAG |
41 KEYCTL_CAPS1_ACL_ALTERABLE),
41}; 42};
42 43
43static int key_get_type_from_user(char *type, 44static int key_get_type_from_user(char *type,
@@ -130,8 +131,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
130 /* create or update the requested key and add it to the target 131 /* create or update the requested key and add it to the target
131 * keyring */ 132 * keyring */
132 key_ref = key_create_or_update(keyring_ref, type, description, 133 key_ref = key_create_or_update(keyring_ref, type, description,
133 payload, plen, KEY_PERM_UNDEF, 134 payload, plen, NULL, KEY_ALLOC_IN_QUOTA);
134 KEY_ALLOC_IN_QUOTA);
135 if (!IS_ERR(key_ref)) { 135 if (!IS_ERR(key_ref)) {
136 ret = key_ref_to_ptr(key_ref)->serial; 136 ret = key_ref_to_ptr(key_ref)->serial;
137 key_ref_put(key_ref); 137 key_ref_put(key_ref);
@@ -221,7 +221,8 @@ SYSCALL_DEFINE4(request_key, const char __user *, _type,
221 221
222 /* do the search */ 222 /* do the search */
223 key = request_key_and_link(ktype, description, NULL, callout_info, 223 key = request_key_and_link(ktype, description, NULL, callout_info,
224 callout_len, NULL, key_ref_to_ptr(dest_ref), 224 callout_len, NULL, NULL,
225 key_ref_to_ptr(dest_ref),
225 KEY_ALLOC_IN_QUOTA); 226 KEY_ALLOC_IN_QUOTA);
226 if (IS_ERR(key)) { 227 if (IS_ERR(key)) {
227 ret = PTR_ERR(key); 228 ret = PTR_ERR(key);
@@ -383,16 +384,10 @@ long keyctl_revoke_key(key_serial_t id)
383 struct key *key; 384 struct key *key;
384 long ret; 385 long ret;
385 386
386 key_ref = lookup_user_key(id, 0, KEY_NEED_WRITE); 387 key_ref = lookup_user_key(id, 0, KEY_NEED_REVOKE);
387 if (IS_ERR(key_ref)) { 388 if (IS_ERR(key_ref)) {
388 ret = PTR_ERR(key_ref); 389 ret = PTR_ERR(key_ref);
389 if (ret != -EACCES) 390 goto error;
390 goto error;
391 key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR);
392 if (IS_ERR(key_ref)) {
393 ret = PTR_ERR(key_ref);
394 goto error;
395 }
396 } 391 }
397 392
398 key = key_ref_to_ptr(key_ref); 393 key = key_ref_to_ptr(key_ref);
@@ -426,7 +421,7 @@ long keyctl_invalidate_key(key_serial_t id)
426 421
427 kenter("%d", id); 422 kenter("%d", id);
428 423
429 key_ref = lookup_user_key(id, 0, KEY_NEED_SEARCH); 424 key_ref = lookup_user_key(id, 0, KEY_NEED_INVAL);
430 if (IS_ERR(key_ref)) { 425 if (IS_ERR(key_ref)) {
431 ret = PTR_ERR(key_ref); 426 ret = PTR_ERR(key_ref);
432 427
@@ -471,7 +466,7 @@ long keyctl_keyring_clear(key_serial_t ringid)
471 struct key *keyring; 466 struct key *keyring;
472 long ret; 467 long ret;
473 468
474 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_WRITE); 469 keyring_ref = lookup_user_key(ringid, KEY_LOOKUP_CREATE, KEY_NEED_CLEAR);
475 if (IS_ERR(keyring_ref)) { 470 if (IS_ERR(keyring_ref)) {
476 ret = PTR_ERR(keyring_ref); 471 ret = PTR_ERR(keyring_ref);
477 472
@@ -646,6 +641,7 @@ long keyctl_describe_key(key_serial_t keyid,
646 size_t buflen) 641 size_t buflen)
647{ 642{
648 struct key *key, *instkey; 643 struct key *key, *instkey;
644 unsigned int perm;
649 key_ref_t key_ref; 645 key_ref_t key_ref;
650 char *infobuf; 646 char *infobuf;
651 long ret; 647 long ret;
@@ -675,6 +671,10 @@ okay:
675 key = key_ref_to_ptr(key_ref); 671 key = key_ref_to_ptr(key_ref);
676 desclen = strlen(key->description); 672 desclen = strlen(key->description);
677 673
674 rcu_read_lock();
675 perm = key_acl_to_perm(rcu_dereference(key->acl));
676 rcu_read_unlock();
677
678 /* calculate how much information we're going to return */ 678 /* calculate how much information we're going to return */
679 ret = -ENOMEM; 679 ret = -ENOMEM;
680 infobuf = kasprintf(GFP_KERNEL, 680 infobuf = kasprintf(GFP_KERNEL,
@@ -682,7 +682,7 @@ okay:
682 key->type->name, 682 key->type->name,
683 from_kuid_munged(current_user_ns(), key->uid), 683 from_kuid_munged(current_user_ns(), key->uid),
684 from_kgid_munged(current_user_ns(), key->gid), 684 from_kgid_munged(current_user_ns(), key->gid),
685 key->perm); 685 perm);
686 if (!infobuf) 686 if (!infobuf)
687 goto error2; 687 goto error2;
688 infolen = strlen(infobuf); 688 infolen = strlen(infobuf);
@@ -899,7 +899,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
899 goto error; 899 goto error;
900 900
901 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 901 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
902 KEY_NEED_SETATTR); 902 KEY_NEED_SETSEC);
903 if (IS_ERR(key_ref)) { 903 if (IS_ERR(key_ref)) {
904 ret = PTR_ERR(key_ref); 904 ret = PTR_ERR(key_ref);
905 goto error; 905 goto error;
@@ -994,18 +994,25 @@ quota_overrun:
994 * the key need not be fully instantiated yet. If the caller does not have 994 * the key need not be fully instantiated yet. If the caller does not have
995 * sysadmin capability, it may only change the permission on keys that it owns. 995 * sysadmin capability, it may only change the permission on keys that it owns.
996 */ 996 */
997long keyctl_setperm_key(key_serial_t id, key_perm_t perm) 997long keyctl_setperm_key(key_serial_t id, unsigned int perm)
998{ 998{
999 struct key_acl *acl;
999 struct key *key; 1000 struct key *key;
1000 key_ref_t key_ref; 1001 key_ref_t key_ref;
1001 long ret; 1002 long ret;
1003 int nr, i, j;
1002 1004
1003 ret = -EINVAL;
1004 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL)) 1005 if (perm & ~(KEY_POS_ALL | KEY_USR_ALL | KEY_GRP_ALL | KEY_OTH_ALL))
1005 goto error; 1006 return -EINVAL;
1007
1008 nr = 0;
1009 if (perm & KEY_POS_ALL) nr++;
1010 if (perm & KEY_USR_ALL) nr++;
1011 if (perm & KEY_GRP_ALL) nr++;
1012 if (perm & KEY_OTH_ALL) nr++;
1006 1013
1007 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 1014 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
1008 KEY_NEED_SETATTR); 1015 KEY_NEED_SETSEC);
1009 if (IS_ERR(key_ref)) { 1016 if (IS_ERR(key_ref)) {
1010 ret = PTR_ERR(key_ref); 1017 ret = PTR_ERR(key_ref);
1011 goto error; 1018 goto error;
@@ -1013,17 +1020,45 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
1013 1020
1014 key = key_ref_to_ptr(key_ref); 1021 key = key_ref_to_ptr(key_ref);
1015 1022
1016 /* make the changes with the locks held to prevent chown/chmod races */ 1023 ret = -EOPNOTSUPP;
1017 ret = -EACCES; 1024 if (test_bit(KEY_FLAG_HAS_ACL, &key->flags))
1018 down_write(&key->sem); 1025 goto error_key;
1019 1026
1020 /* if we're not the sysadmin, we can only change a key that we own */ 1027 ret = -ENOMEM;
1021 if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) { 1028 acl = kzalloc(struct_size(acl, aces, nr), GFP_KERNEL);
1022 key->perm = perm; 1029 if (!acl)
1023 ret = 0; 1030 goto error_key;
1031
1032 refcount_set(&acl->usage, 1);
1033 acl->nr_ace = nr;
1034 j = 0;
1035 for (i = 0; i < 4; i++) {
1036 struct key_ace *ace = &acl->aces[j];
1037 unsigned int subset = (perm >> (i * 8)) & KEY_OTH_ALL;
1038
1039 if (!subset)
1040 continue;
1041 ace->type = KEY_ACE_SUBJ_STANDARD;
1042 ace->subject_id = KEY_ACE_EVERYONE + i;
1043 ace->perm = subset;
1044 if (subset & (KEY_OTH_WRITE | KEY_OTH_SETATTR))
1045 ace->perm |= KEY_ACE_REVOKE;
1046 if (subset & KEY_OTH_SEARCH)
1047 ace->perm |= KEY_ACE_INVAL;
1048 if (key->type == &key_type_keyring) {
1049 if (subset & KEY_OTH_SEARCH)
1050 ace->perm |= KEY_ACE_JOIN;
1051 if (subset & KEY_OTH_WRITE)
1052 ace->perm |= KEY_ACE_CLEAR;
1053 }
1054 j++;
1024 } 1055 }
1025 1056
1057 /* make the changes with the locks held to prevent chown/chmod races */
1058 down_write(&key->sem);
1059 ret = key_set_acl(key, acl);
1026 up_write(&key->sem); 1060 up_write(&key->sem);
1061error_key:
1027 key_put(key); 1062 key_put(key);
1028error: 1063error:
1029 return ret; 1064 return ret;
@@ -1388,7 +1423,7 @@ long keyctl_set_timeout(key_serial_t id, unsigned timeout)
1388 long ret; 1423 long ret;
1389 1424
1390 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL, 1425 key_ref = lookup_user_key(id, KEY_LOOKUP_CREATE | KEY_LOOKUP_PARTIAL,
1391 KEY_NEED_SETATTR); 1426 KEY_NEED_SETSEC);
1392 if (IS_ERR(key_ref)) { 1427 if (IS_ERR(key_ref)) {
1393 /* setting the timeout on a key under construction is permitted 1428 /* setting the timeout on a key under construction is permitted
1394 * if we have the authorisation token handy */ 1429 * if we have the authorisation token handy */
@@ -1539,7 +1574,7 @@ long keyctl_get_security(key_serial_t keyid,
1539 * Attempt to install the calling process's session keyring on the process's 1574 * Attempt to install the calling process's session keyring on the process's
1540 * parent process. 1575 * parent process.
1541 * 1576 *
1542 * The keyring must exist and must grant the caller LINK permission, and the 1577 * The keyring must exist and must grant the caller JOIN permission, and the
1543 * parent process must be single-threaded and must have the same effective 1578 * parent process must be single-threaded and must have the same effective
1544 * ownership as this process and mustn't be SUID/SGID. 1579 * ownership as this process and mustn't be SUID/SGID.
1545 * 1580 *
@@ -1556,7 +1591,7 @@ long keyctl_session_to_parent(void)
1556 struct cred *cred; 1591 struct cred *cred;
1557 int ret; 1592 int ret;
1558 1593
1559 keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_NEED_LINK); 1594 keyring_r = lookup_user_key(KEY_SPEC_SESSION_KEYRING, 0, KEY_NEED_JOIN);
1560 if (IS_ERR(keyring_r)) 1595 if (IS_ERR(keyring_r))
1561 return PTR_ERR(keyring_r); 1596 return PTR_ERR(keyring_r);
1562 1597
@@ -1658,7 +1693,7 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
1658 char *restriction = NULL; 1693 char *restriction = NULL;
1659 long ret; 1694 long ret;
1660 1695
1661 key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR); 1696 key_ref = lookup_user_key(id, 0, KEY_NEED_SETSEC);
1662 if (IS_ERR(key_ref)) 1697 if (IS_ERR(key_ref))
1663 return PTR_ERR(key_ref); 1698 return PTR_ERR(key_ref);
1664 1699
@@ -1764,7 +1799,7 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1764 1799
1765 case KEYCTL_SETPERM: 1800 case KEYCTL_SETPERM:
1766 return keyctl_setperm_key((key_serial_t) arg2, 1801 return keyctl_setperm_key((key_serial_t) arg2,
1767 (key_perm_t) arg3); 1802 (unsigned int)arg3);
1768 1803
1769 case KEYCTL_INSTANTIATE: 1804 case KEYCTL_INSTANTIATE:
1770 return keyctl_instantiate_key((key_serial_t) arg2, 1805 return keyctl_instantiate_key((key_serial_t) arg2,
@@ -1853,6 +1888,11 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
1853 (key_serial_t)arg3, 1888 (key_serial_t)arg3,
1854 (key_serial_t)arg4, 1889 (key_serial_t)arg4,
1855 (unsigned int)arg5); 1890 (unsigned int)arg5);
1891 case KEYCTL_GRANT_PERMISSION:
1892 return keyctl_grant_permission((key_serial_t)arg2,
1893 (enum key_ace_subject_type)arg3,
1894 (unsigned int)arg4,
1895 (unsigned int)arg5);
1856 1896
1857 case KEYCTL_CAPABILITIES: 1897 case KEYCTL_CAPABILITIES:
1858 return keyctl_capabilities((unsigned char __user *)arg2, (size_t)arg3); 1898 return keyctl_capabilities((unsigned char __user *)arg2, (size_t)arg3);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index febf36c6ddc5..3b5458f23a95 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -515,11 +515,19 @@ static long keyring_read(const struct key *keyring,
515 return ret; 515 return ret;
516} 516}
517 517
518/* 518/**
519 * Allocate a keyring and link into the destination keyring. 519 * keyring_alloc - Allocate a keyring and link into the destination
520 * @description: The key description to allow the key to be searched out.
521 * @uid: The owner of the new key.
522 * @gid: The group ID for the new key's group permissions.
523 * @cred: The credentials specifying UID namespace.
524 * @acl: The ACL to attach to the new key.
525 * @flags: Flags specifying quota properties.
526 * @restrict_link: Optional link restriction for new keyrings.
527 * @dest: Destination keyring.
520 */ 528 */
521struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid, 529struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
522 const struct cred *cred, key_perm_t perm, 530 const struct cred *cred, struct key_acl *acl,
523 unsigned long flags, 531 unsigned long flags,
524 struct key_restriction *restrict_link, 532 struct key_restriction *restrict_link,
525 struct key *dest) 533 struct key *dest)
@@ -528,7 +536,7 @@ struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
528 int ret; 536 int ret;
529 537
530 keyring = key_alloc(&key_type_keyring, description, 538 keyring = key_alloc(&key_type_keyring, description,
531 uid, gid, cred, perm, flags, restrict_link); 539 uid, gid, cred, acl, flags, restrict_link);
532 if (!IS_ERR(keyring)) { 540 if (!IS_ERR(keyring)) {
533 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL); 541 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
534 if (ret < 0) { 542 if (ret < 0) {
@@ -1132,10 +1140,11 @@ found:
1132/* 1140/*
1133 * Find a keyring with the specified name. 1141 * Find a keyring with the specified name.
1134 * 1142 *
1135 * Only keyrings that have nonzero refcount, are not revoked, and are owned by a 1143 * Only keyrings that have nonzero refcount, are not revoked, and are owned by
1136 * user in the current user namespace are considered. If @uid_keyring is %true, 1144 * a user in the current user namespace are considered. If @uid_keyring is
1137 * the keyring additionally must have been allocated as a user or user session 1145 * %true, the keyring additionally must have been allocated as a user or user
1138 * keyring; otherwise, it must grant Search permission directly to the caller. 1146 * session keyring; otherwise, it must grant JOIN permission directly to the
1147 * caller (ie. not through possession).
1139 * 1148 *
1140 * Returns a pointer to the keyring with the keyring's refcount having being 1149 * Returns a pointer to the keyring with the keyring's refcount having being
1141 * incremented on success. -ENOKEY is returned if a key could not be found. 1150 * incremented on success. -ENOKEY is returned if a key could not be found.
@@ -1169,7 +1178,7 @@ struct key *find_keyring_by_name(const char *name, bool uid_keyring)
1169 continue; 1178 continue;
1170 } else { 1179 } else {
1171 if (key_permission(make_key_ref(keyring, 0), 1180 if (key_permission(make_key_ref(keyring, 0),
1172 KEY_NEED_SEARCH) < 0) 1181 KEY_NEED_JOIN) < 0)
1173 continue; 1182 continue;
1174 } 1183 }
1175 1184
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 085f907b64ac..fd8a5dc6910a 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -7,13 +7,67 @@
7 7
8#include <linux/export.h> 8#include <linux/export.h>
9#include <linux/security.h> 9#include <linux/security.h>
10#include <linux/user_namespace.h>
11#include <linux/uaccess.h>
10#include "internal.h" 12#include "internal.h"
11 13
14struct key_acl default_key_acl = {
15 .usage = REFCOUNT_INIT(1),
16 .nr_ace = 2,
17 .possessor_viewable = true,
18 .aces = {
19 KEY_POSSESSOR_ACE(KEY_ACE__PERMS & ~KEY_ACE_JOIN),
20 KEY_OWNER_ACE(KEY_ACE_VIEW),
21 }
22};
23EXPORT_SYMBOL(default_key_acl);
24
25struct key_acl joinable_keyring_acl = {
26 .usage = REFCOUNT_INIT(1),
27 .nr_ace = 2,
28 .possessor_viewable = true,
29 .aces = {
30 KEY_POSSESSOR_ACE(KEY_ACE__PERMS & ~KEY_ACE_JOIN),
31 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_LINK | KEY_ACE_JOIN),
32 }
33};
34EXPORT_SYMBOL(joinable_keyring_acl);
35
36struct key_acl internal_key_acl = {
37 .usage = REFCOUNT_INIT(1),
38 .nr_ace = 2,
39 .aces = {
40 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH),
41 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_SEARCH),
42 }
43};
44EXPORT_SYMBOL(internal_key_acl);
45
46struct key_acl internal_keyring_acl = {
47 .usage = REFCOUNT_INIT(1),
48 .nr_ace = 2,
49 .aces = {
50 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH),
51 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_SEARCH),
52 }
53};
54EXPORT_SYMBOL(internal_keyring_acl);
55
56struct key_acl internal_writable_keyring_acl = {
57 .usage = REFCOUNT_INIT(1),
58 .nr_ace = 2,
59 .aces = {
60 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
61 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE | KEY_ACE_SEARCH),
62 }
63};
64EXPORT_SYMBOL(internal_writable_keyring_acl);
65
12/** 66/**
13 * key_task_permission - Check a key can be used 67 * key_task_permission - Check a key can be used
14 * @key_ref: The key to check. 68 * @key_ref: The key to check.
15 * @cred: The credentials to use. 69 * @cred: The credentials to use.
16 * @perm: The permissions to check for. 70 * @desired_perm: The permission to check for.
17 * 71 *
18 * Check to see whether permission is granted to use a key in the desired way, 72 * Check to see whether permission is granted to use a key in the desired way,
19 * but permit the security modules to override. 73 * but permit the security modules to override.
@@ -24,53 +78,73 @@
24 * permissions bits or the LSM check. 78 * permissions bits or the LSM check.
25 */ 79 */
26int key_task_permission(const key_ref_t key_ref, const struct cred *cred, 80int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
27 unsigned perm) 81 unsigned int desired_perm)
28{ 82{
29 struct key *key; 83 const struct key_acl *acl;
30 key_perm_t kperm; 84 const struct key *key;
31 int ret; 85 unsigned int allow = 0;
86 int i;
87
88 BUILD_BUG_ON(KEY_NEED_VIEW != KEY_ACE_VIEW ||
89 KEY_NEED_READ != KEY_ACE_READ ||
90 KEY_NEED_WRITE != KEY_ACE_WRITE ||
91 KEY_NEED_SEARCH != KEY_ACE_SEARCH ||
92 KEY_NEED_LINK != KEY_ACE_LINK ||
93 KEY_NEED_SETSEC != KEY_ACE_SET_SECURITY ||
94 KEY_NEED_INVAL != KEY_ACE_INVAL ||
95 KEY_NEED_REVOKE != KEY_ACE_REVOKE ||
96 KEY_NEED_JOIN != KEY_ACE_JOIN ||
97 KEY_NEED_CLEAR != KEY_ACE_CLEAR);
32 98
33 key = key_ref_to_ptr(key_ref); 99 key = key_ref_to_ptr(key_ref);
34 100
35 /* use the second 8-bits of permissions for keys the caller owns */ 101 rcu_read_lock();
36 if (uid_eq(key->uid, cred->fsuid)) {
37 kperm = key->perm >> 16;
38 goto use_these_perms;
39 }
40 102
41 /* use the third 8-bits of permissions for keys the caller has a group 103 acl = rcu_dereference(key->acl);
42 * membership in common with */ 104 if (!acl || acl->nr_ace == 0)
43 if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) { 105 goto no_access_rcu;
44 if (gid_eq(key->gid, cred->fsgid)) {
45 kperm = key->perm >> 8;
46 goto use_these_perms;
47 }
48 106
49 ret = groups_search(cred->group_info, key->gid); 107 for (i = 0; i < acl->nr_ace; i++) {
50 if (ret) { 108 const struct key_ace *ace = &acl->aces[i];
51 kperm = key->perm >> 8; 109
52 goto use_these_perms; 110 switch (ace->type) {
111 case KEY_ACE_SUBJ_STANDARD:
112 switch (ace->subject_id) {
113 case KEY_ACE_POSSESSOR:
114 if (is_key_possessed(key_ref))
115 allow |= ace->perm;
116 break;
117 case KEY_ACE_OWNER:
118 if (uid_eq(key->uid, cred->fsuid))
119 allow |= ace->perm;
120 break;
121 case KEY_ACE_GROUP:
122 if (gid_valid(key->gid)) {
123 if (gid_eq(key->gid, cred->fsgid))
124 allow |= ace->perm;
125 else if (groups_search(cred->group_info, key->gid))
126 allow |= ace->perm;
127 }
128 break;
129 case KEY_ACE_EVERYONE:
130 allow |= ace->perm;
131 break;
132 }
133 break;
53 } 134 }
54 } 135 }
55 136
56 /* otherwise use the least-significant 8-bits */ 137 rcu_read_unlock();
57 kperm = key->perm;
58
59use_these_perms:
60 138
61 /* use the top 8-bits of permissions for keys the caller possesses 139 if (!(allow & desired_perm))
62 * - possessor permissions are additive with other permissions 140 goto no_access;
63 */
64 if (is_key_possessed(key_ref))
65 kperm |= key->perm >> 24;
66 141
67 kperm = kperm & perm & KEY_NEED_ALL; 142 return security_key_permission(key_ref, cred, desired_perm);
68 143
69 if (kperm != perm) 144no_access_rcu:
70 return -EACCES; 145 rcu_read_unlock();
71 146no_access:
72 /* let LSM be the final arbiter */ 147 return -EACCES;
73 return security_key_permission(key_ref, cred, perm);
74} 148}
75EXPORT_SYMBOL(key_task_permission); 149EXPORT_SYMBOL(key_task_permission);
76 150
@@ -104,3 +178,218 @@ int key_validate(const struct key *key)
104 return 0; 178 return 0;
105} 179}
106EXPORT_SYMBOL(key_validate); 180EXPORT_SYMBOL(key_validate);
181
182/*
183 * Roughly render an ACL to an old-style permissions mask. We cannot
184 * accurately render what the ACL, particularly if it has ACEs that represent
185 * subjects outside of { poss, user, group, other }.
186 */
187unsigned int key_acl_to_perm(const struct key_acl *acl)
188{
189 unsigned int perm = 0, tperm;
190 int i;
191
192 BUILD_BUG_ON(KEY_OTH_VIEW != KEY_ACE_VIEW ||
193 KEY_OTH_READ != KEY_ACE_READ ||
194 KEY_OTH_WRITE != KEY_ACE_WRITE ||
195 KEY_OTH_SEARCH != KEY_ACE_SEARCH ||
196 KEY_OTH_LINK != KEY_ACE_LINK ||
197 KEY_OTH_SETATTR != KEY_ACE_SET_SECURITY);
198
199 if (!acl || acl->nr_ace == 0)
200 return 0;
201
202 for (i = 0; i < acl->nr_ace; i++) {
203 const struct key_ace *ace = &acl->aces[i];
204
205 switch (ace->type) {
206 case KEY_ACE_SUBJ_STANDARD:
207 tperm = ace->perm & KEY_OTH_ALL;
208
209 /* Invalidation and joining were allowed by SEARCH */
210 if (ace->perm & (KEY_ACE_INVAL | KEY_ACE_JOIN))
211 tperm |= KEY_OTH_SEARCH;
212
213 /* Revocation was allowed by either SETATTR or WRITE */
214 if ((ace->perm & KEY_ACE_REVOKE) && !(tperm & KEY_OTH_SETATTR))
215 tperm |= KEY_OTH_WRITE;
216
217 /* Clearing was allowed by WRITE */
218 if (ace->perm & KEY_ACE_CLEAR)
219 tperm |= KEY_OTH_WRITE;
220
221 switch (ace->subject_id) {
222 case KEY_ACE_POSSESSOR:
223 perm |= tperm << 24;
224 break;
225 case KEY_ACE_OWNER:
226 perm |= tperm << 16;
227 break;
228 case KEY_ACE_GROUP:
229 perm |= tperm << 8;
230 break;
231 case KEY_ACE_EVERYONE:
232 perm |= tperm << 0;
233 break;
234 }
235 }
236 }
237
238 return perm;
239}
240
241/*
242 * Destroy a key's ACL.
243 */
244void key_put_acl(struct key_acl *acl)
245{
246 if (acl && refcount_dec_and_test(&acl->usage))
247 kfree_rcu(acl, rcu);
248}
249
250/*
251 * Try to set the ACL. This either attaches or discards the proposed ACL.
252 */
253long key_set_acl(struct key *key, struct key_acl *acl)
254{
255 int i;
256
257 /* If we're not the sysadmin, we can only change a key that we own. */
258 if (!capable(CAP_SYS_ADMIN) && !uid_eq(key->uid, current_fsuid())) {
259 key_put_acl(acl);
260 return -EACCES;
261 }
262
263 for (i = 0; i < acl->nr_ace; i++) {
264 const struct key_ace *ace = &acl->aces[i];
265 if (ace->type == KEY_ACE_SUBJ_STANDARD &&
266 ace->subject_id == KEY_ACE_POSSESSOR) {
267 if (ace->perm & KEY_ACE_VIEW)
268 acl->possessor_viewable = true;
269 break;
270 }
271 }
272
273 rcu_swap_protected(key->acl, acl, lockdep_is_held(&key->sem));
274 key_put_acl(acl);
275 return 0;
276}
277
278/*
279 * Allocate a new ACL with an extra ACE slot.
280 */
281static struct key_acl *key_alloc_acl(const struct key_acl *old_acl, int nr, int skip)
282{
283 struct key_acl *acl;
284 int nr_ace, i, j = 0;
285
286 nr_ace = old_acl->nr_ace + nr;
287 if (nr_ace > 16)
288 return ERR_PTR(-EINVAL);
289
290 acl = kzalloc(struct_size(acl, aces, nr_ace), GFP_KERNEL);
291 if (!acl)
292 return ERR_PTR(-ENOMEM);
293
294 refcount_set(&acl->usage, 1);
295 acl->nr_ace = nr_ace;
296 for (i = 0; i < old_acl->nr_ace; i++) {
297 if (i == skip)
298 continue;
299 acl->aces[j] = old_acl->aces[i];
300 j++;
301 }
302 return acl;
303}
304
305/*
306 * Generate the revised ACL.
307 */
308static long key_change_acl(struct key *key, struct key_ace *new_ace)
309{
310 struct key_acl *acl, *old;
311 int i;
312
313 old = rcu_dereference_protected(key->acl, lockdep_is_held(&key->sem));
314
315 for (i = 0; i < old->nr_ace; i++)
316 if (old->aces[i].type == new_ace->type &&
317 old->aces[i].subject_id == new_ace->subject_id)
318 goto found_match;
319
320 if (new_ace->perm == 0)
321 return 0; /* No permissions to remove. Add deny record? */
322
323 acl = key_alloc_acl(old, 1, -1);
324 if (IS_ERR(acl))
325 return PTR_ERR(acl);
326 acl->aces[i] = *new_ace;
327 goto change;
328
329found_match:
330 if (new_ace->perm == 0)
331 goto delete_ace;
332 if (new_ace->perm == old->aces[i].perm)
333 return 0;
334 acl = key_alloc_acl(old, 0, -1);
335 if (IS_ERR(acl))
336 return PTR_ERR(acl);
337 acl->aces[i].perm = new_ace->perm;
338 goto change;
339
340delete_ace:
341 acl = key_alloc_acl(old, -1, i);
342 if (IS_ERR(acl))
343 return PTR_ERR(acl);
344 goto change;
345
346change:
347 return key_set_acl(key, acl);
348}
349
350/*
351 * Add, alter or remove (if perm == 0) an ACE in a key's ACL.
352 */
353long keyctl_grant_permission(key_serial_t keyid,
354 enum key_ace_subject_type type,
355 unsigned int subject,
356 unsigned int perm)
357{
358 struct key_ace new_ace;
359 struct key *key;
360 key_ref_t key_ref;
361 long ret;
362
363 new_ace.type = type;
364 new_ace.perm = perm;
365
366 switch (type) {
367 case KEY_ACE_SUBJ_STANDARD:
368 if (subject >= nr__key_ace_standard_subject)
369 return -ENOENT;
370 new_ace.subject_id = subject;
371 break;
372
373 default:
374 return -ENOENT;
375 }
376
377 key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_SETSEC);
378 if (IS_ERR(key_ref)) {
379 ret = PTR_ERR(key_ref);
380 goto error;
381 }
382
383 key = key_ref_to_ptr(key_ref);
384
385 down_write(&key->sem);
386
387 /* If we're not the sysadmin, we can only change a key that we own */
388 ret = -EACCES;
389 if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid()))
390 ret = key_change_acl(key, &new_ace);
391 up_write(&key->sem);
392 key_put(key);
393error:
394 return ret;
395}
diff --git a/security/keys/persistent.c b/security/keys/persistent.c
index 97af230aa4b2..8171c90d4c9a 100644
--- a/security/keys/persistent.c
+++ b/security/keys/persistent.c
@@ -12,6 +12,27 @@
12 12
13unsigned persistent_keyring_expiry = 3 * 24 * 3600; /* Expire after 3 days of non-use */ 13unsigned persistent_keyring_expiry = 3 * 24 * 3600; /* Expire after 3 days of non-use */
14 14
15static struct key_acl persistent_register_keyring_acl = {
16 .usage = REFCOUNT_INIT(1),
17 .nr_ace = 2,
18 .aces = {
19 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
20 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
21 }
22};
23
24static struct key_acl persistent_keyring_acl = {
25 .usage = REFCOUNT_INIT(1),
26 .nr_ace = 2,
27 .possessor_viewable = true,
28 .aces = {
29 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE |
30 KEY_ACE_SEARCH | KEY_ACE_LINK |
31 KEY_ACE_CLEAR | KEY_ACE_INVAL),
32 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
33 }
34};
35
15/* 36/*
16 * Create the persistent keyring register for the current user namespace. 37 * Create the persistent keyring register for the current user namespace.
17 * 38 *
@@ -22,8 +43,7 @@ static int key_create_persistent_register(struct user_namespace *ns)
22 struct key *reg = keyring_alloc(".persistent_register", 43 struct key *reg = keyring_alloc(".persistent_register",
23 KUIDT_INIT(0), KGIDT_INIT(0), 44 KUIDT_INIT(0), KGIDT_INIT(0),
24 current_cred(), 45 current_cred(),
25 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 46 &persistent_register_keyring_acl,
26 KEY_USR_VIEW | KEY_USR_READ),
27 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); 47 KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
28 if (IS_ERR(reg)) 48 if (IS_ERR(reg))
29 return PTR_ERR(reg); 49 return PTR_ERR(reg);
@@ -56,8 +76,7 @@ static key_ref_t key_create_persistent(struct user_namespace *ns, kuid_t uid,
56 76
57 persistent = keyring_alloc(index_key->description, 77 persistent = keyring_alloc(index_key->description,
58 uid, INVALID_GID, current_cred(), 78 uid, INVALID_GID, current_cred(),
59 ((KEY_POS_ALL & ~KEY_POS_SETATTR) | 79 &persistent_keyring_acl,
60 KEY_USR_VIEW | KEY_USR_READ),
61 KEY_ALLOC_NOT_IN_QUOTA, NULL, 80 KEY_ALLOC_NOT_IN_QUOTA, NULL,
62 ns->persistent_keyring_register); 81 ns->persistent_keyring_register);
63 if (IS_ERR(persistent)) 82 if (IS_ERR(persistent))
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 415f3f1c2da0..b394ad1e874b 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -110,11 +110,13 @@ static struct key *find_ge_key(struct seq_file *p, key_serial_t id)
110} 110}
111 111
112static void *proc_keys_start(struct seq_file *p, loff_t *_pos) 112static void *proc_keys_start(struct seq_file *p, loff_t *_pos)
113 __acquires(rcu)
113 __acquires(key_serial_lock) 114 __acquires(key_serial_lock)
114{ 115{
115 key_serial_t pos = *_pos; 116 key_serial_t pos = *_pos;
116 struct key *key; 117 struct key *key;
117 118
119 rcu_read_lock();
118 spin_lock(&key_serial_lock); 120 spin_lock(&key_serial_lock);
119 121
120 if (*_pos > INT_MAX) 122 if (*_pos > INT_MAX)
@@ -144,12 +146,15 @@ static void *proc_keys_next(struct seq_file *p, void *v, loff_t *_pos)
144 146
145static void proc_keys_stop(struct seq_file *p, void *v) 147static void proc_keys_stop(struct seq_file *p, void *v)
146 __releases(key_serial_lock) 148 __releases(key_serial_lock)
149 __releases(rcu)
147{ 150{
148 spin_unlock(&key_serial_lock); 151 spin_unlock(&key_serial_lock);
152 rcu_read_unlock();
149} 153}
150 154
151static int proc_keys_show(struct seq_file *m, void *v) 155static int proc_keys_show(struct seq_file *m, void *v)
152{ 156{
157 const struct key_acl *acl;
153 struct rb_node *_p = v; 158 struct rb_node *_p = v;
154 struct key *key = rb_entry(_p, struct key, serial_node); 159 struct key *key = rb_entry(_p, struct key, serial_node);
155 unsigned long flags; 160 unsigned long flags;
@@ -157,6 +162,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
157 time64_t now, expiry; 162 time64_t now, expiry;
158 char xbuf[16]; 163 char xbuf[16];
159 short state; 164 short state;
165 bool check_pos;
160 u64 timo; 166 u64 timo;
161 int rc; 167 int rc;
162 168
@@ -170,15 +176,15 @@ static int proc_keys_show(struct seq_file *m, void *v)
170 KEYRING_SEARCH_RECURSE), 176 KEYRING_SEARCH_RECURSE),
171 }; 177 };
172 178
173 key_ref = make_key_ref(key, 0); 179 acl = rcu_dereference(key->acl);
180 check_pos = acl->possessor_viewable;
174 181
175 /* determine if the key is possessed by this process (a test we can 182 /* determine if the key is possessed by this process (a test we can
176 * skip if the key does not indicate the possessor can view it 183 * skip if the key does not indicate the possessor can view it
177 */ 184 */
178 if (key->perm & KEY_POS_VIEW) { 185 key_ref = make_key_ref(key, 0);
179 rcu_read_lock(); 186 if (check_pos) {
180 skey_ref = search_cred_keyrings_rcu(&ctx); 187 skey_ref = search_cred_keyrings_rcu(&ctx);
181 rcu_read_unlock();
182 if (!IS_ERR(skey_ref)) { 188 if (!IS_ERR(skey_ref)) {
183 key_ref_put(skey_ref); 189 key_ref_put(skey_ref);
184 key_ref = make_key_ref(key, 1); 190 key_ref = make_key_ref(key, 1);
@@ -188,12 +194,10 @@ static int proc_keys_show(struct seq_file *m, void *v)
188 /* check whether the current task is allowed to view the key */ 194 /* check whether the current task is allowed to view the key */
189 rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW); 195 rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
190 if (rc < 0) 196 if (rc < 0)
191 return 0; 197 goto out;
192 198
193 now = ktime_get_real_seconds(); 199 now = ktime_get_real_seconds();
194 200
195 rcu_read_lock();
196
197 /* come up with a suitable timeout value */ 201 /* come up with a suitable timeout value */
198 expiry = READ_ONCE(key->expiry); 202 expiry = READ_ONCE(key->expiry);
199 if (expiry == 0) { 203 if (expiry == 0) {
@@ -232,7 +236,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
232 showflag(flags, 'i', KEY_FLAG_INVALIDATED), 236 showflag(flags, 'i', KEY_FLAG_INVALIDATED),
233 refcount_read(&key->usage), 237 refcount_read(&key->usage),
234 xbuf, 238 xbuf,
235 key->perm, 239 key_acl_to_perm(acl),
236 from_kuid_munged(seq_user_ns(m), key->uid), 240 from_kuid_munged(seq_user_ns(m), key->uid),
237 from_kgid_munged(seq_user_ns(m), key->gid), 241 from_kgid_munged(seq_user_ns(m), key->gid),
238 key->type->name); 242 key->type->name);
@@ -243,7 +247,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
243 key->type->describe(key, m); 247 key->type->describe(key, m);
244 seq_putc(m, '\n'); 248 seq_putc(m, '\n');
245 249
246 rcu_read_unlock(); 250out:
247 return 0; 251 return 0;
248} 252}
249 253
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 09541de31f2f..aa3bfcadbc66 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -32,6 +32,47 @@ struct key_user root_key_user = {
32 .uid = GLOBAL_ROOT_UID, 32 .uid = GLOBAL_ROOT_UID,
33}; 33};
34 34
35static struct key_acl user_reg_keyring_acl = {
36 .usage = REFCOUNT_INIT(1),
37 .possessor_viewable = true,
38 .nr_ace = 2,
39 .aces = {
40 KEY_POSSESSOR_ACE(KEY_ACE_WRITE | KEY_ACE_SEARCH),
41 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
42 }
43};
44
45static struct key_acl user_keyring_acl = {
46 .usage = REFCOUNT_INIT(1),
47 .possessor_viewable = true,
48 .nr_ace = 2,
49 .aces = {
50 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE |
51 KEY_ACE_SEARCH | KEY_ACE_LINK),
52 KEY_OWNER_ACE(KEY_ACE__PERMS & ~(KEY_ACE_JOIN | KEY_ACE_SET_SECURITY)),
53 }
54};
55
56static struct key_acl session_keyring_acl = {
57 .usage = REFCOUNT_INIT(1),
58 .possessor_viewable = true,
59 .nr_ace = 2,
60 .aces = {
61 KEY_POSSESSOR_ACE(KEY_ACE__PERMS & ~KEY_ACE_JOIN),
62 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
63 }
64};
65
66static struct key_acl thread_and_process_keyring_acl = {
67 .usage = REFCOUNT_INIT(1),
68 .possessor_viewable = true,
69 .nr_ace = 2,
70 .aces = {
71 KEY_POSSESSOR_ACE(KEY_ACE__PERMS & ~(KEY_ACE_JOIN | KEY_ACE_SET_SECURITY)),
72 KEY_OWNER_ACE(KEY_ACE_VIEW),
73 }
74};
75
35/* 76/*
36 * Get or create a user register keyring. 77 * Get or create a user register keyring.
37 */ 78 */
@@ -51,11 +92,8 @@ static struct key *get_user_register(struct user_namespace *user_ns)
51 if (!reg_keyring) { 92 if (!reg_keyring) {
52 reg_keyring = keyring_alloc(".user_reg", 93 reg_keyring = keyring_alloc(".user_reg",
53 user_ns->owner, INVALID_GID, 94 user_ns->owner, INVALID_GID,
54 &init_cred, 95 &init_cred, &user_reg_keyring_acl,
55 KEY_POS_WRITE | KEY_POS_SEARCH | 96 0, NULL, NULL);
56 KEY_USR_VIEW | KEY_USR_READ,
57 0,
58 NULL, NULL);
59 if (!IS_ERR(reg_keyring)) 97 if (!IS_ERR(reg_keyring))
60 smp_store_release(&user_ns->user_keyring_register, 98 smp_store_release(&user_ns->user_keyring_register,
61 reg_keyring); 99 reg_keyring);
@@ -77,14 +115,11 @@ int look_up_user_keyrings(struct key **_user_keyring,
77 const struct cred *cred = current_cred(); 115 const struct cred *cred = current_cred();
78 struct user_namespace *user_ns = current_user_ns(); 116 struct user_namespace *user_ns = current_user_ns();
79 struct key *reg_keyring, *uid_keyring, *session_keyring; 117 struct key *reg_keyring, *uid_keyring, *session_keyring;
80 key_perm_t user_keyring_perm;
81 key_ref_t uid_keyring_r, session_keyring_r; 118 key_ref_t uid_keyring_r, session_keyring_r;
82 uid_t uid = from_kuid(user_ns, cred->user->uid); 119 uid_t uid = from_kuid(user_ns, cred->user->uid);
83 char buf[20]; 120 char buf[20];
84 int ret; 121 int ret;
85 122
86 user_keyring_perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL;
87
88 kenter("%u", uid); 123 kenter("%u", uid);
89 124
90 reg_keyring = get_user_register(user_ns); 125 reg_keyring = get_user_register(user_ns);
@@ -104,7 +139,7 @@ int look_up_user_keyrings(struct key **_user_keyring,
104 kdebug("_uid %p", uid_keyring_r); 139 kdebug("_uid %p", uid_keyring_r);
105 if (uid_keyring_r == ERR_PTR(-EAGAIN)) { 140 if (uid_keyring_r == ERR_PTR(-EAGAIN)) {
106 uid_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID, 141 uid_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID,
107 cred, user_keyring_perm, 142 cred, &user_keyring_acl,
108 KEY_ALLOC_UID_KEYRING | 143 KEY_ALLOC_UID_KEYRING |
109 KEY_ALLOC_IN_QUOTA, 144 KEY_ALLOC_IN_QUOTA,
110 NULL, reg_keyring); 145 NULL, reg_keyring);
@@ -126,7 +161,7 @@ int look_up_user_keyrings(struct key **_user_keyring,
126 kdebug("_uid_ses %p", session_keyring_r); 161 kdebug("_uid_ses %p", session_keyring_r);
127 if (session_keyring_r == ERR_PTR(-EAGAIN)) { 162 if (session_keyring_r == ERR_PTR(-EAGAIN)) {
128 session_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID, 163 session_keyring = keyring_alloc(buf, cred->user->uid, INVALID_GID,
129 cred, user_keyring_perm, 164 cred, &user_keyring_acl,
130 KEY_ALLOC_UID_KEYRING | 165 KEY_ALLOC_UID_KEYRING |
131 KEY_ALLOC_IN_QUOTA, 166 KEY_ALLOC_IN_QUOTA,
132 NULL, NULL); 167 NULL, NULL);
@@ -226,7 +261,7 @@ int install_thread_keyring_to_cred(struct cred *new)
226 return 0; 261 return 0;
227 262
228 keyring = keyring_alloc("_tid", new->uid, new->gid, new, 263 keyring = keyring_alloc("_tid", new->uid, new->gid, new,
229 KEY_POS_ALL | KEY_USR_VIEW, 264 &thread_and_process_keyring_acl,
230 KEY_ALLOC_QUOTA_OVERRUN, 265 KEY_ALLOC_QUOTA_OVERRUN,
231 NULL, NULL); 266 NULL, NULL);
232 if (IS_ERR(keyring)) 267 if (IS_ERR(keyring))
@@ -273,7 +308,7 @@ int install_process_keyring_to_cred(struct cred *new)
273 return 0; 308 return 0;
274 309
275 keyring = keyring_alloc("_pid", new->uid, new->gid, new, 310 keyring = keyring_alloc("_pid", new->uid, new->gid, new,
276 KEY_POS_ALL | KEY_USR_VIEW, 311 &thread_and_process_keyring_acl,
277 KEY_ALLOC_QUOTA_OVERRUN, 312 KEY_ALLOC_QUOTA_OVERRUN,
278 NULL, NULL); 313 NULL, NULL);
279 if (IS_ERR(keyring)) 314 if (IS_ERR(keyring))
@@ -328,8 +363,7 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
328 flags = KEY_ALLOC_IN_QUOTA; 363 flags = KEY_ALLOC_IN_QUOTA;
329 364
330 keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred, 365 keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred,
331 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ, 366 &session_keyring_acl, flags, NULL, NULL);
332 flags, NULL, NULL);
333 if (IS_ERR(keyring)) 367 if (IS_ERR(keyring))
334 return PTR_ERR(keyring); 368 return PTR_ERR(keyring);
335 } else { 369 } else {
@@ -609,7 +643,7 @@ bool lookup_user_key_possessed(const struct key *key,
609 * returned key reference. 643 * returned key reference.
610 */ 644 */
611key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, 645key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
612 key_perm_t perm) 646 unsigned int desired_perm)
613{ 647{
614 struct keyring_search_context ctx = { 648 struct keyring_search_context ctx = {
615 .match_data.cmp = lookup_user_key_possessed, 649 .match_data.cmp = lookup_user_key_possessed,
@@ -784,12 +818,12 @@ try_again:
784 case -ERESTARTSYS: 818 case -ERESTARTSYS:
785 goto invalid_key; 819 goto invalid_key;
786 default: 820 default:
787 if (perm) 821 if (desired_perm)
788 goto invalid_key; 822 goto invalid_key;
789 case 0: 823 case 0:
790 break; 824 break;
791 } 825 }
792 } else if (perm) { 826 } else if (desired_perm) {
793 ret = key_validate(key); 827 ret = key_validate(key);
794 if (ret < 0) 828 if (ret < 0)
795 goto invalid_key; 829 goto invalid_key;
@@ -801,9 +835,11 @@ try_again:
801 goto invalid_key; 835 goto invalid_key;
802 836
803 /* check the permissions */ 837 /* check the permissions */
804 ret = key_task_permission(key_ref, ctx.cred, perm); 838 if (desired_perm) {
805 if (ret < 0) 839 ret = key_task_permission(key_ref, ctx.cred, desired_perm);
806 goto invalid_key; 840 if (ret < 0)
841 goto invalid_key;
842 }
807 843
808 key->last_used_at = ktime_get_real_seconds(); 844 key->last_used_at = ktime_get_real_seconds();
809 845
@@ -868,13 +904,13 @@ long join_session_keyring(const char *name)
868 if (PTR_ERR(keyring) == -ENOKEY) { 904 if (PTR_ERR(keyring) == -ENOKEY) {
869 /* not found - try and create a new one */ 905 /* not found - try and create a new one */
870 keyring = keyring_alloc( 906 keyring = keyring_alloc(
871 name, old->uid, old->gid, old, 907 name, old->uid, old->gid, old, &joinable_keyring_acl,
872 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK,
873 KEY_ALLOC_IN_QUOTA, NULL, NULL); 908 KEY_ALLOC_IN_QUOTA, NULL, NULL);
874 if (IS_ERR(keyring)) { 909 if (IS_ERR(keyring)) {
875 ret = PTR_ERR(keyring); 910 ret = PTR_ERR(keyring);
876 goto error2; 911 goto error2;
877 } 912 }
913 goto no_perm_test;
878 } else if (IS_ERR(keyring)) { 914 } else if (IS_ERR(keyring)) {
879 ret = PTR_ERR(keyring); 915 ret = PTR_ERR(keyring);
880 goto error2; 916 goto error2;
@@ -883,6 +919,12 @@ long join_session_keyring(const char *name)
883 goto error3; 919 goto error3;
884 } 920 }
885 921
922 ret = key_task_permission(make_key_ref(keyring, false), old,
923 KEY_NEED_JOIN);
924 if (ret < 0)
925 goto error3;
926
927no_perm_test:
886 /* we've got a keyring - now to install it */ 928 /* we've got a keyring - now to install it */
887 ret = install_session_keyring_to_cred(new, keyring); 929 ret = install_session_keyring_to_cred(new, keyring);
888 if (ret < 0) 930 if (ret < 0)
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 7325f382dbf4..46c5187ce03f 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -135,8 +135,7 @@ static int call_sbin_request_key(struct key *authkey, void *aux)
135 135
136 cred = get_current_cred(); 136 cred = get_current_cred();
137 keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred, 137 keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
138 KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ, 138 NULL, KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL);
139 KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL);
140 put_cred(cred); 139 put_cred(cred);
141 if (IS_ERR(keyring)) { 140 if (IS_ERR(keyring)) {
142 ret = PTR_ERR(keyring); 141 ret = PTR_ERR(keyring);
@@ -367,11 +366,11 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
367 struct key *dest_keyring, 366 struct key *dest_keyring,
368 unsigned long flags, 367 unsigned long flags,
369 struct key_user *user, 368 struct key_user *user,
369 struct key_acl *acl,
370 struct key **_key) 370 struct key **_key)
371{ 371{
372 struct assoc_array_edit *edit = NULL; 372 struct assoc_array_edit *edit = NULL;
373 struct key *key; 373 struct key *key;
374 key_perm_t perm;
375 key_ref_t key_ref; 374 key_ref_t key_ref;
376 int ret; 375 int ret;
377 376
@@ -381,17 +380,9 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
381 *_key = NULL; 380 *_key = NULL;
382 mutex_lock(&user->cons_lock); 381 mutex_lock(&user->cons_lock);
383 382
384 perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
385 perm |= KEY_USR_VIEW;
386 if (ctx->index_key.type->read)
387 perm |= KEY_POS_READ;
388 if (ctx->index_key.type == &key_type_keyring ||
389 ctx->index_key.type->update)
390 perm |= KEY_POS_WRITE;
391
392 key = key_alloc(ctx->index_key.type, ctx->index_key.description, 383 key = key_alloc(ctx->index_key.type, ctx->index_key.description,
393 ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred, 384 ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,
394 perm, flags, NULL); 385 acl, flags, NULL);
395 if (IS_ERR(key)) 386 if (IS_ERR(key))
396 goto alloc_failed; 387 goto alloc_failed;
397 388
@@ -474,6 +465,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
474 const char *callout_info, 465 const char *callout_info,
475 size_t callout_len, 466 size_t callout_len,
476 void *aux, 467 void *aux,
468 struct key_acl *acl,
477 struct key *dest_keyring, 469 struct key *dest_keyring,
478 unsigned long flags) 470 unsigned long flags)
479{ 471{
@@ -496,7 +488,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
496 goto error_put_dest_keyring; 488 goto error_put_dest_keyring;
497 } 489 }
498 490
499 ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); 491 ret = construct_alloc_key(ctx, dest_keyring, flags, user, acl, &key);
500 key_user_put(user); 492 key_user_put(user);
501 493
502 if (ret == 0) { 494 if (ret == 0) {
@@ -534,6 +526,7 @@ error:
534 * @callout_info: The data to pass to the instantiation upcall (or NULL). 526 * @callout_info: The data to pass to the instantiation upcall (or NULL).
535 * @callout_len: The length of callout_info. 527 * @callout_len: The length of callout_info.
536 * @aux: Auxiliary data for the upcall. 528 * @aux: Auxiliary data for the upcall.
529 * @acl: The ACL to attach if a new key is created.
537 * @dest_keyring: Where to cache the key. 530 * @dest_keyring: Where to cache the key.
538 * @flags: Flags to key_alloc(). 531 * @flags: Flags to key_alloc().
539 * 532 *
@@ -561,6 +554,7 @@ struct key *request_key_and_link(struct key_type *type,
561 const void *callout_info, 554 const void *callout_info,
562 size_t callout_len, 555 size_t callout_len,
563 void *aux, 556 void *aux,
557 struct key_acl *acl,
564 struct key *dest_keyring, 558 struct key *dest_keyring,
565 unsigned long flags) 559 unsigned long flags)
566{ 560{
@@ -635,7 +629,7 @@ struct key *request_key_and_link(struct key_type *type,
635 goto error_free; 629 goto error_free;
636 630
637 key = construct_key_and_link(&ctx, callout_info, callout_len, 631 key = construct_key_and_link(&ctx, callout_info, callout_len,
638 aux, dest_keyring, flags); 632 aux, acl, dest_keyring, flags);
639 } 633 }
640 634
641error_free: 635error_free:
@@ -678,6 +672,7 @@ EXPORT_SYMBOL(wait_for_key_construction);
678 * @description: The searchable description of the key. 672 * @description: The searchable description of the key.
679 * @domain_tag: The domain in which the key operates. 673 * @domain_tag: The domain in which the key operates.
680 * @callout_info: The data to pass to the instantiation upcall (or NULL). 674 * @callout_info: The data to pass to the instantiation upcall (or NULL).
675 * @acl: The ACL to attach if a new key is created.
681 * 676 *
682 * As for request_key_and_link() except that it does not add the returned key 677 * As for request_key_and_link() except that it does not add the returned key
683 * to a keyring if found, new keys are always allocated in the user's quota, 678 * to a keyring if found, new keys are always allocated in the user's quota,
@@ -690,7 +685,8 @@ EXPORT_SYMBOL(wait_for_key_construction);
690struct key *request_key_tag(struct key_type *type, 685struct key *request_key_tag(struct key_type *type,
691 const char *description, 686 const char *description,
692 struct key_tag *domain_tag, 687 struct key_tag *domain_tag,
693 const char *callout_info) 688 const char *callout_info,
689 struct key_acl *acl)
694{ 690{
695 struct key *key; 691 struct key *key;
696 size_t callout_len = 0; 692 size_t callout_len = 0;
@@ -700,7 +696,7 @@ struct key *request_key_tag(struct key_type *type,
700 callout_len = strlen(callout_info); 696 callout_len = strlen(callout_info);
701 key = request_key_and_link(type, description, domain_tag, 697 key = request_key_and_link(type, description, domain_tag,
702 callout_info, callout_len, 698 callout_info, callout_len,
703 NULL, NULL, KEY_ALLOC_IN_QUOTA); 699 NULL, acl, NULL, KEY_ALLOC_IN_QUOTA);
704 if (!IS_ERR(key)) { 700 if (!IS_ERR(key)) {
705 ret = wait_for_key_construction(key, false); 701 ret = wait_for_key_construction(key, false);
706 if (ret < 0) { 702 if (ret < 0) {
@@ -720,6 +716,7 @@ EXPORT_SYMBOL(request_key_tag);
720 * @callout_info: The data to pass to the instantiation upcall (or NULL). 716 * @callout_info: The data to pass to the instantiation upcall (or NULL).
721 * @callout_len: The length of callout_info. 717 * @callout_len: The length of callout_info.
722 * @aux: Auxiliary data for the upcall. 718 * @aux: Auxiliary data for the upcall.
719 * @acl: The ACL to attach if a new key is created.
723 * 720 *
724 * As for request_key_and_link() except that it does not add the returned key 721 * As for request_key_and_link() except that it does not add the returned key
725 * to a keyring if found and new keys are always allocated in the user's quota. 722 * to a keyring if found and new keys are always allocated in the user's quota.
@@ -732,14 +729,15 @@ struct key *request_key_with_auxdata(struct key_type *type,
732 struct key_tag *domain_tag, 729 struct key_tag *domain_tag,
733 const void *callout_info, 730 const void *callout_info,
734 size_t callout_len, 731 size_t callout_len,
735 void *aux) 732 void *aux,
733 struct key_acl *acl)
736{ 734{
737 struct key *key; 735 struct key *key;
738 int ret; 736 int ret;
739 737
740 key = request_key_and_link(type, description, domain_tag, 738 key = request_key_and_link(type, description, domain_tag,
741 callout_info, callout_len, 739 callout_info, callout_len,
742 aux, NULL, KEY_ALLOC_IN_QUOTA); 740 aux, acl, NULL, KEY_ALLOC_IN_QUOTA);
743 if (!IS_ERR(key)) { 741 if (!IS_ERR(key)) {
744 ret = wait_for_key_construction(key, false); 742 ret = wait_for_key_construction(key, false);
745 if (ret < 0) { 743 if (ret < 0) {
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index e73ec040e250..27e437d94b81 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -24,6 +24,17 @@ static void request_key_auth_revoke(struct key *);
24static void request_key_auth_destroy(struct key *); 24static void request_key_auth_destroy(struct key *);
25static long request_key_auth_read(const struct key *, char __user *, size_t); 25static long request_key_auth_read(const struct key *, char __user *, size_t);
26 26
27static struct key_acl request_key_auth_acl = {
28 .usage = REFCOUNT_INIT(1),
29 .nr_ace = 2,
30 .possessor_viewable = true,
31 .aces = {
32 KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_SEARCH |
33 KEY_ACE_LINK),
34 KEY_OWNER_ACE(KEY_ACE_VIEW),
35 }
36};
37
27/* 38/*
28 * The request-key authorisation key type definition. 39 * The request-key authorisation key type definition.
29 */ 40 */
@@ -210,8 +221,8 @@ struct key *request_key_auth_new(struct key *target, const char *op,
210 221
211 authkey = key_alloc(&key_type_request_key_auth, desc, 222 authkey = key_alloc(&key_type_request_key_auth, desc,
212 cred->fsuid, cred->fsgid, cred, 223 cred->fsuid, cred->fsgid, cred,
213 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_LINK | 224 &request_key_auth_acl,
214 KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL); 225 KEY_ALLOC_NOT_IN_QUOTA, NULL);
215 if (IS_ERR(authkey)) { 226 if (IS_ERR(authkey)) {
216 ret = PTR_ERR(authkey); 227 ret = PTR_ERR(authkey);
217 goto error_free_rka; 228 goto error_free_rka;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3ec7ac70c313..4ed83d869084 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6502,6 +6502,7 @@ static int selinux_key_permission(key_ref_t key_ref,
6502{ 6502{
6503 struct key *key; 6503 struct key *key;
6504 struct key_security_struct *ksec; 6504 struct key_security_struct *ksec;
6505 unsigned oldstyle_perm;
6505 u32 sid; 6506 u32 sid;
6506 6507
6507 /* if no specific permissions are requested, we skip the 6508 /* if no specific permissions are requested, we skip the
@@ -6510,13 +6511,26 @@ static int selinux_key_permission(key_ref_t key_ref,
6510 if (perm == 0) 6511 if (perm == 0)
6511 return 0; 6512 return 0;
6512 6513
6514 oldstyle_perm = perm & (KEY_NEED_VIEW | KEY_NEED_READ | KEY_NEED_WRITE |
6515 KEY_NEED_SEARCH | KEY_NEED_LINK);
6516 if (perm & KEY_NEED_SETSEC)
6517 oldstyle_perm |= OLD_KEY_NEED_SETATTR;
6518 if (perm & KEY_NEED_INVAL)
6519 oldstyle_perm |= KEY_NEED_SEARCH;
6520 if (perm & KEY_NEED_REVOKE && !(perm & OLD_KEY_NEED_SETATTR))
6521 oldstyle_perm |= KEY_NEED_WRITE;
6522 if (perm & KEY_NEED_JOIN)
6523 oldstyle_perm |= KEY_NEED_SEARCH;
6524 if (perm & KEY_NEED_CLEAR)
6525 oldstyle_perm |= KEY_NEED_WRITE;
6526
6513 sid = cred_sid(cred); 6527 sid = cred_sid(cred);
6514 6528
6515 key = key_ref_to_ptr(key_ref); 6529 key = key_ref_to_ptr(key_ref);
6516 ksec = key->security; 6530 ksec = key->security;
6517 6531
6518 return avc_has_perm(&selinux_state, 6532 return avc_has_perm(&selinux_state,
6519 sid, ksec->sid, SECCLASS_KEY, perm, NULL); 6533 sid, ksec->sid, SECCLASS_KEY, oldstyle_perm, NULL);
6520} 6534}
6521 6535
6522static int selinux_key_getsecurity(struct key *key, char **_buffer) 6536static int selinux_key_getsecurity(struct key *key, char **_buffer)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 4c5e5a438f8b..50c536cad85b 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4284,7 +4284,8 @@ static int smack_key_permission(key_ref_t key_ref,
4284#endif 4284#endif
4285 if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW)) 4285 if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
4286 request |= MAY_READ; 4286 request |= MAY_READ;
4287 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) 4287 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETSEC |
4288 KEY_NEED_INVAL | KEY_NEED_REVOKE | KEY_NEED_CLEAR))
4288 request |= MAY_WRITE; 4289 request |= MAY_WRITE;
4289 rc = smk_access(tkp, keyp->security, request, &ad); 4290 rc = smk_access(tkp, keyp->security, request, &ad);
4290 rc = smk_bu_note("key access", tkp, keyp->security, request, rc); 4291 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-16 14:17:07 -0400