1 files changed, 4 insertions, 23 deletions

diff --git a/security/keys/persistent.c b/security/keys/persistent.c
index 8171c90d4c9a..97af230aa4b2 100644
--- a/security/keys/persistent.c
+++ b/security/keys/persistent.c
@@ -12,27 +12,6 @@
 
 unsigned persistent_keyring_expiry = 3 * 24 * 3600; /* Expire after 3 days of non-use */
 
-static struct key_acl persistent_register_keyring_acl = {
-        .usage  = REFCOUNT_INIT(1),
-        .nr_ace = 2,
-        .aces = {
-                KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE),
-                KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
-        }
-};
-
-static struct key_acl persistent_keyring_acl = {
-        .usage  = REFCOUNT_INIT(1),
-        .nr_ace = 2,
-        .possessor_viewable = true,
-        .aces = {
-                KEY_POSSESSOR_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE |
-                                  KEY_ACE_SEARCH | KEY_ACE_LINK |
-                                  KEY_ACE_CLEAR | KEY_ACE_INVAL),
-                KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ),
-        }
-};
-
 /*
  * Create the persistent keyring register for the current user namespace.
  *
@@ -43,7 +22,8 @@ static int key_create_persistent_register(struct user_namespace *ns)
         struct key *reg = keyring_alloc(".persistent_register",
                                         KUIDT_INIT(0), KGIDT_INIT(0),
                                         current_cred(),
-                                        &persistent_register_keyring_acl,
+                                        ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                         KEY_USR_VIEW | KEY_USR_READ),
                                         KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
         if (IS_ERR(reg))
                 return PTR_ERR(reg);
@@ -76,7 +56,8 @@ static key_ref_t key_create_persistent(struct user_namespace *ns, kuid_t uid,
 
         persistent = keyring_alloc(index_key->description,
                                    uid, INVALID_GID, current_cred(),
-                                   &persistent_keyring_acl,
+                                   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                    KEY_USR_VIEW | KEY_USR_READ),
                                    KEY_ALLOC_NOT_IN_QUOTA, NULL,
                                    ns->persistent_keyring_register);
         if (IS_ERR(persistent))