KEYS: Add a facility to restrict new links into a keyring

Add a facility whereby proposed new links to be added to a keyring can be
vetted, permitting them to be rejected if necessary.  This can be used to
block public keys from which the signature cannot be verified or for which
the signature verification fails.  It could also be used to provide
blacklisting.

This affects operations like add_key(), KEYCTL_LINK and KEYCTL_INSTANTIATE.

To this end:

 (1) A function pointer is added to the key struct that, if set, points to
     the vetting function.  This is called as:

	int (*restrict_link)(struct key *keyring,
			     const struct key_type *key_type,
			     unsigned long key_flags,
			     const union key_payload *key_payload),

     where 'keyring' will be the keyring being added to, key_type and
     key_payload will describe the key being added and key_flags[*] can be
     AND'ed with KEY_FLAG_TRUSTED.

     [*] This parameter will be removed in a later patch when
     	 KEY_FLAG_TRUSTED is removed.

     The function should return 0 to allow the link to take place or an
     error (typically -ENOKEY, -ENOPKG or -EKEYREJECTED) to reject the
     link.

     The pointer should not be set directly, but rather should be set
     through keyring_alloc().

     Note that if called during add_key(), preparse is called before this
     method, but a key isn't actually allocated until after this function
     is called.

 (2) KEY_ALLOC_BYPASS_RESTRICTION is added.  This can be passed to
     key_create_or_update() or key_instantiate_and_link() to bypass the
     restriction check.

 (3) KEY_FLAG_TRUSTED_ONLY is removed.  The entire contents of a keyring
     with this restriction emplaced can be considered 'trustworthy' by
     virtue of being in the keyring when that keyring is consulted.

 (4) key_alloc() and keyring_alloc() take an extra argument that will be
     used to set restrict_link in the new key.  This ensures that the
     pointer is set before the key is published, thus preventing a window
     of unrestrictedness.  Normally this argument will be NULL.

 (5) As a temporary affair, keyring_restrict_trusted_only() is added.  It
     should be passed to keyring_alloc() as the extra argument instead of
     setting KEY_FLAG_TRUSTED_ONLY on a keyring.  This will be replaced in
     a later patch with functions that look in the appropriate places for
     authoritative keys.

Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>

1 files changed, 36 insertions, 7 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index b28755131687..deb881754e03 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -201,6 +201,7 @@ serial_exists:
  * @cred: The credentials specifying UID namespace.
  * @perm: The permissions mask of the new key.
  * @flags: Flags specifying quota properties.
+ * @restrict_link: Optional link restriction method for new keyrings.
  *
  * Allocate a key of the specified type with the attributes given.  The key is
  * returned in an uninstantiated state and the caller needs to instantiate the
@@ -223,7 +224,11 @@ serial_exists:
  */
 struct key *key_alloc(struct key_type *type, const char *desc,
                       kuid_t uid, kgid_t gid, const struct cred *cred,
-                      key_perm_t perm, unsigned long flags)
+                      key_perm_t perm, unsigned long flags,
+                      int (*restrict_link)(struct key *,
+                                           const struct key_type *,
+                                           unsigned long,
+                                           const union key_payload *))
 {
         struct key_user *user = NULL;
         struct key *key;
@@ -291,6 +296,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
         key->uid = uid;
         key->gid = gid;
         key->perm = perm;
+        key->restrict_link = restrict_link;
 
         if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
@@ -496,6 +502,12 @@ int key_instantiate_and_link(struct key *key,
         }
 
         if (keyring) {
+                if (keyring->restrict_link) {
+                        ret = keyring->restrict_link(keyring, key->type,
+                                                     key->flags, &prep.payload);
+                        if (ret < 0)
+                                goto error;
+                }
                 ret = __key_link_begin(keyring, &key->index_key, &edit);
                 if (ret < 0)
                         goto error;
@@ -551,8 +563,12 @@ int key_reject_and_link(struct key *key,
         awaken = 0;
         ret = -EBUSY;
 
-        if (keyring)
+        if (keyring) {
+                if (keyring->restrict_link)
+                        return -EPERM;
+
                 link_ret = __key_link_begin(keyring, &key->index_key, &edit);
+        }
 
         mutex_lock(&key_construction_mutex);
 
@@ -793,6 +809,10 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         struct key *keyring, *key = NULL;
         key_ref_t key_ref;
         int ret;
+        int (*restrict_link)(struct key *,
+                             const struct key_type *,
+                             unsigned long,
+                             const union key_payload *) = NULL;
 
         /* look up the key type to see if it's one of the registered kernel
          * types */
@@ -811,6 +831,10 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         key_check(keyring);
 
+        key_ref = ERR_PTR(-EPERM);
+        if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))
+                restrict_link = keyring->restrict_link;
+
         key_ref = ERR_PTR(-ENOTDIR);
         if (keyring->type != &key_type_keyring)
                 goto error_put_type;
@@ -835,10 +859,15 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         }
         index_key.desc_len = strlen(index_key.description);
 
-        key_ref = ERR_PTR(-EPERM);
-        if (!prep.trusted && test_bit(KEY_FLAG_TRUSTED_ONLY, &keyring->flags))
-                goto error_free_prep;
-        flags |= prep.trusted ? KEY_ALLOC_TRUSTED : 0;
+        if (restrict_link) {
+                unsigned long kflags = prep.trusted ? KEY_FLAG_TRUSTED : 0;
+                ret = restrict_link(keyring,
+                                    index_key.type, kflags, &prep.payload);
+                if (ret < 0) {
+                        key_ref = ERR_PTR(ret);
+                        goto error_free_prep;
+                }
+        }
 
         ret = __key_link_begin(keyring, &index_key, &edit);
         if (ret < 0) {
@@ -879,7 +908,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         /* allocate a new key */
         key = key_alloc(index_key.type, index_key.description,
-                        cred->fsuid, cred->fsgid, cred, perm, flags);
+                        cred->fsuid, cred->fsgid, cred, perm, flags, NULL);
         if (IS_ERR(key)) {
                 key_ref = ERR_CAST(key);
                 goto error_link_end;