aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2005-08-04 06:50:01 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-08-04 11:20:47 -0400
commit1260f801b4e4ba7be200886b4a53d730de05ca19 (patch)
tree319a68125252ac50df21b6e84cc1131c96e60d6f
parentc36f19e02a96488f550fdb678c92500afca3109b (diff)
[PATCH] Keys: Fix key management syscall interface bugs
This fixes five bugs in the key management syscall interface: (1) add_key() returns 0 rather than EINVAL if the key type is "". Checking the key type isn't "" should be left to lookup_user_key(). (2) request_key() returns ENOKEY rather than EPERM if the key type begins with a ".". lookup_user_key() can't do this because internal key types begin with a ".". (3) Key revocation always returns 0, even if it fails. (4) Key read can return EAGAIN rather than EACCES under some circumstances. A key is permitted to by read by a process if it doesn't grant read access, but it does grant search access and it is in the process's keyrings. That search returns EAGAIN if it fails, and this needs translating to EACCES. (5) request_key() never adds the new key to the destination keyring if one is supplied. The wrong macro was being used to test for an error condition: PTR_ERR() will always return true, whether or not there's an error; this should've been IS_ERR(). Signed-Off-By: David Howells <dhowells@redhat.com> Signed-Off-By: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--security/keys/keyctl.c11
-rw-r--r--security/keys/request_key.c2
2 files changed, 8 insertions, 5 deletions
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index fea262860ea0..a6516a64b297 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -49,9 +49,6 @@ asmlinkage long sys_add_key(const char __user *_type,
49 goto error; 49 goto error;
50 type[31] = '\0'; 50 type[31] = '\0';
51 51
52 if (!type[0])
53 goto error;
54
55 ret = -EPERM; 52 ret = -EPERM;
56 if (type[0] == '.') 53 if (type[0] == '.')
57 goto error; 54 goto error;
@@ -144,6 +141,10 @@ asmlinkage long sys_request_key(const char __user *_type,
144 goto error; 141 goto error;
145 type[31] = '\0'; 142 type[31] = '\0';
146 143
144 ret = -EPERM;
145 if (type[0] == '.')
146 goto error;
147
147 /* pull the description into kernel space */ 148 /* pull the description into kernel space */
148 ret = -EFAULT; 149 ret = -EFAULT;
149 dlen = strnlen_user(_description, PAGE_SIZE - 1); 150 dlen = strnlen_user(_description, PAGE_SIZE - 1);
@@ -362,7 +363,7 @@ long keyctl_revoke_key(key_serial_t id)
362 363
363 key_put(key); 364 key_put(key);
364 error: 365 error:
365 return 0; 366 return ret;
366 367
367} /* end keyctl_revoke_key() */ 368} /* end keyctl_revoke_key() */
368 369
@@ -685,6 +686,8 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
685 goto can_read_key2; 686 goto can_read_key2;
686 687
687 ret = PTR_ERR(skey); 688 ret = PTR_ERR(skey);
689 if (ret == -EAGAIN)
690 ret = -EACCES;
688 goto error2; 691 goto error2;
689 } 692 }
690 693
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index dfcd983af1fd..90c1506d007c 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -405,7 +405,7 @@ struct key *request_key_and_link(struct key_type *type,
405 key_user_put(user); 405 key_user_put(user);
406 406
407 /* link the new key into the appropriate keyring */ 407 /* link the new key into the appropriate keyring */
408 if (!PTR_ERR(key)) 408 if (!IS_ERR(key))
409 request_key_link(key, dest_keyring); 409 request_key_link(key, dest_keyring);
410 } 410 }
411 411