aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/key-ui.h
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2005-09-28 12:03:15 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-09-28 12:10:47 -0400
commit664cceb0093b755739e56572b836a99104ee8a75 (patch)
treedbaa3ab802803879f29532db4d8a91a54294cf88 /include/linux/key-ui.h
parent5134fc15b643dc36eb9aa77e4318b886844a9ac5 (diff)
[PATCH] Keys: Add possessor permissions to keys [try #3]
The attached patch adds extra permission grants to keys for the possessor of a key in addition to the owner, group and other permissions bits. This makes SUID binaries easier to support without going as far as labelling keys and key targets using the LSM facilities. This patch adds a second "pointer type" to key structures (struct key_ref *) that can have the bottom bit of the address set to indicate the possession of a key. This is propagated through searches from the keyring to the discovered key. It has been made a separate type so that the compiler can spot attempts to dereference a potentially incorrect pointer. The "possession" attribute can't be attached to a key structure directly as it's not an intrinsic property of a key. Pointers to keys have been replaced with struct key_ref *'s wherever possession information needs to be passed through. This does assume that the bottom bit of the pointer will always be zero on return from kmem_cache_alloc(). The key reference type has been made into a typedef so that at least it can be located in the sources, even though it's basically a pointer to an undefined type. I've also renamed the accessor functions to be more useful, and all reference variables should now end in "_ref". Signed-Off-By: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'include/linux/key-ui.h')
-rw-r--r--include/linux/key-ui.h28
1 files changed, 19 insertions, 9 deletions
diff --git a/include/linux/key-ui.h b/include/linux/key-ui.h
index cc326174a808..918c34a8347e 100644
--- a/include/linux/key-ui.h
+++ b/include/linux/key-ui.h
@@ -42,11 +42,14 @@ struct keyring_list {
42/* 42/*
43 * check to see whether permission is granted to use a key in the desired way 43 * check to see whether permission is granted to use a key in the desired way
44 */ 44 */
45static inline int key_permission(const struct key *key, key_perm_t perm) 45static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
46{ 46{
47 struct key *key = key_ref_to_ptr(key_ref);
47 key_perm_t kperm; 48 key_perm_t kperm;
48 49
49 if (key->uid == current->fsuid) 50 if (is_key_possessed(key_ref))
51 kperm = key->perm >> 24;
52 else if (key->uid == current->fsuid)
50 kperm = key->perm >> 16; 53 kperm = key->perm >> 16;
51 else if (key->gid != -1 && 54 else if (key->gid != -1 &&
52 key->perm & KEY_GRP_ALL && 55 key->perm & KEY_GRP_ALL &&
@@ -65,11 +68,14 @@ static inline int key_permission(const struct key *key, key_perm_t perm)
65 * check to see whether permission is granted to use a key in at least one of 68 * check to see whether permission is granted to use a key in at least one of
66 * the desired ways 69 * the desired ways
67 */ 70 */
68static inline int key_any_permission(const struct key *key, key_perm_t perm) 71static inline int key_any_permission(const key_ref_t key_ref, key_perm_t perm)
69{ 72{
73 struct key *key = key_ref_to_ptr(key_ref);
70 key_perm_t kperm; 74 key_perm_t kperm;
71 75
72 if (key->uid == current->fsuid) 76 if (is_key_possessed(key_ref))
77 kperm = key->perm >> 24;
78 else if (key->uid == current->fsuid)
73 kperm = key->perm >> 16; 79 kperm = key->perm >> 16;
74 else if (key->gid != -1 && 80 else if (key->gid != -1 &&
75 key->perm & KEY_GRP_ALL && 81 key->perm & KEY_GRP_ALL &&
@@ -94,13 +100,17 @@ static inline int key_task_groups_search(struct task_struct *tsk, gid_t gid)
94 return ret; 100 return ret;
95} 101}
96 102
97static inline int key_task_permission(const struct key *key, 103static inline int key_task_permission(const key_ref_t key_ref,
98 struct task_struct *context, 104 struct task_struct *context,
99 key_perm_t perm) 105 key_perm_t perm)
100{ 106{
107 struct key *key = key_ref_to_ptr(key_ref);
101 key_perm_t kperm; 108 key_perm_t kperm;
102 109
103 if (key->uid == context->fsuid) { 110 if (is_key_possessed(key_ref)) {
111 kperm = key->perm >> 24;
112 }
113 else if (key->uid == context->fsuid) {
104 kperm = key->perm >> 16; 114 kperm = key->perm >> 16;
105 } 115 }
106 else if (key->gid != -1 && 116 else if (key->gid != -1 &&
@@ -121,9 +131,9 @@ static inline int key_task_permission(const struct key *key,
121 131
122} 132}
123 133
124extern struct key *lookup_user_key(struct task_struct *context, 134extern key_ref_t lookup_user_key(struct task_struct *context,
125 key_serial_t id, int create, int partial, 135 key_serial_t id, int create, int partial,
126 key_perm_t perm); 136 key_perm_t perm);
127 137
128extern long join_session_keyring(const char *name); 138extern long join_session_keyring(const char *name);
129 139