KEYS: Reduce initial permissions on keys

Reduce the initial permissions on new keys to grant the possessor everything,
view permission only to the user (so the keys can be seen in /proc/keys) and
nothing else.

This gives the creator a chance to adjust the permissions mask before other
processes can access the new key or create a link to it.

To aid with this, keyring_alloc() now takes a permission argument rather than
setting the permissions itself.

The following permissions are now set:

 (1) The user and user-session keyrings grant the user that owns them full
     permissions and grant a possessor everything bar SETATTR.

 (2) The process and thread keyrings grant the possessor full permissions but
     only grant the user VIEW.  This permits the user to see them in
     /proc/keys, but not to do anything with them.

 (3) Anonymous session keyrings grant the possessor full permissions, but only
     grant the user VIEW and READ.  This means that the user can see them in
     /proc/keys and can list them, but nothing else.  Possibly READ shouldn't
     be provided either.

 (4) Named session keyrings grant everything an anonymous session keyring does,
     plus they grant the user LINK permission.  The whole point of named
     session keyrings is that others can also subscribe to them.  Possibly this
     should be a separate permission to LINK.

 (5) The temporary session keyring created by call_sbin_request_key() gets the
     same permissions as an anonymous session keyring.

 (6) Keys created by add_key() get VIEW, SEARCH, LINK and SETATTR for the
     possessor, plus READ and/or WRITE if the key type supports them.  The used
     only gets VIEW now.

 (7) Keys created by request_key() now get the same as those created by
     add_key().

Reported-by: Lennart Poettering <lennart@poettering.net>
Reported-by: Stef Walter <stefw@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 275c4f9e4b8c..0ae3a2202771 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -126,6 +126,7 @@ static int call_sbin_request_key(struct key_construction *cons,
 
         cred = get_current_cred();
         keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
+                                KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
         put_cred(cred);
         if (IS_ERR(keyring)) {
@@ -347,6 +348,7 @@ static int construct_alloc_key(struct key_type *type,
         const struct cred *cred = current_cred();
         unsigned long prealloc;
         struct key *key;
+        key_perm_t perm;
         key_ref_t key_ref;
         int ret;
 
@@ -355,8 +357,15 @@ static int construct_alloc_key(struct key_type *type,
         *_key = NULL;
         mutex_lock(&user->cons_lock);
 
+        perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
+        perm |= KEY_USR_VIEW;
+        if (type->read)
+                perm |= KEY_POS_READ;
+        if (type == &key_type_keyring || type->update)
+                perm |= KEY_POS_WRITE;
+
         key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
-                        KEY_POS_ALL, flags);
+                        perm, flags);
         if (IS_ERR(key))
                 goto alloc_failed;