aboutsummaryrefslogtreecommitdiffstats
path: root/security/keys
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2005-10-07 10:07:38 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-10-08 17:53:31 -0400
commit468ed2b0c85ec4310b429e60358213b6d077289e (patch)
treed1f570c1b89df450753cbec8768b1c1cfac6d9a2 /security/keys
parentf1a9badcf6ecad9975240d94514721cb93932151 (diff)
[PATCH] Keys: Split key permissions checking into a .c file
The attached patch splits key permissions checking out of key-ui.h and moves it into a .c file. It's quite large and called quite a lot, and it's about to get bigger with the addition of LSM support for keys... key_any_permission() is also discarded as it's no longer used. Signed-Off-By: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security/keys')
-rw-r--r--security/keys/Makefile1
-rw-r--r--security/keys/permission.c70
2 files changed, 71 insertions, 0 deletions
diff --git a/security/keys/Makefile b/security/keys/Makefile
index c392d750b208..5145adfb6a05 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -6,6 +6,7 @@ obj-y := \
6 key.o \ 6 key.o \
7 keyring.o \ 7 keyring.o \
8 keyctl.o \ 8 keyctl.o \
9 permission.o \
9 process_keys.o \ 10 process_keys.o \
10 request_key.o \ 11 request_key.o \
11 request_key_auth.o \ 12 request_key_auth.o \
diff --git a/security/keys/permission.c b/security/keys/permission.c
new file mode 100644
index 000000000000..1c3651670ce9
--- /dev/null
+++ b/security/keys/permission.c
@@ -0,0 +1,70 @@
1/* permission.c: key permission determination
2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include "internal.h"
14
15/*****************************************************************************/
16/*
17 * check to see whether permission is granted to use a key in the desired way,
18 * but permit the security modules to override
19 */
20int key_task_permission(const key_ref_t key_ref,
21 struct task_struct *context,
22 key_perm_t perm)
23{
24 struct key *key;
25 key_perm_t kperm;
26 int ret;
27
28 key = key_ref_to_ptr(key_ref);
29
30 /* use the top 8-bits of permissions for keys the caller possesses */
31 if (is_key_possessed(key_ref)) {
32 kperm = key->perm >> 24;
33 goto use_these_perms;
34 }
35
36 /* use the second 8-bits of permissions for keys the caller owns */
37 if (key->uid == context->fsuid) {
38 kperm = key->perm >> 16;
39 goto use_these_perms;
40 }
41
42 /* use the third 8-bits of permissions for keys the caller has a group
43 * membership in common with */
44 if (key->gid != -1 && key->perm & KEY_GRP_ALL) {
45 if (key->gid == context->fsgid) {
46 kperm = key->perm >> 8;
47 goto use_these_perms;
48 }
49
50 task_lock(context);
51 ret = groups_search(context->group_info, key->gid);
52 task_unlock(context);
53
54 if (ret) {
55 kperm = key->perm >> 8;
56 goto use_these_perms;
57 }
58 }
59
60 /* otherwise use the least-significant 8-bits */
61 kperm = key->perm;
62
63use_these_perms:
64 kperm = kperm & perm & KEY_ALL;
65
66 return kperm == perm;
67
68} /* end key_task_permission() */
69
70EXPORT_SYMBOL(key_task_permission);