[PATCH] keys: sort out key quota system

Add the ability for key creation to overrun the user's quota in some
circumstances - notably when a session keyring is created and assigned to a
process that didn't previously have one.

This means it's still possible to log in, should PAM require the creation of a
new session keyring, and fix an overburdened key quota.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 6 insertions, 3 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 79c16e31c884..13384fef0d60 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4264,7 +4264,8 @@ static int selinux_setprocattr(struct task_struct *p,
 
 #ifdef CONFIG_KEYS
 
-static int selinux_key_alloc(struct key *k, struct task_struct *tsk)
+static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
+                             unsigned long flags)
 {
         struct task_security_struct *tsec = tsk->security;
         struct key_security_struct *ksec;
@@ -4513,8 +4514,10 @@ static __init int selinux_init(void)
 
 #ifdef CONFIG_KEYS
         /* Add security information to initial keyrings */
-        security_key_alloc(&root_user_keyring, current);
-        security_key_alloc(&root_session_keyring, current);
+        security_key_alloc(&root_user_keyring, current,
+                           KEY_ALLOC_NOT_IN_QUOTA);
+        security_key_alloc(&root_session_keyring, current,
+                           KEY_ALLOC_NOT_IN_QUOTA);
 #endif
 
         return 0;