aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--include/linux/key-ui.h91
-rw-r--r--security/keys/Makefile1
-rw-r--r--security/keys/permission.c70
3 files changed, 76 insertions, 86 deletions
diff --git a/include/linux/key-ui.h b/include/linux/key-ui.h
index 918c34a8347e..7a2e332067c3 100644
--- a/include/linux/key-ui.h
+++ b/include/linux/key-ui.h
@@ -38,97 +38,16 @@ struct keyring_list {
38 struct key *keys[0]; 38 struct key *keys[0];
39}; 39};
40 40
41
42/* 41/*
43 * check to see whether permission is granted to use a key in the desired way 42 * check to see whether permission is granted to use a key in the desired way
44 */ 43 */
45static inline int key_permission(const key_ref_t key_ref, key_perm_t perm) 44extern int key_task_permission(const key_ref_t key_ref,
46{ 45 struct task_struct *context,
47 struct key *key = key_ref_to_ptr(key_ref); 46 key_perm_t perm);
48 key_perm_t kperm;
49
50 if (is_key_possessed(key_ref))
51 kperm = key->perm >> 24;
52 else if (key->uid == current->fsuid)
53 kperm = key->perm >> 16;
54 else if (key->gid != -1 &&
55 key->perm & KEY_GRP_ALL &&
56 in_group_p(key->gid)
57 )
58 kperm = key->perm >> 8;
59 else
60 kperm = key->perm;
61
62 kperm = kperm & perm & KEY_ALL;
63
64 return kperm == perm;
65}
66
67/*
68 * check to see whether permission is granted to use a key in at least one of
69 * the desired ways
70 */
71static inline int key_any_permission(const key_ref_t key_ref, key_perm_t perm)
72{
73 struct key *key = key_ref_to_ptr(key_ref);
74 key_perm_t kperm;
75
76 if (is_key_possessed(key_ref))
77 kperm = key->perm >> 24;
78 else if (key->uid == current->fsuid)
79 kperm = key->perm >> 16;
80 else if (key->gid != -1 &&
81 key->perm & KEY_GRP_ALL &&
82 in_group_p(key->gid)
83 )
84 kperm = key->perm >> 8;
85 else
86 kperm = key->perm;
87 47
88 kperm = kperm & perm & KEY_ALL; 48static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
89
90 return kperm != 0;
91}
92
93static inline int key_task_groups_search(struct task_struct *tsk, gid_t gid)
94{
95 int ret;
96
97 task_lock(tsk);
98 ret = groups_search(tsk->group_info, gid);
99 task_unlock(tsk);
100 return ret;
101}
102
103static inline int key_task_permission(const key_ref_t key_ref,
104 struct task_struct *context,
105 key_perm_t perm)
106{ 49{
107 struct key *key = key_ref_to_ptr(key_ref); 50 return key_task_permission(key_ref, current, perm);
108 key_perm_t kperm;
109
110 if (is_key_possessed(key_ref)) {
111 kperm = key->perm >> 24;
112 }
113 else if (key->uid == context->fsuid) {
114 kperm = key->perm >> 16;
115 }
116 else if (key->gid != -1 &&
117 key->perm & KEY_GRP_ALL && (
118 key->gid == context->fsgid ||
119 key_task_groups_search(context, key->gid)
120 )
121 ) {
122 kperm = key->perm >> 8;
123 }
124 else {
125 kperm = key->perm;
126 }
127
128 kperm = kperm & perm & KEY_ALL;
129
130 return kperm == perm;
131
132} 51}
133 52
134extern key_ref_t lookup_user_key(struct task_struct *context, 53extern key_ref_t lookup_user_key(struct task_struct *context,
diff --git a/security/keys/Makefile b/security/keys/Makefile
index c392d750b208..5145adfb6a05 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -6,6 +6,7 @@ obj-y := \
6 key.o \ 6 key.o \
7 keyring.o \ 7 keyring.o \
8 keyctl.o \ 8 keyctl.o \
9 permission.o \
9 process_keys.o \ 10 process_keys.o \
10 request_key.o \ 11 request_key.o \
11 request_key_auth.o \ 12 request_key_auth.o \
diff --git a/security/keys/permission.c b/security/keys/permission.c
new file mode 100644
index 000000000000..1c3651670ce9
--- /dev/null
+++ b/security/keys/permission.c
@@ -0,0 +1,70 @@
1/* permission.c: key permission determination
2 *
3 * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
12#include <linux/module.h>
13#include "internal.h"
14
15/*****************************************************************************/
16/*
17 * check to see whether permission is granted to use a key in the desired way,
18 * but permit the security modules to override
19 */
20int key_task_permission(const key_ref_t key_ref,
21 struct task_struct *context,
22 key_perm_t perm)
23{
24 struct key *key;
25 key_perm_t kperm;
26 int ret;
27
28 key = key_ref_to_ptr(key_ref);
29
30 /* use the top 8-bits of permissions for keys the caller possesses */
31 if (is_key_possessed(key_ref)) {
32 kperm = key->perm >> 24;
33 goto use_these_perms;
34 }
35
36 /* use the second 8-bits of permissions for keys the caller owns */
37 if (key->uid == context->fsuid) {
38 kperm = key->perm >> 16;
39 goto use_these_perms;
40 }
41
42 /* use the third 8-bits of permissions for keys the caller has a group
43 * membership in common with */
44 if (key->gid != -1 && key->perm & KEY_GRP_ALL) {
45 if (key->gid == context->fsgid) {
46 kperm = key->perm >> 8;
47 goto use_these_perms;
48 }
49
50 task_lock(context);
51 ret = groups_search(context->group_info, key->gid);
52 task_unlock(context);
53
54 if (ret) {
55 kperm = key->perm >> 8;
56 goto use_these_perms;
57 }
58 }
59
60 /* otherwise use the least-significant 8-bits */
61 kperm = key->perm;
62
63use_these_perms:
64 kperm = kperm & perm & KEY_ALL;
65
66 return kperm == perm;
67
68} /* end key_task_permission() */
69
70EXPORT_SYMBOL(key_task_permission);
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-21 04:52:15 -0500