1 files changed, 10 insertions, 8 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index 654d23baf352..d98c61953be6 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -757,11 +757,11 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                const char *description,
                                const void *payload,
                                size_t plen,
+                               key_perm_t perm,
                                unsigned long flags)
 {
         struct key_type *ktype;
         struct key *keyring, *key = NULL;
-        key_perm_t perm;
         key_ref_t key_ref;
         int ret;
 
@@ -806,15 +806,17 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                         goto found_matching_key;
         }
 
-        /* decide on the permissions we want */
-        perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
-        perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
+        /* if the client doesn't provide, decide on the permissions we want */
+        if (perm == KEY_PERM_UNDEF) {
+                perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
+                perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
 
-        if (ktype->read)
-                perm |= KEY_POS_READ | KEY_USR_READ;
+                if (ktype->read)
+                        perm |= KEY_POS_READ | KEY_USR_READ;
 
-        if (ktype == &key_type_keyring || ktype->update)
-                perm |= KEY_USR_WRITE;
+                if (ktype == &key_type_keyring || ktype->update)
+                        perm |= KEY_USR_WRITE;
+        }
 
         /* allocate a new key */
         key = key_alloc(ktype, description, current->fsuid, current->fsgid,