9 files changed, 317 insertions, 269 deletions

diff --git a/security/keys/internal.h b/security/keys/internal.h
index d1586c629788..81932abefe7b 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -12,6 +12,7 @@
 #ifndef _INTERNAL_H
 #define _INTERNAL_H
 
+#include <linux/sched.h>
 #include <linux/key-type.h>
 
 static inline __attribute__((format(printf, 1, 2)))
@@ -25,7 +26,7 @@ void no_printk(const char *fmt, ...)
 #define kleave(FMT, ...) \
         printk(KERN_DEBUG "<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
 #define kdebug(FMT, ...) \
-        printk(KERN_DEBUG "xxx" FMT"yyy\n", ##__VA_ARGS__)
+        printk(KERN_DEBUG "   "FMT"\n", ##__VA_ARGS__)
 #else
 #define kenter(FMT, ...) \
         no_printk(KERN_DEBUG "==> %s("FMT")\n", __func__, ##__VA_ARGS__)
@@ -97,7 +98,7 @@ extern struct key *keyring_search_instkey(struct key *keyring,
 typedef int (*key_match_func_t)(const struct key *, const void *);
 
 extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                                    struct task_struct *tsk,
+                                    const struct cred *cred,
                                     struct key_type *type,
                                     const void *description,
                                     key_match_func_t match);
@@ -105,13 +106,13 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
 extern key_ref_t search_process_keyrings(struct key_type *type,
                                          const void *description,
                                          key_match_func_t match,
-                                         struct task_struct *tsk);
+                                         const struct cred *cred);
 
 extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
 
 extern int install_user_keyrings(void);
-extern int install_thread_keyring(void);
-extern int install_process_keyring(void);
+extern int install_thread_keyring_to_cred(struct cred *);
+extern int install_process_keyring_to_cred(struct cred *);
 
 extern struct key *request_key_and_link(struct key_type *type,
                                         const char *description,
@@ -130,12 +131,12 @@ extern long join_session_keyring(const char *name);
  * check to see whether permission is granted to use a key in the desired way
  */
 extern int key_task_permission(const key_ref_t key_ref,
-                               struct task_struct *context,
+                               const struct cred *cred,
                                key_perm_t perm);
 
 static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 {
-        return key_task_permission(key_ref, current, perm);
+        return key_task_permission(key_ref, current_cred(), perm);
 }
 
 /* required permissions */
@@ -153,7 +154,7 @@ static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 struct request_key_auth {
         struct key              *target_key;
         struct key              *dest_keyring;
-        struct task_struct      *context;
+        const struct cred       *cred;
         void                    *callout_info;
         size_t                  callout_len;
         pid_t                   pid;
diff --git a/security/keys/key.c b/security/keys/key.c
index a6ca39ed3b0e..f76c8a546fd3 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -218,7 +218,7 @@ serial_exists:
  *   instantiate the key or discard it before returning
  */
 struct key *key_alloc(struct key_type *type, const char *desc,
-                      uid_t uid, gid_t gid, struct task_struct *ctx,
+                      uid_t uid, gid_t gid, const struct cred *cred,
                       key_perm_t perm, unsigned long flags)
 {
         struct key_user *user = NULL;
@@ -294,7 +294,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
 #endif
 
         /* let the security module know about the key */
-        ret = security_key_alloc(key, ctx, flags);
+        ret = security_key_alloc(key, cred, flags);
         if (ret < 0)
                 goto security_error;
 
@@ -391,7 +391,7 @@ static int __key_instantiate_and_link(struct key *key,
                                       const void *data,
                                       size_t datalen,
                                       struct key *keyring,
-                                      struct key *instkey)
+                                      struct key *authkey)
 {
         int ret, awaken;
 
@@ -421,8 +421,8 @@ static int __key_instantiate_and_link(struct key *key,
                                 ret = __key_link(keyring, key);
 
                         /* disable the authorisation key */
-                        if (instkey)
-                                key_revoke(instkey);
+                        if (authkey)
+                                key_revoke(authkey);
                 }
         }
 
@@ -444,14 +444,14 @@ int key_instantiate_and_link(struct key *key,
                              const void *data,
                              size_t datalen,
                              struct key *keyring,
-                             struct key *instkey)
+                             struct key *authkey)
 {
         int ret;
 
         if (keyring)
                 down_write(&keyring->sem);
 
-        ret = __key_instantiate_and_link(key, data, datalen, keyring, instkey);
+        ret = __key_instantiate_and_link(key, data, datalen, keyring, authkey);
 
         if (keyring)
                 up_write(&keyring->sem);
@@ -469,7 +469,7 @@ EXPORT_SYMBOL(key_instantiate_and_link);
 int key_negate_and_link(struct key *key,
                         unsigned timeout,
                         struct key *keyring,
-                        struct key *instkey)
+                        struct key *authkey)
 {
         struct timespec now;
         int ret, awaken;
@@ -504,8 +504,8 @@ int key_negate_and_link(struct key *key,
                         ret = __key_link(keyring, key);
 
                 /* disable the authorisation key */
-                if (instkey)
-                        key_revoke(instkey);
+                if (authkey)
+                        key_revoke(authkey);
         }
 
         mutex_unlock(&key_construction_mutex);
@@ -743,6 +743,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                key_perm_t perm,
                                unsigned long flags)
 {
+        const struct cred *cred = current_cred();
         struct key_type *ktype;
         struct key *keyring, *key = NULL;
         key_ref_t key_ref;
@@ -802,8 +803,8 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         }
 
         /* allocate a new key */
-        key = key_alloc(ktype, description, current_fsuid(), current_fsgid(),
-                        current, perm, flags);
+        key = key_alloc(ktype, description, cred->fsuid, cred->fsgid, cred,
+                        perm, flags);
         if (IS_ERR(key)) {
                 key_ref = ERR_CAST(key);
                 goto error_3;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 8833b447adef..7c72baa02f2e 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -866,6 +866,23 @@ static long get_instantiation_keyring(key_serial_t ringid,
         return -ENOKEY;
 }
 
+/*
+ * change the request_key authorisation key on the current process
+ */
+static int keyctl_change_reqkey_auth(struct key *key)
+{
+        struct cred *new;
+
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+
+        key_put(new->request_key_auth);
+        new->request_key_auth = key_get(key);
+
+        return commit_creds(new);
+}
+
 /*****************************************************************************/
 /*
  * instantiate the key with the specified payload, and, if one is given, link
@@ -876,12 +893,15 @@ long keyctl_instantiate_key(key_serial_t id,
                             size_t plen,
                             key_serial_t ringid)
 {
+        const struct cred *cred = current_cred();
         struct request_key_auth *rka;
         struct key *instkey, *dest_keyring;
         void *payload;
         long ret;
         bool vm = false;
 
+        kenter("%d,,%zu,%d", id, plen, ringid);
+
         ret = -EINVAL;
         if (plen > 1024 * 1024 - 1)
                 goto error;
@@ -889,7 +909,7 @@ long keyctl_instantiate_key(key_serial_t id,
         /* the appropriate instantiation authorisation key must have been
          * assumed before calling this */
         ret = -EPERM;
-        instkey = current->cred->request_key_auth;
+        instkey = cred->request_key_auth;
         if (!instkey)
                 goto error;
 
@@ -931,10 +951,8 @@ long keyctl_instantiate_key(key_serial_t id,
 
         /* discard the assumed authority if it's just been disabled by
          * instantiation of the key */
-        if (ret == 0) {
-                key_put(current->cred->request_key_auth);
-                current->cred->request_key_auth = NULL;
-        }
+        if (ret == 0)
+                keyctl_change_reqkey_auth(NULL);
 
 error2:
         if (!vm)
@@ -953,14 +971,17 @@ error:
  */
 long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 {
+        const struct cred *cred = current_cred();
         struct request_key_auth *rka;
         struct key *instkey, *dest_keyring;
         long ret;
 
+        kenter("%d,%u,%d", id, timeout, ringid);
+
         /* the appropriate instantiation authorisation key must have been
          * assumed before calling this */
         ret = -EPERM;
-        instkey = current->cred->request_key_auth;
+        instkey = cred->request_key_auth;
         if (!instkey)
                 goto error;
 
@@ -982,10 +1003,8 @@ long keyctl_negate_key(key_serial_t id, unsigned timeout, key_serial_t ringid)
 
         /* discard the assumed authority if it's just been disabled by
          * instantiation of the key */
-        if (ret == 0) {
-                key_put(current->cred->request_key_auth);
-                current->cred->request_key_auth = NULL;
-        }
+        if (ret == 0)
+                keyctl_change_reqkey_auth(NULL);
 
 error:
         return ret;
@@ -999,36 +1018,56 @@ error:
  */
 long keyctl_set_reqkey_keyring(int reqkey_defl)
 {
-        struct cred *cred = current->cred;
-        int ret;
+        struct cred *new;
+        int ret, old_setting;
+
+        old_setting = current_cred_xxx(jit_keyring);
+
+        if (reqkey_defl == KEY_REQKEY_DEFL_NO_CHANGE)
+                return old_setting;
+
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
 
         switch (reqkey_defl) {
         case KEY_REQKEY_DEFL_THREAD_KEYRING:
-                ret = install_thread_keyring();
+                ret = install_thread_keyring_to_cred(new);
                 if (ret < 0)
-                        return ret;
+                        goto error;
                 goto set;
 
         case KEY_REQKEY_DEFL_PROCESS_KEYRING:
-                ret = install_process_keyring();
-                if (ret < 0)
-                        return ret;
+                ret = install_process_keyring_to_cred(new);
+                if (ret < 0) {
+                        if (ret != -EEXIST)
+                                goto error;
+                        ret = 0;
+                }
+                goto set;
 
         case KEY_REQKEY_DEFL_DEFAULT:
         case KEY_REQKEY_DEFL_SESSION_KEYRING:
         case KEY_REQKEY_DEFL_USER_KEYRING:
         case KEY_REQKEY_DEFL_USER_SESSION_KEYRING:
-        set:
-                cred->jit_keyring = reqkey_defl;
+        case KEY_REQKEY_DEFL_REQUESTOR_KEYRING:
+                goto set;
 
         case KEY_REQKEY_DEFL_NO_CHANGE:
-                return cred->jit_keyring;
-
         case KEY_REQKEY_DEFL_GROUP_KEYRING:
         default:
-                return -EINVAL;
+                ret = -EINVAL;
+                goto error;
         }
 
+set:
+        new->jit_keyring = reqkey_defl;
+        commit_creds(new);
+        return old_setting;
+error:
+        abort_creds(new);
+        return -EINVAL;
+
 } /* end keyctl_set_reqkey_keyring() */
 
 /*****************************************************************************/
@@ -1087,9 +1126,7 @@ long keyctl_assume_authority(key_serial_t id)
 
         /* we divest ourselves of authority if given an ID of 0 */
         if (id == 0) {
-                key_put(current->cred->request_key_auth);
-                current->cred->request_key_auth = NULL;
-                ret = 0;
+                ret = keyctl_change_reqkey_auth(NULL);
                 goto error;
         }
 
@@ -1104,10 +1141,12 @@ long keyctl_assume_authority(key_serial_t id)
                 goto error;
         }
 
-        key_put(current->cred->request_key_auth);
-        current->cred->request_key_auth = authkey;
-        ret = authkey->serial;
+        ret = keyctl_change_reqkey_auth(authkey);
+        if (ret < 0)
+                goto error;
+        key_put(authkey);
 
+        ret = authkey->serial;
 error:
         return ret;
 
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index fdf75f901991..ed851574d073 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -245,14 +245,14 @@ static long keyring_read(const struct key *keyring,
  * allocate a keyring and link into the destination keyring
  */
 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
-                          struct task_struct *ctx, unsigned long flags,
+                          const struct cred *cred, unsigned long flags,
                           struct key *dest)
 {
         struct key *keyring;
         int ret;
 
         keyring = key_alloc(&key_type_keyring, description,
-                            uid, gid, ctx,
+                            uid, gid, cred,
                             (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
                             flags);
 
@@ -281,7 +281,7 @@ struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
  * - we propagate the possession attribute from the keyring ref to the key ref
  */
 key_ref_t keyring_search_aux(key_ref_t keyring_ref,
-                             struct task_struct *context,
+                             const struct cred *cred,
                              struct key_type *type,
                              const void *description,
                              key_match_func_t match)
@@ -304,7 +304,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
         key_check(keyring);
 
         /* top keyring must have search permission to begin the search */
-        err = key_task_permission(keyring_ref, context, KEY_SEARCH);
+        err = key_task_permission(keyring_ref, cred, KEY_SEARCH);
         if (err < 0) {
                 key_ref = ERR_PTR(err);
                 goto error;
@@ -377,7 +377,7 @@ descend:
 
                 /* key must have search permissions */
                 if (key_task_permission(make_key_ref(key, possessed),
-                                        context, KEY_SEARCH) < 0)
+                                        cred, KEY_SEARCH) < 0)
                         continue;
 
                 /* we set a different error code if we pass a negative key */
@@ -404,7 +404,7 @@ ascend:
                         continue;
 
                 if (key_task_permission(make_key_ref(key, possessed),
-                                        context, KEY_SEARCH) < 0)
+                                        cred, KEY_SEARCH) < 0)
                         continue;
 
                 /* stack the current position */
@@ -459,7 +459,7 @@ key_ref_t keyring_search(key_ref_t keyring,
         if (!type->match)
                 return ERR_PTR(-ENOKEY);
 
-        return keyring_search_aux(keyring, current,
+        return keyring_search_aux(keyring, current->cred,
                                   type, description, type->match);
 
 } /* end keyring_search() */
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 13c36164f284..5d9fc7b93f2e 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -14,24 +14,27 @@
 #include "internal.h"
 
 /*****************************************************************************/
-/*
- * check to see whether permission is granted to use a key in the desired way,
- * but permit the security modules to override
+/**
+ * key_task_permission - Check a key can be used
+ * @key_ref: The key to check
+ * @cred: The credentials to use
+ * @perm: The permissions to check for
+ *
+ * Check to see whether permission is granted to use a key in the desired way,
+ * but permit the security modules to override.
+ *
+ * The caller must hold either a ref on cred or must hold the RCU readlock or a
+ * spinlock.
  */
-int key_task_permission(const key_ref_t key_ref,
-                        struct task_struct *context,
+int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
                         key_perm_t perm)
 {
-        const struct cred *cred;
         struct key *key;
         key_perm_t kperm;
         int ret;
 
         key = key_ref_to_ptr(key_ref);
 
-        rcu_read_lock();
-        cred = __task_cred(context);
-
         /* use the second 8-bits of permissions for keys the caller owns */
         if (key->uid == cred->fsuid) {
                 kperm = key->perm >> 16;
@@ -57,7 +60,6 @@ int key_task_permission(const key_ref_t key_ref,
         kperm = key->perm;
 
 use_these_perms:
-        rcu_read_lock();
 
         /* use the top 8-bits of permissions for keys the caller possesses
          * - possessor permissions are additive with other permissions
@@ -71,7 +73,7 @@ use_these_perms:
                 return -EACCES;
 
         /* let LSM be the final arbiter */
-        return security_key_permission(key_ref, context, perm);
+        return security_key_permission(key_ref, cred, perm);
 
 } /* end key_task_permission() */
 
diff --git a/security/keys/proc.c b/security/keys/proc.c
index f619170da760..7f508def50e3 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -136,8 +136,12 @@ static int proc_keys_show(struct seq_file *m, void *v)
         int rc;
 
         /* check whether the current task is allowed to view the key (assuming
-         * non-possession) */
-        rc = key_task_permission(make_key_ref(key, 0), current, KEY_VIEW);
+         * non-possession)
+         * - the caller holds a spinlock, and thus the RCU read lock, making our
+         *   access to __current_cred() safe
+         */
+        rc = key_task_permission(make_key_ref(key, 0), current_cred(),
+                                 KEY_VIEW);
         if (rc < 0)
                 return 0;
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 70ee93406f30..df329f684a65 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -42,11 +42,15 @@ struct key_user root_key_user = {
  */
 int install_user_keyrings(void)
 {
-        struct user_struct *user = current->cred->user;
+        struct user_struct *user;
+        const struct cred *cred;
         struct key *uid_keyring, *session_keyring;
         char buf[20];
         int ret;
 
+        cred = current_cred();
+        user = cred->user;
+
         kenter("%p{%u}", user, user->uid);
 
         if (user->uid_keyring) {
@@ -67,7 +71,7 @@ int install_user_keyrings(void)
                 uid_keyring = find_keyring_by_name(buf, true);
                 if (IS_ERR(uid_keyring)) {
                         uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
-                                                    current, KEY_ALLOC_IN_QUOTA,
+                                                    cred, KEY_ALLOC_IN_QUOTA,
                                                     NULL);
                         if (IS_ERR(uid_keyring)) {
                                 ret = PTR_ERR(uid_keyring);
@@ -83,8 +87,7 @@ int install_user_keyrings(void)
                 if (IS_ERR(session_keyring)) {
                         session_keyring =
                                 keyring_alloc(buf, user->uid, (gid_t) -1,
-                                              current, KEY_ALLOC_IN_QUOTA,
-                                              NULL);
+                                              cred, KEY_ALLOC_IN_QUOTA, NULL);
                         if (IS_ERR(session_keyring)) {
                                 ret = PTR_ERR(session_keyring);
                                 goto error_release;
@@ -116,142 +119,128 @@ error:
         return ret;
 }
 
-/*****************************************************************************/
 /*
- * deal with the UID changing
+ * install a fresh thread keyring directly to new credentials
  */
-void switch_uid_keyring(struct user_struct *new_user)
+int install_thread_keyring_to_cred(struct cred *new)
 {
-#if 0 /* do nothing for now */
-        struct key *old;
-
-        /* switch to the new user's session keyring if we were running under
-         * root's default session keyring */
-        if (new_user->uid != 0 &&
-            current->session_keyring == &root_session_keyring
-            ) {
-                atomic_inc(&new_user->session_keyring->usage);
-
-                task_lock(current);
-                old = current->session_keyring;
-                current->session_keyring = new_user->session_keyring;
-                task_unlock(current);
+        struct key *keyring;
 
-                key_put(old);
-        }
-#endif
+        keyring = keyring_alloc("_tid", new->uid, new->gid, new,
+                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        if (IS_ERR(keyring))
+                return PTR_ERR(keyring);
 
-} /* end switch_uid_keyring() */
+        new->thread_keyring = keyring;
+        return 0;
+}
 
-/*****************************************************************************/
 /*
  * install a fresh thread keyring, discarding the old one
  */
-int install_thread_keyring(void)
+static int install_thread_keyring(void)
 {
-        struct task_struct *tsk = current;
-        struct key *keyring, *old;
-        char buf[20];
+        struct cred *new;
         int ret;
 
-        sprintf(buf, "_tid.%u", tsk->pid);
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
 
-        keyring = keyring_alloc(buf, tsk->cred->uid, tsk->cred->gid, tsk,
-                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
-        if (IS_ERR(keyring)) {
-                ret = PTR_ERR(keyring);
-                goto error;
+        BUG_ON(new->thread_keyring);
+
+        ret = install_thread_keyring_to_cred(new);
+        if (ret < 0) {
+                abort_creds(new);
+                return ret;
         }
 
-        task_lock(tsk);
-        old = tsk->cred->thread_keyring;
-        tsk->cred->thread_keyring = keyring;
-        task_unlock(tsk);
+        return commit_creds(new);
+}
 
-        ret = 0;
+/*
+ * install a process keyring directly to a credentials struct
+ * - returns -EEXIST if there was already a process keyring, 0 if one installed,
+ *   and other -ve on any other error
+ */
+int install_process_keyring_to_cred(struct cred *new)
+{
+        struct key *keyring;
+        int ret;
 
-        key_put(old);
-error:
+        if (new->tgcred->process_keyring)
+                return -EEXIST;
+
+        keyring = keyring_alloc("_pid", new->uid, new->gid,
+                                new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        if (IS_ERR(keyring))
+                return PTR_ERR(keyring);
+
+        spin_lock_irq(&new->tgcred->lock);
+        if (!new->tgcred->process_keyring) {
+                new->tgcred->process_keyring = keyring;
+                keyring = NULL;
+                ret = 0;
+        } else {
+                ret = -EEXIST;
+        }
+        spin_unlock_irq(&new->tgcred->lock);
+        key_put(keyring);
         return ret;
+}
 
-} /* end install_thread_keyring() */
-
-/*****************************************************************************/
 /*
  * make sure a process keyring is installed
+ * - we
  */
-int install_process_keyring(void)
+static int install_process_keyring(void)
 {
-        struct task_struct *tsk = current;
-        struct key *keyring;
-        char buf[20];
+        struct cred *new;
         int ret;
 
-        might_sleep();
-
-        if (!tsk->cred->tgcred->process_keyring) {
-                sprintf(buf, "_pid.%u", tsk->tgid);
-
-                keyring = keyring_alloc(buf, tsk->cred->uid, tsk->cred->gid, tsk,
-                                        KEY_ALLOC_QUOTA_OVERRUN, NULL);
-                if (IS_ERR(keyring)) {
-                        ret = PTR_ERR(keyring);
-                        goto error;
-                }
-
-                /* attach keyring */
-                spin_lock_irq(&tsk->cred->tgcred->lock);
-                if (!tsk->cred->tgcred->process_keyring) {
-                        tsk->cred->tgcred->process_keyring = keyring;
-                        keyring = NULL;
-                }
-                spin_unlock_irq(&tsk->cred->tgcred->lock);
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
 
-                key_put(keyring);
+        ret = install_process_keyring_to_cred(new);
+        if (ret < 0) {
+                abort_creds(new);
+                return ret != -EEXIST ?: 0;
         }
 
-        ret = 0;
-error:
-        return ret;
-
-} /* end install_process_keyring() */
+        return commit_creds(new);
+}
 
-/*****************************************************************************/
 /*
- * install a session keyring, discarding the old one
- * - if a keyring is not supplied, an empty one is invented
+ * install a session keyring directly to a credentials struct
  */
-static int install_session_keyring(struct key *keyring)
+static int install_session_keyring_to_cred(struct cred *cred,
+                                           struct key *keyring)
 {
-        struct task_struct *tsk = current;
         unsigned long flags;
         struct key *old;
-        char buf[20];
 
         might_sleep();
 
         /* create an empty session keyring */
         if (!keyring) {
-                sprintf(buf, "_ses.%u", tsk->tgid);
-
                 flags = KEY_ALLOC_QUOTA_OVERRUN;
-                if (tsk->cred->tgcred->session_keyring)
+                if (cred->tgcred->session_keyring)
                         flags = KEY_ALLOC_IN_QUOTA;
 
-                keyring = keyring_alloc(buf, tsk->cred->uid, tsk->cred->gid,
-                                        tsk, flags, NULL);
+                keyring = keyring_alloc("_ses", cred->uid, cred->gid,
+                                        cred, flags, NULL);
                 if (IS_ERR(keyring))
                         return PTR_ERR(keyring);
-        }
-        else {
+        } else {
                 atomic_inc(&keyring->usage);
         }
 
         /* install the keyring */
-        spin_lock_irq(&tsk->cred->tgcred->lock);
-        old = tsk->cred->tgcred->session_keyring;
-        rcu_assign_pointer(tsk->cred->tgcred->session_keyring, keyring);
-        spin_unlock_irq(&tsk->cred->tgcred->lock);
+        spin_lock_irq(&cred->tgcred->lock);
+        old = cred->tgcred->session_keyring;
+        rcu_assign_pointer(cred->tgcred->session_keyring, keyring);
+        spin_unlock_irq(&cred->tgcred->lock);
 
         /* we're using RCU on the pointer, but there's no point synchronising
          * on it if it didn't previously point to anything */
@@ -261,38 +250,29 @@ static int install_session_keyring(struct key *keyring)
         }
 
         return 0;
+}
 
-} /* end install_session_keyring() */
-
-/*****************************************************************************/
 /*
- * copy the keys for fork
+ * install a session keyring, discarding the old one
+ * - if a keyring is not supplied, an empty one is invented
  */
-int copy_keys(unsigned long clone_flags, struct task_struct *tsk)
+static int install_session_keyring(struct key *keyring)
 {
-        key_check(tsk->cred->thread_keyring);
-        key_check(tsk->cred->request_key_auth);
-
-        /* no thread keyring yet */
-        tsk->cred->thread_keyring = NULL;
-
-        /* copy the request_key() authorisation for this thread */
-        key_get(tsk->cred->request_key_auth);
-
-        return 0;
+        struct cred *new;
+        int ret;
 
-} /* end copy_keys() */
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
 
-/*****************************************************************************/
-/*
- * dispose of per-thread keys upon thread exit
- */
-void exit_keys(struct task_struct *tsk)
-{
-        key_put(tsk->cred->thread_keyring);
-        key_put(tsk->cred->request_key_auth);
+        ret = install_session_keyring_to_cred(new, NULL);
+        if (ret < 0) {
+                abort_creds(new);
+                return ret;
+        }
 
-} /* end exit_keys() */
+        return commit_creds(new);
+}
 
 /*****************************************************************************/
 /*
@@ -300,38 +280,41 @@ void exit_keys(struct task_struct *tsk)
  */
 int exec_keys(struct task_struct *tsk)
 {
-        struct key *old;
+        struct thread_group_cred *tgcred = NULL;
+        struct cred *new;
 
-        /* newly exec'd tasks don't get a thread keyring */
-        task_lock(tsk);
-        old = tsk->cred->thread_keyring;
-        tsk->cred->thread_keyring = NULL;
-        task_unlock(tsk);
+#ifdef CONFIG_KEYS
+        tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
+        if (!tgcred)
+                return -ENOMEM;
+#endif
 
-        key_put(old);
+        new = prepare_creds();
+        if (new < 0)
+                return -ENOMEM;
 
-        /* discard the process keyring from a newly exec'd task */
-        spin_lock_irq(&tsk->cred->tgcred->lock);
-        old = tsk->cred->tgcred->process_keyring;
-        tsk->cred->tgcred->process_keyring = NULL;
-        spin_unlock_irq(&tsk->cred->tgcred->lock);
+        /* newly exec'd tasks don't get a thread keyring */
+        key_put(new->thread_keyring);
+        new->thread_keyring = NULL;
 
-        key_put(old);
+        /* create a new per-thread-group creds for all this set of threads to
+         * share */
+        memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred));
 
-        return 0;
+        atomic_set(&tgcred->usage, 1);
+        spin_lock_init(&tgcred->lock);
 
-} /* end exec_keys() */
+        /* inherit the session keyring; new process keyring */
+        key_get(tgcred->session_keyring);
+        tgcred->process_keyring = NULL;
 
-/*****************************************************************************/
-/*
- * deal with SUID programs
- * - we might want to make this invent a new session keyring
- */
-int suid_keys(struct task_struct *tsk)
-{
+        release_tgcred(new);
+        new->tgcred = tgcred;
+
+        commit_creds(new);
         return 0;
 
-} /* end suid_keys() */
+} /* end exec_keys() */
 
 /*****************************************************************************/
 /*
@@ -376,16 +359,13 @@ void key_fsgid_changed(struct task_struct *tsk)
 key_ref_t search_process_keyrings(struct key_type *type,
                                   const void *description,
                                   key_match_func_t match,
-                                  struct task_struct *context)
+                                  const struct cred *cred)
 {
         struct request_key_auth *rka;
-        struct cred *cred;
         key_ref_t key_ref, ret, err;
 
         might_sleep();
 
-        cred = get_task_cred(context);
-
         /* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
          * searchable, but we failed to find a key or we found a negative key;
          * otherwise we want to return a sample error (probably -EACCES) if
@@ -401,7 +381,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
         if (cred->thread_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->thread_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -422,7 +402,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
         if (cred->tgcred->process_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->tgcred->process_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -446,7 +426,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
                         make_key_ref(rcu_dereference(
                                              cred->tgcred->session_keyring),
                                      1),
-                        context, type, description, match);
+                        cred, type, description, match);
                 rcu_read_unlock();
 
                 if (!IS_ERR(key_ref))
@@ -468,7 +448,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
         else if (cred->user->session_keyring) {
                 key_ref = keyring_search_aux(
                         make_key_ref(cred->user->session_keyring, 1),
-                        context, type, description, match);
+                        cred, type, description, match);
                 if (!IS_ERR(key_ref))
                         goto found;
 
@@ -490,7 +470,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
          * - we don't permit access to request_key auth keys via this method
          */
         if (cred->request_key_auth &&
-            context == current &&
+            cred == current_cred() &&
             type != &key_type_request_key_auth
             ) {
                 /* defend against the auth key being revoked */
@@ -500,7 +480,7 @@ key_ref_t search_process_keyrings(struct key_type *type,
                         rka = cred->request_key_auth->payload.data;
 
                         key_ref = search_process_keyrings(type, description,
-                                                          match, rka->context);
+                                                          match, rka->cred);
 
                         up_read(&cred->request_key_auth->sem);
 
@@ -527,7 +507,6 @@ key_ref_t search_process_keyrings(struct key_type *type,
         key_ref = ret ? ret : err;
 
 found:
-        put_cred(cred);
         return key_ref;
 
 } /* end search_process_keyrings() */
@@ -552,8 +531,7 @@ key_ref_t lookup_user_key(key_serial_t id, int create, int partial,
                           key_perm_t perm)
 {
         struct request_key_auth *rka;
-        struct task_struct *t = current;
-        struct cred *cred;
+        const struct cred *cred;
         struct key *key;
         key_ref_t key_ref, skey_ref;
         int ret;
@@ -608,6 +586,7 @@ try_again:
                                 goto error;
                         ret = install_session_keyring(
                                 cred->user->session_keyring);
+
                         if (ret < 0)
                                 goto error;
                         goto reget_creds;
@@ -693,7 +672,7 @@ try_again:
                 /* check to see if we possess the key */
                 skey_ref = search_process_keyrings(key->type, key,
                                                    lookup_user_key_possessed,
-                                                   current);
+                                                   cred);
 
                 if (!IS_ERR(skey_ref)) {
                         key_put(key);
@@ -725,7 +704,7 @@ try_again:
                 goto invalid_key;
 
         /* check the permissions */
-        ret = key_task_permission(key_ref, t, perm);
+        ret = key_task_permission(key_ref, cred, perm);
         if (ret < 0)
                 goto invalid_key;
 
@@ -755,21 +734,33 @@ reget_creds:
  */
 long join_session_keyring(const char *name)
 {
-        struct task_struct *tsk = current;
-        struct cred *cred = current->cred;
+        const struct cred *old;
+        struct cred *new;
         struct key *keyring;
-        long ret;
+        long ret, serial;
+
+        /* only permit this if there's a single thread in the thread group -
+         * this avoids us having to adjust the creds on all threads and risking
+         * ENOMEM */
+        if (!is_single_threaded(current))
+                return -EMLINK;
+
+        new = prepare_creds();
+        if (!new)
+                return -ENOMEM;
+        old = current_cred();
 
         /* if no name is provided, install an anonymous keyring */
         if (!name) {
-                ret = install_session_keyring(NULL);
+                ret = install_session_keyring_to_cred(new, NULL);
                 if (ret < 0)
                         goto error;
 
-                rcu_read_lock();
-                ret = rcu_dereference(cred->tgcred->session_keyring)->serial;
-                rcu_read_unlock();
-                goto error;
+                serial = new->tgcred->session_keyring->serial;
+                ret = commit_creds(new);
+                if (ret == 0)
+                        ret = serial;
+                goto okay;
         }
 
         /* allow the user to join or create a named keyring */
@@ -779,29 +770,33 @@ long join_session_keyring(const char *name)
         keyring = find_keyring_by_name(name, false);
         if (PTR_ERR(keyring) == -ENOKEY) {
                 /* not found - try and create a new one */
-                keyring = keyring_alloc(name, cred->uid, cred->gid, tsk,
+                keyring = keyring_alloc(name, old->uid, old->gid, old,
                                         KEY_ALLOC_IN_QUOTA, NULL);
                 if (IS_ERR(keyring)) {
                         ret = PTR_ERR(keyring);
                         goto error2;
                 }
-        }
-        else if (IS_ERR(keyring)) {
+        } else if (IS_ERR(keyring)) {
                 ret = PTR_ERR(keyring);
                 goto error2;
         }
 
         /* we've got a keyring - now to install it */
-        ret = install_session_keyring(keyring);
+        ret = install_session_keyring_to_cred(new, keyring);
         if (ret < 0)
                 goto error2;
 
+        commit_creds(new);
+        mutex_unlock(&key_session_mutex);
+
         ret = keyring->serial;
         key_put(keyring);
+okay:
+        return ret;
 
 error2:
         mutex_unlock(&key_session_mutex);
 error:
+        abort_creds(new);
         return ret;
-
-} /* end join_session_keyring() */
+}
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 3d12558362df..0e04f72ef2d4 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -83,8 +83,10 @@ static int call_sbin_request_key(struct key_construction *cons,
         /* allocate a new session keyring */
         sprintf(desc, "_req.%u", key->serial);
 
-        keyring = keyring_alloc(desc, current_fsuid(), current_fsgid(), current,
+        cred = get_current_cred();
+        keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        put_cred(cred);
         if (IS_ERR(keyring)) {
                 ret = PTR_ERR(keyring);
                 goto error_alloc;
@@ -104,8 +106,7 @@ static int call_sbin_request_key(struct key_construction *cons,
 
         /* we specify the process's default keyrings */
         sprintf(keyring_str[0], "%d",
-                cred->thread_keyring ?
-                cred->thread_keyring->serial : 0);
+                cred->thread_keyring ? cred->thread_keyring->serial : 0);
 
         prkey = 0;
         if (cred->tgcred->process_keyring)
@@ -155,8 +156,8 @@ error_link:
         key_put(keyring);
 
 error_alloc:
-        kleave(" = %d", ret);
         complete_request_key(cons, ret);
+        kleave(" = %d", ret);
         return ret;
 }
 
@@ -295,6 +296,7 @@ static int construct_alloc_key(struct key_type *type,
                                struct key_user *user,
                                struct key **_key)
 {
+        const struct cred *cred = current_cred();
         struct key *key;
         key_ref_t key_ref;
 
@@ -302,9 +304,8 @@ static int construct_alloc_key(struct key_type *type,
 
         mutex_lock(&user->cons_lock);
 
-        key = key_alloc(type, description,
-                        current_fsuid(), current_fsgid(), current, KEY_POS_ALL,
-                        flags);
+        key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
+                        KEY_POS_ALL, flags);
         if (IS_ERR(key))
                 goto alloc_failed;
 
@@ -317,8 +318,7 @@ static int construct_alloc_key(struct key_type *type,
          * waited for locks */
         mutex_lock(&key_construction_mutex);
 
-        key_ref = search_process_keyrings(type, description, type->match,
-                                          current);
+        key_ref = search_process_keyrings(type, description, type->match, cred);
         if (!IS_ERR(key_ref))
                 goto key_already_present;
 
@@ -363,6 +363,8 @@ static struct key *construct_key_and_link(struct key_type *type,
         struct key *key;
         int ret;
 
+        kenter("");
+
         user = key_user_lookup(current_fsuid());
         if (!user)
                 return ERR_PTR(-ENOMEM);
@@ -376,17 +378,21 @@ static struct key *construct_key_and_link(struct key_type *type,
         if (ret == 0) {
                 ret = construct_key(key, callout_info, callout_len, aux,
                                     dest_keyring);
-                if (ret < 0)
+                if (ret < 0) {
+                        kdebug("cons failed");
                         goto construction_failed;
+                }
         }
 
         key_put(dest_keyring);
+        kleave(" = key %d", key_serial(key));
         return key;
 
 construction_failed:
         key_negate_and_link(key, key_negative_timeout, NULL, NULL);
         key_put(key);
         key_put(dest_keyring);
+        kleave(" = %d", ret);
         return ERR_PTR(ret);
 }
 
@@ -405,6 +411,7 @@ struct key *request_key_and_link(struct key_type *type,
                                  struct key *dest_keyring,
                                  unsigned long flags)
 {
+        const struct cred *cred = current_cred();
         struct key *key;
         key_ref_t key_ref;
 
@@ -414,7 +421,7 @@ struct key *request_key_and_link(struct key_type *type,
 
         /* search all the process keyrings for a key */
         key_ref = search_process_keyrings(type, description, type->match,
-                                          current);
+                                          cred);
 
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 2125579d5d73..86747151ee5b 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -105,9 +105,9 @@ static void request_key_auth_revoke(struct key *key)
 
         kenter("{%d}", key->serial);
 
-        if (rka->context) {
-                put_task_struct(rka->context);
-                rka->context = NULL;
+        if (rka->cred) {
+                put_cred(rka->cred);
+                rka->cred = NULL;
         }
 
 } /* end request_key_auth_revoke() */
@@ -122,9 +122,9 @@ static void request_key_auth_destroy(struct key *key)
 
         kenter("{%d}", key->serial);
 
-        if (rka->context) {
-                put_task_struct(rka->context);
-                rka->context = NULL;
+        if (rka->cred) {
+                put_cred(rka->cred);
+                rka->cred = NULL;
         }
 
         key_put(rka->target_key);
@@ -143,6 +143,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                                  size_t callout_len, struct key *dest_keyring)
 {
         struct request_key_auth *rka, *irka;
+        const struct cred *cred = current->cred;
         struct key *authkey = NULL;
         char desc[20];
         int ret;
@@ -164,28 +165,25 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
 
         /* see if the calling process is already servicing the key request of
          * another process */
-        if (current->cred->request_key_auth) {
+        if (cred->request_key_auth) {
                 /* it is - use that instantiation context here too */
-                down_read(&current->cred->request_key_auth->sem);
+                down_read(&cred->request_key_auth->sem);
 
                 /* if the auth key has been revoked, then the key we're
                  * servicing is already instantiated */
-                if (test_bit(KEY_FLAG_REVOKED,
-                             &current->cred->request_key_auth->flags))
+                if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
                         goto auth_key_revoked;
 
-                irka = current->cred->request_key_auth->payload.data;
-                rka->context = irka->context;
+                irka = cred->request_key_auth->payload.data;
+                rka->cred = get_cred(irka->cred);
                 rka->pid = irka->pid;
-                get_task_struct(rka->context);
 
-                up_read(&current->cred->request_key_auth->sem);
+                up_read(&cred->request_key_auth->sem);
         }
         else {
                 /* it isn't - use this process as the context */
-                rka->context = current;
+                rka->cred = get_cred(cred);
                 rka->pid = current->pid;
-                get_task_struct(rka->context);
         }
 
         rka->target_key = key_get(target);
@@ -197,7 +195,7 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
         sprintf(desc, "%x", target->serial);
 
         authkey = key_alloc(&key_type_request_key_auth, desc,
-                            current_fsuid(), current_fsgid(), current,
+                            cred->fsuid, cred->fsgid, cred,
                             KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
                             KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
         if (IS_ERR(authkey)) {
@@ -205,16 +203,16 @@ struct key *request_key_auth_new(struct key *target, const void *callout_info,
                 goto error_alloc;
         }
 
-        /* construct and attach to the keyring */
+        /* construct the auth key */
         ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
         if (ret < 0)
                 goto error_inst;
 
-        kleave(" = {%d}", authkey->serial);
+        kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
         return authkey;
 
 auth_key_revoked:
-        up_read(&current->cred->request_key_auth->sem);
+        up_read(&cred->request_key_auth->sem);
         kfree(rka->callout_info);
         kfree(rka);
         kleave("= -EKEYREVOKED");
@@ -257,6 +255,7 @@ static int key_get_instantiation_authkey_match(const struct key *key,
  */
 struct key *key_get_instantiation_authkey(key_serial_t target_id)
 {
+        const struct cred *cred = current_cred();
         struct key *authkey;
         key_ref_t authkey_ref;
 
@@ -264,7 +263,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
                 &key_type_request_key_auth,
                 (void *) (unsigned long) target_id,
                 key_get_instantiation_authkey_match,
-                current);
+                cred);
 
         if (IS_ERR(authkey_ref)) {
                 authkey = ERR_CAST(authkey_ref);