4 files changed, 33 insertions, 19 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index 50d96d4e06f2..bebeca3a78e4 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -826,13 +826,13 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
         /* if the client doesn't provide, decide on the permissions we want */
         if (perm == KEY_PERM_UNDEF) {
                 perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
-                perm |= KEY_USR_VIEW | KEY_USR_SEARCH | KEY_USR_LINK | KEY_USR_SETATTR;
+                perm |= KEY_USR_VIEW;
 
                 if (ktype->read)
-                        perm |= KEY_POS_READ | KEY_USR_READ;
+                        perm |= KEY_POS_READ;
 
                 if (ktype == &key_type_keyring || ktype->update)
-                        perm |= KEY_USR_WRITE;
+                        perm |= KEY_POS_WRITE;
         }
 
         /* allocate a new key */
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 81e7852d281d..cf704a92083f 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -257,17 +257,14 @@ error:
  * Allocate a keyring and link into the destination keyring.
  */
 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
-                          const struct cred *cred, unsigned long flags,
-                          struct key *dest)
+                          const struct cred *cred, key_perm_t perm,
+                          unsigned long flags, struct key *dest)
 {
         struct key *keyring;
         int ret;
 
         keyring = key_alloc(&key_type_keyring, description,
-                            uid, gid, cred,
-                            (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
-                            flags);
-
+                            uid, gid, cred, perm, flags);
         if (!IS_ERR(keyring)) {
                 ret = key_instantiate_and_link(keyring, NULL, 0, dest, NULL);
                 if (ret < 0) {
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 9de5dc598276..b58d93892740 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -46,9 +46,11 @@ int install_user_keyrings(void)
         struct user_struct *user;
         const struct cred *cred;
         struct key *uid_keyring, *session_keyring;
+        key_perm_t user_keyring_perm;
         char buf[20];
         int ret;
 
+        user_keyring_perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL;
         cred = current_cred();
         user = cred->user;
 
@@ -72,8 +74,8 @@ int install_user_keyrings(void)
                 uid_keyring = find_keyring_by_name(buf, true);
                 if (IS_ERR(uid_keyring)) {
                         uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
-                                                    cred, KEY_ALLOC_IN_QUOTA,
-                                                    NULL);
+                                                    cred, user_keyring_perm,
+                                                    KEY_ALLOC_IN_QUOTA, NULL);
                         if (IS_ERR(uid_keyring)) {
                                 ret = PTR_ERR(uid_keyring);
                                 goto error;
@@ -88,7 +90,8 @@ int install_user_keyrings(void)
                 if (IS_ERR(session_keyring)) {
                         session_keyring =
                                 keyring_alloc(buf, user->uid, (gid_t) -1,
-                                              cred, KEY_ALLOC_IN_QUOTA, NULL);
+                                              cred, user_keyring_perm,
+                                              KEY_ALLOC_IN_QUOTA, NULL);
                         if (IS_ERR(session_keyring)) {
                                 ret = PTR_ERR(session_keyring);
                                 goto error_release;
@@ -129,6 +132,7 @@ int install_thread_keyring_to_cred(struct cred *new)
         struct key *keyring;
 
         keyring = keyring_alloc("_tid", new->uid, new->gid, new,
+                                KEY_POS_ALL | KEY_USR_VIEW,
                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
         if (IS_ERR(keyring))
                 return PTR_ERR(keyring);
@@ -173,8 +177,9 @@ int install_process_keyring_to_cred(struct cred *new)
         if (new->process_keyring)
                 return -EEXIST;
 
-        keyring = keyring_alloc("_pid", new->uid, new->gid,
-                                new, KEY_ALLOC_QUOTA_OVERRUN, NULL);
+        keyring = keyring_alloc("_pid", new->uid, new->gid, new,
+                                KEY_POS_ALL | KEY_USR_VIEW,
+                                KEY_ALLOC_QUOTA_OVERRUN, NULL);
         if (IS_ERR(keyring))
                 return PTR_ERR(keyring);
 
@@ -223,8 +228,9 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
                 if (cred->session_keyring)
                         flags = KEY_ALLOC_IN_QUOTA;
 
-                keyring = keyring_alloc("_ses", cred->uid, cred->gid,
-                                        cred, flags, NULL);
+                keyring = keyring_alloc("_ses", cred->uid, cred->gid, cred,
+                                        KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
+                                        flags, NULL);
                 if (IS_ERR(keyring))
                         return PTR_ERR(keyring);
         } else {
@@ -773,8 +779,10 @@ long join_session_keyring(const char *name)
         keyring = find_keyring_by_name(name, false);
         if (PTR_ERR(keyring) == -ENOKEY) {
                 /* not found - try and create a new one */
-                keyring = keyring_alloc(name, old->uid, old->gid, old,
-                                        KEY_ALLOC_IN_QUOTA, NULL);
+                keyring = keyring_alloc(
+                        name, old->uid, old->gid, old,
+                        KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_LINK,
+                        KEY_ALLOC_IN_QUOTA, NULL);
                 if (IS_ERR(keyring)) {
                         ret = PTR_ERR(keyring);
                         goto error2;
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 275c4f9e4b8c..0ae3a2202771 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -126,6 +126,7 @@ static int call_sbin_request_key(struct key_construction *cons,
 
         cred = get_current_cred();
         keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
+                                KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
                                 KEY_ALLOC_QUOTA_OVERRUN, NULL);
         put_cred(cred);
         if (IS_ERR(keyring)) {
@@ -347,6 +348,7 @@ static int construct_alloc_key(struct key_type *type,
         const struct cred *cred = current_cred();
         unsigned long prealloc;
         struct key *key;
+        key_perm_t perm;
         key_ref_t key_ref;
         int ret;
 
@@ -355,8 +357,15 @@ static int construct_alloc_key(struct key_type *type,
         *_key = NULL;
         mutex_lock(&user->cons_lock);
 
+        perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
+        perm |= KEY_USR_VIEW;
+        if (type->read)
+                perm |= KEY_POS_READ;
+        if (type == &key_type_keyring || type->update)
+                perm |= KEY_POS_WRITE;
+
         key = key_alloc(type, description, cred->fsuid, cred->fsgid, cred,
-                        KEY_POS_ALL, flags);
+                        perm, flags);
         if (IS_ERR(key))
                 goto alloc_failed;