4 files changed, 63 insertions, 137 deletions

diff --git a/security/commoncap.c b/security/commoncap.c
index 8a6e097f99ea..841eb4e5c62b 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -60,8 +60,8 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
 int cap_ptrace (struct task_struct *parent, struct task_struct *child)
 {
         /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
-        if (!cap_issubset (child->cap_permitted, current->cap_permitted) &&
-            !capable(CAP_SYS_PTRACE))
+        if (!cap_issubset(child->cap_permitted, parent->cap_permitted) &&
+            !__capable(parent, CAP_SYS_PTRACE))
                 return -EPERM;
         return 0;
 }
diff --git a/security/keys/key.c b/security/keys/key.c
index 99781b798312..a057e3311aad 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -1,6 +1,6 @@
 /* key.c: basic authentication token and access key management
  *
- * Copyright (C) 2004 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2004-6 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
  * This program is free software; you can redistribute it and/or
@@ -271,7 +271,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
          * its description */
         if (!not_in_quota) {
                 spin_lock(&user->lock);
-                if (user->qnkeys + 1 >= KEYQUOTA_MAX_KEYS &&
+                if (user->qnkeys + 1 >= KEYQUOTA_MAX_KEYS ||
                     user->qnbytes + quotalen >= KEYQUOTA_MAX_BYTES
                     )
                         goto no_quota;
@@ -795,12 +795,16 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                 goto error_3;
         }
 
-        /* search for an existing key of the same type and description in the
-         * destination keyring
+        /* if it's possible to update this type of key, search for an existing
+         * key of the same type and description in the destination keyring and
+         * update that instead if possible
          */
-        key_ref = __keyring_search_one(keyring_ref, ktype, description, 0);
-        if (!IS_ERR(key_ref))
-                goto found_matching_key;
+        if (ktype->update) {
+                key_ref = __keyring_search_one(keyring_ref, ktype, description,
+                                               0);
+                if (!IS_ERR(key_ref))
+                        goto found_matching_key;
+        }
 
         /* decide on the permissions we want */
         perm = KEY_POS_VIEW | KEY_POS_SEARCH | KEY_POS_LINK | KEY_POS_SETATTR;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 0c62798ac7d8..ed71d86d2ce2 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -17,10 +17,33 @@
 #include <linux/keyctl.h>
 #include <linux/fs.h>
 #include <linux/capability.h>
+#include <linux/string.h>
 #include <linux/err.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
+static int key_get_type_from_user(char *type,
+                                  const char __user *_type,
+                                  unsigned len)
+{
+        int ret;
+
+        ret = strncpy_from_user(type, _type, len);
+
+        if (ret < 0)
+                return -EFAULT;
+
+        if (ret == 0 || ret >= len)
+                return -EINVAL;
+
+        if (type[0] == '.')
+                return -EPERM;
+
+        type[len - 1] = '\0';
+
+        return 0;
+}
+
 /*****************************************************************************/
 /*
  * extract the description of a new key from userspace and either add it as a
@@ -38,40 +61,22 @@ asmlinkage long sys_add_key(const char __user *_type,
         key_ref_t keyring_ref, key_ref;
         char type[32], *description;
         void *payload;
-        long dlen, ret;
+        long ret;
 
         ret = -EINVAL;
         if (plen > 32767)
                 goto error;
 
         /* draw all the data into kernel space */
-        ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+        ret = key_get_type_from_user(type, _type, sizeof(type));
         if (ret < 0)
                 goto error;
-        type[31] = '\0';
-
-        ret = -EPERM;
-        if (type[0] == '.')
-                goto error;
-
-        ret = -EFAULT;
-        dlen = strnlen_user(_description, PAGE_SIZE - 1);
-        if (dlen <= 0)
-                goto error;
 
-        ret = -EINVAL;
-        if (dlen > PAGE_SIZE - 1)
-                goto error;
-
-        ret = -ENOMEM;
-        description = kmalloc(dlen + 1, GFP_KERNEL);
-        if (!description)
+        description = strndup_user(_description, PAGE_SIZE);
+        if (IS_ERR(description)) {
+                ret = PTR_ERR(description);
                 goto error;
-        description[dlen] = '\0';
-
-        ret = -EFAULT;
-        if (copy_from_user(description, _description, dlen) != 0)
-                goto error2;
+        }
 
         /* pull the payload in if one was supplied */
         payload = NULL;
@@ -136,59 +141,28 @@ asmlinkage long sys_request_key(const char __user *_type,
         struct key *key;
         key_ref_t dest_ref;
         char type[32], *description, *callout_info;
-        long dlen, ret;
+        long ret;
 
         /* pull the type into kernel space */
-        ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+        ret = key_get_type_from_user(type, _type, sizeof(type));
         if (ret < 0)
                 goto error;
-        type[31] = '\0';
-
-        ret = -EPERM;
-        if (type[0] == '.')
-                goto error;
 
         /* pull the description into kernel space */
-        ret = -EFAULT;
-        dlen = strnlen_user(_description, PAGE_SIZE - 1);
-        if (dlen <= 0)
-                goto error;
-
-        ret = -EINVAL;
-        if (dlen > PAGE_SIZE - 1)
-                goto error;
-
-        ret = -ENOMEM;
-        description = kmalloc(dlen + 1, GFP_KERNEL);
-        if (!description)
+        description = strndup_user(_description, PAGE_SIZE);
+        if (IS_ERR(description)) {
+                ret = PTR_ERR(description);
                 goto error;
-        description[dlen] = '\0';
-
-        ret = -EFAULT;
-        if (copy_from_user(description, _description, dlen) != 0)
-                goto error2;
+        }
 
         /* pull the callout info into kernel space */
         callout_info = NULL;
         if (_callout_info) {
-                ret = -EFAULT;
-                dlen = strnlen_user(_callout_info, PAGE_SIZE - 1);
-                if (dlen <= 0)
-                        goto error2;
-
-                ret = -EINVAL;
-                if (dlen > PAGE_SIZE - 1)
-                        goto error2;
-
-                ret = -ENOMEM;
-                callout_info = kmalloc(dlen + 1, GFP_KERNEL);
-                if (!callout_info)
+                callout_info = strndup_user(_callout_info, PAGE_SIZE);
+                if (IS_ERR(callout_info)) {
+                        ret = PTR_ERR(callout_info);
                         goto error2;
-                callout_info[dlen] = '\0';
-
-                ret = -EFAULT;
-                if (copy_from_user(callout_info, _callout_info, dlen) != 0)
-                        goto error3;
+                }
         }
 
         /* get the destination keyring if specified */
@@ -264,36 +238,21 @@ long keyctl_get_keyring_ID(key_serial_t id, int create)
 long keyctl_join_session_keyring(const char __user *_name)
 {
         char *name;
-        long nlen, ret;
+        long ret;
 
         /* fetch the name from userspace */
         name = NULL;
         if (_name) {
-                ret = -EFAULT;
-                nlen = strnlen_user(_name, PAGE_SIZE - 1);
-                if (nlen <= 0)
-                        goto error;
-
-                ret = -EINVAL;
-                if (nlen > PAGE_SIZE - 1)
+                name = strndup_user(_name, PAGE_SIZE);
+                if (IS_ERR(name)) {
+                        ret = PTR_ERR(name);
                         goto error;
-
-                ret = -ENOMEM;
-                name = kmalloc(nlen + 1, GFP_KERNEL);
-                if (!name)
-                        goto error;
-                name[nlen] = '\0';
-
-                ret = -EFAULT;
-                if (copy_from_user(name, _name, nlen) != 0)
-                        goto error2;
+                }
         }
 
         /* join the session */
         ret = join_session_keyring(name);
 
- error2:
-        kfree(name);
  error:
         return ret;
 
@@ -566,32 +525,18 @@ long keyctl_keyring_search(key_serial_t ringid,
         struct key_type *ktype;
         key_ref_t keyring_ref, key_ref, dest_ref;
         char type[32], *description;
-        long dlen, ret;
+        long ret;
 
         /* pull the type and description into kernel space */
-        ret = strncpy_from_user(type, _type, sizeof(type) - 1);
+        ret = key_get_type_from_user(type, _type, sizeof(type));
         if (ret < 0)
                 goto error;
-        type[31] = '\0';
 
-        ret = -EFAULT;
-        dlen = strnlen_user(_description, PAGE_SIZE - 1);
-        if (dlen <= 0)
+        description = strndup_user(_description, PAGE_SIZE);
+        if (IS_ERR(description)) {
+                ret = PTR_ERR(description);
                 goto error;
-
-        ret = -EINVAL;
-        if (dlen > PAGE_SIZE - 1)
-                goto error;
-
-        ret = -ENOMEM;
-        description = kmalloc(dlen + 1, GFP_KERNEL);
-        if (!description)
-                goto error;
-        description[dlen] = '\0';
-
-        ret = -EFAULT;
-        if (copy_from_user(description, _description, dlen) != 0)
-                goto error2;
+        }
 
         /* get the keyring at which to begin the search */
         keyring_ref = lookup_user_key(NULL, ringid, 0, 0, KEY_SEARCH);
diff --git a/security/security.c b/security/security.c
index f693e1f66b98..51ef509710b9 100644
--- a/security/security.c
+++ b/security/security.c
@@ -174,31 +174,8 @@ int mod_unreg_security(const char *name, struct security_operations *ops)
         return security_ops->unregister_security(name, ops);
 }
 
-/**
- * capable - calls the currently loaded security module's capable() function with the specified capability
- * @cap: the requested capability level.
- *
- * This function calls the currently loaded security module's capable()
- * function with a pointer to the current task and the specified @cap value.
- *
- * This allows the security module to implement the capable function call
- * however it chooses to.
- */
-int capable(int cap)
-{
-        if (security_ops->capable(current, cap)) {
-                /* capability denied */
-                return 0;
-        }
-
-        /* capability granted */
-        current->flags |= PF_SUPERPRIV;
-        return 1;
-}
-
 EXPORT_SYMBOL_GPL(register_security);
 EXPORT_SYMBOL_GPL(unregister_security);
 EXPORT_SYMBOL_GPL(mod_reg_security);
 EXPORT_SYMBOL_GPL(mod_unreg_security);
-EXPORT_SYMBOL(capable);
 EXPORT_SYMBOL(security_ops);