5 files changed, 42 insertions, 14 deletions

diff --git a/security/keys/internal.h b/security/keys/internal.h
index 3c2877f0663e..1bb416f4bbce 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -99,6 +99,7 @@ extern int install_process_keyring(struct task_struct *tsk);
 extern struct key *request_key_and_link(struct key_type *type,
                                         const char *description,
                                         const char *callout_info,
+                                        void *aux,
                                         struct key *dest_keyring,
                                         unsigned long flags);
 
diff --git a/security/keys/key.c b/security/keys/key.c
index 43295ca37b5d..80de8c3e9cc3 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -11,6 +11,7 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/poison.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/security.h>
@@ -988,7 +989,7 @@ void unregister_key_type(struct key_type *ktype)
                 if (key->type == ktype) {
                         if (ktype->destroy)
                                 ktype->destroy(key);
-                        memset(&key->payload, 0xbd, sizeof(key->payload));
+                        memset(&key->payload, KEY_DESTROY, sizeof(key->payload));
                 }
         }
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 329411cf8768..d9ca15c109cc 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -183,7 +183,7 @@ asmlinkage long sys_request_key(const char __user *_type,
         }
 
         /* do the search */
-        key = request_key_and_link(ktype, description, callout_info,
+        key = request_key_and_link(ktype, description, callout_info, NULL,
                                    key_ref_to_ptr(dest_ref),
                                    KEY_ALLOC_IN_QUOTA);
         if (IS_ERR(key)) {
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 58d1efd4fc2c..f573ac189a0a 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -1,6 +1,6 @@
 /* request_key.c: request a key from userspace
  *
- * Copyright (C) 2004-5 Red Hat, Inc. All Rights Reserved.
+ * Copyright (C) 2004-6 Red Hat, Inc. All Rights Reserved.
  * Written by David Howells (dhowells@redhat.com)
  *
  * This program is free software; you can redistribute it and/or
@@ -33,7 +33,8 @@ DECLARE_WAIT_QUEUE_HEAD(request_key_conswq);
  */
 static int call_sbin_request_key(struct key *key,
                                  struct key *authkey,
-                                 const char *op)
+                                 const char *op,
+                                 void *aux)
 {
         struct task_struct *tsk = current;
         key_serial_t prkey, sskey;
@@ -127,6 +128,7 @@ error_alloc:
 static struct key *__request_key_construction(struct key_type *type,
                                               const char *description,
                                               const char *callout_info,
+                                              void *aux,
                                               unsigned long flags)
 {
         request_key_actor_t actor;
@@ -164,7 +166,7 @@ static struct key *__request_key_construction(struct key_type *type,
         actor = call_sbin_request_key;
         if (type->request_key)
                 actor = type->request_key;
-        ret = actor(key, authkey, "create");
+        ret = actor(key, authkey, "create", aux);
         if (ret < 0)
                 goto request_failed;
 
@@ -258,8 +260,9 @@ alloc_failed:
  */
 static struct key *request_key_construction(struct key_type *type,
                                             const char *description,
-                                            struct key_user *user,
                                             const char *callout_info,
+                                            void *aux,
+                                            struct key_user *user,
                                             unsigned long flags)
 {
         struct key_construction *pcons;
@@ -284,7 +287,7 @@ static struct key *request_key_construction(struct key_type *type,
         }
 
         /* see about getting userspace to construct the key */
-        key = __request_key_construction(type, description, callout_info,
+        key = __request_key_construction(type, description, callout_info, aux,
                                          flags);
  error:
         kleave(" = %p", key);
@@ -392,6 +395,7 @@ static void request_key_link(struct key *key, struct key *dest_keyring)
 struct key *request_key_and_link(struct key_type *type,
                                  const char *description,
                                  const char *callout_info,
+                                 void *aux,
                                  struct key *dest_keyring,
                                  unsigned long flags)
 {
@@ -399,8 +403,9 @@ struct key *request_key_and_link(struct key_type *type,
         struct key *key;
         key_ref_t key_ref;
 
-        kenter("%s,%s,%s,%p,%lx",
-               type->name, description, callout_info, dest_keyring, flags);
+        kenter("%s,%s,%s,%p,%p,%lx",
+               type->name, description, callout_info, aux,
+               dest_keyring, flags);
 
         /* search all the process keyrings for a key */
         key_ref = search_process_keyrings(type, description, type->match,
@@ -433,8 +438,8 @@ struct key *request_key_and_link(struct key_type *type,
                         /* ask userspace (returns NULL if it waited on a key
                          * being constructed) */
                         key = request_key_construction(type, description,
-                                                       user, callout_info,
-                                                       flags);
+                                                       callout_info, aux,
+                                                       user, flags);
                         if (key)
                                 break;
 
@@ -491,8 +496,27 @@ struct key *request_key(struct key_type *type,
                         const char *callout_info)
 {
         return request_key_and_link(type, description, callout_info, NULL,
-                                    KEY_ALLOC_IN_QUOTA);
+                                    NULL, KEY_ALLOC_IN_QUOTA);
 
 } /* end request_key() */
 
 EXPORT_SYMBOL(request_key);
+
+/*****************************************************************************/
+/*
+ * request a key with auxiliary data for the upcaller
+ * - search the process's keyrings
+ * - check the list of keys being created or updated
+ * - call out to userspace for a key if supplementary info was provided
+ */
+struct key *request_key_with_auxdata(struct key_type *type,
+                                     const char *description,
+                                     const char *callout_info,
+                                     void *aux)
+{
+        return request_key_and_link(type, description, callout_info, aux,
+                                    NULL, KEY_ALLOC_IN_QUOTA);
+
+} /* end request_key_with_auxdata() */
+
+EXPORT_SYMBOL(request_key_with_auxdata);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ac7f2b2e3924..28832e689800 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1532,8 +1532,9 @@ static int selinux_bprm_set_security(struct linux_binprm *bprm)
         /* Default to the current task SID. */
         bsec->sid = tsec->sid;
 
-        /* Reset create and sockcreate SID on execve. */
+        /* Reset fs, key, and sock SIDs on execve. */
         tsec->create_sid = 0;
+        tsec->keycreate_sid = 0;
         tsec->sockcreate_sid = 0;
 
         if (tsec->exec_sid) {
@@ -2586,9 +2587,10 @@ static int selinux_task_alloc_security(struct task_struct *tsk)
         tsec2->osid = tsec1->osid;
         tsec2->sid = tsec1->sid;
 
-        /* Retain the exec, create, and sock SIDs across fork */
+        /* Retain the exec, fs, key, and sock SIDs across fork */
         tsec2->exec_sid = tsec1->exec_sid;
         tsec2->create_sid = tsec1->create_sid;
+        tsec2->keycreate_sid = tsec1->keycreate_sid;
         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
 
         /* Retain ptracer SID across fork, if any.