ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 12:43:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

keys: Make the KEY_NEED_* perms an enum rather than a mask

Browse Source 
Since the meaning of combining the KEY_NEED_* constants is undefined, make
it so that you can't do that by turning them into an enum.

The enum is also given some extra values to represent special
circumstances, such as:

 (1) The '0' value is reserved and causes a warning to trap the parameter
     being unset.

 (2) The key is to be unlinked and we require no permissions on it, only
     the keyring, (this replaces the KEY_LOOKUP_FOR_UNLINK flag).

 (3) An override due to CAP_SYS_ADMIN.

 (4) An override due to an instantiation token being present.

 (5) The permissions check is being deferred to later key_permission()
     calls.

The extra values give the opportunity for LSMs to audit these situations.

[Note: This really needs overhauling so that lookup_user_key() tells
 key_task_permission() and the LSM what operation is being done and leaves
 it to those functions to decide how to map that onto the available
 permits.  However, I don't really want to make these change in the middle
 of the notifications patchset.]

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
cc: Paul Moore <paul@paul-moore.com>
cc: Stephen Smalley <stephen.smalley.work@gmail.com>
cc: Casey Schaufler <casey@schaufler-ca.com>
cc: keyrings@vger.kernel.org
cc: selinux@vger.kernel.org
This commit is contained in:
David Howells
2020-05-12 15:16:29 +01:00
parent e7d553d69c
commit 8c0637e950
9 changed files with 135 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
security/selinux/hooks.c
View File

@@ -6561,20 +6561,43 @@ static void selinux_key_free(struct key *k)
static int selinux_key_permission(key_ref_t key_ref,
const struct cred *cred,
unsigned perm)
enum key_need_perm need_perm)
{
struct key *key;
struct key_security_struct *ksec;
u32 sid;
u32 perm, sid;
/* if no specific permissions are requested, we skip the
permission check. No serious, additional covert channels
appear to be created. */
if (perm == 0)
switch (need_perm) {
case KEY_NEED_VIEW:
perm = KEY__VIEW;
break;
case KEY_NEED_READ:
perm = KEY__READ;
break;
case KEY_NEED_WRITE:
perm = KEY__WRITE;
break;
case KEY_NEED_SEARCH:
perm = KEY__SEARCH;
break;
case KEY_NEED_LINK:
perm = KEY__LINK;
break;
case KEY_NEED_SETATTR:
perm = KEY__SETATTR;
break;
case KEY_NEED_UNLINK:
case KEY_SYSADMIN_OVERRIDE:
case KEY_AUTHTOKEN_OVERRIDE:
case KEY_DEFER_PERM_CHECK:
return 0;
default:
WARN_ON(1);
return -EPERM;
}
sid = cred_sid(cred);
key = key_ref_to_ptr(key_ref);
ksec = key->security;