• David Howells's avatar
    KEYS: Alter use of key instantiation link-to-keyring argument · 8bbf4976
    David Howells authored
    Alter the use of the key instantiation and negation functions' link-to-keyring
    arguments.  Currently this specifies a keyring in the target process to link
    the key into, creating the keyring if it doesn't exist.  This, however, can be
    a problem for copy-on-write credentials as it means that the instantiating
    process can alter the credentials of the requesting process.
    
    This patch alters the behaviour such that:
    
     (1) If keyctl_instantiate_key() or keyctl_negate_key() are given a specific
         keyring by ID (ringid >= 0), then that keyring will be used.
    
     (2) If keyctl_instantiate_key() or keyctl_negate_key() are given one of the
         special constants that refer to the requesting process's keyrings
         (KEY_SPEC_*_KEYRING, all <= 0), then:
    
         (a) If sys_request_key() was given a keyring to use (destringid) then the
         	 key will be attached to that keyring.
    
         (b) If sys_request_key() was given a NULL keyring, then the key being
         	 instantiated will be attached to the default keyring as set by
         	 keyctl_set_reqkey_keyring().
    
     (3) No extra link will be made.
    
    Decision point (1) follows current behaviour, and allows those instantiators
    who've searched for a specifically named keyring in the requestor's keyring so
    as to partition the keys by type to still have their named keyrings.
    
    Decision point (2) allows the requestor to make sure that the key or keys that
    get produced by request_key() go where they want, whilst allowing the
    instantiator to request that the key is retained.  This is mainly useful for
    situations where the instantiator makes a secondary request, the key for which
    should be retained by the initial requestor:
    
    	+-----------+        +--------------+        +--------------+
    	|           |        |              |        |              |
    	| Requestor |------->| Instantiator |------->| Instantiator |
    	|           |        |              |        |              |
    	+-----------+        +--------------+        +--------------+
    	           request_key()           request_key()
    
    This might be useful, for example, in Kerberos, where the requestor requests a
    ticket, and then the ticket instantiator requests the TGT, which someone else
    then has to go and fetch.  The TGT, however, should be retained in the
    keyrings of the requestor, not the first instantiator.  To make this explict
    an extra special keyring constant is also added.
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Reviewed-by: default avatarJames Morris <jmorris@namei.org>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    8bbf4976
request_key_auth.c 7.59 KB