• David Howells's avatar
    KEYS: Reduce initial permissions on keys · 96b5c8fe
    David Howells authored
    Reduce the initial permissions on new keys to grant the possessor everything,
    view permission only to the user (so the keys can be seen in /proc/keys) and
    nothing else.
    
    This gives the creator a chance to adjust the permissions mask before other
    processes can access the new key or create a link to it.
    
    To aid with this, keyring_alloc() now takes a permission argument rather than
    setting the permissions itself.
    
    The following permissions are now set:
    
     (1) The user and user-session keyrings grant the user that owns them full
         permissions and grant a possessor everything bar SETATTR.
    
     (2) The process and thread keyrings grant the possessor full permissions but
         only grant the user VIEW.  This permits the user to see them in
         /proc/keys, but not to do anything with them.
    
     (3) Anonymous session keyrings grant the possessor full permissions, but only
         grant the user VIEW and READ.  This means that the user can see them in
         /proc/keys and can list them, but nothing else.  Possibly READ shouldn't
         be provided either.
    
     (4) Named session keyrings grant everything an anonymous session keyring does,
         plus they grant the user LINK permission.  The whole point of named
         session keyrings is that others can also subscribe to them.  Possibly this
         should be a separate permission to LINK.
    
     (5) The temporary session keyring created by call_sbin_request_key() gets the
         same permissions as an anonymous session keyring.
    
     (6) Keys created by add_key() get VIEW, SEARCH, LINK and SETATTR for the
         possessor, plus READ and/or WRITE if the key type supports them.  The used
         only gets VIEW now.
    
     (7) Keys created by request_key() now get the same as those created by
         add_key().
    Reported-by: default avatarLennart Poettering <lennart@poettering.net>
    Reported-by: default avatarStef Walter <stefw@redhat.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    96b5c8fe
key.c 26.9 KB