aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'stable-4.12' of git://git.infradead.org/users/pcmoore/selinux ↵James Morris2017-04-1911-70/+69
|\ | | | | | | into next
| * selinux: Fix an uninitialized variable bugDan Carpenter2017-03-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | We removed this initialization as a cleanup but it is probably required. The concern is that "nel" can be zero. I'm not an expert on SELinux code but I think it looks possible to write an SELinux policy which triggers this bug. GCC doesn't catch this, but my static checker does. Fixes: 9c312e79d6af ("selinux: Delete an unnecessary variable initialisation in range_read()") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Remove unnecessary check of array base in selinux_set_mapping()Matthias Kaehlcke2017-03-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'perms' will never be NULL since it isn't a plain pointer but an array of u32 values. This fixes the following warning when building with clang: security/selinux/ss/services.c:158:16: error: address of array 'p_in->perms' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion] while (p_in->perms && p_in->perms[k]) { Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checksStephen Smalley2017-03-291-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | generic_permission() presently checks CAP_DAC_OVERRIDE prior to CAP_DAC_READ_SEARCH. This can cause misleading audit messages when using a LSM such as SELinux or AppArmor, since CAP_DAC_OVERRIDE may not be required for the operation. Flip the order of the tests so that CAP_DAC_OVERRIDE is only checked when required for the operation. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: John Johansen <john.johansen@canonical.com> Reviewed-by: Serge Hallyn <serge@hallyn.com> Acked-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinuxfs: Use seq_puts() in sel_avc_stats_seq_show()Markus Elfring2017-03-291-4/+4
| | | | | | | | | | | | | | | | | | | | A string which did not contain data format specifications should be put into a sequence. Thus use the corresponding function "seq_puts". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Adjust two checks for null pointersMarkus Elfring2017-03-291-2/+2
| | | | | | | | | | | | | | | | | | | | | | The script "checkpatch.pl" pointed information out like the following. Comparison to NULL could be written !… Thus fix affected source code places. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Use kmalloc_array() in sidtab_init()Markus Elfring2017-03-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in roles_init()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in perm_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in common_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in class_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in role_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in type_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in user_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Improve another size determination in sens_read()Markus Elfring2017-03-291-1/+1
| | | | | | | | | | | | | | | | | | Replace the specification of a data type by a pointer dereference as the parameter for the operator "sizeof" to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in sens_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed kzalloc() in cat_read()Markus Elfring2017-03-291-2/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "kzalloc" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Delete an unnecessary variable initialisation in range_read()Markus Elfring2017-03-231-1/+1
| | | | | | | | | | | | | | | | | | The local variable "rt" will be set to an appropriate pointer a bit later. Thus omit the explicit initialisation at the beginning which became unnecessary with a previous update step. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed next_entry() in range_read()Markus Elfring2017-03-231-1/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "next_entry" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Delete an unnecessary variable assignment in filename_trans_read()Markus Elfring2017-03-231-1/+0
| | | | | | | | | | | | | | | | | | The local variable "ft" was set to a null pointer despite of an immediate reassignment. Thus remove this statement from the beginning of a loop. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: One function call less in genfs_read() after null pointer detectionMarkus Elfring2017-03-231-2/+3
| | | | | | | | | | | | | | | | Call the function "kfree" at the end only after it was determined that the local variable "newgenfs" contained a non-null pointer. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Return directly after a failed next_entry() in genfs_read()Markus Elfring2017-03-231-1/+1
| | | | | | | | | | | | | | | | Return directly after a call of the function "next_entry" failed at the beginning. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Delete an unnecessary return statement in policydb_destroy()Markus Elfring2017-03-231-2/+0
| | | | | | | | | | | | | | | | | | | | | | The script "checkpatch.pl" pointed information out like the following. WARNING: void function return statements are not generally useful Thus remove such a statement in the affected function. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Use kcalloc() in policydb_index()Markus Elfring2017-03-231-9/+9
| | | | | | | | | | | | | | | | | | | | | | Multiplications for the size determination of memory allocations indicated that array data structures should be processed. Thus use the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Adjust four checks for null pointersMarkus Elfring2017-03-231-4/+4
| | | | | | | | | | | | | | | | | | | | | | The script "checkpatch.pl" pointed information out like the following. Comparison to NULL could be written !… Thus fix affected source code places. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Use kmalloc_array() in hashtab_create()Markus Elfring2017-03-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Improve size determinations in four functionsMarkus Elfring2017-03-231-4/+4
| | | | | | | | | | | | | | | | | | Replace the specification of data structures by pointer dereferences as the parameter for the operator "sizeof" to make the corresponding size determination a bit safer. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Delete an unnecessary return statement in cond_compute_av()Markus Elfring2017-03-231-1/+0
| | | | | | | | | | | | | | | | | | | | | | The script "checkpatch.pl" pointed information out like the following. WARNING: void function return statements are not generally useful Thus remove such a statement in the affected function. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: Use kmalloc_array() in cond_init_bool_indexes()Markus Elfring2017-03-231-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. * Replace the specification of a data type by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: check for address length in selinux_socket_bind()Alexander Potapenko2017-03-101-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | KMSAN (KernelMemorySanitizer, a new error detection tool) reports use of uninitialized memory in selinux_socket_bind(): ================================================================== BUG: KMSAN: use of unitialized memory inter: 0 CPU: 3 PID: 1074 Comm: packet2 Tainted: G B 4.8.0-rc6+ #1916 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 0000000000000000 ffff8800882ffb08 ffffffff825759c8 ffff8800882ffa48 ffffffff818bf551 ffffffff85bab870 0000000000000092 ffffffff85bab550 0000000000000000 0000000000000092 00000000bb0009bb 0000000000000002 Call Trace: [< inline >] __dump_stack lib/dump_stack.c:15 [<ffffffff825759c8>] dump_stack+0x238/0x290 lib/dump_stack.c:51 [<ffffffff818bdee6>] kmsan_report+0x276/0x2e0 mm/kmsan/kmsan.c:1008 [<ffffffff818bf0fb>] __msan_warning+0x5b/0xb0 mm/kmsan/kmsan_instr.c:424 [<ffffffff822dae71>] selinux_socket_bind+0xf41/0x1080 security/selinux/hooks.c:4288 [<ffffffff8229357c>] security_socket_bind+0x1ec/0x240 security/security.c:1240 [<ffffffff84265d98>] SYSC_bind+0x358/0x5f0 net/socket.c:1366 [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356 [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [<ffffffff8518217c>] entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.o:? chained origin: 00000000ba6009bb [<ffffffff810bb7a7>] save_stack_trace+0x27/0x50 arch/x86/kernel/stacktrace.c:67 [< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:322 [< inline >] kmsan_save_stack mm/kmsan/kmsan.c:337 [<ffffffff818bd2b8>] kmsan_internal_chain_origin+0x118/0x1e0 mm/kmsan/kmsan.c:530 [<ffffffff818bf033>] __msan_set_alloca_origin4+0xc3/0x130 mm/kmsan/kmsan_instr.c:380 [<ffffffff84265b69>] SYSC_bind+0x129/0x5f0 net/socket.c:1356 [<ffffffff84265a22>] SyS_bind+0x82/0xa0 net/socket.c:1356 [<ffffffff81005678>] do_syscall_64+0x58/0x70 arch/x86/entry/common.c:292 [<ffffffff8518217c>] return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.o:? origin description: ----address@SYSC_bind (origin=00000000b8c00900) ================================================================== (the line numbers are relative to 4.8-rc6, but the bug persists upstream) , when I run the following program as root: ======================================================= #include <string.h> #include <sys/socket.h> #include <netinet/in.h> int main(int argc, char *argv[]) { struct sockaddr addr; int size = 0; if (argc > 1) { size = atoi(argv[1]); } memset(&addr, 0, sizeof(addr)); int fd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); bind(fd, &addr, size); return 0; } ======================================================= (for different values of |size| other error reports are printed). This happens because bind() unconditionally copies |size| bytes of |addr| to the kernel, leaving the rest uninitialized. Then security_socket_bind() reads the IP address bytes, including the uninitialized ones, to determine the port, or e.g. pass them further to sel_netnode_find(), which uses them to calculate a hash. Signed-off-by: Alexander Potapenko <glider@google.com> Acked-by: Eric Dumazet <edumazet@google.com> [PM: fixed some whitespace damage] Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: include sys/socket.h in host programs to have PF_MAXNicolas Iooss2017-03-102-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compiling with clang and -Wundef makes the compiler report a usage of undefined PF_MAX macro in security/selinux/include/classmap.h: In file included from scripts/selinux/mdp/mdp.c:48: security/selinux/include/classmap.h:37:31: warning: no previous extern declaration for non-static variable 'secclass_map' [-Wmissing-variable-declarations] struct security_class_mapping secclass_map[] = { ^ security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not defined, evaluates to 0 [-Werror,-Wundef] #if PF_MAX > 43 ^ In file included from scripts/selinux/genheaders/genheaders.c:17: security/selinux/include/classmap.h:37:31: warning: no previous extern declaration for non-static variable 'secclass_map' [-Wmissing-variable-declarations] struct security_class_mapping secclass_map[] = { ^ security/selinux/include/classmap.h:235:5: error: 'PF_MAX' is not defined, evaluates to 0 [-Werror,-Wundef] #if PF_MAX > 43 ^ PF_MAX is defined in include/linux/socket.h but not in include/uapi/linux/socket.h. Therefore host programs have to rely on the definition from libc's /usr/include/bits/socket.h, included by <sys/socket.h>. Fix the issue by using sys/socket.h in mdp and genheaders. When classmap.h is included by security/selinux/avc.c, it uses the kernel definition of PF_MAX, which makes the test consistent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> Signed-off-by: Paul Moore <paul@paul-moore.com>
| * selinux: constify nlmsg permission tablesJames Morris2017-03-061-5/+5
| | | | | | | | | | | | | | | | Constify nlmsg permission tables, which are initialized once and then do not change. Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
* | Merge tag 'keys-next-20170412' of ↵James Morris2017-04-1833-116/+1305
|\ \ | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next
| * | keys: select CONFIG_CRYPTO when selecting DH / KDFStephan Müller2017-04-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Select CONFIG_CRYPTO in addition to CONFIG_HASH to ensure that also CONFIG_HASH2 is selected. Both are needed for the shash cipher support required for the KDF operation. Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: David Howells <dhowells@redhat.com>
| * | KEYS: add SP800-56A KDF support for DHStephan Mueller2017-04-0410-26/+315
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SP800-56A defines the use of DH with key derivation function based on a counter. The input to the KDF is defined as (DH shared secret || other information). The value for the "other information" is to be provided by the caller. The KDF is implemented using the hash support from the kernel crypto API. The implementation uses the symmetric hash support as the input to the hash operation is usually very small. The caller is allowed to specify the hash name that he wants to use to derive the key material allowing the use of all supported hashes provided with the kernel crypto API. As the KDF implements the proper truncation of the DH shared secret to the requested size, this patch fills the caller buffer up to its size. The patch is tested with a new test added to the keyutils user space code which uses a CAVS test vector testing the compliance with SP800-56A. Signed-off-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: David Howells <dhowells@redhat.com>
| * | Merge branch 'keyctl-restrict' of ↵David Howells2017-04-0418-82/+724
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/martineau/linux into keys-next To quote Mat Martineau: """ Keyrings recently acquired the ability to validate keys before they are linked using kernel internal APIs. This patch set enables configuration of restricted keyrings from userspace. These patches apply to linux-fs/keys-misc and are also available here: https://git.kernel.org/cgit/linux/kernel/git/martineau/linux.git/log/?h=keyctl-restrict v13: Detect and avoid cycles in restriction references, and change restrictions to store a single key pointer rather than arbitrary data. v12: Rework the KEYCTL_RESTRICT_KEYRING command to take an additional parameter, renamed some functions based on feedback, and dropped an unnecessary locking change (patch 1 in previous set). v11: Configure restrictions using KEYCTL_RESTRICT_KEYRING instead of using a keyring payload at creation time. Make the garbage collector aware of restrictions. v10: Fixups from maintainer feedback. Added some missing documentation. v9: Rebased on linux-fs/keys-misc (v4.9-rc5) v8: Add option to look for signing keys within the destination keyring. Fix a consistency issue with keyring locking and restriction checks. v7: Rework key restriction payload syntax. Move key-type-specific payload parsing to the key-type. Attach more restriction information to keyrings (restriction function, data, and data free) so future restrictions are not limited to storing a key ID to use for key validation. Validate key before using it to verify another key. Modify key type locking model to allow key type lookup during keyring creation. v6: Return error if only restrict_key is supplied, address misc. review comments. v5: Fixed signature bypass problem in patch 3/6 v4: Added userspace restriction options based on builtin keyrings. restrict_link_by_signature implementation is no longer modified. Split up v3's patch 2/5 to isolate the change to key.h. v3: Updated commit message for patch 2/5 (restrict_link_by_signature_indirect) v2: Payload is now preparsed """ Signed-off-by: David Howells <dhowells@redhat.com>
| | * | KEYS: Keyring asymmetric key restrict method with chainingMat Martineau2017-04-044-46/+155
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a restrict_link_by_key_or_keyring_chain link restriction that searches for signing keys in the destination keyring in addition to the signing key or keyring designated when the destination keyring was created. Userspace enables this behavior by including the "chain" option in the keyring restriction: keyctl(KEYCTL_RESTRICT_KEYRING, keyring, "asymmetric", "key_or_keyring:<signing key>:chain"); Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Restrict asymmetric key linkage using a specific keychainMat Martineau2017-04-044-1/+121
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds restrict_link_by_signature_keyring(), which uses the restrict_key member of the provided destination_keyring data structure as the key or keyring to search for signing keys. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Add a lookup_restriction function for the asymmetric key typeMat Martineau2017-04-042-8/+79
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Look up asymmetric keyring restriction information using the key-type lookup_restrict hook. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Add KEYCTL_RESTRICT_KEYRINGMat Martineau2017-04-047-1/+201
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Keyrings recently gained restrict_link capabilities that allow individual keys to be validated prior to linking. This functionality was only available using internal kernel APIs. With the KEYCTL_RESTRICT_KEYRING command existing keyrings can be configured to check the content of keys before they are linked, and then allow or disallow linkage of that key to the keyring. To restrict a keyring, call: keyctl(KEYCTL_RESTRICT_KEYRING, key_serial_t keyring, const char *type, const char *restriction) where 'type' is the name of a registered key type and 'restriction' is a string describing how key linkage is to be restricted. The restriction option syntax is specific to each key type. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Consistent ordering for __key_link_begin and restrict checkMat Martineau2017-04-041-11/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The keyring restrict callback was sometimes called before __key_link_begin and sometimes after, which meant that the keyring semaphores were not always held during the restrict callback. If the semaphores are consistently acquired before checking link restrictions, keyring contents cannot be changed after the restrict check is complete but before the evaluated key is linked to the keyring. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Add an optional lookup_restriction hook to key_typeMat Martineau2017-04-042-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The restrict_link functions used to validate keys as they are linked to a keyring can be associated with specific key types. Each key type may be loaded (or not) at runtime, so lookup of restrict_link functions needs to be part of the key type implementation to ensure that the requested keys can be examined. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Use structure to capture key restriction function and dataMat Martineau2017-04-049-30/+144
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace struct key's restrict_link function pointer with a pointer to the new struct key_restriction. The structure contains pointers to the restriction function as well as relevant data for evaluating the restriction. The garbage collector checks restrict_link->keytype when key types are unregistered. Restrictions involving a removed key type are converted to use restrict_link_reject so that restrictions cannot be removed by unregistering key types. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Add a key restriction structMat Martineau2017-04-031-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Key link restrictions require restriction-specific data as well as a restriction-specific function pointer. As a first step toward replacing the restrict_link pointer in struct key, define a more general key_restriction structure that captures the required function, key, and key type pointers. Key type modules should not be pinned on account of this key type pointer because the pointer will be cleared by the garbage collector if the key type is unregistered. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Split role of the keyring pointer for keyring restrict functionsMat Martineau2017-04-038-25/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The first argument to the restrict_link_func_t functions was a keyring pointer. These functions are called by the key subsystem with this argument set to the destination keyring, but restrict_link_by_signature expects a pointer to the relevant trusted keyring. Restrict functions may need something other than a single struct key pointer to allow or reject key linkage, so the data used to make that decision (such as the trust keyring) is moved to a new, fourth argument. The first argument is now always the destination keyring. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| | * | KEYS: Use a typedef for restrict_link function pointersMat Martineau2017-04-034-22/+11
| |/ / | | | | | | | | | | | | | | | | | | This pointer type needs to be returned from a lookup function, and without a typedef the syntax gets cumbersome. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
| * | Merge branch 'keys-blacklist' into keys-nextDavid Howells2017-04-0311-8/+265
| |\ \
| | * | PKCS#7: Handle blacklisted certificatesDavid Howells2017-04-032-8/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | PKCS#7: Handle certificates that are blacklisted when verifying the chain of trust on the signatures on a PKCS#7 message. Signed-off-by: David Howells <dhowells@redhat.com>
| | * | X.509: Allow X.509 certs to be blacklistedDavid Howells2017-04-032-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow X.509 certs to be blacklisted based on their TBSCertificate hash. This is convenient since we have to determine this anyway to be able to check the signature on an X.509 certificate. This is also what UEFI uses in its blacklist. If a certificate built into the kernel is blacklisted, something like the following might then be seen during boot: X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted Problem loading in-kernel X.509 certificate (-129) where the hex string shown is the blacklisted hash. Signed-off-by: David Howells <dhowells@redhat.com>
| | * | KEYS: Add a system blacklist keyringDavid Howells2017-04-037-0/+224
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the following: (1) A new system keyring that is used to store information about blacklisted certificates and signatures. (2) A new key type (called 'blacklist') that is used to store a blacklisted hash in its description as a hex string. The key accepts no payload. (3) The ability to configure a list of blacklisted hashes into the kernel at build time. This is done by setting CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes that are in the form: "<hash>", "<hash>", ..., "<hash>" where each <hash> is a hex string representation of the hash and must include all necessary leading zeros to pad the hash to the right size. The above are enabled with CONFIG_SYSTEM_BLACKLIST_KEYRING. Once the kernel is booted, the blacklist keyring can be listed: root@andromeda ~]# keyctl show %:.blacklist Keyring 723359729 ---lswrv 0 0 keyring: .blacklist 676257228 ---lswrv 0 0 \_ blacklist: 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 The blacklist cannot currently be modified by userspace, but it will be possible to load it, for example, from the UEFI blacklist database. A later commit will make it possible to load blacklisted asymmetric keys in here too. Signed-off-by: David Howells <dhowells@redhat.com>
generated by cgit (git 2.34.1) at 2025-03-03 09:10:46 +0000