linux-kernel - [PATCH (RESEND)] ecryptfs: propagate key errors up at mount time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <485AAACA.4010006@redhat.com>
Date:	Thu, 19 Jun 2008 13:51:54 -0500
From:	Eric Sandeen <sandeen@...hat.com>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Michael Halcrow <mhalcrow@...ibm.com>,
	Jan Tluka <jtluka@...hat.com>
Subject: [PATCH (RESEND)] ecryptfs: propagate key errors up at mount time

(re-sending this, forgot to actually put it on any list last time!)

Mounting with invalid key signatures should probably fail,
if they were specifically requested but not available.

Also fix case checks in process_request_key_err() for
the right sign of the errnos, as spotted by Jan Tluka.

Signed-off-by: Eric Sandeen <sandeen@...hat.com>
Acked-by: Michael Halcrow <mhalcrow@...ibm.com>
Reported-by: Jan Tluka <jtluka@...hat.com>
---

Index: linux-2.6/fs/ecryptfs/keystore.c
===================================================================
--- linux-2.6.orig/fs/ecryptfs/keystore.c	2008-06-05 13:44:20.363046095 -0500
+++ linux-2.6/fs/ecryptfs/keystore.c	2008-06-13 15:16:37.738983417 -0500
@@ -44,15 +44,15 @@ static int process_request_key_err(long 
 	int rc = 0;
 
 	switch (err_code) {
-	case ENOKEY:
+	case -ENOKEY:
 		ecryptfs_printk(KERN_WARNING, "No key\n");
 		rc = -ENOENT;
 		break;
-	case EKEYEXPIRED:
+	case -EKEYEXPIRED:
 		ecryptfs_printk(KERN_WARNING, "Key expired\n");
 		rc = -ETIME;
 		break;
-	case EKEYREVOKED:
+	case -EKEYREVOKED:
 		ecryptfs_printk(KERN_WARNING, "Key revoked\n");
 		rc = -EINVAL;
 		break;
@@ -963,8 +963,7 @@ int ecryptfs_keyring_auth_tok_for_sig(st
 	if (!(*auth_tok_key) || IS_ERR(*auth_tok_key)) {
 		printk(KERN_ERR "Could not find key with description: [%s]\n",
 		       sig);
-		process_request_key_err(PTR_ERR(*auth_tok_key));
-		rc = -EINVAL;
+		rc = process_request_key_err(PTR_ERR(*auth_tok_key));
 		goto out;
 	}
 	(*auth_tok) = ecryptfs_get_key_payload_data(*auth_tok_key);
Index: linux-2.6/fs/ecryptfs/main.c
===================================================================
--- linux-2.6.orig/fs/ecryptfs/main.c	2008-06-05 13:44:20.363046095 -0500
+++ linux-2.6/fs/ecryptfs/main.c	2008-06-13 15:16:37.756983075 -0500
@@ -262,10 +262,11 @@ static int ecryptfs_init_global_auth_tok
 			       "session keyring for sig specified in mount "
 			       "option: [%s]\n", global_auth_tok->sig);
 			global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;
-			rc = 0;
+			goto out;
 		} else
 			global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;
 	}
+out:
 	return rc;
 }
 
@@ -430,7 +431,6 @@ static int ecryptfs_parse_options(struct
 		printk(KERN_WARNING "One or more global auth toks could not "
 		       "properly register; rc = [%d]\n", rc);
 	}
-	rc = 0;
 out:
 	return rc;
 }



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/