linux-kernel - Re: [PATCH 2/6] KEYS: Reinstate EPERM for a key type name beginning with a '.'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1410443212.5187.59.camel@dhcp-9-2-203-236.watson.ibm.com>
Date:	Thu, 11 Sep 2014 09:46:52 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Dmitry Kasatkin <dmitry.kasatkin@...il.com>
Cc:	David Howells <dhowells@...hat.com>,
	James Morris <jmorris@...ei.org>,
	keyrings <keyrings@...ux-nfs.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	linux-security-module <linux-security-module@...r.kernel.org>,
	Vivek Goyal <vgoyal@...hat.com>
Subject: Re: [PATCH 2/6] KEYS: Reinstate EPERM for a key type name beginning
 with a '.'

On Thu, 2014-09-11 at 15:27 +0300, Dmitry Kasatkin wrote: 
> On 11 September 2014 15:09, David Howells <dhowells@...hat.com> wrote:
> > Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> >
> >> On Wed, 2014-09-10 at 19:36 -0400, Mimi Zohar wrote:
> >> > On Wed, 2014-09-10 at 22:22 +0100, David Howells wrote:
> >> > > Reinstate the generation of EPERM for a key type name beginning with a
> >> > > '.' in a userspace call.  Types whose name begins with a '.' are
> >> > > internal only.
> >>
> >> After re-reading your comment and looking at the different types,
> >> testing for dot prefixed types now makes sense.  Both dot prefixed types
> >> and keyring names are reserved for the kernel.
> >
> > Are you withdrawing your objection, then?

The misunderstanding was based on being told that dot prefixed keyrings
were protected, but in fact the only dot prefix code was here in
key_get_type_from_user().

The concept of dot prefixing should probably be documented either in the
code and/or documentation.  At this point, both types and keyring names
are reserved.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/