linux-kernel - Re: [RFC PATCH 07/20] KEYS: Add a facility to restrict new links into a keyring [ver #2]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <30190.1456760980@warthog.procyon.org.uk>
Date:	Mon, 29 Feb 2016 15:49:40 +0000
From:	David Howells <dhowells@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	dhowells@...hat.com, linux-security-module@...r.kernel.org,
	keyrings@...r.kernel.org, petkan@...-labs.com,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 07/20] KEYS: Add a facility to restrict new links into a keyring [ver #2]

Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:

> > +    If restrict_link not NULL, it should point to a function will be called to
> > +    vet all attempts to link keys into the keyring, though this can be
> > +    overridden by passing KEY_ALLOC_BYPASS_RESTRICTION to
> > +    key_create_or_update().
> 
> Please fix the first part of the sentence.   Maybe add an example of
> when it is appropriate to bypass the restriction - (eg. loading the
> builtin keys).

Okay:

    If restrict_link not NULL, it should point to a function that will be
    called each time an attempt is made to link a key into the new keyring.
    This function is called to check whether a key may be added into the keying
    or not.  Callers of key_create_or_update() within the kernel can pass
    KEY_ALLOC_BYPASS_RESTRICTION to suppress the check.  An example of using
    this is to manage rings of cryptographic keys that are set up when the
    kernel boots where userspace is also permitted to add keys - provided they
    can be verified by a key the kernel already has.

    When called, the restriction function will be passed the keyring being
    added to, the key flags value and the type and payload of the key being
    added.  Note that when a new key is being created, this is called between
    payload preparsing and actual key creation.  The function should return 0
    to allow the link or an error to reject it.

David