linux-kernel - Re: [RFC] Keyrings: How to make them more useful

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <473711.1749760578@warthog.procyon.org.uk>
Date: Thu, 12 Jun 2025 21:36:18 +0100
From: David Howells <dhowells@...hat.com>
To: James Bottomley <James.Bottomley@...senPartnership.com>
Cc: dhowells@...hat.com, keyrings@...r.kernel.org,
    Jarkko Sakkinen <jarkko@...nel.org>,
    Steve French <sfrench@...ba.org>,
    Chuck Lever <chuck.lever@...cle.com>,
    Mimi Zohar <zohar@...ux.ibm.com>, Paulo Alcantara <pc@...guebit.org>,
    Herbert Xu <herbert@...dor.apana.org.au>,
    Jeffrey Altman <jaltman@...istor.com>, hch@...radead.org,
    linux-afs@...ts.infradead.org, linux-nfs@...r.kernel.org,
    linux-cifs@...r.kernel.org, linux-security-module@...r.kernel.org,
    linux-fsdevel@...r.kernel.org, linux-crypto@...r.kernel.org,
    netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [RFC] Keyrings: How to make them more useful

James Bottomley <James.Bottomley@...senPartnership.com> wrote:

> One of the problems I keep tripping over is different special casing
> for user keyrings (which are real struct key structures) and system
> keyrings which are special values of the pointer in struct key *.

It's meant to be like that.  The trusted system keyrings are static within
system_keyring.c and not so easily accessible by kernel modules for
direct modification, bypassing the security checks.

Obviously this is merely a bit of obscurity and enforcement isn't possible
against kernel code that is determined to modify those keyrings or otherwise
interfere in the verification process.

> For examples of what this special handling does, just look at things
> like bpf_trace.c:bpf_lookup_{user|system}_key
> 
> Since the serial allocation code has a hard coded not less than 3
> (which looks for all the world like it was designed to mean the two
> system keyring id's were never used as user serial numbers)

That's just a coincidence.  The <3 thing predates the advent of those system
keyring magic pointers.

> I think we could simply allow the two system keyring ids to be passed into
> lookup_user_key() (which now might be a bit misnamed) and special case not
> freeing it in put_key().

If you want to make lookup_user_key() provide access to specific keyrings like
this, just use the next negative numbers - it's not like we're likely to run
out soon.

But I'd rather not let lookup_user_key() return pointers to these keyrings...

David