Blame view
security/keys/permission.c
2.9 KB
973c9f4f4 KEYS: Fix up comm... |
1 |
/* Key permission checking |
468ed2b0c [PATCH] Keys: Spl... |
2 3 4 5 6 7 8 9 10 11 12 |
* * Copyright (C) 2005 Red Hat, Inc. All Rights Reserved. * Written by David Howells (dhowells@redhat.com) * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. */ #include <linux/module.h> |
29db91906 [PATCH] Keys: Add... |
13 |
#include <linux/security.h> |
468ed2b0c [PATCH] Keys: Spl... |
14 |
#include "internal.h" |
d84f4f992 CRED: Inaugurate ... |
15 16 |
/** * key_task_permission - Check a key can be used |
973c9f4f4 KEYS: Fix up comm... |
17 18 19 |
* @key_ref: The key to check. * @cred: The credentials to use. * @perm: The permissions to check for. |
d84f4f992 CRED: Inaugurate ... |
20 21 22 23 |
* * Check to see whether permission is granted to use a key in the desired way, * but permit the security modules to override. * |
973c9f4f4 KEYS: Fix up comm... |
24 25 26 27 |
* The caller must hold either a ref on cred or must hold the RCU readlock. * * Returns 0 if successful, -EACCES if access is denied based on the * permissions bits or the LSM check. |
468ed2b0c [PATCH] Keys: Spl... |
28 |
*/ |
d84f4f992 CRED: Inaugurate ... |
29 |
int key_task_permission(const key_ref_t key_ref, const struct cred *cred, |
468ed2b0c [PATCH] Keys: Spl... |
30 31 32 33 34 35 36 |
key_perm_t perm) { struct key *key; key_perm_t kperm; int ret; key = key_ref_to_ptr(key_ref); |
8ff3bc313 keys: consider us... |
37 38 |
if (key->user->user_ns != cred->user->user_ns) goto use_other_perms; |
468ed2b0c [PATCH] Keys: Spl... |
39 |
/* use the second 8-bits of permissions for keys the caller owns */ |
b6dff3ec5 CRED: Separate ta... |
40 |
if (key->uid == cred->fsuid) { |
468ed2b0c [PATCH] Keys: Spl... |
41 42 43 44 45 46 47 |
kperm = key->perm >> 16; goto use_these_perms; } /* use the third 8-bits of permissions for keys the caller has a group * membership in common with */ if (key->gid != -1 && key->perm & KEY_GRP_ALL) { |
b6dff3ec5 CRED: Separate ta... |
48 |
if (key->gid == cred->fsgid) { |
468ed2b0c [PATCH] Keys: Spl... |
49 50 51 |
kperm = key->perm >> 8; goto use_these_perms; } |
b6dff3ec5 CRED: Separate ta... |
52 |
ret = groups_search(cred->group_info, key->gid); |
468ed2b0c [PATCH] Keys: Spl... |
53 54 55 56 57 |
if (ret) { kperm = key->perm >> 8; goto use_these_perms; } } |
8ff3bc313 keys: consider us... |
58 |
use_other_perms: |
468ed2b0c [PATCH] Keys: Spl... |
59 60 61 62 |
/* otherwise use the least-significant 8-bits */ kperm = key->perm; use_these_perms: |
c69e8d9c0 CRED: Use RCU to ... |
63 |
|
7ab501db8 [PATCH] Keys: Pos... |
64 65 66 67 68 |
/* use the top 8-bits of permissions for keys the caller possesses * - possessor permissions are additive with other permissions */ if (is_key_possessed(key_ref)) kperm |= key->perm >> 24; |
468ed2b0c [PATCH] Keys: Spl... |
69 |
kperm = kperm & perm & KEY_ALL; |
29db91906 [PATCH] Keys: Add... |
70 71 72 73 |
if (kperm != perm) return -EACCES; /* let LSM be the final arbiter */ |
d84f4f992 CRED: Inaugurate ... |
74 |
return security_key_permission(key_ref, cred, perm); |
a8b17ed01 KEYS: Do some sty... |
75 |
} |
468ed2b0c [PATCH] Keys: Spl... |
76 |
EXPORT_SYMBOL(key_task_permission); |
b5f545c88 [PATCH] keys: Per... |
77 |
|
973c9f4f4 KEYS: Fix up comm... |
78 79 80 81 82 83 84 |
/** * key_validate - Validate a key. * @key: The key to be validated. * * Check that a key is valid, returning 0 if the key is okay, -EKEYREVOKED if * the key's type has been removed or if the key has been revoked or * -EKEYEXPIRED if the key has expired. |
b5f545c88 [PATCH] keys: Per... |
85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 |
*/ int key_validate(struct key *key) { struct timespec now; int ret = 0; if (key) { /* check it's still accessible */ ret = -EKEYREVOKED; if (test_bit(KEY_FLAG_REVOKED, &key->flags) || test_bit(KEY_FLAG_DEAD, &key->flags)) goto error; /* check it hasn't expired */ ret = 0; if (key->expiry) { now = current_kernel_time(); if (now.tv_sec >= key->expiry) ret = -EKEYEXPIRED; } } |
c5b60b5e6 security: whitesp... |
106 |
error: |
b5f545c88 [PATCH] keys: Per... |
107 |
return ret; |
a8b17ed01 KEYS: Do some sty... |
108 |
} |
b5f545c88 [PATCH] keys: Per... |
109 |
EXPORT_SYMBOL(key_validate); |