|
|
@@ -394,6 +394,13 @@ static void keyring_destroy(struct key *keyring)
|
|
|
write_unlock(&keyring_name_lock);
|
|
|
}
|
|
|
|
|
|
+ if (keyring->restrict_link) {
|
|
|
+ struct key_restriction *keyres = keyring->restrict_link;
|
|
|
+
|
|
|
+ key_put(keyres->key);
|
|
|
+ kfree(keyres);
|
|
|
+ }
|
|
|
+
|
|
|
assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops);
|
|
|
}
|
|
|
|
|
|
@@ -492,7 +499,7 @@ static long keyring_read(const struct key *keyring,
|
|
|
struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
|
|
|
const struct cred *cred, key_perm_t perm,
|
|
|
unsigned long flags,
|
|
|
- key_restrict_link_func_t restrict_link,
|
|
|
+ struct key_restriction *restrict_link,
|
|
|
struct key *dest)
|
|
|
{
|
|
|
struct key *keyring;
|
|
|
@@ -523,8 +530,8 @@ EXPORT_SYMBOL(keyring_alloc);
|
|
|
* passing KEY_ALLOC_BYPASS_RESTRICTION to key_instantiate_and_link() when
|
|
|
* adding a key to a keyring.
|
|
|
*
|
|
|
- * This is meant to be passed as the restrict_link parameter to
|
|
|
- * keyring_alloc().
|
|
|
+ * This is meant to be stored in a key_restriction structure which is passed
|
|
|
+ * in the restrict_link parameter to keyring_alloc().
|
|
|
*/
|
|
|
int restrict_link_reject(struct key *keyring,
|
|
|
const struct key_type *type,
|
|
|
@@ -1220,9 +1227,10 @@ void __key_link_end(struct key *keyring,
|
|
|
*/
|
|
|
static int __key_link_check_restriction(struct key *keyring, struct key *key)
|
|
|
{
|
|
|
- if (!keyring->restrict_link)
|
|
|
+ if (!keyring->restrict_link || !keyring->restrict_link->check)
|
|
|
return 0;
|
|
|
- return keyring->restrict_link(keyring, key->type, &key->payload, NULL);
|
|
|
+ return keyring->restrict_link->check(keyring, key->type, &key->payload,
|
|
|
+ keyring->restrict_link->key);
|
|
|
}
|
|
|
|
|
|
/**
|
|
|
@@ -1426,3 +1434,53 @@ do_gc:
|
|
|
up_write(&keyring->sem);
|
|
|
kleave(" [gc]");
|
|
|
}
|
|
|
+
|
|
|
+/*
|
|
|
+ * Garbage collect restriction pointers from a keyring.
|
|
|
+ *
|
|
|
+ * Keyring restrictions are associated with a key type, and must be cleaned
|
|
|
+ * up if the key type is unregistered. The restriction is altered to always
|
|
|
+ * reject additional keys so a keyring cannot be opened up by unregistering
|
|
|
+ * a key type.
|
|
|
+ *
|
|
|
+ * Not called with any keyring locks held. The keyring's key struct will not
|
|
|
+ * be deallocated under us as only our caller may deallocate it.
|
|
|
+ *
|
|
|
+ * The caller is required to hold key_types_sem and dead_type->sem. This is
|
|
|
+ * fulfilled by key_gc_keytype() holding the locks on behalf of
|
|
|
+ * key_garbage_collector(), which it invokes on a workqueue.
|
|
|
+ */
|
|
|
+void keyring_restriction_gc(struct key *keyring, struct key_type *dead_type)
|
|
|
+{
|
|
|
+ struct key_restriction *keyres;
|
|
|
+
|
|
|
+ kenter("%x{%s}", keyring->serial, keyring->description ?: "");
|
|
|
+
|
|
|
+ /*
|
|
|
+ * keyring->restrict_link is only assigned at key allocation time
|
|
|
+ * or with the key type locked, so the only values that could be
|
|
|
+ * concurrently assigned to keyring->restrict_link are for key
|
|
|
+ * types other than dead_type. Given this, it's ok to check
|
|
|
+ * the key type before acquiring keyring->sem.
|
|
|
+ */
|
|
|
+ if (!dead_type || !keyring->restrict_link ||
|
|
|
+ keyring->restrict_link->keytype != dead_type) {
|
|
|
+ kleave(" [no restriction gc]");
|
|
|
+ return;
|
|
|
+ }
|
|
|
+
|
|
|
+ /* Lock the keyring to ensure that a link is not in progress */
|
|
|
+ down_write(&keyring->sem);
|
|
|
+
|
|
|
+ keyres = keyring->restrict_link;
|
|
|
+
|
|
|
+ keyres->check = restrict_link_reject;
|
|
|
+
|
|
|
+ key_put(keyres->key);
|
|
|
+ keyres->key = NULL;
|
|
|
+ keyres->keytype = NULL;
|
|
|
+
|
|
|
+ up_write(&keyring->sem);
|
|
|
+
|
|
|
+ kleave(" [restriction gc]");
|
|
|
+}
|
Mat Martineau