kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[PATCH] keys: sort out key quota system

Browse source 
Add the ability for key creation to overrun the user's quota in some
circumstances - notably when a session keyring is created and assigned to a
process that didn't previously have one.

This means it's still possible to log in, should PAM require the creation of a
new session keyring, and fix an overburdened key quota.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
David Howells 2006-06-26 00:24:50 -07:00 • committed by Linus Torvalds
parent f116629d03
commit 7e047ef5fe
11 changed files with 85 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

13
include/linux/key.h
View file

@ -248,7 +248,14 @@ extern struct key *key_alloc(struct key_type *type,
const char *desc,
uid_t uid, gid_t gid,
struct task_struct *ctx,
key_perm_t perm, int not_in_quota);
key_perm_t perm,
unsigned long flags);
#define KEY_ALLOC_IN_QUOTA 0x0000 /* add to quota, reject if would overrun */
#define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */
#define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */
extern int key_payload_reserve(struct key *key, size_t datalen);
extern int key_instantiate_and_link(struct key *key,
const void *data,
@ -285,7 +292,7 @@ extern key_ref_t key_create_or_update(key_ref_t keyring,
const char *description,
const void *payload,
size_t plen,
int not_in_quota);
unsigned long flags);
extern int key_update(key_ref_t key,
const void *payload,
@ -299,7 +306,7 @@ extern int key_unlink(struct key *keyring,
extern struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
struct task_struct *ctx,
int not_in_quota,
unsigned long flags,
struct key *dest);
extern int keyring_clear(struct key *keyring);

11
include/linux/security.h
View file

@ -862,6 +862,7 @@ struct swap_info_struct;
* Permit allocation of a key and assign security data. Note that key does
* not have a serial number assigned at this point.
* @key points to the key.
* @flags is the allocation flags
* Return 0 if permission is granted, -ve error otherwise.
* @key_free:
* Notification of destruction; free security data.
@ -1324,7 +1325,7 @@ struct security_operations {
/* key management security hooks */
#ifdef CONFIG_KEYS
int (*key_alloc)(struct key *key, struct task_struct *tsk);
int (*key_alloc)(struct key *key, struct task_struct *tsk, unsigned long flags);
void (*key_free)(struct key *key);
int (*key_permission)(key_ref_t key_ref,
struct task_struct *context,
@ -3040,9 +3041,10 @@ static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid
#ifdef CONFIG_KEYS
#ifdef CONFIG_SECURITY
static inline int security_key_alloc(struct key *key,
struct task_struct *tsk)
struct task_struct *tsk,
unsigned long flags)
{
return security_ops->key_alloc(key, tsk);
return security_ops->key_alloc(key, tsk, flags);
}
static inline void security_key_free(struct key *key)
@ -3060,7 +3062,8 @@ static inline int security_key_permission(key_ref_t key_ref,
#else
static inline int security_key_alloc(struct key *key,
struct task_struct *tsk)
struct task_struct *tsk,
unsigned long flags)
{
return 0;
}