On 3 June 2014 20:58, Mimi Zohar <[email protected]> wrote: > Dot prefixed keyring names are supposed to be reserved for the > kernel, but add_key() calls key_get_type_from_user(), which > incorrectly verifies the 'type' field, not the 'description' field. > This patch verifies the 'description' field isn't dot prefixed, > when creating a new keyring, and removes the dot prefix test in > key_get_type_from_user(). > > Changelog v5: > - Only prevent userspace from creating a dot prefixed keyring, not > regular keys - Dmitry > > Reported-by: Dmitry Kasatkin <[email protected]> > Cc: David Howells <[email protected]> > Signed-off-by: Mimi Zohar <[email protected]> > --- > security/keys/keyctl.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c > index cd5bd0c..62a9952 100644 > --- a/security/keys/keyctl.c > +++ b/security/keys/keyctl.c > @@ -37,8 +37,6 @@ static int key_get_type_from_user(char *type, > return ret; > if (ret == 0 || ret >= len) > return -EINVAL; > - if (type[0] == '.') > - return -EPERM; > type[len - 1] = '\0'; > return 0; > } > @@ -86,6 +84,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, > if (!*description) { > kfree(description); > description = NULL; > + } else if ((description[0] == '.') && > + (strncmp(type, "keyring", 7) == 0)) { > + ret = -EPERM; > + goto error2; > } > } > > -- > 1.8.1.4 > > -- > To unsubscribe from this list: send the line "unsubscribe > linux-security-module" in > the body of a message to [email protected] > More majordomo info at http://vger.kernel.org/majordomo-info.html
I think it does not another problem... It is not only prevent creating new keyring with ".abc" name but also prevent adding new key... this is wrong... - Dmitry -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
