On Sat, 2014-06-07 at 00:48 +0300, Dmitry Kasatkin wrote: > On 3 June 2014 20:58, Mimi Zohar <[email protected]> wrote: > > Dot prefixed keyring names are supposed to be reserved for the > > kernel, but add_key() calls key_get_type_from_user(), which > > incorrectly verifies the 'type' field, not the 'description' field. > > This patch verifies the 'description' field isn't dot prefixed, > > when creating a new keyring, and removes the dot prefix test in > > key_get_type_from_user(). > > > > Changelog v5: > > - Only prevent userspace from creating a dot prefixed keyring, not > > regular keys - Dmitry > > > > Reported-by: Dmitry Kasatkin <[email protected]> > > Cc: David Howells <[email protected]> > > Signed-off-by: Mimi Zohar <[email protected]> > > --- > > security/keys/keyctl.c | 6 ++++-- > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c > > index cd5bd0c..62a9952 100644 > > --- a/security/keys/keyctl.c > > +++ b/security/keys/keyctl.c > > @@ -37,8 +37,6 @@ static int key_get_type_from_user(char *type, > > return ret; > > if (ret == 0 || ret >= len) > > return -EINVAL; > > - if (type[0] == '.') > > - return -EPERM; > > type[len - 1] = '\0'; > > return 0; > > } > > @@ -86,6 +84,10 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, > > if (!*description) { > > kfree(description); > > description = NULL; > > + } else if ((description[0] == '.') && > > + (strncmp(type, "keyring", 7) == 0)) { > > + ret = -EPERM; > > + goto error2; > > } > > }
> I think it does not another problem... > It is not only prevent creating new keyring with ".abc" name but also > prevent adding new key... > > this is wrong... Seems to prevent creating a dot prefixed keyring, but permits creating a dot prefixed key. Do you have an example? thanks, Mimi Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
