linux-stable.git/security/keys/key.c, branch v3.16

KEYS: Move the flags representing required permission to linux/key.h

2014-03-14T17:44:49+00:00

Move the flags representing required permission to linux/key.h as the perm
parameter of security_key_permission() is in terms of them - and not the
permissions mask flags used in key->perm.

Whilst we're at it:

 (1) Rename them to be KEY_NEED_xxx rather than KEY_xxx to avoid collisions
     with symbols in uapi/linux/input.h.

 (2) Don't use key_perm_t for a mask of required permissions, but rather limit
     it to the permissions mask attached to the key and arguments related
     directly to that.

Signed-off-by: David Howells 
Tested-by: Dmitry Kasatkin

KEYS: Pre-clear struct key on allocation

2013-12-02T11:24:18+00:00

The second word of key->payload does not get initialised in key_alloc(), but
the big_key type is relying on it having been cleared.  The problem comes when
big_key fails to instantiate a large key and doesn't then set the payload.  The
big_key_destroy() op is called from the garbage collector and this assumes that
the dentry pointer stored in the second word will be NULL if instantiation did
not complete.

Therefore just pre-clear the entire struct key on allocation rather than trying
to be clever and only initialising to 0 only those bits that aren't otherwise
initialised.

The lack of initialisation can lead to a bug report like the following if
big_key failed to initialise its file:

	general protection fault: 0000 [#1] SMP
	Modules linked in: ...
	CPU: 0 PID: 51 Comm: kworker/0:1 Not tainted 3.10.0-53.el7.x86_64 #1
	Hardware name: Dell Inc. PowerEdge 1955/0HC513, BIOS 1.4.4 12/09/2008
	Workqueue: events key_garbage_collector
	task: ffff8801294f5680 ti: ffff8801296e2000 task.ti: ffff8801296e2000
	RIP: 0010:[] dput+0x21/0x2d0
	...
	Call Trace:
	 [] path_put+0x16/0x30
	 [] big_key_destroy+0x44/0x60
	 [] key_gc_unused_keys.constprop.2+0x5b/0xe0
	 [] key_garbage_collector+0x1df/0x3c0
	 [] process_one_work+0x17b/0x460
	 [] worker_thread+0x11b/0x400
	 [] ? rescuer_thread+0x3e0/0x3e0
	 [] kthread+0xc0/0xd0
	 [] ? kthread_create_on_node+0x110/0x110
	 [] ret_from_fork+0x7c/0xb0
	 [] ? kthread_create_on_node+0x110/0x110

Reported-by: Patrik Kis 
Signed-off-by: David Howells 
Reviewed-by: Stephen Gallagher

KEYS: Fix a race between negating a key and reading the error set

2013-10-30T11:15:24+00:00

key_reject_and_link() marking a key as negative and setting the error with
which it was negated races with keyring searches and other things that read
that error.

The fix is to switch the order in which the assignments are done in
key_reject_and_link() and to use memory barriers.

Kudos to Dave Wysochanski  and Scott Mayhew
 for tracking this down.

This may be the cause of:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000070
IP: [] wait_for_key_construction+0x31/0x80
PGD c6b2c3067 PUD c59879067 PMD 0
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
CPU 0
Modules linked in: ...

Pid: 13359, comm: amqzxma0 Not tainted 2.6.32-358.20.1.el6.x86_64 #1 IBM System x3650 M3 -[7945PSJ]-/00J6159
RIP: 0010:[] wait_for_key_construction+0x31/0x80
RSP: 0018:ffff880c6ab33758  EFLAGS: 00010246
RAX: ffffffff81219080 RBX: 0000000000000000 RCX: 0000000000000002
RDX: ffffffff81219060 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff880c6ab33768 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff880adfcbce40
R13: ffffffffa03afb84 R14: ffff880adfcbce40 R15: ffff880adfcbce43
FS:  00007f29b8042700(0000) GS:ffff880028200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000070 CR3: 0000000c613dc000 CR4: 00000000000007f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process amqzxma0 (pid: 13359, threadinfo ffff880c6ab32000, task ffff880c610deae0)
Stack:
 ffff880adfcbce40 0000000000000000 ffff880c6ab337b8 ffffffff81219695
 0000000000000000 ffff880a000000d0 ffff880c6ab337a8 000000000000000f
 ffffffffa03afb93 000000000000000f ffff88186c7882c0 0000000000000014
Call Trace:
 [] request_key+0x65/0xa0
 [] nfs_idmap_request_key+0xc5/0x170 [nfs]
 [] nfs_idmap_lookup_id+0x34/0x80 [nfs]
 [] nfs_map_group_to_gid+0x75/0xa0 [nfs]
 [] decode_getfattr_attrs+0xbdd/0xfb0 [nfs]
 [] ? __dequeue_entity+0x30/0x50
 [] ? __switch_to+0x26e/0x320
 [] decode_getfattr+0x83/0xe0 [nfs]
 [] ? nfs4_xdr_dec_getattr+0x0/0xa0 [nfs]
 [] nfs4_xdr_dec_getattr+0x8f/0xa0 [nfs]
 [] rpcauth_unwrap_resp+0x84/0xb0 [sunrpc]
 [] ? nfs4_xdr_dec_getattr+0x0/0xa0 [nfs]
 [] call_decode+0x1b3/0x800 [sunrpc]
 [] ? wake_bit_function+0x0/0x50
 [] ? call_decode+0x0/0x800 [sunrpc]
 [] __rpc_execute+0x77/0x350 [sunrpc]
 [] ? bit_waitqueue+0x17/0xd0
 [] rpc_execute+0x61/0xa0 [sunrpc]
 [] rpc_run_task+0x75/0x90 [sunrpc]
 [] rpc_call_sync+0x42/0x70 [sunrpc]
 [] _nfs4_call_sync+0x30/0x40 [nfs]
 [] _nfs4_proc_getattr+0xac/0xc0 [nfs]
 [] ? futex_wait+0x227/0x380
 [] nfs4_proc_getattr+0x56/0x80 [nfs]
 [] __nfs_revalidate_inode+0xe3/0x220 [nfs]
 [] nfs_revalidate_mapping+0x4e/0x170 [nfs]
 [] nfs_file_read+0x77/0x130 [nfs]
 [] do_sync_read+0xfa/0x140
 [] ? autoremove_wake_function+0x0/0x40
 [] ? apic_timer_interrupt+0xe/0x20
 [] ? common_interrupt+0xe/0x13
 [] ? selinux_file_permission+0xfb/0x150
 [] ? security_file_permission+0x16/0x20
 [] vfs_read+0xb5/0x1a0
 [] sys_read+0x51/0x90
 [] ? __audit_syscall_exit+0x265/0x290
 [] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells 
cc: Dave Wysochanski 
cc: Scott Mayhew

KEYS: Add a 'trusted' flag and a 'trusted only' flag

2013-09-25T16:17:01+00:00

Add KEY_FLAG_TRUSTED to indicate that a key either comes from a trusted source
or had a cryptographic signature chain that led back to a trusted key the
kernel already possessed.

Add KEY_FLAGS_TRUSTED_ONLY to indicate that a keyring will only accept links to
keys marked with KEY_FLAGS_TRUSTED.

Signed-off-by: David Howells 
Reviewed-by: Kees Cook

KEYS: Expand the capacity of a keyring

2013-09-24T09:35:18+00:00

Expand the capacity of a keyring to be able to hold a lot more keys by using
the previously added associative array implementation.  Currently the maximum
capacity is:

	(PAGE_SIZE - sizeof(header)) / sizeof(struct key *)

which, on a 64-bit system, is a little more 500.  However, since this is being
used for the NFS uid mapper, we need more than that.  The new implementation
gives us effectively unlimited capacity.

With some alterations, the keyutils testsuite runs successfully to completion
after this patch is applied.  The alterations are because (a) keyrings that
are simply added to no longer appear ordered and (b) some of the errors have
changed a bit.

Signed-off-by: David Howells

KEYS: Drop the permissions argument from __keyring_search_one()

2013-09-24T09:35:17+00:00

Drop the permissions argument from __keyring_search_one() as the only caller
passes 0 here - which causes all checks to be skipped.

Signed-off-by: David Howells

KEYS: Define a __key_get() wrapper to use rather than atomic_inc()

2013-09-24T09:35:16+00:00

Define a __key_get() wrapper to use rather than atomic_inc() on the key usage
count as this makes it easier to hook in refcount error debugging.

Signed-off-by: David Howells

KEYS: Consolidate the concept of an 'index key' for key access

2013-09-24T09:35:15+00:00

Consolidate the concept of an 'index key' for accessing keys.  The index key
is the search term needed to find a key directly - basically the key type and
the key description.  We can add to that the description length.

This will be useful when turning a keyring into an associative array rather
than just a pointer block.

Signed-off-by: David Howells

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2012-12-16T23:40:50+00:00

Pull security subsystem updates from James Morris:
 "A quiet cycle for the security subsystem with just a few maintenance
  updates."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  Smack: create a sysfs mount point for smackfs
  Smack: use select not depends in Kconfig
  Yama: remove locking from delete path
  Yama: add RCU to drop read locking
  drivers/char/tpm: remove tasklet and cleanup
  KEYS: Use keyring_alloc() to create special keyrings
  KEYS: Reduce initial permissions on keys
  KEYS: Make the session and process keyrings per-thread
  seccomp: Make syscall skipping and nr changes more consistent
  key: Fix resource leak
  keys: Fix unreachable code
  KEYS: Add payload preparsing opportunity prior to key instantiate or update

Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2012-10-14T20:39:34+00:00

Pull module signing support from Rusty Russell:
 "module signing is the highlight, but it's an all-over David Howells frenzy..."

Hmm "Magrathea: Glacier signing key". Somebody has been reading too much HHGTTG.

* 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (37 commits)
  X.509: Fix indefinite length element skip error handling
  X.509: Convert some printk calls to pr_devel
  asymmetric keys: fix printk format warning
  MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
  MODSIGN: Make mrproper should remove generated files.
  MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
  MODSIGN: Use the same digest for the autogen key sig as for the module sig
  MODSIGN: Sign modules during the build process
  MODSIGN: Provide a script for generating a key ID from an X.509 cert
  MODSIGN: Implement module signature checking
  MODSIGN: Provide module signing public keys to the kernel
  MODSIGN: Automatically generate module signing keys if missing
  MODSIGN: Provide Kconfig options
  MODSIGN: Provide gitignore and make clean rules for extra files
  MODSIGN: Add FIPS policy
  module: signature checking hook
  X.509: Add a crypto key parser for binary (DER) X.509 certificates
  MPILIB: Provide a function to read raw data into an MPI
  X.509: Add an ASN.1 decoder
  X.509: Add simple ASN.1 grammar compiler
  ...