[linux] 03/03: KEYS: Don't permit request_key() to construct a new keyring

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch sid
in repository linux.

commit 6dd6bf4bb237f11cc6a28812d6a37238611656e0
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Mon Oct 19 21:33:39 2015 +0200

    KEYS: Don't permit request_key() to construct a new keyring
---
 debian/changelog                                   |  1 +
 ...permit-request_key-to-construct-a-new-key.patch | 33 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 35 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 1475550..c2b93ec 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ linux (4.2.3-3) UNRELEASED; urgency=medium
 
   * KEYS: Fix race between key destruction and finding a keyring by name
   * KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
+  * KEYS: Don't permit request_key() to construct a new keyring
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Mon, 19 Oct 2015 21:23:18 +0200
 
diff --git a/debian/patches/bugfix/all/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/debian/patches/bugfix/all/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
new file mode 100644
index 0000000..7ad72d5
--- /dev/null
+++ b/debian/patches/bugfix/all/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
@@ -0,0 +1,33 @@
+From: David Howells <dhowells at redhat.com>
+Date: Mon, 19 Oct 2015 11:33:38 +0100
+Subject: KEYS: Don't permit request_key() to construct a new  keyring
+Origin: http://pkgs.fedoraproject.org/cgit/kernel.git/plain/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch?id=d76d5fe34b5c151ad83761160998b1075729b541
+
+    If request_key() is used to find a keyring, only do the search part - don't
+    do the construction part if the keyring was not found by the search.  We
+    don't really want keyrings in the negative instantiated state since the
+    rejected/negative instantiation error value in the payload is unioned with
+    keyring metadata.
+
+    Signed-off-by: David Howells <dhowells at redhat.com>
+---
+ security/keys/request_key.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 486ef6fa393b..0d6253124278 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 
+ 	kenter("");
+ 
++	if (ctx->index_key.type == &key_type_keyring)
++		return ERR_PTR(-EPERM);
++	
+ 	user = key_user_lookup(current_fsuid());
+ 	if (!user)
+ 		return ERR_PTR(-ENOMEM);
+-- 
+2.4.3
+
diff --git a/debian/patches/series b/debian/patches/series
index 67f0b4e..fdc565f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -110,3 +110,4 @@ bugfix/all/nbd-add-locking-for-tasks.patch
 
 bugfix/all/0001-KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
 bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
+bugfix/all/0002-KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git