[linux] 03/03: KEYS: Don't permit request_key() to construct a new keyring

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit 0118315df1a4473ab2094b9b4e46d9b0e611648f
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Tue Oct 20 19:22:12 2015 +0200

    KEYS: Don't permit request_key() to construct a new keyring
---
 debian/changelog                                   |  1 +
 ...permit-request_key-to-construct-a-new-key.patch | 37 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 39 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 4213f63..85b1e2b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,7 @@ linux (3.16.7-ckt11-1+deb8u6) UNRELEASED; urgency=medium
   * KEYS: Fix race between key destruction and finding a keyring by name
   * KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
     (CVE-2015-7872)
+  * KEYS: Don't permit request_key() to construct a new keyring
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Tue, 20 Oct 2015 19:12:50 +0200
 
diff --git a/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
new file mode 100644
index 0000000..e2859ca
--- /dev/null
+++ b/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
@@ -0,0 +1,37 @@
+From: David Howells <dhowells at redhat.com>
+Date: Mon, 19 Oct 2015 11:20:28 +0100
+Subject: KEYS: Don't permit request_key() to construct a new keyring
+Origin: https://git.kernel.org/linus/911b79cde95c7da0ec02f48105358a36636b7a71
+
+If request_key() is used to find a keyring, only do the search part - don't
+do the construction part if the keyring was not found by the search.  We
+don't really want keyrings in the negative instantiated state since the
+rejected/negative instantiation error value in the payload is unioned with
+keyring metadata.
+
+Now the kernel gives an error:
+
+	request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
+
+Signed-off-by: David Howells <dhowells at redhat.com>
+---
+ security/keys/request_key.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 486ef6f..0d62531 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
+ 
+ 	kenter("");
+ 
++	if (ctx->index_key.type == &key_type_keyring)
++		return ERR_PTR(-EPERM);
++	
+ 	user = key_user_lookup(current_fsuid());
+ 	if (!user)
+ 		return ERR_PTR(-ENOMEM);
+-- 
+2.6.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 43076b3..f4d3cd2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -654,3 +654,4 @@ bugfix/all/ipc-sem.c-fully-initialize-sem_array-before-making-i.patch
 bugfix/all/Initialize-msg-shm-IPC-objects-before-doing-ipc_addid.patch
 bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
 bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
+bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git