[linux] 03/03: KEYS: Don't permit request_key() to construct a new keyring

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch wheezy-security
in repository linux.

commit 8bdcd86ded94de68ac764b6bc6c508236e9ef9e5
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Wed Oct 21 17:23:00 2015 +0200

    KEYS: Don't permit request_key() to construct a new keyring
---
 debian/changelog                                   |  1 +
 ...permit-request_key-to-construct-a-new-key.patch | 34 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 36 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index bb8a3d1..3b17c77 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,7 @@ linux (3.2.68-1+deb7u6) UNRELEASED; urgency=medium
   * KEYS: Fix race between key destruction and finding a keyring by name
   * KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
     (CVE-2015-7872)
+  * KEYS: Don't permit request_key() to construct a new keyring
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Wed, 21 Oct 2015 17:00:31 +0200
 
diff --git a/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch b/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
new file mode 100644
index 0000000..a87e95d
--- /dev/null
+++ b/debian/patches/bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch
@@ -0,0 +1,34 @@
+From: David Howells <dhowells at redhat.com>
+Date: Mon, 19 Oct 2015 11:20:28 +0100
+Subject: KEYS: Don't permit request_key() to construct a new keyring
+Origin: https://git.kernel.org/linus/911b79cde95c7da0ec02f48105358a36636b7a71
+
+If request_key() is used to find a keyring, only do the search part - don't
+do the construction part if the keyring was not found by the search.  We
+don't really want keyrings in the negative instantiated state since the
+rejected/negative instantiation error value in the payload is unioned with
+keyring metadata.
+
+Now the kernel gives an error:
+
+	request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
+
+Signed-off-by: David Howells <dhowells at redhat.com>
+[carnil: Backported for 3.2: adjust context. Search context structure only
+introduced in 4bdf0bc300314141e5475e145acb8b5ad846f00d]
+---
+ security/keys/request_key.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -449,6 +449,9 @@ static struct key *construct_key_and_lin
+ 
+ 	kenter("");
+ 
++	if (type == &key_type_keyring)
++		return ERR_PTR(-EPERM);
++
+ 	user = key_user_lookup(current_fsuid(), current_user_ns());
+ 	if (!user)
+ 		return ERR_PTR(-ENOMEM);
diff --git a/debian/patches/series b/debian/patches/series
index ecfa141..01002c2 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1186,3 +1186,4 @@ bugfix/all/dcache-handle-escaped-paths-in-prepend_path.patch
 bugfix/all/vfs-test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch
 bugfix/all/KEYS-Fix-race-between-key-destruction-and-finding-a-.patch
 bugfix/all/KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch
+bugfix/all/KEYS-Don-t-permit-request_key-to-construct-a-new-key.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git