LKML Archive on
help / color / mirror / Atom feed
From: David Howells <>
To: Arun Raghavan <>
Subject: Re: [PATCH] keyring: Incorrect permissions checking in __keyring_search_one()
Date: Mon, 10 Mar 2008 12:25:21 +0000	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <Pine.LNX.4.64.0803082235430.27953@peripatetic.hades>

Arun Raghavan <> wrote:

> The __keyring_search_one() function currently has 2 issues with regards
> to permissions:
>  1. It does not check for KEY_SEARCH on the keyring before performing a
>     search

That is correct.  This is used by key_create_or_update() to check to see
whether there's a key in the current keyring that it can update rather than
adding a new key entirely.  key_create_or_update() mustn't be bound by
KEY_SEARCH permission, and similarly the target key doesn't require KEY_SEARCH
permission either; the control here is whether or not the target key has
KEY_WRITE permission.

>  2. It accepts a "perm" parameter to check whether a given key in the
>     keyring may be returned.

The "perm" parameter is superfluous given that nothing else now calls this


      reply	other threads:[~2008-03-10 12:25 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-03-08 17:22 Arun Raghavan
2008-03-10 12:25 ` David Howells [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \
    --subject='Re: [PATCH] keyring: Incorrect permissions checking in __keyring_search_one()' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).