LKML Archive on
help / color / mirror / Atom feed
From: Andrew Morton <>
To: David Howells <>
Subject: Re: [PATCH 2/4] KEYS: Check starting keyring as part of search
Date: Tue, 12 Feb 2008 15:47:49 -0800	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

On Fri, 08 Feb 2008 16:04:29 +0000
David Howells <> wrote:

> Check the starting keyring as part of the search to (a) see if that is what
> we're searching for, and (b) to check it is still valid for searching.
> The scenario:  User in process A does things that cause things to be
> created in its process session keyring.  The user then does an su to
> another user and starts a new process, B.  The two processes now
> share the same process session keyring.
> Process B does an NFS access which results in an upcall to gssd.
> When gssd attempts to instantiate the context key (to be linked
> into the process session keyring), it is denied access even though it
> has an authorization key.
> The order of calls is:
>    keyctl_instantiate_key()
>       lookup_user_key()				    (the default: case)
>          search_process_keyrings(current)
> 	    search_process_keyrings(rka->context)   (recursive call)
> 	       keyring_search_aux()
> keyring_search_aux() verifies the keys and keyrings underneath the
> top-level keyring it is given, but that top-level keyring is neither
> fully validated nor checked to see if it is the thing being searched for.
> This patch changes keyring_search_aux() to:
> 1) do more validation on the top keyring it is given and
> 2) check whether that top-level keyring is the thing being searched for
> ...
> +	    (keyring->expiry && now.tv_sec >= keyring->expiry))


  reply	other threads:[~2008-02-12 23:48 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-02-08 16:04 [PATCH 1/4] KEYS: Increase the payload size when instantiating a key David Howells
2008-02-08 16:04 ` [PATCH 2/4] KEYS: Check starting keyring as part of search David Howells
2008-02-12 23:47   ` Andrew Morton [this message]
2008-02-13 12:35   ` David Howells
2008-02-08 16:04 ` [PATCH 3/4] KEYS: Allow the callout data to be passed as a blob rather than a string David Howells
2008-02-08 16:04 ` [PATCH 4/4] KEYS: Add keyctl function to get a security label David Howells
2008-02-12 23:51   ` Andrew Morton
2008-02-13 12:38   ` David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \
    --subject='Re: [PATCH 2/4] KEYS: Check starting keyring as part of search' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).