linux-hardened/security/keys
David Howells fbf8c53f1a KEYS: Fix UID check in keyctl_get_persistent()
If the UID is specified by userspace when calling the KEYCTL_GET_PERSISTENT
function and the process does not have the CAP_SETUID capability, then the
function will return -EPERM if the current process's uid, suid, euid and fsuid
all match the requested UID.  This is incorrect.

Fix it such that when a non-privileged caller requests a persistent keyring by
a specific UID they can only request their own (ie. the specified UID matches
either then process's UID or the process's EUID).

This can be tested by logging in as the user and doing:

	keyctl get_persistent @p
	keyctl get_persistent @p `id -u`
	keyctl get_persistent @p 0

The first two should successfully print the same key ID.  The third should do
the same if called by UID 0 or indicate Operation Not Permitted otherwise.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Stephen Gallagher <sgallagh@redhat.com>
2013-11-06 14:01:51 +00:00
..
encrypted-keys KEYS: Add payload preparsing opportunity prior to key instantiate or update 2012-10-08 13:49:48 +10:30
big_key.c KEYS: fix error return code in big_key_instantiate() 2013-10-30 12:54:29 +00:00
compat.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
gc.c KEYS: Expand the capacity of a keyring 2013-09-24 10:35:18 +01:00
internal.h KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
Kconfig KEYS: Make BIG_KEYS boolean 2013-10-30 11:15:23 +00:00
key.c KEYS: Fix a race between negating a key and reading the error set 2013-10-30 11:15:24 +00:00
keyctl.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
keyring.c KEYS: Fix keyring quota misaccounting on key replacement and unlink 2013-10-30 11:15:24 +00:00
Makefile KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
permission.c userns: Convert security/keys to the new userns infrastructure 2012-09-13 18:28:02 -07:00
persistent.c KEYS: Fix UID check in keyctl_get_persistent() 2013-11-06 14:01:51 +00:00
proc.c KEYS: Introduce a search context structure 2013-09-24 10:35:15 +01:00
process_keys.c KEYS: initialize root uid and session keyrings early 2013-09-25 17:17:01 +01:00
request_key.c KEYS: Fix a race between negating a key and reading the error set 2013-10-30 11:15:24 +00:00
request_key_auth.c KEYS: Search for auth-key by name rather than target key ID 2013-09-24 10:35:16 +01:00
sysctl.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
trusted.c Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux 2012-10-14 13:39:34 -07:00
trusted.h trusted-keys: rename trusted_defined files to trusted 2011-01-24 10:14:22 +11:00
user_defined.c KEYS: Introduce a search context structure 2013-09-24 10:35:15 +01:00