luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

keys: Add capability-checking keyctl function

Browse Source 
Add a keyctl function that requests a set of capability bits to find out
what features are supported.

Signed-off-by: David Howells <dhowells@redhat.com>
This commit is contained in:
David Howells 2019-05-30 14:53:10 +01:00
parent 4754620865
commit 45e0f30c30
4 changed files with 54 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
include/uapi/linux/keyctl.h
View File

@ -68,6 +68,7 @@
#define KEYCTL_PKEY_VERIFY 28 /* Verify a public key signature */
#define KEYCTL_RESTRICT_KEYRING 29 /* Restrict keys allowed to link to a keyring */
#define KEYCTL_MOVE 30 /* Move keys between keyrings */
#define KEYCTL_CAPABILITIES 31 /* Find capabilities of keyrings subsystem */
/* keyctl structures */
struct keyctl_dh_params {
@ -115,4 +116,17 @@ struct keyctl_pkey_params {
#define KEYCTL_MOVE_EXCL 0x00000001 /* Do not displace from the to-keyring */
/*
* Capabilities flags. The capabilities list is an array of 8-bit integers;
* each integer can carry up to 8 flags.
*/
#define KEYCTL_CAPS0_CAPABILITIES 0x01 /* KEYCTL_CAPABILITIES supported */
#define KEYCTL_CAPS0_PERSISTENT_KEYRINGS 0x02 /* Persistent keyrings enabled */
#define KEYCTL_CAPS0_DIFFIE_HELLMAN 0x04 /* Diffie-Hellman computation enabled */
#define KEYCTL_CAPS0_PUBLIC_KEY 0x08 /* Public key ops enabled */
#define KEYCTL_CAPS0_BIG_KEY 0x10 /* big_key-type enabled */
#define KEYCTL_CAPS0_INVALIDATE 0x20 /* KEYCTL_INVALIDATE supported */
#define KEYCTL_CAPS0_RESTRICT_KEYRING 0x40 /* KEYCTL_RESTRICT_KEYRING supported */
#define KEYCTL_CAPS0_MOVE 0x80 /* KEYCTL_MOVE supported */
#endif /* _LINUX_KEYCTL_H */

3
security/keys/compat.c
View File

@ -162,6 +162,9 @@ COMPAT_SYSCALL_DEFINE5(keyctl, u32, option,
case KEYCTL_MOVE:
return keyctl_keyring_move(arg2, arg3, arg4, arg5);
case KEYCTL_CAPABILITIES:
return keyctl_capabilities(compat_ptr(arg2), arg3);
default:
return -EOPNOTSUPP;
}

2
security/keys/internal.h
View File

@ -329,6 +329,8 @@ static inline long keyctl_pkey_e_d_s(int op,
}
#endif
extern long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen);
/*
* Debugging key validation
*/

35
security/keys/keyctl.c
View File

@ -30,6 +30,18 @@
#define KEY_MAX_DESC_SIZE 4096
static const unsigned char keyrings_capabilities[1] = {
[0] = (KEYCTL_CAPS0_CAPABILITIES |
(IS_ENABLED(CONFIG_PERSISTENT_KEYRINGS) ? KEYCTL_CAPS0_PERSISTENT_KEYRINGS : 0) |
(IS_ENABLED(CONFIG_KEY_DH_OPERATIONS) ? KEYCTL_CAPS0_DIFFIE_HELLMAN : 0) |
(IS_ENABLED(CONFIG_ASYMMETRIC_KEY_TYPE) ? KEYCTL_CAPS0_PUBLIC_KEY : 0) |
(IS_ENABLED(CONFIG_BIG_KEYS) ? KEYCTL_CAPS0_BIG_KEY : 0) |
KEYCTL_CAPS0_INVALIDATE |
KEYCTL_CAPS0_RESTRICT_KEYRING |
KEYCTL_CAPS0_MOVE
),
};
static int key_get_type_from_user(char *type,
const char __user *_type,
unsigned len)
@ -1678,6 +1690,26 @@ long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
return ret;
}
/*
* Get keyrings subsystem capabilities.
*/
long keyctl_capabilities(unsigned char __user *_buffer, size_t buflen)
{
size_t size = buflen;
if (size > 0) {
if (size > sizeof(keyrings_capabilities))
size = sizeof(keyrings_capabilities);
if (copy_to_user(_buffer, keyrings_capabilities, size) != 0)
return -EFAULT;
if (size < buflen &&
clear_user(_buffer + size, buflen - size) != 0)
return -EFAULT;
}
return sizeof(keyrings_capabilities);
}
/*
* The key control system call
*/
@ -1824,6 +1856,9 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
(key_serial_t)arg4,
(unsigned int)arg5);
case KEYCTL_CAPABILITIES:
return keyctl_capabilities((unsigned char __user *)arg2, (size_t)arg3);
default:
return -EOPNOTSUPP;
}