Skip to content
  • David Howells's avatar
    KEYS: Add a facility to restrict new links into a keyring · 5ac7eace
    David Howells authored
    
    
    Add a facility whereby proposed new links to be added to a keyring can be
    vetted, permitting them to be rejected if necessary.  This can be used to
    block public keys from which the signature cannot be verified or for which
    the signature verification fails.  It could also be used to provide
    blacklisting.
    
    This affects operations like add_key(), KEYCTL_LINK and KEYCTL_INSTANTIATE.
    
    To this end:
    
     (1) A function pointer is added to the key struct that, if set, points to
         the vetting function.  This is called as:
    
    	int (*restrict_link)(struct key *keyring,
    			     const struct key_type *key_type,
    			     unsigned long key_flags,
    			     const union key_payload *key_payload),
    
         where 'keyring' will be the keyring being added to, key_type and
         key_payload will describe the key being added and key_flags[*] can be
         AND'ed with KEY_FLAG_TRUSTED.
    
         [*] This parameter will be removed in a later patch when
         	 KEY_FLAG_TRUSTED is removed.
    
         The function should return 0 to allow the link to take place or an
         error (typically -ENOKEY, -ENOPKG or -EKEYREJECTED) to reject the
         link.
    
         The pointer should not be set directly, but rather should be set
         through keyring_alloc().
    
         Note that if called during add_key(), preparse is called before this
         method, but a key isn't actually allocated until after this function
         is called.
    
     (2) KEY_ALLOC_BYPASS_RESTRICTION is added.  This can be passed to
         key_create_or_update() or key_instantiate_and_link() to bypass the
         restriction check.
    
     (3) KEY_FLAG_TRUSTED_ONLY is removed.  The entire contents of a keyring
         with this restriction emplaced can be considered 'trustworthy' by
         virtue of being in the keyring when that keyring is consulted.
    
     (4) key_alloc() and keyring_alloc() take an extra argument that will be
         used to set restrict_link in the new key.  This ensures that the
         pointer is set before the key is published, thus preventing a window
         of unrestrictedness.  Normally this argument will be NULL.
    
     (5) As a temporary affair, keyring_restrict_trusted_only() is added.  It
         should be passed to keyring_alloc() as the extra argument instead of
         setting KEY_FLAG_TRUSTED_ONLY on a keyring.  This will be replaced in
         a later patch with functions that look in the appropriate places for
         authoritative keys.
    
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Reviewed-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
    5ac7eace