xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

KEYS: Use structure to capture key restriction function and data

Browse Source 
Replace struct key's restrict_link function pointer with a pointer to
the new struct key_restriction. The structure contains pointers to the
restriction function as well as relevant data for evaluating the
restriction.

The garbage collector checks restrict_link->keytype when key types are
unregistered. Restrictions involving a removed key type are converted
to use restrict_link_reject so that restrictions cannot be removed by
unregistering key types.

Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
This commit is contained in:
Mat Martineau
2016-08-31 16:05:43 -07:00
parent e9cc0f689a
commit 2b6aa412ff
9 changed files with 144 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/linux/key.h
View File

@@ -217,7 +217,7 @@ struct key {
};
/* This is set on a keyring to restrict the addition of a link to a key
* to it. If this method isn't provided then it is assumed that the
* to it. If this structure isn't provided then it is assumed that the
* keyring is open to any addition. It is ignored for non-keyring
* keys.
*
@@ -226,7 +226,7 @@ struct key {
* overrides this, allowing the kernel to add extra keys without
* restriction.
*/
key_restrict_link_func_t restrict_link;
struct key_restriction *restrict_link;
};
extern struct key *key_alloc(struct key_type *type,
@@ -235,7 +235,7 @@ extern struct key *key_alloc(struct key_type *type,
const struct cred *cred,
key_perm_t perm,
unsigned long flags,
key_restrict_link_func_t restrict_link);
struct key_restriction *restrict_link);
#define KEY_ALLOC_IN_QUOTA 0x0000 /* add to quota, reject if would overrun */
@@ -311,7 +311,7 @@ extern struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid
const struct cred *cred,
key_perm_t perm,
unsigned long flags,
key_restrict_link_func_t restrict_link,
struct key_restriction *restrict_link,
struct key *dest);
extern int restrict_link_reject(struct key *keyring,