• David Howells's avatar
    KEYS: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN · 0c7774ab
    David Howells authored
    Special kernel keys, such as those used to hold DNS results for AFS, CIFS and
    NFS and those used to hold idmapper results for NFS, used to be
    'invalidateable' with key_revoke().  However, since the default permissions for
    keys were reduced:
    
    	Commit: 96b5c8fe
    	KEYS: Reduce initial permissions on keys
    
    it has become impossible to do this.
    
    Add a key flag (KEY_FLAG_ROOT_CAN_INVAL) that will permit a key to be
    invalidated by root.  This should not be used for system keyrings as the
    garbage collector will try and remove any invalidate key.  For system keyrings,
    KEY_FLAG_ROOT_CAN_CLEAR can be used instead.
    
    After this, from userspace, keyctl_invalidate() and "keyctl invalidate" can be
    used by any possessor of CAP_SYS_ADMIN (typically root) to invalidate DNS and
    idmapper keys.  Invalidated keys are immediately garbage collected and will be
    immediately rerequested if needed again.
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Tested-by: default avatarSteve Dickson <steved@redhat.com>
    0c7774ab
idmap.c 19.3 KB