• David Howells's avatar
    [PATCH] keys: Permit running process to instantiate keys · b5f545c8
    David Howells authored
    Make it possible for a running process (such as gssapid) to be able to
    instantiate a key, as was requested by Trond Myklebust for NFS4.
    
    The patch makes the following changes:
    
     (1) A new, optional key type method has been added. This permits a key type
         to intercept requests at the point /sbin/request-key is about to be
         spawned and do something else with them - passing them over the
         rpc_pipefs files or netlink sockets for instance.
    
         The uninstantiated key, the authorisation key and the intended operation
         name are passed to the method.
    
     (2) The callout_info is no longer passed as an argument to /sbin/request-key
         to prevent unauthorised viewing of this data using ps or by looking in
         /proc/pid/cmdline.
    
         This means that the old /sbin/request-key program will not work with the
         patched kernel as it will expect to see an extra argument that is no
         longer there.
    
         A revised keyutils package will be made available tomorrow.
    
     (3) The callout_info is now attached to the authorisation key. Reading this
         key will retrieve the information.
    
     (4) A new field has been added to the task_struct. This holds the
         authorisation key currently active for a thread. Searches now look here
         for the caller's set of keys rather than looking for an auth key in the
         lowest level of the session keyring.
    
         This permits a thread to be servicing multiple requests at once and to
         switch between them. Note that this is per-thread, not per-process, and
         so is usable in multithreaded programs.
    
         The setting of this field is inherited across fork and exec.
    
     (5) A new keyctl function (KEYCTL_ASSUME_AUTHORITY) has been added that
         permits a thread to assume the authority to deal with an uninstantiated
         key. Assumption is only permitted if the authorisation key associated
         with the uninstantiated key is somewhere in the thread's keyrings.
    
         This function can also clear the assumption.
    
     (6) A new magic key specifier has been added to refer to the currently
         assumed authorisation key (KEY_SPEC_REQKEY_AUTH_KEY).
    
     (7) Instantiation will only proceed if the appropriate authorisation key is
         assumed first. The assumed authorisation key is discarded if
         instantiation is successful.
    
     (8) key_validate() is moved from the file of request_key functions to the
         file of permissions functions.
    
     (9) The documentation is updated.
    
    From: <Valdis.Kletnieks@vt.edu>
    
        Build fix.
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
    Cc: Alexander Zangerl <az@bond.edu.au>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    b5f545c8
keys-request-key.txt 6.21 KB