You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

David Howells 21279cfa10 KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases ... The destination keyring specified to request_key() and co. is made available to the process that instantiates the key (the slave process started by /sbin/request-key typically). This is passed in the request_key_auth struct as the dest_keyring member. keyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring() to get the keyring to attach the newly constructed key to at the end of instantiation. This may be given a specific keyring into which a link will be made later, or it may be asked to find the keyring passed to request_key(). In the former case, it returns a keyring with the refcount incremented by lookup_user_key(); in the latter case, it returns the keyring from the request_key_auth struct - and does _not_ increment the refcount. The latter case will eventually result in an oops when the keyring prematurely runs out of references and gets destroyed. The effect may take some time to show up as the key is destroyed lazily. To fix this, the keyring returned by get_instantiation_keyring() must always have its refcount incremented, no matter where it comes from. This can be tested by setting /etc/request-key.conf to: #OP TYPE DESCRIPTION CALLOUT INFO PROGRAM ARG1 ARG2 ARG3 ... #====== ======= =============== =============== =============================== create * test:* * |/bin/false %u %g %d %{user:_display} negate * * * /bin/keyctl negate %k 10 @u and then doing: keyctl add user _display aaaaaaaa @u while keyctl request2 user test:x test:x @u && keyctl list @u; do keyctl request2 user test:x test:x @u; sleep 31; keyctl list @u; done which will oops eventually. Changing the negate line to have @u rather than %S at the end is important as that forces the latter case by passing a special keyring ID rather than an actual keyring ID. Reported-by: Alexander Zangerl <az@bond.edu.au> Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Alexander Zangerl <az@bond.edu.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		15 years ago
..
integrity/ima	const: constify remaining file_operations	16 years ago
keys	KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases	15 years ago
selinux	do_wait() wakeup optimization: change __wake_up_parent() to use filtered wakeup	16 years ago
smack	…
tomoyo	…
Kconfig	…
Makefile	…
capability.c	…
commoncap.c	…
device_cgroup.c	cgroups: let ss->can_attach and ss->attach do whole threadgroups at a time	16 years ago
inode.c	…
lsm_audit.c	lsm: Use a compressed IPv6 string format in audit events	16 years ago
min_addr.c	sysctl: remove "struct file *" argument of ->proc_handler	16 years ago
root_plug.c	…
security.c	…