summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* test: Grant permissionsnextDavid Howells2020-07-067-59/+40
| | | | | | Test permission granting using the internal ACL. Signed-off-by: David Howells <dhowells@redhat.com>
* Add a keyctl command for granting a permit on a keyDavid Howells2020-07-0616-3/+1301
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a keyctl command to allow permits to be granted or removed on a key for a specific subject. The kernel maintains the ACL internally from these alterations, but the ACL isn't directly accessible. The command looks like: keyctl grant <keyid> <subject> <permits> where subject can currently be one of pos - Permits available to a possessor of the key own - Permits available to key's owner grp - Permits available to key's group ID all - Permits available to everyone and permits can be any combination of the following letters: v - Permit the subject to view the key's attributes r - Permit the subject to read the key's payload w - Permit the subject to change the key's payload s - Permit the subject to find the key in a search l - Permit the subject to create a link to the key I - Permit the subject to invalidate the key R - Permit the subject to revoke the key S - Permit the subject to change the key's security j - Permit the subject to join the session keyring c - Permit the subject to clear the keyring For example: $ keyctl grant @s own j will grant the key's owner a permit to join the key as its session keyring, but will remove all other permits for the owner directly, such as view, read, etc.. Signed-off-by: David Howells <dhowells@redhat.com>
* Handle kernel having key/keyring ACLsDavid Howells2020-07-069-30/+62
| | | | | | | | | | | | | | Handle the kernel using ACLs to store the list of permits for a key or keyring: (1) Make the "keyctl supports" command show it (2) Change the behaviour of the keyctl/permitting/valid tests to take account of the fact that 'Other' permits are replaced with 'Everyone' permits and so are added to the other permits rather than being used as a fallback instead of the other permits. Signed-off-by: David Howells <dhowells@redhat.com>
* Version 1.6.2v1.6.2David Howells2020-07-061-1/+13
|
* Build: Remove libkeyutils.pc on make cleanDavid Howells2020-07-061-1/+1
| | | | Signed-off-by: David Howells <dhowells@redhat.com>
* Fix error when a C++ program is linked with libkeyutilsChristophe Vu-Brugier2020-07-061-0/+8
| | | | | | | | Declare all the functions as extern "C" in keyutils.h to instruct a C++ compiler that these functions are not mangled. Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Check that keyutils.h has valid C++ syntax at build timeChristophe Vu-Brugier2020-07-061-1/+15
| | | | | Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Fix compilation error when keyutils.h is used in C++Christophe Vu-Brugier2020-07-062-3/+3
| | | | | | | | | | | | | | The declaration of the keyctl_dh_compute_kdf() function contains a parameter named "private". Unfortunately, "private" is a C++ reserved keyword. As a consequence, compiling a C++ program that includes keyutils.h fails. This patch renames the "private" variable to "priv" since a similar parameter is named this way in the nearby keyctl_dh_compute() function. Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* man: fix typosChristophe Vu-Brugier2020-07-0611-16/+12
| | | | | Signed-off-by: Christophe Vu-Brugier <cvubrugier@fastmail.fm> Signed-off-by: David Howells <dhowells@redhat.com>
* Add the ability to supply filters to watches set with keyctlDavid Howells2020-07-066-23/+269
| | | | | | | Add the ability to supply filters to watches set with "keyctl watch" and "keyctl watch_session". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Use notifications in testingDavid Howells2020-07-062-20/+348
| | | | | | | Make the testing infrastructure do automatic checking for notifications as tests manipulate keys. Signed-off-by: David Howells <dhowells@redhat.com>
* Add a notification facility for watching for key changesDavid Howells2020-07-0612-9/+963
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add keyctl commands and library functions to handle the setting and removal of watches on keys for notifications of change events. Five keyctl commands are defined: (1) keyctl watch <key> Watch the specified key for changes, logging notifications to stdout. (2) keyctl watch_session [-n <name>] <notifylog> <gclog> <fd> prog [<arg>...] Create a new session keyring and attach a watch to it that an auxiliary logging process monitors. The nominated program is run with the session program with the arguments given. The session keyring can be given a name. The logging process will log synchronous events to file notifylog and asynchronous events to file gclog. The specified file descriptor will be attached to the watch_queue and left open across the exec. This can be made use of by the next few commands. (3) keyctl watch_add <fd> <key> (4) keyctl watch_rm <fd> <key> Add/remove a watch on the specified key to/from the given watch_queue derived from watch_session. (5) keyctl watch_sync <fd> Wait for the logging process that's watching the given watch_queue to synchronise. Commands (2) to (5) are primarily provided for the testsuite's purposes. Signed-off-by: David Howells <dhowells@redhat.com>
* lib: Open version KEYUTILS_1.10David Howells2020-07-062-1/+5
| | | | | | Open API version KEYUTILS_1.10 in the shared library. Signed-off-by: David Howells <dhowells@redhat.com>
* dns: Apply a default TTL to records obtained from getaddrinfo()David Howells2020-07-066-25/+277
| | | | | | | | | | | | | | | | | | | | Address records obtained from getaddrinfo() don't come with any TTL information, even if they're obtained from the DNS, with the result that key.dns_resolver upcall program doesn't set an expiry time on dns_resolver records unless they include a component obtained directly from the DNS, such as an SRV or AFSDB record. Fix this to apply a default TTL of 10mins in the event that we haven't got one. This can be configured in /etc/keyutils/key.dns_resolver.conf by adding the line: default_ttl = <number-of-seconds> to the file. Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Ben Boeckel <me@benboeckel.net> Reviewed-by: Jeff Layton <jlayton@kernel.org>
* Makefile: Use rpmspec to calculate package nameDavid Howells2020-05-181-6/+6
| | | | | | | Use the rpmspec program to calculate the package name rather than trying to substitute macros that keep changing. Signed-off-by: David Howells <dhowells@redhat.com>
* man: the info strings are actually space or tab separatedBen Boeckel2020-05-183-5/+5
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* man: clarify that keyctl_set_reqkey_keyring(3) returns the old defaultBen Boeckel2020-05-181-2/+2
| | | | | | | | The prose mentions this, but the return value section gave conflicting information. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: try to wipe keys from memory after useMaciej S. Szmigiero2019-10-311-7/+41
| | | | | | | | | | | | | | The key being added or updated likely contains secrets so it would be best not to leave it in memory or in a core dump when no longer needed. Glibc 2.25+ provides the explicit_bzero() function that can be used for this purpose, let's utilize it if it is present. Tested by redefining exit(n) to abort() and inspecting the resulting core file for key data. Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: Use hex input for keyctl/dh_compute/bad-argsDavid Howells2019-09-041-41/+41
| | | | | | | Use keyctl add's hex input capability for keyctl/dh_compute/bad-args rather than an "echo -e | keyctl padd" construct. Signed-off-by: David Howells <dhowells@redhat.com>
* tests/search: test a found key without search permissionsBen Boeckel2019-09-041-5/+29
| | | | | | | | | | | | | | These stanzas were essentially duplicates of the previous blocks. Fix them to test first disabling Search on the first keyring and then the second keyring. Also add disabling of Search on the target key and checking searches from the session keyring. [DH: Modified to fix the searches and add Ben's change as a separate test in its own right] Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/search: test searching with a mismatched typeBen Boeckel2019-09-041-0/+5
| | | | | | | This should fail because the actually found key has a type mismatch. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/reading: fix test commentBen Boeckel2019-09-041-1/+1
| | | | | | | | This comment was copied from another test. This one actually fails because search permissions were also removed. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* test/instantiating: test bad arguments for `keyctl reject`Ben Boeckel2019-09-042-0/+36
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/instantiating: test the unlinked keyidBen Boeckel2019-09-041-3/+3
| | | | | | | | Testing the `0` ID just repeats the "BAD KEY" tests at the beginning of the file. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/timeout: test actions on an expired keyring as wellBen Boeckel2019-09-041-0/+15
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: fix typos in test commentsBen Boeckel2019-09-049-11/+11
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: unify spelling of "unparsable"Ben Boeckel2019-09-041-3/+3
| | | | | | | | Both spelling seems to be accepted, but the majority of uses agreed on the "unparsable" variant. Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: remove some trailing whitespaceBen Boeckel2019-09-044-15/+15
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests: fix some typos in marker linesBen Boeckel2019-09-041-1/+1
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* tests/toolbox: detect endianness with PIE executablesBen Boeckel2019-09-041-2/+2
| | | | | Signed-off-by: Ben Boeckel <mathstuf@gmail.com> Signed-off-by: David Howells <dhowells@redhat.com>
* test: Fold expect_keyid into create_key and suchlikeDavid Howells2019-09-0451-468/+559
| | | | | | | | Fold the use of expect_keyid into create_key and suchlike to make it easier to integrate notification checks into the existing superstructure, thereby making them happen automatically rather than having to manually code them. Signed-off-by: David Howells <dhowells@redhat.com>
* rpm: Fix version determination for "make rpm"David Howells2019-09-041-5/+9
| | | | | | | Fix the determination of the version string for "make rpm" by making sure that all otherwise unhandled %{...} variable substitutions get deleted. Signed-off-by: David Howells <dhowells@redhat.com>
* Fix the guess for the default LIBDIRDavid Howells2019-09-041-1/+1
| | | | | | | | | | | The guesser for the default LIBDIR examines the libraries used by make, looking for libc. Make uses libcrypt as well as libc, so if libcrypt happens to come first, that matches and the sed command to extract the library path fails. Fix this by looking for a match on "libc." instead of "libc". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Test trusted keyring featuresDavid Howells2019-08-191-0/+101
| | | | | | Test kernel features like the builtin trusted keyring. Signed-off-by: David Howells <dhowells@redhat.com>
* test: Use hex-converting padd for dh_compute testsDavid Howells2019-08-191-124/+124
| | | | | | Use hex-converting padd to load data for dh_compute tests. Signed-off-by: David Howells <dhowells@redhat.com>
* keyctl: Allow add, padd and suchlike to take hex-encoded dataDavid Howells2019-08-198-36/+202
| | | | | | | | | | | | | Allow add, padd, update, pupdate, instantiate, pinstantiate and dh_compute_kdf_oi to take hex-encoded data which is then converted into binary before being passed to the kernel, e.g.: $ keyctl add -x user foo 686578 @s $ echo 686578 | keyctl padd -x user foo @s This makes it easier to stash data in scripts. Signed-off-by: David Howells <dhowells@redhat.com>
* test: Check that KEYCTL_SESSION_TO_PARENT worksDavid Howells2019-08-192-0/+68
| | | | | | Check that the KEYCTL_SESSION_TO_PARENT keyctl function works. Signed-off-by: David Howells <dhowells@redhat.com>
* Allow keyctl new_session to name the session keyringDavid Howells2019-08-192-6/+9
| | | | | | | | | | Allow "keyctl new_session" to name the session keyring it creates and attaches to the parent: $ keyctl new_session fred 52095209 Signed-off-by: David Howells <dhowells@redhat.com>
* Add a symbolic ID to numeric ID keyctl commandDavid Howells2019-08-196-0/+176
| | | | | | | | | | | | | Add a keyctl command to look up a symbolic key ID (such as "@s") or a named reference (such as "%user:foo") and return the numeric ID for the key or keyring, eg: $ keyctl id @s 259509209 The command will also just convert numeric IDs to themselves. Signed-off-by: David Howells <dhowells@redhat.com>
* Put the keyctl get_persistent command in the right orderDavid Howells2019-08-191-1/+1
| | | | | | | Put the keyctl get_persistent command in the right place in the alphabetic command order. Signed-off-by: David Howells <dhowells@redhat.com>
* Allow retrieval of raw data with "keyctl supports"David Howells2019-08-192-9/+31
| | | | | | | Allow "keyctl supports" to be given a "--raw" flag to request a hexdump of the data retrieved. Signed-off-by: David Howells <dhowells@redhat.com>
* Add namespace-related capability tagsDavid Howells2019-08-194-0/+27
| | | | | | | Add missing ns_keyring_name and ns_key_tag capability tags to "keyctl supports". Signed-off-by: David Howells <dhowells@redhat.com>
* test: Test all possible type, description and payload lengths to add_keyDavid Howells2019-08-195-20/+310
| | | | | | | | | | | Test all possible type, description and payload lengths to add_key() to make sure that the kernel doesn't crash when handling them. The bulk of this test is implemented in C in the keyctl command so that it completes in a reasonable amount of time (testing over a million different sizes of payload from shell script is just too slow). Signed-off-by: David Howells <dhowells@redhat.com>
* Move to version 1.6.1v1.6.1David Howells2019-08-021-1/+7
|
* test: Use capabilities query function in test scriptsDavid Howells2019-06-191-36/+42
| | | | Signed-off-by: David Howells <dhowells@redhat.com>
* Provide the ability to query subsystem capabilitiesDavid Howells2019-06-1910-0/+355
| | | | | | Provide the ability to query the capabilities of the keyrings subsystem. Signed-off-by: David Howells <dhowells@redhat.com>
* Add support for KEYCTL_MOVEDavid Howells2019-06-1913-2/+755
| | | | Signed-off-by: David Howells <dhowells@redhat.com>
* Make key=value argument list optional for pkey_{encrypt,decrypt,sign}Lennert Buytenhek2019-06-191-3/+3
| | | | | | | | | | | | | keyctl's help message suggests that including a key=value style list of arguments is optional for the pkey_* operations, and for pkey_query and pkey_verify it indeed seems to be optional, but the other three operations require that at least one key=value pair be passed in. This patch changes the logic to make key=value lists optional for all pkey_* operations. Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org> Signed-off-by: David Howells <dhowells@redhat.com>
* Fix syscall signature for KEYCTL_PKEY_QUERYLennert Buytenhek2019-06-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, running 'keyctl pkey_query' (or pkey_{encrypt,decrypt,sign}, due to those using pkey_query internally) will always return: keyctl_pkey_query: Invalid argument This is because we invoke KEYCTL_PKEY_QUERY as: return keyctl(KEYCTL_PKEY_QUERY, key_id, info, result); While the kernel code (security/keys/keyctl.c) does this: [...] case KEYCTL_PKEY_QUERY: if (arg3 != 0) return -EINVAL; return keyctl_pkey_query((key_serial_t)arg2, (const char __user *)arg4, (struct keyctl_pkey_query __user *)arg5); [...] In other words, there is supposed to be an argument between 'key_id' and 'info' (presumably for the (currently unsupported) key password field?) which is supposed to be NULL. Adding a NULL argument seems to make things happy. Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org> Signed-off-by: David Howells <dhowells@redhat.com>
* Fix 'keyctl pkey_query' argument parsingLennert Buytenhek2019-06-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | keyctl's pkey_* operations each have an argument that allows specifying a key password, but since that feature isn't currently supported, it is supposed to always be passed in as "0": if (strcmp(argv[2], "0") != 0) { fprintf(stderr, "Password passing is not yet supported\n"); exit(2); } However, act_keyctl_pkey_query() has an off-by-one that makes it start parsing key=value style option pairs at the password argument, which causes the following error if the password argument is not in key=value format: $ keyctl pkey_query 541826697 0 Option not in key=val form $ And this error if the password argument is in key=value format: $ keyctl pkey_query 541826697 a=b Password passing is not yet supported $ This patch fixes act_keyctl_pkey_query() to start parsing key=value pairs from the right place in its argument list, which gets it a little further. Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org> Signed-off-by: David Howells <dhowells@redhat.com>
View Lorry Controller Status