diff options
Diffstat (limited to 'fs/crypto/keyring.c')
| -rw-r--r-- | fs/crypto/keyring.c | 40 |
1 files changed, 33 insertions, 7 deletions
diff --git a/fs/crypto/keyring.c b/fs/crypto/keyring.c index c34fa7c61b43..fb4f6a44ffcd 100644 --- a/fs/crypto/keyring.c +++ b/fs/crypto/keyring.c @@ -127,6 +127,35 @@ static struct key_type key_type_fscrypt_user = { .describe = fscrypt_user_key_describe, }; +static struct key_acl fscrypt_keyring_acl = { + .usage = REFCOUNT_INIT(1), + .nr_ace = 2, + .aces = { + KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_INVAL | + KEY_ACE_JOIN), + KEY_OWNER_ACE(KEY_ACE_SEARCH | KEY_ACE_INVAL | KEY_ACE_JOIN | + KEY_ACE_READ | KEY_ACE_VIEW), + } +}; + +static struct key_acl fscrypt_key_acl = { + .usage = REFCOUNT_INIT(1), + .nr_ace = 2, + .aces = { + KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_INVAL), + KEY_OWNER_ACE(KEY_ACE_SEARCH | KEY_ACE_INVAL | KEY_ACE_VIEW), + } +}; + +static struct key_acl fscrypt_user_key_acl = { + .usage = REFCOUNT_INIT(1), + .nr_ace = 2, + .aces = { + KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_INVAL), + KEY_OWNER_ACE(KEY_ACE_VIEW), + } +}; + /* Search ->s_master_keys or ->mk_users */ static struct key *search_fscrypt_keyring(struct key *keyring, struct key_type *type, @@ -203,8 +232,7 @@ static int allocate_filesystem_keyring(struct super_block *sb) format_fs_keyring_description(description, sb); keyring = keyring_alloc(description, GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, - current_cred(), KEY_POS_SEARCH | - KEY_USR_SEARCH | KEY_USR_READ | KEY_USR_VIEW, + current_cred(), &fscrypt_keyring_acl, KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); if (IS_ERR(keyring)) return PTR_ERR(keyring); @@ -247,8 +275,7 @@ static int allocate_master_key_users_keyring(struct fscrypt_master_key *mk) format_mk_users_keyring_description(description, mk->mk_spec.u.identifier); keyring = keyring_alloc(description, GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, - current_cred(), KEY_POS_SEARCH | - KEY_USR_SEARCH | KEY_USR_READ | KEY_USR_VIEW, + current_cred(), &fscrypt_keyring_acl, KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); if (IS_ERR(keyring)) return PTR_ERR(keyring); @@ -285,7 +312,7 @@ static int add_master_key_user(struct fscrypt_master_key *mk) format_mk_user_description(description, mk->mk_spec.u.identifier); mk_user = key_alloc(&key_type_fscrypt_user, description, current_fsuid(), current_gid(), current_cred(), - KEY_POS_SEARCH | KEY_USR_VIEW, 0, NULL); + &fscrypt_user_key_acl, 0, NULL); if (IS_ERR(mk_user)) return PTR_ERR(mk_user); @@ -357,8 +384,7 @@ static int add_new_master_key(struct fscrypt_master_key_secret *secret, format_mk_description(description, mk_spec); key = key_alloc(&key_type_fscrypt, description, GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(), - KEY_POS_SEARCH | KEY_USR_SEARCH | KEY_USR_VIEW, - KEY_ALLOC_NOT_IN_QUOTA, NULL); + &fscrypt_key_acl, KEY_ALLOC_NOT_IN_QUOTA, NULL); if (IS_ERR(key)) { err = PTR_ERR(key); goto out_free_mk; |