• David Howells's avatar
    keys: Make the KEY_NEED_* perms an enum rather than a mask · 8c0637e9
    David Howells authored
    Since the meaning of combining the KEY_NEED_* constants is undefined, make
    it so that you can't do that by turning them into an enum.
    
    The enum is also given some extra values to represent special
    circumstances, such as:
    
     (1) The '0' value is reserved and causes a warning to trap the parameter
         being unset.
    
     (2) The key is to be unlinked and we require no permissions on it, only
         the keyring, (this replaces the KEY_LOOKUP_FOR_UNLINK flag).
    
     (3) An override due to CAP_SYS_ADMIN.
    
     (4) An override due to an instantiation token being present.
    
     (5) The permissions check is being deferred to later key_permission()
         calls.
    
    The extra values give the opportunity for LSMs to audit these situations.
    
    [Note: This really needs overhauling so that lookup_user_key() tells
     key_task_permission() and the LSM what operation is being done and leaves
     it to those functions to decide how to map that onto the available
     permits.  However, I don't really want to make these change in the middle
     of the notifications patchset.]
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    cc: Paul Moore <paul@paul-moore.com>
    cc: Stephen Smalley <stephen.smalley.work@gmail.com>
    cc: Casey Schaufler <casey@schaufler-ca.com>
    cc: keyrings@vger.kernel.org
    cc: selinux@vger.kernel.org
    8c0637e9
security.c 62.2 KB