KEYS: prevent keys from being removed from specified keyrings

Browse source

Userspace should not be allowed to remove keys from certain keyrings
(eg. blacklist), though the keys themselves can expire.

This patch defines a new key flag named KEY_FLAG_KEEP to prevent
userspace from being able to unlink, revoke, invalidate or timed
out a key on a keyring.  When this flag is set on the keyring, all
keys subsequently added are flagged.

In addition, when this flag is set, the keyring itself can not be
cleared.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Howells <dhowells@redhat.com>

...

This commit is contained in:

Mimi Zohar 2015-11-10 08:34:46 -05:00

parent 80eae209d6

commit d3600bcf9d

3 changed files with 52 additions and 11 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

include/linux/key.h

View file

6

security/keys/key.c

View file

56

security/keys/keyctl.c

View file