login
Login
/
Register
Search
Forums
News
Blogs
Features
Site
Home
»
Mailing list archives
»
linux-kernel
»
2008
»
February
»
12
Re: [PATCH 2/4] KEYS: Check starting keyring as part of search
view
thread
!MAILaRCHIVE_VOTE_RePLACE
Previous message: [
thread
] [
date
] [
author
]
Next message: [
thread
] [
date
] [
author
]
[view in full thread]
From:
Andrew Morton <akpm@...>
To: David Howells <dhowells@...>
Cc: <torvalds@...>, <linux-kernel@...>, <dhowells@...>
Subject:
Re: [PATCH 2/4] KEYS: Check starting keyring as part of search
Date: Tuesday, February 12, 2008 - 7:47 pm
On Fri, 08 Feb 2008 16:04:29 +0000 David Howells <dhowells@redhat.com> wrote:
quoted text
> Check the starting keyring as part of the search to (a) see if that is what > we're searching for, and (b) to check it is still valid for searching. > > The scenario: User in process A does things that cause things to be > created in its process session keyring. The user then does an su to > another user and starts a new process, B. The two processes now > share the same process session keyring. > > Process B does an NFS access which results in an upcall to gssd. > When gssd attempts to instantiate the context key (to be linked > into the process session keyring), it is denied access even though it > has an authorization key. > > The order of calls is: > > keyctl_instantiate_key() > lookup_user_key() (the default: case) > search_process_keyrings(current) > search_process_keyrings(rka->context) (recursive call) > keyring_search_aux() > > keyring_search_aux() verifies the keys and keyrings underneath the > top-level keyring it is given, but that top-level keyring is neither > fully validated nor checked to see if it is the thing being searched for. > > This patch changes keyring_search_aux() to: > 1) do more validation on the top keyring it is given and > 2) check whether that top-level keyring is the thing being searched for > > ... > > + (keyring->expiry && now.tv_sec >= keyring->expiry))
time_after()? --
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to
majordomo@vger.kernel.org
More majordomo info at
http://vger.kernel.org/majordomo-info.html
Please read the FAQ at
http://www.tux.org/lkml/
Previous message: [
thread
] [
date
] [
author
]
Next message: [
thread
] [
date
] [
author
]
Messages in current thread:
[PATCH 1/4] KEYS: Increase the payload size when instantiati...
, David Howells
, (Fri Feb 8, 12:04 pm)
[PATCH 4/4] KEYS: Add keyctl function to get a security label
, David Howells
, (Fri Feb 8, 12:04 pm)
Re: [PATCH 4/4] KEYS: Add keyctl function to get a security ...
, Andrew Morton
, (Tue Feb 12, 7:51 pm)
Re: [PATCH 4/4] KEYS: Add keyctl function to get a security ...
, David Howells
, (Wed Feb 13, 8:38 am)
[PATCH 3/4] KEYS: Allow the callout data to be passed as a b...
, David Howells
, (Fri Feb 8, 12:04 pm)
[PATCH 2/4] KEYS: Check starting keyring as part of search
, David Howells
, (Fri Feb 8, 12:04 pm)
Re: [PATCH 2/4] KEYS: Check starting keyring as part of search
, Andrew Morton
, (Tue Feb 12, 7:47 pm)
Re: [PATCH 2/4] KEYS: Check starting keyring as part of search
, David Howells
, (Wed Feb 13, 8:35 am)
Navigation
Create content
Mailing list archives
Recent posts
Popular discussions
linux-kernel
:
Davide Libenzi
Re: [patch 7/8] fdmap v2 - implement sys_socket2
Bart Van Assche
Integration of SCST in the mainstream Linux kernel
Greg Kroah-Hartman
[PATCH 005/196] Chinese: add translation of SubmittingDrivers
Mariusz Kozlowski
[KJ PATCHES] mostly kmalloc + memset conversion to k[cz]alloc
git
:
linux-netdev
:
KOSAKI Motohiro
[bug?] tg3: Failed to load firmware "tigon/tg3_tso.bin"
Stefan Richter
Re: [GIT]: Networking
David Miller
Re: [PATCH] pkt_sched: Destroy gen estimators under rtnl_lock().
Gerrit Renker
[PATCH 0/37] dccp: Feature negotiation - last call for comments
git-commits-head
:
Colocation donated by:
Who's online
There are currently
3 users
and
814 guests
online.
Online users
strcmp
zerhai30
tgrey
Syndicate