Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

KEYS: Fix UID check in keyctl_get_persistent()

Browse source 
If the UID is specified by userspace when calling the KEYCTL_GET_PERSISTENT
function and the process does not have the CAP_SETUID capability, then the
function will return -EPERM if the current process's uid, suid, euid and fsuid
all match the requested UID.  This is incorrect.

Fix it such that when a non-privileged caller requests a persistent keyring by
a specific UID they can only request their own (ie. the specified UID matches
either then process's UID or the process's EUID).

This can be tested by logging in as the user and doing:

	keyctl get_persistent @p
	keyctl get_persistent @p `id -u`
	keyctl get_persistent @p 0

The first two should successfully print the same key ID.  The third should do
the same if called by UID 0 or indicate Operation Not Permitted otherwise.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Stephen Gallagher <sgallagh@redhat.com>
This commit is contained in:
David Howells 2013-11-06 14:01:51 +00:00
parent dbed714163
commit fbf8c53f1a
1 changed files with 2 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
security/keys/persistent.c
View file

@ -144,10 +144,8 @@ long keyctl_get_persistent(uid_t _uid, key_serial_t destid)
/* You can only see your own persistent cache if you're not /* You can only see your own persistent cache if you're not
* sufficiently privileged. * sufficiently privileged.
*/ */
if (uid_eq(uid, current_uid()) && if (!uid_eq(uid, current_uid()) &&
uid_eq(uid, current_suid()) && !uid_eq(uid, current_euid()) &&
uid_eq(uid, current_euid()) &&
uid_eq(uid, current_fsuid()) &&
!ns_capable(ns, CAP_SETUID)) !ns_capable(ns, CAP_SETUID))
return -EPERM; return -EPERM;
} }