From: David Howells <dhowells@redhat.com> To: keyrings@vger.kernel.org, ebiggers@kernel.org Cc: Mat Martineau <mathew.j.martineau@linux.intel.com>, Eric Biggers <ebiggers@google.com>, James Morris <jamorris@linux.microsoft.com>, dhowells@redhat.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 00/10] keys: Miscellany [ver #3] Date: Wed, 19 Jun 2019 13:18:40 +0000 [thread overview] Message-ID: <156095032052.9363.8954337545422131435.stgit@warthog.procyon.org.uk> (raw) Here are some miscellaneous keyrings fixes and improvements intended for the next merge window: (1) Fix a bunch of warnings from sparse, including missing RCU bits and kdoc-function argument mismatches (2) Implement a keyctl to allow a key to be moved from one keyring to another, with the option of prohibiting key replacement in the destination keyring. (3) Grant Link permission to possessors of request_key_auth tokens so that upcall servicing daemons can more easily arrange things such that only the necessary auth key is passed to the actual service program, and not all the auth keys a daemon might possesss. (4) Improvement in lookup_user_key(). (5) Implement a keyctl to allow keyrings subsystem capabilities to be queried. The patches can be found on the following branch: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-misc The keyutils next branch has commits to make available, document and test the move-key and capabilities code: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/log/?h=next Changes: V3: (*) Made the capabilities array unsigned char[] rather than unsigned int[]. V2: (*) Fixed lock ordering bug in KEYCTL_MOVE. (*) Added improvement patch from Eric. (*) Added capabilities patch. David --- David Howells (9): keys: sparse: Fix key_fs[ug]id_changed() keys: sparse: Fix incorrect RCU accesses keys: sparse: Fix kdoc mismatches keys: Change keyring_serialise_link_sem to a mutex keys: Break bits out of key_unlink() keys: Hoist locking out of __key_link_begin() keys: Add a keyctl to move a key between keyrings keys: Grant Link permission to possessers of request_key auth keys keys: Add capability-checking keyctl function Eric Biggers (1): keys: Reuse keyring_index_key::desc_len in lookup_user_key() Documentation/security/keys/core.rst | 21 +++ include/linux/key.h | 13 +- include/uapi/linux/keyctl.h | 17 ++ kernel/cred.c | 4 security/keys/compat.c | 6 + security/keys/internal.h | 7 + security/keys/key.c | 27 +++ security/keys/keyctl.c | 90 +++++++++++ security/keys/keyring.c | 278 ++++++++++++++++++++++++++++------ security/keys/process_keys.c | 26 +-- security/keys/request_key.c | 9 + security/keys/request_key_auth.c | 4 12 files changed, 418 insertions(+), 84 deletions(-)
WARNING: multiple messages have this Message-ID (diff)
From: David Howells <dhowells@redhat.com> To: keyrings@vger.kernel.org, ebiggers@kernel.org Cc: Mat Martineau <mathew.j.martineau@linux.intel.com>, Eric Biggers <ebiggers@google.com>, James Morris <jamorris@linux.microsoft.com>, dhowells@redhat.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 00/10] keys: Miscellany [ver #3] Date: Wed, 19 Jun 2019 14:18:40 +0100 [thread overview] Message-ID: <156095032052.9363.8954337545422131435.stgit@warthog.procyon.org.uk> (raw) Here are some miscellaneous keyrings fixes and improvements intended for the next merge window: (1) Fix a bunch of warnings from sparse, including missing RCU bits and kdoc-function argument mismatches (2) Implement a keyctl to allow a key to be moved from one keyring to another, with the option of prohibiting key replacement in the destination keyring. (3) Grant Link permission to possessors of request_key_auth tokens so that upcall servicing daemons can more easily arrange things such that only the necessary auth key is passed to the actual service program, and not all the auth keys a daemon might possesss. (4) Improvement in lookup_user_key(). (5) Implement a keyctl to allow keyrings subsystem capabilities to be queried. The patches can be found on the following branch: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-misc The keyutils next branch has commits to make available, document and test the move-key and capabilities code: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/keyutils.git/log/?h=next Changes: V3: (*) Made the capabilities array unsigned char[] rather than unsigned int[]. V2: (*) Fixed lock ordering bug in KEYCTL_MOVE. (*) Added improvement patch from Eric. (*) Added capabilities patch. David --- David Howells (9): keys: sparse: Fix key_fs[ug]id_changed() keys: sparse: Fix incorrect RCU accesses keys: sparse: Fix kdoc mismatches keys: Change keyring_serialise_link_sem to a mutex keys: Break bits out of key_unlink() keys: Hoist locking out of __key_link_begin() keys: Add a keyctl to move a key between keyrings keys: Grant Link permission to possessers of request_key auth keys keys: Add capability-checking keyctl function Eric Biggers (1): keys: Reuse keyring_index_key::desc_len in lookup_user_key() Documentation/security/keys/core.rst | 21 +++ include/linux/key.h | 13 +- include/uapi/linux/keyctl.h | 17 ++ kernel/cred.c | 4 security/keys/compat.c | 6 + security/keys/internal.h | 7 + security/keys/key.c | 27 +++ security/keys/keyctl.c | 90 +++++++++++ security/keys/keyring.c | 278 ++++++++++++++++++++++++++++------ security/keys/process_keys.c | 26 +-- security/keys/request_key.c | 9 + security/keys/request_key_auth.c | 4 12 files changed, 418 insertions(+), 84 deletions(-)
next reply other threads:[~2019-06-19 13:18 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-06-19 13:18 David Howells [this message] 2019-06-19 13:18 ` [PATCH 00/10] keys: Miscellany [ver #3] David Howells 2019-06-19 13:18 ` [PATCH 01/10] keys: sparse: Fix key_fs[ug]id_changed() " David Howells 2019-06-19 13:18 ` David Howells 2019-06-19 13:19 ` [PATCH 02/10] keys: sparse: Fix incorrect RCU accesses " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 03/10] keys: sparse: Fix kdoc mismatches " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 04/10] keys: Change keyring_serialise_link_sem to a mutex " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 05/10] keys: Break bits out of key_unlink() " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 06/10] keys: Hoist locking out of __key_link_begin() " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 07/10] keys: Add a keyctl to move a key between keyrings " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 08/10] keys: Grant Link permission to possessers of request_key auth keys " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:19 ` [PATCH 09/10] keys: Reuse keyring_index_key::desc_len in lookup_user_key() " David Howells 2019-06-19 13:19 ` David Howells 2019-06-19 13:20 ` [PATCH 10/10] keys: Add capability-checking keyctl function " David Howells 2019-06-19 13:20 ` David Howells
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=156095032052.9363.8954337545422131435.stgit@warthog.procyon.org.uk \ --to=dhowells@redhat.com \ --cc=ebiggers@google.com \ --cc=ebiggers@kernel.org \ --cc=jamorris@linux.microsoft.com \ --cc=keyrings@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=mathew.j.martineau@linux.intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.