summaryrefslogtreecommitdiffstats
path: root/security/keys/keyring.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2006-04-10 15:15:21 +0100
committerLinus Torvalds <torvalds@g5.osdl.org>2006-04-10 09:33:46 -0700
commitc3a9d6541f84ac3ff566982d08389b87c1c36b4e (patch)
tree161e507b276105b35dadf0c2637be9f018b0f664 /security/keys/keyring.c
parent460fbf82c0842cad3f3c744c4dcb81978b7829f3 (diff)
downloadop-kernel-dev-c3a9d6541f84ac3ff566982d08389b87c1c36b4e.zip
op-kernel-dev-c3a9d6541f84ac3ff566982d08389b87c1c36b4e.tar.gz
[Security] Keys: Fix oops when adding key to non-keyring
This fixes the problem of an oops occuring when a user attempts to add a key to a non-keyring key [CVE-2006-1522]. The problem is that __keyring_search_one() doesn't check that the keyring it's been given is actually a keyring. I've fixed this problem by: (1) declaring that caller of __keyring_search_one() must guarantee that the keyring is a keyring; and (2) making key_create_or_update() check that the keyring is a keyring, and return -ENOTDIR if it isn't. This can be tested by: keyctl add user b b `keyctl add user a a @s` Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security/keys/keyring.c')
-rw-r--r--security/keys/keyring.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d65a180..bffa924 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
/*
* search the given keyring only (no recursion)
* - keyring must be locked by caller
+ * - caller must guarantee that the keyring is a keyring
*/
key_ref_t __keyring_search_one(key_ref_t keyring_ref,
const struct key_type *ktype,
OpenPOWER on IntegriCloud