summaryrefslogtreecommitdiff
path: root/security/keys/proc.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2011-03-11 17:57:23 +0000
committerJames Morris <jmorris@namei.org>2011-03-17 11:59:32 +1100
commit78b7280cce23293f7570ad52c1ffe1485c6d9669 (patch)
treef3051c5fe69cb41e88f9470dead8534dda3e94e0 /security/keys/proc.c
parentc151694b2c48d956ac8c8c59c6927f89cc29ef70 (diff)
downloadlinux-3.10-78b7280cce23293f7570ad52c1ffe1485c6d9669.tar.gz
linux-3.10-78b7280cce23293f7570ad52c1ffe1485c6d9669.tar.bz2
linux-3.10-78b7280cce23293f7570ad52c1ffe1485c6d9669.zip
KEYS: Improve /proc/keys
Improve /proc/keys by: (1) Don't attempt to summarise the payload of a negated key. It won't have one. To this end, a helper function - key_is_instantiated() has been added that allows the caller to find out whether the key is positively instantiated (as opposed to being uninstantiated or negatively instantiated). (2) Do show keys that are negative, expired or revoked rather than hiding them. This requires an override flag (no_state_check) to be passed to search_my_process_keyrings() and keyring_search_aux() to suppress this check. Without this, keys that are possessed by the caller, but only grant permissions to the caller if possessed are skipped as the possession check fails. Keys that are visible due to user, group or other checks are visible with or without this patch. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'security/keys/proc.c')
-rw-r--r--security/keys/proc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/security/keys/proc.c b/security/keys/proc.c
index 525cf8a29cd..49bbc97943a 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -199,7 +199,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
if (key->perm & KEY_POS_VIEW) {
skey_ref = search_my_process_keyrings(key->type, key,
lookup_user_key_possessed,
- cred);
+ true, cred);
if (!IS_ERR(skey_ref)) {
key_ref_put(skey_ref);
key_ref = make_key_ref(key, 1);