diff options
| author |   Zoran Markovic <zmarkovic@sierrawireless.com> | 2018-10-17 16:25:44 -0700 |
|---|---|---|
| committer |   Casey Schaufler <casey.schaufler@intel.com> | 2018-12-03 11:57:55 -0800 |
| commit | 5b841bfab695e3b8ae793172a9ff7990f99cc3e2 (patch) | |
| tree | 5cb5dd112e5f414a1008adef5c5aa061441851af /Documentation/admin-guide/LSM/Smack.rst | |
| parent | Merge tag 'v4.20-rc2' into next-general (diff) | |
| download | linux-dev-5b841bfab695e3b8ae793172a9ff7990f99cc3e2.tar.xz linux-dev-5b841bfab695e3b8ae793172a9ff7990f99cc3e2.zip | |
smack: fix access permissions for keyring
Function smack_key_permission() only issues smack requests for the
following operations:
- KEY_NEED_READ (issues MAY_READ)
- KEY_NEED_WRITE (issues MAY_WRITE)
- KEY_NEED_LINK (issues MAY_WRITE)
- KEY_NEED_SETATTR (issues MAY_WRITE)
A blank smack request is issued in all other cases, resulting in
smack access being granted if there is any rule defined between
subject and object, or denied with -EACCES otherwise.
Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW.
Fix the logic in the unlikely case when both MAY_READ and
MAY_WRITE are needed. Validate access permission field for valid
contents.
Signed-off-by: Zoran Markovic <zmarkovic@sierrawireless.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Diffstat (limited to 'Documentation/admin-guide/LSM/Smack.rst')
0 files changed, 0 insertions, 0 deletions