Re: [PATCH] keyring: Incorrect permissions checking in __keyring_search_one()

[David Howells <dhowells@redhat.com>]

Arun Raghavan <arunsr@cse.iitk.ac.in> wrote:

> The __keyring_search_one() function currently has 2 issues with regards
> to permissions:
> 
>  1. It does not check for KEY_SEARCH on the keyring before performing a
>     search

That is correct.  This is used by key_create_or_update() to check to see
whether there's a key in the current keyring that it can update rather than
adding a new key entirely.  key_create_or_update() mustn't be bound by
KEY_SEARCH permission, and similarly the target key doesn't require KEY_SEARCH
permission either; the control here is whether or not the target key has
KEY_WRITE permission.

>  2. It accepts a "perm" parameter to check whether a given key in the
>     keyring may be returned.

The "perm" parameter is superfluous given that nothing else now calls this
function.

David