Re: [PATCH v0 2/2] KEYS: LSM Hook for key_create_or_update

[Mimi Zohar <zohar@linux.ibm.com>]

On Fri, 2019-10-11 at 10:35 -0700, Lakshmi Ramasubramanian wrote:
> diff --git a/security/keys/key.c b/security/keys/key.c
> index 764f4c57913e..973dfead490c 100644
> --- a/security/keys/key.c
> +++ b/security/keys/key.c
> @@ -14,6 +14,7 @@
>  #include <linux/workqueue.h>
>  #include <linux/random.h>
>  #include <linux/err.h>
> +#include <keys/system_keyring.h>
>  #include "internal.h"
>  
>  struct kmem_cache *key_jar;
> @@ -823,6 +824,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
>  	key_ref_t key_ref;
>  	int ret;
>  	struct key_restriction *restrict_link = NULL;
> +	bool trusted_keyring = false;
>  
>  	/* look up the key type to see if it's one of the registered kernel
>  	 * types */
> @@ -936,6 +938,16 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
>  		goto error_link_end;
>  	}
>  
> +	/* let the security module know about the key */
> +	trusted_keyring = is_builtin_or_secondary_trusted_keyring(keyring);

Nothing should be added to the keys subsystem, other than the LSM
hook.

Mimi

> +	ret = security_key_create_or_update(keyring, key, cred, flags,
> +					    trusted_keyring);
> +	if (ret < 0) {
> +		key_put(key);
> +		key_ref = ERR_PTR(ret);
> +		goto error_link_end;
> +	}
> +