From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: keyrings@vger.kernel.org
Subject: Re: [RESEND] security/keys: remove possessor verify after key permission check
Date: Wed, 27 May 2020 19:58:21 +0000 [thread overview]
Message-ID: <1590609501.4731.3.camel@HansenPartnership.com> (raw)
In-Reply-To: <20200505091958.GD16980@willie-the-truck>
On Wed, 2020-05-27 at 22:47 +0300, Jarkko Sakkinen wrote:
[...]
> > ping
>
> Please send a new version with a full example of the scenario that
> you are referring. This thread became too messy to follow with the
> HTML emails included (that do no reach vger).
Yes, please ... I'm missing most of the emails because of the vger and
html problem. I think the request is to remove the possessor check in
keyctl_read, but just done blindly that would completely destroy our
namespaced security system for keys, so it doesn't sound like a good
idea at all. What's the actual problem this is trying to solve? It's
annoying that root has to join the session keyring to read a key, but
the reason for it is well justified and the fact that even root can't
reach some session keyrings is a feature not a bug.
James
prev parent reply other threads:[~2020-05-27 19:58 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-05 9:19 [RESEND] security/keys: remove possessor verify after key permission check Will Deacon
2020-05-05 13:07 ` Jarkko Sakkinen
2020-05-07 7:24 ` Jarkko Sakkinen
2020-05-13 16:50 ` Jarkko Sakkinen
2020-05-27 19:47 ` Jarkko Sakkinen
2020-05-27 19:58 ` James Bottomley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1590609501.4731.3.camel@HansenPartnership.com \
--to=james.bottomley@hansenpartnership.com \
--cc=keyrings@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.