Re: [PATCH] KEYS: request_key: enforce keyring restrictions on constructed keys

[Jarkko Sakkinen <jarkko@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 619 bytes --]

On Sat, Oct 31, 2026 at 10:20:44AM +0200, Jarkko Sakkinen wrote:
> I tried to go through the code change now as it is huge and there was no
> explanation why you need to do all of this.
> 
> It is full out-of-scope changes. Please redo this just as a scoped bug
> fix, and don't add any new flags.

Unfortunately it immediately hit me after sending this how to fix the bug,
and it does not make much sense to ask to write the same fix I would do
myself anyway.

I'll rather go this time with the attached patch and consider this as a
bug report (as marked by reported-by).

Thank you for your contribution.

Br, Jarkko

[-- Attachment #2: 0001-KEYS-Reject-restricted-dest_keyring-in-construct_all.patch --]
[-- Type: text/x-diff, Size: 1580 bytes --]

From 2e37dd3a4fe1c10ebaeec3243e48baa25a6efa1b Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: Sat, 31 Oct 2026 11:06:59 +0200
Subject: [PATCH] KEYS: Reject restricted dest_keyring in construct_alloc_key()

construct_alloc_key() links keys into dest_keyring without checking
restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to
remain in a restricted keyring when instantiated without relinking into
dest_keyring. Reject restricted destination keyrings with -EPERM after
__key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set.

Cc: stable@vger.kernel.org
Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
Reported-by: Anvik Loitongbam <permissiontogallop@gmail.com>
Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@gmail.com/
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 security/keys/request_key.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 22cd66a44da5..715ef3cc51b3 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -404,6 +404,13 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
 		ret = __key_link_lock(dest_keyring, &key->index_key);
 		if (ret < 0)
 			goto link_lock_failed;
+
+		/* The payload is not yet available to check the restriction. */
+		if (dest_keyring->restrict_link &&
+		    !(flags & KEY_ALLOC_BYPASS_RESTRICTION)) {
+			ret = -EPERM;
+			goto link_alloc_failed_unlocked;
+		}
 	}
 
 	/*
-- 
2.47.3