mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

keys: Garbage collect keys for which the domain has been removed 

If a key operation domain (such as a network namespace) has been removed
then attempt to garbage collect all the keys that use it.

Signed-off-by: David Howells <dhowells@redhat.com>
This commit is contained in:
David Howells 2019-06-26 21:02:32 +01:00
parent 3b6e4de05e
commit 218e6424e7
3 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/linux/key.h
View File

@ -278,6 +278,7 @@ extern void key_revoke(struct key *key);
extern void key_invalidate(struct key *key);
extern void key_put(struct key *key);
extern bool key_put_tag(struct key_tag *tag);
extern void key_remove_domain(struct key_tag *domain_tag);
static inline struct key *__key_get(struct key *key)
{
@ -446,6 +447,7 @@ extern void key_init(void);
#define key_fsgid_changed(c) do { } while(0)
#define key_init() do { } while(0)
#define key_free_user_ns(ns) do { } while(0)
#define key_remove_domain(d) do { } while(0)
#endif /* CONFIG_KEYS */
#endif /* __KERNEL__ */

3
security/keys/internal.h
View File

@ -209,7 +209,8 @@ static inline bool key_is_dead(const struct key *key, time64_t limit)
return
key->flags & ((1 << KEY_FLAG_DEAD) |
(1 << KEY_FLAG_INVALIDATED)) ||
(key->expiry > 0 && key->expiry <= limit);
(key->expiry > 0 && key->expiry <= limit) ||
key->domain_tag->removed;
}
/*

15
security/keys/keyring.c
View File

@ -241,6 +241,21 @@ bool key_put_tag(struct key_tag *tag)
return false;
}
/**
* key_remove_domain - Kill off a key domain and gc its keys
* @domain_tag: The domain tag to release.
*
* This marks a domain tag as being dead and releases a ref on it. If that
* wasn't the last reference, the garbage collector is poked to try and delete
* all keys that were in the domain.
*/
void key_remove_domain(struct key_tag *domain_tag)
{
domain_tag->removed = true;
if (!key_put_tag(domain_tag))
key_schedule_gc_links();
}
/*
* Build the next index key chunk.
*