[PATCH] KEYS: prevent creating a different user's keyrings

David Howells dhowells at redhat.com
Tue Sep 19 16:05:20 UTC 2017


Eric Biggers <ebiggers3 at gmail.com> wrote:

> Fix it by marking user and user session keyrings with a flag
> KEY_FLAG_UID_KEYRING.  Then, when searching for a user or user session
> keyring by name, skip all keyrings that don't have the flag set.

I wonder if it's better just to reject attempts to manually create/join
keyrings of such names.  PAM uses the implicit creation method of specifying
the 'macro' key IDs for these keyrings.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html



More information about the Linux-security-module-archive mailing list