[PATCH v3 23/25] keys: handle fsid mappings

[Christian Brauner]

Similar to proc and sysfs let keys use kfsids which are always mapped according
to id mappings.

Suggested-by: Jann Horn <jannh at google.com>
Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>
---
/* v2 */
patch not present

/* v3 */
patch added
- Jann Horn <jannh at google.com>:
  - Add patch to handle the keyrings.
---
 security/keys/key.c              |  2 +-
 security/keys/permission.c       |  4 ++--
 security/keys/process_keys.c     |  6 ++++--
 security/keys/request_key.c      | 10 +++++-----
 security/keys/request_key_auth.c |  2 +-
 5 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/security/keys/key.c b/security/keys/key.c
index 718bf7217420..bfb17e8210d7 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -923,7 +923,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
 	/* allocate a new key */
 	key = key_alloc(index_key.type, index_key.description,
-			cred->fsuid, cred->fsgid, cred, perm, flags, NULL);
+			cred->kfsuid, cred->kfsgid, cred, perm, flags, NULL);
 	if (IS_ERR(key)) {
 		key_ref = ERR_CAST(key);
 		goto error_link_end;
diff --git a/security/keys/permission.c b/security/keys/permission.c
index 085f907b64ac..847187ca6b41 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -33,7 +33,7 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
 	key = key_ref_to_ptr(key_ref);
 
 	/* use the second 8-bits of permissions for keys the caller owns */
-	if (uid_eq(key->uid, cred->fsuid)) {
+	if (uid_eq(key->uid, cred->kfsuid)) {
 		kperm = key->perm >> 16;
 		goto use_these_perms;
 	}
@@ -41,7 +41,7 @@ int key_task_permission(const key_ref_t key_ref, const struct cred *cred,
 	/* use the third 8-bits of permissions for keys the caller has a group
 	 * membership in common with */
 	if (gid_valid(key->gid) && key->perm & KEY_GRP_ALL) {
-		if (gid_eq(key->gid, cred->fsgid)) {
+		if (gid_eq(key->gid, cred->kfsgid)) {
 			kperm = key->perm >> 8;
 			goto use_these_perms;
 		}
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 09541de31f2f..32376f0fbb42 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -379,7 +379,7 @@ void key_fsuid_changed(struct cred *new_cred)
 	/* update the ownership of the thread keyring */
 	if (new_cred->thread_keyring) {
 		down_write(&new_cred->thread_keyring->sem);
-		new_cred->thread_keyring->uid = new_cred->fsuid;
+		new_cred->thread_keyring->uid = new_cred->kfsuid;
 		up_write(&new_cred->thread_keyring->sem);
 	}
 }
@@ -392,7 +392,7 @@ void key_fsgid_changed(struct cred *new_cred)
 	/* update the ownership of the thread keyring */
 	if (new_cred->thread_keyring) {
 		down_write(&new_cred->thread_keyring->sem);
-		new_cred->thread_keyring->gid = new_cred->fsgid;
+		new_cred->thread_keyring->gid = new_cred->kfsgid;
 		up_write(&new_cred->thread_keyring->sem);
 	}
 }
@@ -923,10 +923,12 @@ void key_change_session_keyring(struct callback_head *twork)
 	new-> euid	= old-> euid;
 	new-> suid	= old-> suid;
 	new->fsuid	= old->fsuid;
+	new->kfsuid	= old->kfsuid;
 	new->  gid	= old->  gid;
 	new-> egid	= old-> egid;
 	new-> sgid	= old-> sgid;
 	new->fsgid	= old->fsgid;
+	new->kfsgid	= old->kfsgid;
 	new->user	= get_uid(old->user);
 	new->user_ns	= get_user_ns(old->user_ns);
 	new->group_info	= get_group_info(old->group_info);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 957b9e3e1492..254a7c2f3fde 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -134,7 +134,7 @@ static int call_sbin_request_key(struct key *authkey, void *aux)
 	sprintf(desc, "_req.%u", key->serial);
 
 	cred = get_current_cred();
-	keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred,
+	keyring = keyring_alloc(desc, cred->kfsuid, cred->kfsgid, cred,
 				KEY_POS_ALL | KEY_USR_VIEW | KEY_USR_READ,
 				KEY_ALLOC_QUOTA_OVERRUN, NULL, NULL);
 	put_cred(cred);
@@ -149,8 +149,8 @@ static int call_sbin_request_key(struct key *authkey, void *aux)
 		goto error_link;
 
 	/* record the UID and GID */
-	sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->fsuid));
-	sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->fsgid));
+	sprintf(uid_str, "%d", from_kuid(&init_user_ns, cred->kfsuid));
+	sprintf(gid_str, "%d", from_kgid(&init_user_ns, cred->kfsgid));
 
 	/* we say which key is under construction */
 	sprintf(key_str, "%d", key->serial);
@@ -390,7 +390,7 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
 		perm |= KEY_POS_WRITE;
 
 	key = key_alloc(ctx->index_key.type, ctx->index_key.description,
-			ctx->cred->fsuid, ctx->cred->fsgid, ctx->cred,
+			ctx->cred->kfsuid, ctx->cred->kfsgid, ctx->cred,
 			perm, flags, NULL);
 	if (IS_ERR(key))
 		goto alloc_failed;
@@ -490,7 +490,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
 	if (ret)
 		goto error;
 
-	user = key_user_lookup(current_fsuid());
+	user = key_user_lookup(current_kfsuid());
 	if (!user) {
 		ret = -ENOMEM;
 		goto error_put_dest_keyring;
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index ecba39c93fd9..26808146897c 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -215,7 +215,7 @@ struct key *request_key_auth_new(struct key *target, const char *op,
 	sprintf(desc, "%x", target->serial);
 
 	authkey = key_alloc(&key_type_request_key_auth, desc,
-			    cred->fsuid, cred->fsgid, cred,
+			    cred->kfsuid, cred->kfsgid, cred,
 			    KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH | KEY_POS_LINK |
 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA, NULL);
 	if (IS_ERR(authkey)) {
-- 
2.25.0