BACKPORT: KEYS: Don't permit request_key() to construct a new keyring
If request_key() is used to find a keyring, only do the search part - don't
do the construction part if the keyring was not found by the search. We
don't really want keyrings in the negative instantiated state since the
rejected/negative instantiation error value in the payload is unioned with
keyring metadata.
Now the kernel gives an error:
request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)
BUG=chromium:542341
TEST=build/boot amd64-generic
Signed-off-by: David Howells <dhowells@redhat.com>
(cherry picked from commit 911b79cde95c7da0ec02f48105358a36636b7a71)
Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
Change-Id: Ifdf01a8910c56a8da6ad779e58746e1d1c20dd6e
Reviewed-on: https://chromium-review.googlesource.com/316444
Commit-Ready: Sonny Rao <sonnyrao@chromium.org>
Tested-by: Sonny Rao <sonnyrao@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
1 file changed
