android_kernel_google_msm/security/keys
David Howells 42fa2aa5ce KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
commit ee8f844e3c5a73b999edf733df1c529d6503ec2f upstream.

This fixes CVE-2016-9604.

Keyrings whose name begin with a '.' are special internal keyrings and so
userspace isn't allowed to create keyrings by this name to prevent
shadowing.  However, the patch that added the guard didn't fix
KEYCTL_JOIN_SESSION_KEYRING.  Not only can that create dot-named keyrings,
it can also subscribe to them as a session keyring if they grant SEARCH
permission to the user.

This, for example, allows a root process to set .builtin_trusted_keys as
its session keyring, at which point it has full access because now the
possessor permissions are added.  This permits root to add extra public
keys, thereby bypassing module verification.

This also affects kexec and IMA.

This can be tested by (as root):

	keyctl session .builtin_trusted_keys
	keyctl add user a a @s
	keyctl list @s

which on my test box gives me:

	2 keys in keyring:
	180010936: ---lswrv     0     0 asymmetric: Build time autogenerated kernel key: ae3d4a31b82daa8e1a75b49dc2bba949fd992a05
	801382539: --alswrv     0     0 user: a

Fix this by rejecting names beginning with a '.' in the keyctl.

Change-Id: Ice71af854f4cf5e9278a59ececf46905ac91289b
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
cc: linux-ima-devel@lists.sourceforge.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-06-26 21:32:46 +03:00
..
encrypted-keys KEYS: Fix handling of stored error in a negatively instantiated user key 2016-10-29 23:12:11 +08:00
compat.c KEYS: Add invalidation support 2016-10-29 23:12:12 +08:00
gc.c KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring 2016-10-29 23:12:12 +08:00
internal.h KEYS: Add invalidation support 2016-10-29 23:12:12 +08:00
key.c KEYS: potential uninitialized variable 2016-10-31 22:49:16 +11:00
keyctl.c KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings 2017-06-26 21:32:46 +03:00
keyring.c KEYS: Add invalidation support 2016-10-29 23:12:12 +08:00
Makefile
permission.c KEYS: Add invalidation support 2016-10-29 23:12:12 +08:00
proc.c KEYS: Fix short sprintf buffer in /proc/keys show function 2016-10-31 23:36:27 +11:00
process_keys.c KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings 2017-05-19 18:40:58 -06:00
request_key.c
request_key_auth.c
sysctl.c
trusted.c KEYS: Fix handling of stored error in a negatively instantiated user key 2016-10-29 23:12:11 +08:00
trusted.h trusted-keys: rename trusted_defined files to trusted 2011-01-24 10:14:22 +11:00
user_defined.c KEYS: Fix handling of stored error in a negatively instantiated user key 2016-10-29 23:12:11 +08:00