Pull keyring ACL support from David Howells: "This changes the permissions model used by keys and keyrings to be based on an internal ACL by the following means: - Replace the permissions mask internally with an ACL that contains a list of ACEs, each with a specific subject with a permissions mask. Potted default ACLs are available for new keys and keyrings. ACE subjects can be macroised to indicate the UID and GID specified on the key (which remain). Future commits will be able to add additional subject types, such as specific UIDs or domain tags/namespaces. Also split a number of permissions to give finer control. Examples include splitting the revocation permit from the change-attributes permit, thereby allowing someone to be granted permission to revoke a key without allowing them to change the owner; also the ability to join a keyring is split from the ability to link to it, thereby stopping a process accessing a keyring by joining it and thus acquiring use of possessor permits. - Provide a keyctl to allow the granting or denial of one or more permits to a specific subject. Direct access to the ACL is not granted, and the ACL cannot be viewed" * tag 'keys-acl-20190703' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: keys: Provide KEYCTL_GRANT_PERMISSION keys: Replace uid/gid/perm permissions checking with an ACL
Showing the changes to include/uapi/linux (1 of 46 files). Show all
Unified · Split
| @@ -15,6 +15,69 @@ · 14 unmodified lines | ||
| 15 | 15 | |
| 16 | 16 | #include <linux/types.h> |
| 17 | 17 | |
| 18 | +/* | |
| 19 | + * Keyring permission grant definitions | |
| 20 | + */ | |
| 21 | +enum key_ace_subject_type { | |
| 22 | + KEY_ACE_SUBJ_STANDARD = 0, /* subject is one of key_ace_standard_subject */ | |
| 23 | + nr__key_ace_subject_type | |
| 24 | +}; | |
| 25 | + | |
| 26 | +enum key_ace_standard_subject { | |
| 27 | + KEY_ACE_EVERYONE = 0, /* Everyone, including owner and group */ | |
| 28 | + KEY_ACE_GROUP = 1, /* The key's group */ | |
| 29 | + KEY_ACE_OWNER = 2, /* The owner of the key */ | |
| 30 | + KEY_ACE_POSSESSOR = 3, /* Any process that possesses of the key */ | |
| 31 | + nr__key_ace_standard_subject | |
| 32 | +}; | |
| 33 | + | |
| 34 | +#define KEY_ACE_VIEW 0x00000001 /* Can describe the key */ | |
| 35 | +#define KEY_ACE_READ 0x00000002 /* Can read the key content */ | |
| 36 | +#define KEY_ACE_WRITE 0x00000004 /* Can update/modify the key content */ | |
| 37 | +#define KEY_ACE_SEARCH 0x00000008 /* Can find the key by search */ | |
| 38 | +#define KEY_ACE_LINK 0x00000010 /* Can make a link to the key */ | |
| 39 | +#define KEY_ACE_SET_SECURITY 0x00000020 /* Can set owner, group, ACL */ | |
| 40 | +#define KEY_ACE_INVAL 0x00000040 /* Can invalidate the key */ | |
| 41 | +#define KEY_ACE_REVOKE 0x00000080 /* Can revoke the key */ | |
| 42 | +#define KEY_ACE_JOIN 0x00000100 /* Can join keyring */ | |
| 43 | +#define KEY_ACE_CLEAR 0x00000200 /* Can clear keyring */ | |
| 44 | +#define KEY_ACE__PERMS 0xffffffff | |
| 45 | + | |
| 46 | +/* | |
| 47 | + * Old-style permissions mask, deprecated in favour of ACL. | |
| 48 | + */ | |
| 49 | +#define KEY_POS_VIEW 0x01000000 /* possessor can view a key's attributes */ | |
| 50 | +#define KEY_POS_READ 0x02000000 /* possessor can read key payload / view keyring */ | |
| 51 | +#define KEY_POS_WRITE 0x04000000 /* possessor can update key payload / add link to keyring */ | |
| 52 | +#define KEY_POS_SEARCH 0x08000000 /* possessor can find a key in search / search a keyring */ | |
| 53 | +#define KEY_POS_LINK 0x10000000 /* possessor can create a link to a key/keyring */ | |
| 54 | +#define KEY_POS_SETATTR 0x20000000 /* possessor can set key attributes */ | |
| 55 | +#define KEY_POS_ALL 0x3f000000 | |
| 56 | + | |
| 57 | +#define KEY_USR_VIEW 0x00010000 /* user permissions... */ | |
| 58 | +#define KEY_USR_READ 0x00020000 | |
| 59 | +#define KEY_USR_WRITE 0x00040000 | |
| 60 | +#define KEY_USR_SEARCH 0x00080000 | |
| 61 | +#define KEY_USR_LINK 0x00100000 | |
| 62 | +#define KEY_USR_SETATTR 0x00200000 | |
| 63 | +#define KEY_USR_ALL 0x003f0000 | |
| 64 | + | |
| 65 | +#define KEY_GRP_VIEW 0x00000100 /* group permissions... */ | |
| 66 | +#define KEY_GRP_READ 0x00000200 | |
| 67 | +#define KEY_GRP_WRITE 0x00000400 | |
| 68 | +#define KEY_GRP_SEARCH 0x00000800 | |
| 69 | +#define KEY_GRP_LINK 0x00001000 | |
| 70 | +#define KEY_GRP_SETATTR 0x00002000 | |
| 71 | +#define KEY_GRP_ALL 0x00003f00 | |
| 72 | + | |
| 73 | +#define KEY_OTH_VIEW 0x00000001 /* third party permissions... */ | |
| 74 | +#define KEY_OTH_READ 0x00000002 | |
| 75 | +#define KEY_OTH_WRITE 0x00000004 | |
| 76 | +#define KEY_OTH_SEARCH 0x00000008 | |
| 77 | +#define KEY_OTH_LINK 0x00000010 | |
| 78 | +#define KEY_OTH_SETATTR 0x00000020 | |
| 79 | +#define KEY_OTH_ALL 0x0000003f | |
| 80 | + | |
| 18 | 81 | /* special process keyring shortcut IDs */ |
| 19 | 82 | #define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */ |
| 20 | 83 | #define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */ |
| @@ -69,6 +132,7 @@ · 48 unmodified lines | ||
| 69 | 132 | #define KEYCTL_RESTRICT_KEYRING 29 /* Restrict keys allowed to link to a keyring */ |
| 70 | 133 | #define KEYCTL_MOVE 30 /* Move keys between keyrings */ |
| 71 | 134 | #define KEYCTL_CAPABILITIES 31 /* Find capabilities of keyrings subsystem */ |
| 135 | +#define KEYCTL_GRANT_PERMISSION 32 /* Grant a permit to a key */ | |
| 72 | 136 | |
| 73 | 137 | /* keyctl structures */ |
| 74 | 138 | struct keyctl_dh_params { |
| @@ -130,5 +194,6 @@ struct keyctl_pkey_params { · 55 unmodified lines | ||
| 130 | 194 | #define KEYCTL_CAPS0_MOVE 0x80 /* KEYCTL_MOVE supported */ |
| 131 | 195 | #define KEYCTL_CAPS1_NS_KEYRING_NAME 0x01 /* Keyring names are per-user_namespace */ |
| 132 | 196 | #define KEYCTL_CAPS1_NS_KEY_TAG 0x02 /* Key indexing can include a namespace tag */ |
| 197 | +#define KEYCTL_CAPS1_ACL_ALTERABLE 0x04 /* Keys have internal ACL that can be altered */ | |
| 133 | 198 | |
| 134 | 199 | #endif /* _LINUX_KEYCTL_H */ |