Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.
Showing the changes to security/keys/keyring.c (1 of 16 files). Show all
Unified · Split
| @@ -240,13 +240,14 @@ static long keyring_read(const struct key *keyring, · 239 unmodified lines | |||
| 240 | * allocate a keyring and link into the destination keyring | 240 | * allocate a keyring and link into the destination keyring |
| 241 | */ | 241 | */ |
| 242 | struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, | 242 | struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid, |
| 243 | int not_in_quota, struct key *dest) | 243 | struct task_struct *ctx, int not_in_quota, |
| 244 | struct key *dest) | ||
| 244 | { | 245 | { |
| 245 | struct key *keyring; | 246 | struct key *keyring; |
| 246 | int ret; | 247 | int ret; |
| 247 | 248 | ||
| 248 | keyring = key_alloc(&key_type_keyring, description, | 249 | keyring = key_alloc(&key_type_keyring, description, |
| 249 | uid, gid, | 250 | uid, gid, ctx, |
| 250 | (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL, | 251 | (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL, |
| 251 | not_in_quota); | 252 | not_in_quota); |
| 252 | 253 | ||