On Fri, 2019-10-11 at 10:35 -0700, Lakshmi Ramasubramanian wrote:
> diff --git a/security/keys/key.c b/security/keys/key.c
> index 764f4c57913e..973dfead490c 100644
> --- a/security/keys/key.c
> +++ b/security/keys/key.c
> @@ -14,6 +14,7 @@
> #include <linux/workqueue.h>
> #include <linux/random.h>
> #include <linux/err.h>
> +#include <keys/system_keyring.h>
> #include "internal.h"
>
> struct kmem_cache *key_jar;
> @@ -823,6 +824,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
> key_ref_t key_ref;
> int ret;
> struct key_restriction *restrict_link = NULL;
> + bool trusted_keyring = false;
>
> /* look up the key type to see if it's one of the registered kernel
> * types */
> @@ -936,6 +938,16 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
> goto error_link_end;
> }
>
> + /* let the security module know about the key */
> + trusted_keyring = is_builtin_or_secondary_trusted_keyring(keyring);
Nothing should be added to the keys subsystem, other than the LSM
hook.
Mimi
> + ret = security_key_create_or_update(keyring, key, cred, flags,
> + trusted_keyring);
> + if (ret < 0) {
> + key_put(key);
> + key_ref = ERR_PTR(ret);
> + goto error_link_end;
> + }
> +
