The patch titled KEYS: Make the keyring quotas controllable through /proc/sys (fix) has been removed from the -mm tree. Its filename was keys-make-the-keyring-quotas-controllable-through-proc-sys-fix.patch This patch was dropped because it was folded into keys-make-the-keyring-quotas-controllable-through-proc-sys.patch The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: KEYS: Make the keyring quotas controllable through /proc/sys (fix) From: David Howells <dhowells@xxxxxxxxxx> Oops. Here's a copy of the patch *with* sysctl.c. Note that I've folded the doc updates patch into this one. Signed-off-by: David Howells <dhowells@xxxxxxxxxx> Cc: <kwc@xxxxxxxxxxxxxx> Cc: <arunsr@xxxxxxxxxxxxxx> Cc: <dwalsh@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- Documentation/keys.txt | 24 +++++++++++++++++- security/keys/sysctl.c | 50 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+), 1 deletion(-) diff -puN Documentation/keys.txt~keys-make-the-keyring-quotas-controllable-through-proc-sys-fix Documentation/keys.txt --- a/Documentation/keys.txt~keys-make-the-keyring-quotas-controllable-through-proc-sys-fix +++ a/Documentation/keys.txt @@ -170,7 +170,8 @@ The key service provides a number of fea amount of description and payload space that can be consumed. The user can view information on this and other statistics through procfs - files. + files. The root user may also alter the quota limits through sysctl files + (see the section "New procfs files"). Process-specific and thread-specific keyrings are not counted towards a user's quota. @@ -329,6 +330,27 @@ about the status of the key service: <bytes>/<max> Key size quota +Four new sysctl files have been added also for the purpose of controlling the +quota limits on keys: + + (*) /proc/sys/kernel/keys/root_maxkeys + /proc/sys/kernel/keys/root_maxbytes + + These files hold the maximum number of keys that root may have and the + maximum total number of bytes of data that root may have stored in those + keys. + + (*) /proc/sys/kernel/keys/maxkeys + /proc/sys/kernel/keys/maxbytes + + These files hold the maximum number of keys that each non-root user may + have and the maximum total number of bytes of data that each of those + users may have stored in their keys. + +Root may alter these by writing each new limit as a decimal number string to +the appropriate file. + + =============================== USERSPACE SYSTEM CALL INTERFACE =============================== diff -puN /dev/null security/keys/sysctl.c --- /dev/null +++ a/security/keys/sysctl.c @@ -0,0 +1,50 @@ +/* Key management controls + * + * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved. + * Written by David Howells (dhowells@xxxxxxxxxx) + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public Licence + * as published by the Free Software Foundation; either version + * 2 of the Licence, or (at your option) any later version. + */ + +#include <linux/key.h> +#include <linux/sysctl.h> +#include "internal.h" + +ctl_table key_sysctls[] = { + { + .ctl_name = CTL_UNNUMBERED, + .procname = "maxkeys", + .data = &key_quota_maxkeys, + .maxlen = sizeof(unsigned), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { + .ctl_name = CTL_UNNUMBERED, + .procname = "maxbytes", + .data = &key_quota_maxbytes, + .maxlen = sizeof(unsigned), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { + .ctl_name = CTL_UNNUMBERED, + .procname = "root_maxkeys", + .data = &key_quota_root_maxkeys, + .maxlen = sizeof(unsigned), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { + .ctl_name = CTL_UNNUMBERED, + .procname = "root_maxbytes", + .data = &key_quota_root_maxbytes, + .maxlen = sizeof(unsigned), + .mode = 0644, + .proc_handler = &proc_dointvec, + }, + { .ctl_name = 0 } +}; _ Patches currently in -mm which might be from dhowells@xxxxxxxxxx are origin.patch remove-the-macro-get_personality.patch fdpic-check-that-the-size-returned-by-kernel_read-is-what-we-asked-for.patch maintainers-clarify-status-of-mn10300-mailing-list-as-moderated.patch xattr-add-missing-consts-to-function-arguments.patch keys-increase-the-payload-size-when-instantiating-a-key.patch keys-check-starting-keyring-as-part-of-search.patch keys-allow-the-callout-data-to-be-passed-as-a-blob-rather-than-a-string.patch keys-add-keyctl-function-to-get-a-security-label.patch keys-switch-to-proc_create.patch keys-allow-clients-to-set-key-perms-in-key_create_or_update.patch keys-dont-generate-user-and-user-session-keyrings-unless-theyre-accessed.patch keys-make-the-keyring-quotas-controllable-through-proc-sys.patch keys-make-the-keyring-quotas-controllable-through-proc-sys-fix.patch keys-explicitly-include-required-slabh-header-file.patch keys-make-key_serial-a-function-if-config_keys=y.patch procfs-task-exe-symlink.patch procfs-task-exe-symlink-fix.patch procfs-task-exe-symlink-fix-2.patch proc-introduce-proc_create_data-to-setup-de-data.patch afs-use-non-racy-method-for-proc-entries-creation.patch alloc_uid-cleanup.patch rename-div64_64-to-div64_u64.patch afs-use-the-shorter-list_head-for-brevity.patch afs-the-afs-rpc-op-cbgetcapabilities-is-actually-cbtellmeaboutyourself.patch afs-the-afs-rpc-op-cbgetcapabilities-is-actually-cbtellmeaboutyourself-try-3.patch afs-support-the-cbprobeuuid-rpc-op.patch add-kbuildh-that-contains-common-definitions-for-kbuild-users.patch frv-use-kbuildh-instead-of-defining-macros-in-asm-offsetsc.patch mn10300-use-kbuildh-instead-of-defining-macros-in-asm-offsetsc.patch mutex-subsystem-synchro-test-module.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html