path: root/include
diff options
authorJeff Layton <jlayton@redhat.com>2012-01-17 16:09:11 -0500
committerSteve French <smfrench@gmail.com>2012-01-17 22:39:40 -0600
commit9f6ed2ca257fa8650b876377833e6f14e272848b (patch)
tree8b664dced5415a6d463a56c2bc98756bd5ea5e44 /include
parentce91acb3acae26f4163c5a6f1f695d1a1e8d9009 (diff)
keys: add a "logon" key type
For CIFS, we want to be able to store NTLM credentials (aka username and password) in the keyring. We do not, however want to allow users to fetch those keys back out of the keyring since that would be a security risk. Unfortunately, due to the nuances of key permission bits, it's not possible to do this. We need to grant search permissions so the kernel can find these keys, but that also implies permissions to read the payload. Resolve this by adding a new key_type. This key type is essentially the same as key_type_user, but does not define a .read op. This prevents the payload from ever being visible from userspace. This key type also vets the description to ensure that it's "qualified" by checking to ensure that it has a ':' in it that is preceded by other characters. Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <smfrench@gmail.com>
Diffstat (limited to 'include')
1 files changed, 2 insertions, 1 deletions
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index c37c34275a44..bc9ec1d7698c 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -17,7 +17,7 @@
- * the payload for a key of type "user"
+ * the payload for a key of type "user" or "logon"
* - once filled in and attached to a key:
* - the payload struct is invariant may not be changed, only replaced
* - the payload must be read with RCU procedures or with the key semaphore
@@ -33,6 +33,7 @@ struct user_key_payload {
extern struct key_type key_type_user;
+extern struct key_type key_type_logon;
extern int user_instantiate(struct key *key, const void *data, size_t datalen);
extern int user_update(struct key *key, const void *data, size_t datalen);

Privacy Policy