Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux...

[mirror_ubuntu-artful-kernel.git] / security / keys / keyctl.c

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 4ad3212adebe8becc152f22d2448f8db4716146b..82a9e18511089d12d0bf674b63d57f9aa6363ef5 100644 (file)
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -1584,6 +1584,59 @@ error_keyring:
        return ret;
 }
 
+/*
+ * Apply a restriction to a given keyring.
+ *
+ * The caller must have Setattr permission to change keyring restrictions.
+ *
+ * The requested type name may be a NULL pointer to reject all attempts
+ * to link to the keyring. If _type is non-NULL, _restriction can be
+ * NULL or a pointer to a string describing the restriction. If _type is
+ * NULL, _restriction must also be NULL.
+ *
+ * Returns 0 if successful.
+ */
+long keyctl_restrict_keyring(key_serial_t id, const char __user *_type,
+                            const char __user *_restriction)
+{
+       key_ref_t key_ref;
+       bool link_reject = !_type;
+       char type[32];
+       char *restriction = NULL;
+       long ret;
+
+       key_ref = lookup_user_key(id, 0, KEY_NEED_SETATTR);
+       if (IS_ERR(key_ref))
+               return PTR_ERR(key_ref);
+
+       if (_type) {
+               ret = key_get_type_from_user(type, _type, sizeof(type));
+               if (ret < 0)
+                       goto error;
+       }
+
+       if (_restriction) {
+               if (!_type) {
+                       ret = -EINVAL;
+                       goto error;
+               }
+
+               restriction = strndup_user(_restriction, PAGE_SIZE);
+               if (IS_ERR(restriction)) {
+                       ret = PTR_ERR(restriction);
+                       goto error;
+               }
+       }
+
+       ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
+       kfree(restriction);
+
+error:
+       key_ref_put(key_ref);
+
+       return ret;
+}
+
 /*
  * The key control system call
  */
@@ -1693,7 +1746,12 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
        case KEYCTL_DH_COMPUTE:
                return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2,
                                         (char __user *) arg3, (size_t) arg4,
-                                        (void __user *) arg5);
+                                        (struct keyctl_kdf_params __user *) arg5);
+
+       case KEYCTL_RESTRICT_KEYRING:
+               return keyctl_restrict_keyring((key_serial_t) arg2,
+                                              (const char __user *) arg3,
+                                              (const char __user *) arg4);
 
        default:
                return -EOPNOTSUPP;