linux/security/keys
David Howells 034faeb9ef KEYS: Fix keyring quota misaccounting on key replacement and unlink
If a key is displaced from a keyring by a matching one, then four more bytes
of quota are allocated to the keyring - despite the fact that the keyring does
not change in size.

Further, when a key is unlinked from a keyring, the four bytes of quota
allocated the link isn't recovered and returned to the user's pool.

The first can be tested by repeating:

	keyctl add big_key a fred @s
	cat /proc/key-users

(Don't put it in a shell loop otherwise the garbage collector won't have time
to clear the displaced keys, thus affecting the result).

This was causing the kerberos keyring to run out of room fairly quickly.

The second can be tested by:

	cat /proc/key-users
	a=`keyctl add user a a @s`
	cat /proc/key-users
	keyctl unlink $a
	sleep 1 # Give RCU a chance to delete the key
	cat /proc/key-users

assuming no system activity that otherwise adds/removes keys, the amount of
key data allocated should go up (say 40/20000 -> 47/20000) and then return to
the original value at the end.

Reported-by: Stephen Gallagher <sgallagh@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
2013-10-30 11:15:24 +00:00
..
encrypted-keys KEYS: Add payload preparsing opportunity prior to key instantiate or update 2012-10-08 13:49:48 +10:30
big_key.c KEYS: Implement a big key type that can save to tmpfs 2013-09-24 10:35:18 +01:00
compat.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
gc.c KEYS: Expand the capacity of a keyring 2013-09-24 10:35:18 +01:00
internal.h KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
Kconfig KEYS: Make BIG_KEYS boolean 2013-10-30 11:15:23 +00:00
key.c KEYS: Fix a race between negating a key and reading the error set 2013-10-30 11:15:24 +00:00
keyctl.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
keyring.c KEYS: Fix keyring quota misaccounting on key replacement and unlink 2013-10-30 11:15:24 +00:00
Makefile KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
permission.c userns: Convert security/keys to the new userns infrastructure 2012-09-13 18:28:02 -07:00
persistent.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
proc.c KEYS: Introduce a search context structure 2013-09-24 10:35:15 +01:00
process_keys.c KEYS: initialize root uid and session keyrings early 2013-09-25 17:17:01 +01:00
request_key_auth.c KEYS: Search for auth-key by name rather than target key ID 2013-09-24 10:35:16 +01:00
request_key.c KEYS: Fix a race between negating a key and reading the error set 2013-10-30 11:15:24 +00:00
sysctl.c KEYS: Add per-user_namespace registers for persistent per-UID kerberos caches 2013-09-24 10:35:19 +01:00
trusted.c Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux 2012-10-14 13:39:34 -07:00
trusted.h trusted-keys: rename trusted_defined files to trusted 2011-01-24 10:14:22 +11:00
user_defined.c KEYS: Introduce a search context structure 2013-09-24 10:35:15 +01:00