David Howells 879669961b KEYS/DNS: Fix ____call_usermodehelper() to not lose the session keyring ... ____call_usermodehelper() now erases any credentials set by the subprocess_inf::init() function. The problem is that commit 17f60a7da1 ("capabilites: allow the application of capability limits to usermode helpers") creates and commits new credentials with prepare_kernel_cred() after the call to the init() function. This wipes all keyrings after umh_keys_init() is called. The best way to deal with this is to put the init() call just prior to the commit_creds() call, and pass the cred pointer to init(). That means that umh_keys_init() and suchlike can modify the credentials _before_ they are published and potentially in use by the rest of the system. This prevents request_key() from working as it is prevented from passing the session keyring it set up with the authorisation token to /sbin/request-key, and so the latter can't assume the authority to instantiate the key. This causes the in-kernel DNS resolver to fail with ENOKEY unconditionally. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Eric Paris <eparis@redhat.com> Tested-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2011-06-17 09:40:48 -07:00
..
compat.c	KEYS: Add an iovec version of KEYCTL_INSTANTIATE	2011-03-08 11:17:22 +11:00
encrypted.c	Create Documentation/security/,	2011-05-19 15:59:38 -07:00
encrypted.h	encrypted-keys: rename encrypted_defined files to encrypted	2011-01-24 10:27:57 +11:00
gc.c	KEYS: Fix up comments in key management code	2011-01-21 14:59:30 -08:00
internal.h	KEYS: Improve /proc/keys	2011-03-17 11:59:32 +11:00
key.c	KEYS: Add a new keyctl op to reject a key with a specified error code	2011-03-08 11:17:18 +11:00
keyctl.c	KEYS: Make request_key() and co. return an error for a negative key	2011-03-17 11:59:49 +11:00
keyring.c	KEYS: Improve /proc/keys	2011-03-17 11:59:32 +11:00
Makefile	encrypted-keys: rename encrypted_defined files to encrypted	2011-01-24 10:27:57 +11:00
permission.c	KEYS: Fix up comments in key management code	2011-01-21 14:59:30 -08:00
proc.c	KEYS: Improve /proc/keys	2011-03-17 11:59:32 +11:00
process_keys.c	Set cred->user_ns in key_replace_session_keyring	2011-05-26 13:49:19 -07:00
request_key_auth.c	Merge branch 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs	2011-05-27 10:25:02 -07:00
request_key.c	KEYS/DNS: Fix ____call_usermodehelper() to not lose the session keyring	2011-06-17 09:40:48 -07:00
sysctl.c
trusted.c	Create Documentation/security/,	2011-05-19 15:59:38 -07:00
trusted.h	trusted-keys: rename trusted_defined files to trusted	2011-01-24 10:14:22 +11:00
user_defined.c	Merge branch 'next' into for-linus	2011-05-24 22:55:24 +10:00