Commit 218e6424 authored by David Howells's avatar David Howells
Browse files

keys: Garbage collect keys for which the domain has been removed 



If a key operation domain (such as a network namespace) has been removed
then attempt to garbage collect all the keys that use it.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 3b6e4de0

include/linux/key.h

+2 −0
Original line number Diff line number Diff line
@@ -278,6 +278,7 @@ extern void key_revoke(struct key *key); 
extern void key_invalidate(struct key *key);

extern void key_put(struct key *key);

extern bool key_put_tag(struct key_tag *tag);

extern void key_remove_domain(struct key_tag *domain_tag);



static inline struct key *__key_get(struct key *key)

{
@@ -446,6 +447,7 @@ extern void key_init(void); 
#define key_fsgid_changed(c)		do { } while(0)

#define key_init()			do { } while(0)

#define key_free_user_ns(ns)		do { } while(0)

#define key_remove_domain(d)		do { } while(0)



#endif /* CONFIG_KEYS */

#endif /* __KERNEL__ */

security/keys/internal.h

+2 −1
Original line number Diff line number Diff line
@@ -209,7 +209,8 @@ static inline bool key_is_dead(const struct key *key, time64_t limit) 
	return

		key->flags & ((1 << KEY_FLAG_DEAD) |

			      (1 << KEY_FLAG_INVALIDATED)) ||

		(key->expiry > 0 && key->expiry <= limit);

		(key->expiry > 0 && key->expiry <= limit) ||

		key->domain_tag->removed;

}



/*

security/keys/keyring.c

+15 −0
Original line number Diff line number Diff line
@@ -241,6 +241,21 @@ bool key_put_tag(struct key_tag *tag) 
	return false;

}



/**

 * key_remove_domain - Kill off a key domain and gc its keys

 * @domain_tag: The domain tag to release.

 *

 * This marks a domain tag as being dead and releases a ref on it.  If that

 * wasn't the last reference, the garbage collector is poked to try and delete

 * all keys that were in the domain.

 */

void key_remove_domain(struct key_tag *domain_tag)

{

	domain_tag->removed = true;

	if (!key_put_tag(domain_tag))

		key_schedule_gc_links();

}



/*

 * Build the next index key chunk.

 *