keys: Network namespace domain tag

Create key domain tags for network namespaces and make it possible to
automatically tag keys that are used by networked services (e.g. AF_RXRPC,
AFS, DNS) with the default network namespace if not set by the caller.

This allows keys with the same description but in different namespaces to
coexist within a keyring.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: netdev@vger.kernel.org
cc: linux-nfs@vger.kernel.org
cc: linux-cifs@vger.kernel.org
cc: linux-afs@lists.infradead.org

diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index e49d1de0614eb521318abce6e6b72f3a47a09dfa..2148a6bf58f1e2d78a802ca7ab1faa49aa96c7ae 100644 (file)
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -74,6 +74,9 @@ struct key_type {
         */
        size_t def_datalen;
 
+       unsigned int flags;
+#define KEY_TYPE_NET_DOMAIN    0x00000001 /* Keys of this type have a net namespace domain */
+
        /* vet a description */
        int (*vet_description)(const char *description);
 

diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 12689ddfc24c44fe3297d1eda548811d8061670b..a56bf7fc7c2beb4da312db86195b45e27eac23b6 100644 (file)
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -71,6 +71,9 @@ struct net {
                                                 */
        struct llist_node       cleanup_list;   /* namespaces on death row */
 
+#ifdef CONFIG_KEYS
+       struct key_tag          *key_domain;    /* Key domain of operation tag */
+#endif
        struct user_namespace   *user_ns;       /* Owning user namespace */
        struct ucounts          *ucounts;
        spinlock_t              nsid_lock;

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 711b161505ac1afcc2aa2dd5d07b33b5a2f1ac89..88e603b85ed256ef1dddb22ea2b4b852e048004f 100644 (file)
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -38,9 +38,16 @@ EXPORT_SYMBOL_GPL(net_namespace_list);
 DECLARE_RWSEM(net_rwsem);
 EXPORT_SYMBOL_GPL(net_rwsem);
 
+#ifdef CONFIG_KEYS
+static struct key_tag init_net_key_domain = { .usage = REFCOUNT_INIT(1) };
+#endif
+
 struct net init_net = {
        .count          = REFCOUNT_INIT(1),
        .dev_base_head  = LIST_HEAD_INIT(init_net.dev_base_head),
+#ifdef CONFIG_KEYS
+       .key_domain     = &init_net_key_domain,
+#endif
 };
 EXPORT_SYMBOL(init_net);
 
@@ -386,10 +393,22 @@ static struct net *net_alloc(void)
        if (!net)
                goto out_free;
 
+#ifdef CONFIG_KEYS
+       net->key_domain = kzalloc(sizeof(struct key_tag), GFP_KERNEL);
+       if (!net->key_domain)
+               goto out_free_2;
+       refcount_set(&net->key_domain->usage, 1);
+#endif
+
        rcu_assign_pointer(net->gen, ng);
 out:
        return net;
 
+#ifdef CONFIG_KEYS
+out_free_2:
+       kmem_cache_free(net_cachep, net);
+       net = NULL;
+#endif
 out_free:
        kfree(ng);
        goto out;
@@ -566,6 +585,7 @@ static void cleanup_net(struct work_struct *work)
        list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
                list_del_init(&net->exit_list);
                dec_net_namespaces(net->ucounts);
+               key_remove_domain(net->key_domain);
                put_user_ns(net->user_ns);
                net_drop_ns(net);
        }

diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index a65d553e730d9130d0fe26d896aa2cffcc5aaae1..3e1a906690063fab671e9d077cf500a190423157 100644 (file)
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -314,6 +314,7 @@ static long dns_resolver_read(const struct key *key,
 
 struct key_type key_type_dns_resolver = {
        .name           = "dns_resolver",
+       .flags          = KEY_TYPE_NET_DOMAIN,
        .preparse       = dns_resolver_preparse,
        .free_preparse  = dns_resolver_free_preparse,
        .instantiate    = generic_key_instantiate,

diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index e7f6b8823eb6e6c6794ed78e1197c1cf8aab4858..2722189ec2739babadd37f3c25335fea40314416 100644 (file)
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -43,6 +43,7 @@ static long rxrpc_read(const struct key *, char __user *, size_t);
  */
 struct key_type key_type_rxrpc = {
        .name           = "rxrpc",
+       .flags          = KEY_TYPE_NET_DOMAIN,
        .preparse       = rxrpc_preparse,
        .free_preparse  = rxrpc_free_preparse,
        .instantiate    = generic_key_instantiate,
@@ -58,6 +59,7 @@ EXPORT_SYMBOL(key_type_rxrpc);
  */
 struct key_type key_type_rxrpc_s = {
        .name           = "rxrpc_s",
+       .flags          = KEY_TYPE_NET_DOMAIN,
        .vet_description = rxrpc_vet_description_s,
        .preparse       = rxrpc_preparse_s,
        .free_preparse  = rxrpc_free_preparse_s,

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d3c86fda1510ea0d36dd7586e60d65af39944242..bca070f6ab460f625634d9e5c85f19a5249ebdc1 100644 (file)
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -17,10 +17,12 @@
 #include <linux/seq_file.h>
 #include <linux/err.h>
 #include <linux/user_namespace.h>
+#include <linux/nsproxy.h>
 #include <keys/keyring-type.h>
 #include <keys/user-type.h>
 #include <linux/assoc_array_priv.h>
 #include <linux/uaccess.h>
+#include <net/net_namespace.h>
 #include "internal.h"
 
 /*
@@ -220,7 +222,10 @@ void key_set_index_key(struct keyring_index_key *index_key)
 
        memcpy(index_key->desc, index_key->description, n);
 
-       index_key->domain_tag = &default_domain_tag;
+       if (index_key->type->flags & KEY_TYPE_NET_DOMAIN)
+               index_key->domain_tag = current->nsproxy->net_ns->key_domain;
+       else
+               index_key->domain_tag = &default_domain_tag;
        hash_key_type_and_desc(index_key);
 }