KEYS: Add an optional lookup_restriction hook to key_type

The restrict_link functions used to validate keys as they are linked
to a keyring can be associated with specific key types.  Each key type
may be loaded (or not) at runtime, so lookup of restrict_link
functions needs to be part of the key type implementation to ensure
that the requested keys can be examined.

Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>

diff --git a/Documentation/security/keys.txt b/Documentation/security/keys.txt
index e35de987fc48e56e97509b0177409e80b2facf2b..5fe04a7cc03d4708a98abc1d2e868e40c83fb61e 100644 (file)
--- a/Documentation/security/keys.txt
+++ b/Documentation/security/keys.txt
@@ -1445,6 +1445,15 @@ The structure has a number of fields, some of which are mandatory:
         The authorisation key.
 
 
+ (*) struct key_restriction *(*lookup_restriction)(const char *params);
+
+     This optional method is used to enable userspace configuration of keyring
+     restrictions. The restriction parameter string (not including the key type
+     name) is passed in, and this method returns a pointer to a key_restriction
+     structure containing the relevant functions and data to evaluate each
+     attempted key link operation. If there is no match, -EINVAL is returned.
+
+
 ============================
 REQUEST-KEY CALLBACK SERVICE
 ============================

diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index eaee981c55584bc0aa8ee72365449e376713a536..8496cf64575c679b49a0eeedf0c0d3c4d1e2dd1c 100644 (file)
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -147,6 +147,14 @@ struct key_type {
         */
        request_key_actor_t request_key;
 
+       /* Look up a keyring access restriction (optional)
+        *
+        * - NULL is a valid return value (meaning the requested restriction
+        *   is known but will never block addition of a key)
+        * - should return -EINVAL if the restriction is unknown
+        */
+       struct key_restriction *(*lookup_restriction)(const char *params);
+
        /* internal fields */
        struct list_head        link;           /* link in types list */
        struct lock_class_key   lock_class;     /* key->sem lock class */