[RFC PATCH 1/2] keys: Return user session keyring on lookup
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2026-09-24 05:55:32
Also in:
keyrings, linux-doc, lkml
Subsystem:
documentation, keys/keyrings, security subsystem, the rest · Maintainers:
Jonathan Corbet, David Howells, Jarkko Sakkinen, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
A process without a session keyring looking up KEY_SPEC_SESSION_KEYRING without KEY_LOOKUP_CREATE mutates the credentials. This causes struct creds instances shared with other subsystems to become stale. Address this by returning the resolved user session keyring directly without installing it into credentials. Suggested-by: Jann Horn <jannh@google.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> --- Documentation/security/keys/core.rst | 6 ++-- security/keys/process_keys.c | 44 +++++++--------------------- 2 files changed, 14 insertions(+), 36 deletions(-)
diff --git a/Documentation/security/keys/core.rst b/Documentation/security/keys/core.rst
index 326b8a973828..c81a3a9fe236 100644
--- a/Documentation/security/keys/core.rst
+++ b/Documentation/security/keys/core.rst@@ -165,8 +165,10 @@ The key service provides a number of features besides keys: When a process changes its real UID, if it used to have no session key, it will be subscribed to the default session key for the new UID. - If a process attempts to access its session key when it doesn't have one, - it will be subscribed to the default for its current UID. + If a process attempts to access its session keyring when it doesn't have + one, the default user session keyring for its current UID is returned + without being installed into its credentials. If creation is requested, + an anonymous session keyring is installed. * Each user has two quotas against which the keys they own are tracked. One limits the total number of keys and keyrings, the other limits the total
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index a63c46bb2d14..a5aa056a6725 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c@@ -346,31 +346,6 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) return 0; } -/* - * Install the given keyring as the session keyring of the current task, - * replacing the existing one if any. If the given keyring is NULL, then - * install a new anonymous session keyring. - * - * Return: 0 on success; -errno on failure. - */ -static int install_session_keyring(struct key *keyring) -{ - struct cred *new; - int ret; - - new = prepare_creds(); - if (!new) - return -ENOMEM; - - ret = install_session_keyring_to_cred(new, keyring); - if (ret < 0) { - abort_creds(new); - return ret; - } - - return commit_creds(new); -} - /* * Handle the fsuid changing. */
@@ -665,20 +640,21 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, case KEY_SPEC_SESSION_KEYRING: if (!ctx.cred->session_keyring) { - /* always install a session keyring upon access if one - * doesn't exist yet */ ret = look_up_user_keyrings(NULL, &user_session); if (ret < 0) goto error; - if (lflags & KEY_LOOKUP_CREATE) + + if (lflags & KEY_LOOKUP_CREATE) { + key_put(user_session); ret = join_session_keyring(NULL); - else - ret = install_session_keyring(user_session); + if (ret < 0) + goto error; + goto reget_creds; + } - key_put(user_session); - if (ret < 0) - goto error; - goto reget_creds; + key = user_session; + key_ref = make_key_ref(key, 1); + break; } else if (test_bit(KEY_FLAG_UID_KEYRING, &ctx.cred->session_keyring->flags) && lflags & KEY_LOOKUP_CREATE) {
--
2.47.3