umh: creds: convert call_usermodehelper_keys() to use subprocess_info->init()

call_usermodehelper_keys() uses call_usermodehelper_setkeys() to change
subprocess_info->cred in advance.  Now that we have info->init() we can
change this code to set tgcred->session_keyring in context of execing
kernel thread.

Note: since currently call_usermodehelper_keys() is never called with
UMH_NO_WAIT, call_usermodehelper_keys()->key_get() and umh_keys_cleanup()
are not really needed, we could rely on install_session_keyring_to_cred()
which does key_get() on success.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/kmod.h b/include/linux/kmod.h
index 5c058778ad35dfaa59f7c9144a1a11843e4c0a0e..d876dce217f067d39d58542c50656578ab93a5b9 100644 (file)
--- a/include/linux/kmod.h
+++ b/include/linux/kmod.h
@@ -72,8 +72,6 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
                                                  char **envp, gfp_t gfp_mask);
 
 /* Set various pieces of state into the subprocess_info structure */
-void call_usermodehelper_setkeys(struct subprocess_info *info,
-                                struct key *session_keyring);
 void call_usermodehelper_setfns(struct subprocess_info *info,
                    int (*init)(struct subprocess_info *info),
                    void (*cleanup)(struct subprocess_info *info),
@@ -112,21 +110,6 @@ call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
                                       NULL, NULL, NULL);
 }
 
-static inline int
-call_usermodehelper_keys(char *path, char **argv, char **envp,
-                        struct key *session_keyring, enum umh_wait wait)
-{
-       struct subprocess_info *info;
-       gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
-
-       info = call_usermodehelper_setup(path, argv, envp, gfp_mask);
-       if (info == NULL)
-               return -ENOMEM;
-
-       call_usermodehelper_setkeys(info, session_keyring);
-       return call_usermodehelper_exec(info, wait);
-}
-
 extern void usermodehelper_init(void);
 
 extern int usermodehelper_disable(void);

diff --git a/kernel/kmod.c b/kernel/kmod.c
index d1544547fea61ee5857e4dd34ff5fd21b5b24baf..743d3883517c518692e8889837eb261a3be7ed1d 100644 (file)
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -366,24 +366,6 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
 }
 EXPORT_SYMBOL(call_usermodehelper_setup);
 
-/**
- * call_usermodehelper_setkeys - set the session keys for usermode helper
- * @info: a subprocess_info returned by call_usermodehelper_setup
- * @session_keyring: the session keyring for the process
- */
-void call_usermodehelper_setkeys(struct subprocess_info *info,
-                                struct key *session_keyring)
-{
-#ifdef CONFIG_KEYS
-       struct thread_group_cred *tgcred = info->cred->tgcred;
-       key_put(tgcred->session_keyring);
-       tgcred->session_keyring = key_get(session_keyring);
-#else
-       BUG();
-#endif
-}
-EXPORT_SYMBOL(call_usermodehelper_setkeys);
-
 /**
  * call_usermodehelper_setfns - set a cleanup/init function
  * @info: a subprocess_info returned by call_usermodehelper_setup

diff --git a/security/keys/internal.h b/security/keys/internal.h
index 5d4402a1161aba1110108ece6b6161793746c55b..38783dcf6c61fb6e380131c40c8abbbf1414a5dd 100644 (file)
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -124,6 +124,7 @@ extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
 extern int install_user_keyrings(void);
 extern int install_thread_keyring_to_cred(struct cred *);
 extern int install_process_keyring_to_cred(struct cred *);
+extern int install_session_keyring_to_cred(struct cred *, struct key *);
 
 extern struct key *request_key_and_link(struct key_type *type,
                                        const char *description,

diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 20a38fed61b1efb812799bc83ff31db78c1411ac..6b8e4ff4cc68cfebe2bb845dda44d8d4b8542635 100644 (file)
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -216,8 +216,7 @@ static int install_process_keyring(void)
 /*
  * install a session keyring directly to a credentials struct
  */
-static int install_session_keyring_to_cred(struct cred *cred,
-                                          struct key *keyring)
+int install_session_keyring_to_cred(struct cred *cred, struct key *keyring)
 {
        unsigned long flags;
        struct key *old;

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index f656e9c069e3ec31f64d8a4a2ec9d9add862a4cb..f5ec9ac5d57cf6af80f90eb90427ecb98385ae4f 100644 (file)
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -58,6 +58,38 @@ void complete_request_key(struct key_construction *cons, int error)
 }
 EXPORT_SYMBOL(complete_request_key);
 
+static int umh_keys_init(struct subprocess_info *info)
+{
+       struct cred *cred = (struct cred*)current_cred();
+       struct key *keyring = info->data;
+       /*
+        * This is called in context of freshly forked kthread before
+        * kernel_execve(), we can just change our ->session_keyring.
+        */
+       return install_session_keyring_to_cred(cred, keyring);
+}
+
+static void umh_keys_cleanup(struct subprocess_info *info)
+{
+       struct key *keyring = info->data;
+       key_put(keyring);
+}
+
+static int call_usermodehelper_keys(char *path, char **argv, char **envp,
+                        struct key *session_keyring, enum umh_wait wait)
+{
+       gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;
+       struct subprocess_info *info =
+               call_usermodehelper_setup(path, argv, envp, gfp_mask);
+
+       if (!info)
+               return -ENOMEM;
+
+       call_usermodehelper_setfns(info, umh_keys_init, umh_keys_cleanup,
+                                       key_get(session_keyring));
+       return call_usermodehelper_exec(info, wait);
+}
+
 /*
  * request userspace finish the construction of a key
  * - execute "/sbin/request-key <op> <key> <uid> <gid> <keyring> <keyring> <keyring>"