From 93f27344ac019135dd5ff31a518f1ef2d9e4e4a1 Mon Sep 17 00:00:00 2001

From: David Howells <dhowells@redhat.com>

Date: Mon, 19 Oct 2015 11:33:38 +0100

Subject: [PATCH 2/2] KEYS: Don't permit request_key() to construct a new

 keyring

    If request_key() is used to find a keyring, only do the search part - don't

    do the construction part if the keyring was not found by the search.  We

    don't really want keyrings in the negative instantiated state since the

    rejected/negative instantiation error value in the payload is unioned with

    keyring metadata.

    Signed-off-by: David Howells <dhowells@redhat.com>

---

 security/keys/request_key.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/security/keys/request_key.c b/security/keys/request_key.c

index 486ef6fa393b..0d6253124278 100644

--- a/security/keys/request_key.c

+++ b/security/keys/request_key.c

@@ -440,6 +440,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,

 	kenter("");

+	if (ctx->index_key.type == &key_type_keyring)

+		return ERR_PTR(-EPERM);

+	

 	user = key_user_lookup(current_fsuid());

 	if (!user)

 		return ERR_PTR(-ENOMEM);

-- 

2.4.3