David Howells 0c7774abb4 KEYS: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN ... Special kernel keys, such as those used to hold DNS results for AFS, CIFS and NFS and those used to hold idmapper results for NFS, used to be 'invalidateable' with key_revoke(). However, since the default permissions for keys were reduced: Commit: 96b5c8fea6 KEYS: Reduce initial permissions on keys it has become impossible to do this. Add a key flag (KEY_FLAG_ROOT_CAN_INVAL) that will permit a key to be invalidated by root. This should not be used for system keyrings as the garbage collector will try and remove any invalidate key. For system keyrings, KEY_FLAG_ROOT_CAN_CLEAR can be used instead. After this, from userspace, keyctl_invalidate() and "keyctl invalidate" can be used by any possessor of CAP_SYS_ADMIN (typically root) to invalidate DNS and idmapper keys. Invalidated keys are immediately garbage collected and will be immediately rerequested if needed again. Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Steve Dickson <steved@redhat.com>		2014-07-17 20:45:08 +01:00
..
apparmor	nick kvfree() from apparmor	2014-05-06 14:02:53 -04:00
integrity	ima: introduce ima_kernel_read()	2014-06-12 17:58:08 -04:00
keys	KEYS: Allow special keys (eg. DNS results) to be invalidated by CAP_SYS_ADMIN	2014-07-17 20:45:08 +01:00
selinux	Merge branch 'stable-3.16' of git://git.infradead.org/users/pcmoore/selinux into next	2014-07-17 03:05:51 +10:00
smack	Merge branch 'smack-for-3.16' of git://git.gitorious.org/smack-next/kernel into next	2014-05-20 14:50:09 +10:00
tomoyo	get rid of pointless checks for NULL ->i_op	2014-04-01 23:19:16 -04:00
yama
capability.c	Merge tag 'keys-20140314' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next	2014-04-14 11:42:49 +10:00
commoncap.c	capabilities: allow nice if we are privileged	2013-08-30 23:44:09 -07:00
device_cgroup.c	device_cgroup: use css_has_online_children() instead of has_children()	2014-05-16 13:22:52 -04:00
inode.c
Kconfig	security: select correct default LSM_MMAP_MIN_ADDR on arm on arm64	2014-02-05 14:59:14 +00:00
lsm_audit.c	audit: anchor all pid references in the initial pid namespace	2014-03-20 10:11:55 -04:00
Makefile	security: cleanup Makefiles to use standard syntax for specifying sub-directories	2014-02-17 11:08:04 +11:00
min_addr.c
security.c	Merge branch 'serge-next-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux-security	2014-06-10 10:05:36 -07:00