eCryptfs: Validate global auth tok keys
When searching through the global authentication tokens for a given key signature, verify that a matching key has not been revoked and has not expired. This allows the `keyctl revoke` command to be properly used on keys in use by eCryptfs. Acked-by: Serge Hallyn <serue@us.ibm.com> Cc: ecryptfs-devel@lists.launchpad.net Cc: stable <stable@kernel.org> Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>wifi-calibration
parent
df6ad33ba1
commit
3891959846
|
@ -416,7 +416,9 @@ ecryptfs_find_global_auth_tok_for_sig(
|
||||||
&mount_crypt_stat->global_auth_tok_list,
|
&mount_crypt_stat->global_auth_tok_list,
|
||||||
mount_crypt_stat_list) {
|
mount_crypt_stat_list) {
|
||||||
if (memcmp(walker->sig, sig, ECRYPTFS_SIG_SIZE_HEX) == 0) {
|
if (memcmp(walker->sig, sig, ECRYPTFS_SIG_SIZE_HEX) == 0) {
|
||||||
(*global_auth_tok) = walker;
|
rc = key_validate(walker->global_auth_tok_key);
|
||||||
|
if (!rc)
|
||||||
|
(*global_auth_tok) = walker;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue