KEYS: restrict /proc/keys by credentials at open time

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / security / keys / proc.c

diff --git a/security/keys/proc.c b/security/keys/proc.c
index f0611a6..f2c7e09 100644 (file)
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -181,13 +181,13 @@ static int proc_keys_show(struct seq_file *m, void *v)
        struct timespec now;
        unsigned long timo;
        key_ref_t key_ref, skey_ref;
-       char xbuf[12];
+       char xbuf[16];
+       short state;
        int rc;
 
        struct keyring_search_context ctx = {
-               .index_key.type         = key->type,
-               .index_key.description  = key->description,
-               .cred                   = current_cred(),
+               .index_key              = key->index_key,
+               .cred                   = m->file->f_cred,
                .match_data.cmp         = lookup_user_key_possessed,
                .match_data.raw_data    = key,
                .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
                }
        }
 
-       /* check whether the current task is allowed to view the key (assuming
-        * non-possession)
-        * - the caller holds a spinlock, and thus the RCU read lock, making our
-        *   access to __current_cred() safe
-        */
+       /* check whether the current task is allowed to view the key */
        rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
        if (rc < 0)
                return 0;
@@ -240,17 +236,19 @@ static int proc_keys_show(struct seq_file *m, void *v)
                        sprintf(xbuf, "%luw", timo / (60*60*24*7));
        }
 
+       state = key_read_state(key);
+
 #define showflag(KEY, LETTER, FLAG) \
        (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-')
 
        seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
                   key->serial,
-                  showflag(key, 'I', KEY_FLAG_INSTANTIATED),
+                  state != KEY_IS_UNINSTANTIATED ? 'I' : '-',
                   showflag(key, 'R', KEY_FLAG_REVOKED),
                   showflag(key, 'D', KEY_FLAG_DEAD),
                   showflag(key, 'Q', KEY_FLAG_IN_QUOTA),
                   showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT),
-                  showflag(key, 'N', KEY_FLAG_NEGATIVE),
+                  state < 0 ? 'N' : '-',
                   showflag(key, 'i', KEY_FLAG_INVALIDATED),
                   atomic_read(&key->usage),
                   xbuf,