If the current task is running with overridden credentials calling commit_creds() is forbidden and triggers a BUG_ON(). Reject keyring creation with -EPERM when credentials are overridden. Cc: keyrings@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: Eric Biggers Cc: James Morris Cc: "Serge E. Hallyn" Cc: stable@vger.kernel.org # v5.10+ Cc: stable@vger.kernel.org # v5.10+ Fixes: 3b11a1decef0 ("CRED: Differentiate objective and effective subjective credentials on a task") Suggested-by: Jann Horn Closes: https://lore.kernel.org/keyrings/CAG48ez0XjVSR=M--UBauTm8sJuc+ZbhKzaPa3a6wrSVHyoKevw@mail.gmail.com/ Signed-off-by: Jarkko Sakkinen --- v3: Collapse and open-code cred_overridden() to the entry point of lookup_user_key() (David). v2: - Added mandatory tags. - No code changes. - Link: https://lore.kernel.org/keyrings/20261019145624.309790-2-jarkko@kernel.org/ Documentation/security/keys/core.rst | 3 ++- security/keys/process_keys.c | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) --- Documentation/security/keys/core.rst | 3 ++- security/keys/process_keys.c | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Documentation/security/keys/core.rst b/Documentation/security/keys/core.rst index e3a215e55f81..a60b2f725a0b 100644 --- a/Documentation/security/keys/core.rst +++ b/Documentation/security/keys/core.rst @@ -168,7 +168,8 @@ The key service provides a number of features besides keys: If a process attempts to access its session keyring when it doesn't have one, the default user session keyring for its current UID is returned without being installed into its credentials. If creation is requested, - an anonymous session keyring is installed. + an anonymous session keyring is installed, failing with -EPERM if + credentials are overridden. * Each user has two quotas against which the keys they own are tracked. One limits the total number of keys and keyrings, the other limits the total diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c index cdf03b8124d0..c878a5f8d47c 100644 --- a/security/keys/process_keys.c +++ b/security/keys/process_keys.c @@ -633,7 +633,8 @@ void key_register_fs_verity_keyring(struct key *keyring) * to a key or the best found key was a negative key; -EKEYREVOKED or * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the * found key doesn't grant the requested permit or the LSM denied access to it; - * or -ENOMEM if a special keyring couldn't be created. + * -ENOMEM if a special keyring couldn't be created; or -EPERM if KEY_LOOKUP_CREATE + * is requested while credentials are overridden. * * In the case of a successful return, the possession attribute is set on the * returned key reference. @@ -652,6 +653,9 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, key_ref_t key_ref, skey_ref; int ret; + if ((lflags & KEY_LOOKUP_CREATE) && current_cred() != current_real_cred()) + return ERR_PTR(-EPERM); + try_again: ctx.cred = get_current_cred(); key_ref = ERR_PTR(-ENOKEY); -- 2.47.3