construct_alloc_key() links keys into dest_keyring without checking restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to remain in a restricted keyring when instantiated without relinking into dest_keyring. Reject restricted destination keyrings with -EPERM after __key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set. Cc: stable@vger.kernel.org Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring") Reported-by: Anvik Loitongbam Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@gmail.com/ Signed-off-by: Jarkko Sakkinen --- security/keys/request_key.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 22cd66a44da5..d4611dd7cb49 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -404,6 +404,11 @@ static int construct_alloc_key(struct keyring_search_context *ctx, ret = __key_link_lock(dest_keyring, &key->index_key); if (ret < 0) goto link_lock_failed; + + if (dest_keyring->restrict_link && !(flags & KEY_ALLOC_BYPASS_RESTRICTION)) { + ret = -EPERM; + goto link_alloc_failed_unlocked; + } } /* -- 2.47.3