[PATCH v3 2/2] KEYS: Reject keyring creation with overridden credentials

[Jarkko Sakkinen <jarkko@kernel.org>]

If the current task is running with overridden credentials calling
commit_creds() is forbidden and triggers a BUG_ON().

Reject keyring creation with -EPERM when credentials are overridden.

Cc: keyrings@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: stable@vger.kernel.org # v5.10+
Cc: stable@vger.kernel.org # v5.10+
Fixes: 3b11a1decef0 ("CRED: Differentiate objective and effective subjective credentials on a task")
Suggested-by: Jann Horn <jannh@google.com>
Closes: https://lore.kernel.org/keyrings/CAG48ez0XjVSR=M--UBauTm8sJuc+ZbhKzaPa3a6wrSVHyoKevw@mail.gmail.com/
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
v3:
Collapse and open-code cred_overridden() to the entry point of lookup_user_key() (David).
v2:
- Added mandatory tags.
- No code changes.
- Link: https://lore.kernel.org/keyrings/20261019145624.309790-2-jarkko@kernel.org/
 Documentation/security/keys/core.rst | 3 ++-
 security/keys/process_keys.c         | 6 +++++-
 2 files changed, 7 insertions(+), 2 deletions(-)
---
 Documentation/security/keys/core.rst | 3 ++-
 security/keys/process_keys.c         | 6 +++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/Documentation/security/keys/core.rst b/Documentation/security/keys/core.rst
index e3a215e55f81..a60b2f725a0b 100644
--- a/Documentation/security/keys/core.rst
+++ b/Documentation/security/keys/core.rst
@@ -168,7 +168,8 @@ The key service provides a number of features besides keys:
      If a process attempts to access its session keyring when it doesn't have
      one, the default user session keyring for its current UID is returned
      without being installed into its credentials.  If creation is requested,
-     an anonymous session keyring is installed.
+     an anonymous session keyring is installed, failing with -EPERM if
+     credentials are overridden.

   *  Each user has two quotas against which the keys they own are tracked. One
      limits the total number of keys and keyrings, the other limits the total
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index cdf03b8124d0..c878a5f8d47c 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -633,7 +633,8 @@ void key_register_fs_verity_keyring(struct key *keyring)
  * to a key or the best found key was a negative key; -EKEYREVOKED or
  * -EKEYEXPIRED if the best found key was revoked or expired; -EACCES if the
  * found key doesn't grant the requested permit or the LSM denied access to it;
- * or -ENOMEM if a special keyring couldn't be created.
+ * -ENOMEM if a special keyring couldn't be created; or -EPERM if KEY_LOOKUP_CREATE
+ * is requested while credentials are overridden.
  *
  * In the case of a successful return, the possession attribute is set on the
  * returned key reference.
@@ -652,6 +653,9 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
 	key_ref_t key_ref, skey_ref;
 	int ret;

+	if ((lflags & KEY_LOOKUP_CREATE) && current_cred() != current_real_cred())
+		return ERR_PTR(-EPERM);
+
 try_again:
 	ctx.cred = get_current_cred();
 	key_ref = ERR_PTR(-ENOKEY);
--
2.47.3