From 2e37dd3a4fe1c10ebaeec3243e48baa25a6efa1b Mon Sep 17 00:00:00 2001 From: Jarkko Sakkinen Date: Sat, 31 Oct 2026 11:06:59 +0200 Subject: [PATCH] KEYS: Reject restricted dest_keyring in construct_alloc_key() construct_alloc_key() links keys into dest_keyring without checking restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to remain in a restricted keyring when instantiated without relinking into dest_keyring. Reject restricted destination keyrings with -EPERM after __key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set. Cc: stable@vger.kernel.org Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring") Reported-by: Anvik Loitongbam Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@gmail.com/ Signed-off-by: Jarkko Sakkinen --- security/keys/request_key.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 22cd66a44da5..715ef3cc51b3 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -404,6 +404,13 @@ static int construct_alloc_key(struct keyring_search_context *ctx, ret = __key_link_lock(dest_keyring, &key->index_key); if (ret < 0) goto link_lock_failed; + + /* The payload is not yet available to check the restriction. */ + if (dest_keyring->restrict_link && + !(flags & KEY_ALLOC_BYPASS_RESTRICTION)) { + ret = -EPERM; + goto link_alloc_failed_unlocked; + } } /* -- 2.47.3