summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>2015-12-12 13:19:52 +0200
committerJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>2015-12-20 15:27:12 +0200
commit5208cc83423dde06924121a85368c721a27ca555 (patch)
treefebbe0ce8683938eeebd0321bc5476ea987c0a3d /security
parent6674ff145eef1f158e3d1d065cb1e19f315d909b (diff)
keys, trusted: fix: *do not* allow duplicate key options
The trusted keys option parsing allows specifying the same option multiple times. The last option value specified is used. This is problematic because: * No gain. * This makes complicated to specify options that are dependent on other options. This patch changes the behavior in a way that option can be specified only once. Reported-by: James Morris James Morris <jmorris@namei.org> Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Acked-by: Peter Huewe <peterhuewe@gmx.de>
Diffstat (limited to 'security')
-rw-r--r--security/keys/trusted.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 903dace648a1..7c183c767a3a 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -736,11 +736,14 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
int res;
unsigned long handle;
unsigned long lock;
+ unsigned long token_mask = 0;
while ((p = strsep(&c, " \t"))) {
if (*p == '\0' || *p == ' ' || *p == '\t')
continue;
token = match_token(p, key_tokens, args);
+ if (test_and_set_bit(token, &token_mask))
+ return -EINVAL;
switch (token) {
case Opt_pcrinfo: