diff options
| author | Jarkko Sakkinen | 2015-12-12 13:19:52 +0200 |
|---|---|---|
| committer | Jarkko Sakkinen | 2015-12-20 15:27:12 +0200 |
| commit | 5208cc83423dde06924121a85368c721a27ca555 (patch) | |
| tree | febbe0ce8683938eeebd0321bc5476ea987c0a3d | |
| parent | 6674ff145eef1f158e3d1d065cb1e19f315d909b (diff) | |
keys, trusted: fix: *do not* allow duplicate key options
The trusted keys option parsing allows specifying the same option
multiple times. The last option value specified is used.
This is problematic because:
* No gain.
* This makes complicated to specify options that are dependent on other
options.
This patch changes the behavior in a way that option can be specified
only once.
Reported-by: James Morris James Morris <jmorris@namei.org>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Peter Huewe <peterhuewe@gmx.de>
| -rw-r--r-- | security/keys/trusted.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/security/keys/trusted.c b/security/keys/trusted.c index 903dace648a1..7c183c767a3a 100644 --- a/security/keys/trusted.c +++ b/security/keys/trusted.c @@ -736,11 +736,14 @@ static int getoptions(char *c, struct trusted_key_payload *pay, int res; unsigned long handle; unsigned long lock; + unsigned long token_mask = 0; while ((p = strsep(&c, " \t"))) { if (*p == '\0' || *p == ' ' || *p == '\t') continue; token = match_token(p, key_tokens, args); + if (test_and_set_bit(token, &token_mask)) + return -EINVAL; switch (token) { case Opt_pcrinfo: |