kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Avoid EPERM on key change if user is not owner of key file

Browse Source 
When a user that is in the zkeyadm group, but is not the owner
of the key file changes a key in the zkey repository, then
error "Operation not permitted" occurs. This is due to a superfluous
call to chmod on the key file. When key files are changed then the
permissions of that file are retained anyway.

Also fix a typo in the error message when chmod fails.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-02-04 14:07:34 +01:00
committed by Jan Höppner
parent 847f16f632
commit d95dc6d698
1 changed files with 2 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
zkey/keystore.c
View File

@@ -259,13 +259,13 @@ static int _keystore_set_file_permission(struct keystore *keystore,
if (chmod(filename, keystore->mode) != 0) {
rc = -errno;
warnx("chmod faild on file '%s': %s", filename, strerror(-rc));
warnx("chmod failed on file '%s': %s", filename, strerror(-rc));
return rc;
}
if (chown(filename, geteuid(), keystore->owner) != 0) {
rc = -errno;
warnx("chown faild on file '%s': %s", filename, strerror(-rc));
warnx("chown failed on file '%s': %s", filename, strerror(-rc));
return rc;
}
@@ -1982,10 +1982,6 @@ int keystore_change_key(struct keystore *keystore, const char *name,
goto out;
}
rc = _keystore_set_file_permission(keystore, file_names.info_filename);
if (rc != 0)
goto out;
pr_verbose(keystore, "Successfully changed key '%s'", name);
out:
@@ -2683,10 +2679,6 @@ static int _keystore_process_reencipher(struct keystore *keystore,
if (rc != 0)
goto out;
rc = _keystore_set_file_permission(keystore, out_file);
if (rc != 0)
goto out;
if (params.complete || params.inplace == 1) {
rc = _keystore_set_timestamp_property(properties,
PROP_NAME_REENC_TIME);
@@ -2712,11 +2704,6 @@ static int _keystore_process_reencipher(struct keystore *keystore,
goto out;
}
rc = _keystore_set_file_permission(keystore,
file_names->info_filename);
if (rc != 0)
goto out;
util_asprintf(&temp, "The following LUKS2 volumes are "
"encrypted with key '%s'. You should also "
"re-encipher the volume key of those volumes "