From d95dc6d698b5a666920201e39f3ccd0b1afb918c Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 4 Feb 2019 14:07:34 +0100 Subject: [PATCH] zkey: Avoid EPERM on key change if user is not owner of key file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When a user that is in the zkeyadm group, but is not the owner of the key file changes a key in the zkey repository, then error "Operation not permitted" occurs. This is due to a superfluous call to chmod on the key file. When key files are changed then the permissions of that file are retained anyway. Also fix a typo in the error message when chmod fails. Signed-off-by: Ingo Franzki Reviewed-by: Harald Freudenberger Signed-off-by: Jan Höppner --- zkey/keystore.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) diff --git a/zkey/keystore.c b/zkey/keystore.c index 928b1518..ee0fb8b3 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -259,13 +259,13 @@ static int _keystore_set_file_permission(struct keystore *keystore, if (chmod(filename, keystore->mode) != 0) { rc = -errno; - warnx("chmod faild on file '%s': %s", filename, strerror(-rc)); + warnx("chmod failed on file '%s': %s", filename, strerror(-rc)); return rc; } if (chown(filename, geteuid(), keystore->owner) != 0) { rc = -errno; - warnx("chown faild on file '%s': %s", filename, strerror(-rc)); + warnx("chown failed on file '%s': %s", filename, strerror(-rc)); return rc; } @@ -1982,10 +1982,6 @@ int keystore_change_key(struct keystore *keystore, const char *name, goto out; } - rc = _keystore_set_file_permission(keystore, file_names.info_filename); - if (rc != 0) - goto out; - pr_verbose(keystore, "Successfully changed key '%s'", name); out: @@ -2683,10 +2679,6 @@ static int _keystore_process_reencipher(struct keystore *keystore, if (rc != 0) goto out; - rc = _keystore_set_file_permission(keystore, out_file); - if (rc != 0) - goto out; - if (params.complete || params.inplace == 1) { rc = _keystore_set_timestamp_property(properties, PROP_NAME_REENC_TIME); @@ -2712,11 +2704,6 @@ static int _keystore_process_reencipher(struct keystore *keystore, goto out; } - rc = _keystore_set_file_permission(keystore, - file_names->info_filename); - if (rc != 0) - goto out; - util_asprintf(&temp, "The following LUKS2 volumes are " "encrypted with key '%s'. You should also " "re-encipher the volume key of those volumes "