Proxmox-Port/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-08-16 22:13:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

nfs: create a kernel keyring

Browse Source 
Create a kernel .nfs keyring similar to the nvme .nvme one.  Unlike for
a userspace-created keyrind, tlshd is a possesor of the keys with this
and thus the keys don't need user read permissions.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Link: https://lore.kernel.org/r/20250515115107.33052-3-hch@lst.de
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
This commit is contained in:
Christoph Hellwig 2025-05-15 13:50:56 +02:00 committed by Trond Myklebust
parent 90c9550a8d
commit 87268f7a4f
1 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
fs/nfs/inode.c
View File

@ -2649,6 +2649,35 @@ static struct pernet_operations nfs_net_ops = {
.size = sizeof(struct nfs_net),
};
#ifdef CONFIG_KEYS
static struct key *nfs_keyring;
static int __init nfs_init_keyring(void)
{
nfs_keyring = keyring_alloc(".nfs",
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
current_cred(),
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
(KEY_USR_ALL & ~KEY_USR_SETATTR),
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
return PTR_ERR_OR_ZERO(nfs_keyring);
}
static void __exit nfs_exit_keyring(void)
{
key_put(nfs_keyring);
}
#else
static inline int nfs_init_keyring(void)
{
return 0;
}
static inline void nfs_exit_keyring(void)
{
}
#endif /* CONFIG_KEYS */
/*
* Initialize NFS
*/
@ -2656,6 +2685,10 @@ static int __init init_nfs_fs(void)
{
int err;
err = nfs_init_keyring();
if (err)
return err;
err = nfs_sysfs_init();
if (err < 0)
goto out10;
@ -2716,6 +2749,7 @@ static int __init init_nfs_fs(void)
out9:
nfs_sysfs_exit();
out10:
nfs_exit_keyring();
return err;
}
@ -2731,6 +2765,7 @@ static void __exit exit_nfs_fs(void)
nfs_fs_proc_exit();
nfsiod_stop();
nfs_sysfs_exit();
nfs_exit_keyring();
}
/* Not quite true; I just maintain it */