[PATCH] KEYS: Reject restricted dest_keyring in construct_alloc_key()

[Jarkko Sakkinen]

construct_alloc_key() links keys into dest_keyring without checking
restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to
remain in a restricted keyring when instantiated without relinking into
dest_keyring. Reject restricted destination keyrings with -EPERM after
__key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
Reported-by: Anvik Loitongbam <permissiontogallop@xxxxxxxxx>
Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@xxxxxxxxx/
Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
---
 security/keys/request_key.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 22cd66a44da5..715ef3cc51b3 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -404,6 +404,13 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
 		ret = __key_link_lock(dest_keyring, &key->index_key);
 		if (ret < 0)
 			goto link_lock_failed;
+
+		/* The payload is not yet available to check the restriction. */
+		if (dest_keyring->restrict_link &&
+		    !(flags & KEY_ALLOC_BYPASS_RESTRICTION)) {
+			ret = -EPERM;
+			goto link_alloc_failed_unlocked;
+		}
 	}
 
 	/*
-- 
2.47.3


--fP9ujw+JDj5S0FS3--