Re: [PATCH] KEYS: Reject restricted dest_keyring in construct_alloc_key()

[Jarkko Sakkinen]

On Sat, Oct 31, 2026 at 11:28:18AM +0200, Jarkko Sakkinen wrote:
> construct_alloc_key() links keys into dest_keyring without checking
> restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to
> remain in a restricted keyring when instantiated without relinking into
> dest_keyring. Reject restricted destination keyrings with -EPERM after
> __key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
> Reported-by: Anvik Loitongbam <permissiontogallop@xxxxxxxxx>
> Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@xxxxxxxxx/
> Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>

I don't understand why this came out twice. I must have forgot to add
--dry-run when I trialed it. Sorry about that; was unintended.

Br, Jarkko