[PATCH] KEYS: Reject restricted dest_keyring in construct_alloc_key()

[Jarkko Sakkinen]

construct_alloc_key() links keys into dest_keyring without checking
restrict_link, allowing keys whose key->state reaches KEY_IS_POSITIVE to
remain in a restricted keyring when instantiated without relinking into
dest_keyring. Reject restricted destination keyrings with -EPERM after
__key_link_lock() unless KEY_ALLOC_BYPASS_RESTRICTION is set.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
Reported-by: Anvik Loitongbam <permissiontogallop@xxxxxxxxx>
Closes: https://lore.kernel.org/keyrings/20261030173930.40948-1-permissiontogallop@xxxxxxxxx/
Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
---
 security/keys/request_key.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 22cd66a44da5..d4611dd7cb49 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -404,6 +404,11 @@ static int construct_alloc_key(struct keyring_search_context *ctx,
 		ret = __key_link_lock(dest_keyring, &key->index_key);
 		if (ret < 0)
 			goto link_lock_failed;
+
+		if (dest_keyring->restrict_link && !(flags & KEY_ALLOC_BYPASS_RESTRICTION)) {
+			ret = -EPERM;
+			goto link_alloc_failed_unlocked;
+		}
 	}

 	/*
--
2.47.3