From 2806585aad4b4910156cbaa24c8ea027c572365f Mon Sep 17 00:00:00 2001 From: Rob Austein Date: Mon, 14 Nov 2016 18:22:15 -0500 Subject: Tweak pkey access control to allow wheel to see keys. The current pkey access control rules are a bit complex, because they need to support the somewhat complex rules required by PKCS #11. This is fine, as far as it goes, but a strict interpretation leaves HAL_USER_NORMAL as the only user able to see many keys. This is confusing when using the CLI, to put it mildly. HAL_USER_WHEEL is intended for exactly this sort of thing: it's a user ID which, by definition, can never appear in an RPC call from PKCS to see the same keys that HAL_USER_NORMAL would. HAL_USER_SO remains restricted per the PKCS #11 rules. --- rpc_pkey.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/rpc_pkey.c b/rpc_pkey.c index 52b6b0e..3788f5e 100644 --- a/rpc_pkey.c +++ b/rpc_pkey.c @@ -138,13 +138,21 @@ static inline hal_pkey_slot_t *find_handle(const hal_pkey_handle_t handle) * need to refactor. */ +static inline hal_error_t check_normal_or_wheel(const hal_client_handle_t client) +{ + const hal_error_t err = hal_rpc_is_logged_in(client, HAL_USER_NORMAL); + return (err == HAL_ERROR_FORBIDDEN + ? hal_rpc_is_logged_in(client, HAL_USER_WHEEL) + : err); +} + static inline hal_error_t check_readable(const hal_client_handle_t client, const hal_key_flags_t flags) { if ((flags & HAL_KEY_FLAG_PUBLIC) != 0) return HAL_OK; - return hal_rpc_is_logged_in(client, HAL_USER_NORMAL); + return check_normal_or_wheel(client); } static inline hal_error_t check_writable(const hal_client_handle_t client, @@ -153,7 +161,7 @@ static inline hal_error_t check_writable(const hal_client_handle_t client, if ((flags & (HAL_KEY_FLAG_TOKEN | HAL_KEY_FLAG_PUBLIC)) == HAL_KEY_FLAG_PUBLIC) return HAL_OK; - return hal_rpc_is_logged_in(client, HAL_USER_NORMAL); + return check_normal_or_wheel(client); } /* -- cgit v1.2.3