FAILED: patch "[PATCH] KEYS: Only apply KEY_FLAG_KEEP to a key if a parent keyring" failed to apply to 4.4-stable tree

The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From: David Howells <[email protected]>
Date: Wed, 27 Jan 2016 01:02:03 +0000
Subject: [PATCH] KEYS: Only apply KEY_FLAG_KEEP to a key if a parent keyring
has it set

KEY_FLAG_KEEP should only be applied to a key if the keyring it is being linked into has KEY_FLAG_KEEP set.

To this end, partially revert the following patch:

	commit 1d6d167c2efcfe9539d9cffb1a1be9c92e39c2c0
	Author: Mimi Zohar <[email protected]>
	Date:   Thu Jan 7 07:46:36 2016 -0500
	KEYS: refcount bug fix

to undo the change that made it unconditional (Mimi got it right the first time).

Without undoing this change, it becomes impossible to delete, revoke or invalidate keys added to keyrings through __key_instantiate_and_link() where the keyring has itself been linked to. To test this, run the following command sequence:

keyctl newring foo @s
keyctl add user a a %:foo
keyctl unlink %user:a %:foo
keyctl clear %:foo

With the commit mentioned above the third and fourth commands fail with EPERM when they should succeed.

index 07a87311055c..09ef276c4bdc 100644
@@ -430,7 +430,8 @@ static int __key_instantiate_and_link(struct key *key,
 
 			/* and link it into the destination keyring */
 			if (keyring) {
-				set_bit(KEY_FLAG_KEEP, &key->flags);
+				if (test_bit(KEY_FLAG_KEEP, &keyring->flags))
+					set_bit(KEY_FLAG_KEEP, &key->flags);
 
 				__key_link(key, _edit);
 			}

Sorry for the confusion. KEY_FLAG_KEEP is being added in 4.5.

Mimi