nfs: create a kernel keyring

Create a kernel .nfs keyring similar to the nvme .nvme one.  Unlike for
a userspace-created keyrind, tlshd is a possesor of the keys with this
and thus the keys don't need user read permissions.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Link: https://lore.kernel.org/r/20250515115107.33052-3-hch@lst.de
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 4c7fa4f2bd5e27bda380e3bb92bd834e87f6add3..60fa0c8ff04e5d087205376a5723bb9b092fbc6b 100644 (file)
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -2649,6 +2649,35 @@ static struct pernet_operations nfs_net_ops = {
        .size = sizeof(struct nfs_net),
 };
 
+#ifdef CONFIG_KEYS
+static struct key *nfs_keyring;
+
+static int __init nfs_init_keyring(void)
+{
+       nfs_keyring = keyring_alloc(".nfs",
+                            GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
+                            current_cred(),
+                            (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                            (KEY_USR_ALL & ~KEY_USR_SETATTR),
+                            KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
+       return PTR_ERR_OR_ZERO(nfs_keyring);
+}
+
+static void __exit nfs_exit_keyring(void)
+{
+       key_put(nfs_keyring);
+}
+#else
+static inline int nfs_init_keyring(void)
+{
+       return 0;
+}
+
+static inline void nfs_exit_keyring(void)
+{
+}
+#endif /* CONFIG_KEYS */
+
 /*
  * Initialize NFS
  */
@@ -2656,6 +2685,10 @@ static int __init init_nfs_fs(void)
 {
        int err;
 
+       err = nfs_init_keyring();
+       if (err)
+               return err;
+
        err = nfs_sysfs_init();
        if (err < 0)
                goto out10;
@@ -2716,6 +2749,7 @@ out7:
 out9:
        nfs_sysfs_exit();
 out10:
+       nfs_exit_keyring();
        return err;
 }
 
@@ -2731,6 +2765,7 @@ static void __exit exit_nfs_fs(void)
        nfs_fs_proc_exit();
        nfsiod_stop();
        nfs_sysfs_exit();
+       nfs_exit_keyring();
 }
 
 /* Not quite true; I just maintain it */