linux-kernel - Re: [RFC v2 2/7] keys: initialize root uid and session keyrings early

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 16 Aug 2012 15:08:47 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	Josh Boyer <jwboyer@...il.com>
Cc:	Dmitry Kasatkin <dmitry.kasatkin@...el.com>, jmorris@...ei.org,
	rusty@...tcorp.com.au, dhowells@...hat.com,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, Mimi Zohar <zohar@...ibm.com>
Subject: Re: [RFC v2 2/7] keys: initialize root uid and session keyrings
 early

On Thu, 2012-08-16 at 14:26 -0400, Josh Boyer wrote:
> On Wed, Aug 15, 2012 at 2:43 PM, Dmitry Kasatkin
> <dmitry.kasatkin@...el.com> wrote:
> > From: Mimi Zohar <zohar@...ux.vnet.ibm.com>
> >
> > In order to create the integrity keyrings (eg. _evm, _ima, _modules),
> > root's uid and session keyrings need to be initialized early.
> >
> > Signed-off-by: Mimi Zohar <zohar@...ibm.com>
> > ---
> >  security/keys/Makefile       |    1 +
> >  security/keys/root_keyring.c |   18 ++++++++++++++++++
> >  2 files changed, 19 insertions(+)
> >  create mode 100644 security/keys/root_keyring.c
> >
> > diff --git a/security/keys/Makefile b/security/keys/Makefile
> > index 504aaa0..c93ce8d 100644
> > --- a/security/keys/Makefile
> > +++ b/security/keys/Makefile
> > @@ -18,6 +18,7 @@ obj-y := \
> >  obj-$(CONFIG_KEYS_COMPAT) += compat.o
> >  obj-$(CONFIG_PROC_FS) += proc.o
> >  obj-$(CONFIG_SYSCTL) += sysctl.o
> > +obj-$(CONFIG_INTEGRITY_SIGNATURE) += root_keyring.o
> >
> >  #
> >  # Key types
> > diff --git a/security/keys/root_keyring.c b/security/keys/root_keyring.c
> > new file mode 100644
> > index 0000000..f6662eb
> > --- /dev/null
> > +++ b/security/keys/root_keyring.c
> > @@ -0,0 +1,18 @@
> > +/*
> > + * Copyright (C) 2012 IBM Corporation
> > + *
> > + * Author:
> > + * Mimi Zohar <zohar@...ibm.com>
> > + *
> > + * This program is free software; you can redistribute it and/or modify
> > + * it under the terms of the GNU General Public License as published by
> > + * the Free Software Foundation, version 2 of the License.
> > + */
> > +
> > +#include "internal.h"
> > +static int __init init_root_keyring(void)
> > +{
> > +       return install_user_keyrings();
> > +}
> > +
> > +late_initcall(init_root_keyring);
> > --
> 
> Why is this in an entirely new file instead of just being added to
> process_keys.c ?
> 
> josh

Only when "CONFIG_INTEGRITY_SIGNATURE" is selected, does this get built.

Mimi

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/