linux-kernel - Re: [PATCH] IMA: Use the system trusted keyrings instead of .ima

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 06 Apr 2016 14:50:54 -0400
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	David Howells <dhowells@...hat.com>
Cc:	linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] IMA: Use the system trusted keyrings instead of
 .ima_mok (update)

On Wed, 2016-04-06 at 19:10 +0100, David Howells wrote:
> Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> 
> > I'm not sure what you're asking.  If you're asking if the whole file can
> > be include based on whether this option is enabled, then no.
> 
> No - but integrity_init_keyring() just returns if init_keyring is false - but
> this is a variable and is assigned storage, despite the fact that its value is
> only set at compile time as far as I can see.

Originally userspace created the original IMA and EVM keyrings, while
the dot prefixed trusted keyrings were created by the kernel.  The
kernel could just as well create the original underscore prefixed IMA
and EVM keyrings.

Mimi