lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 26 Jul 2021 13:13:12 -0400 From: Eric Snowberg <eric.snowberg@...cle.com> To: keyrings@...r.kernel.org, linux-integrity@...r.kernel.org, zohar@...ux.ibm.com, dhowells@...hat.com, dwmw2@...radead.org, herbert@...dor.apana.org.au, davem@...emloft.net, jarkko@...nel.org, jmorris@...ei.org, serge@...lyn.com Cc: eric.snowberg@...cle.com, keescook@...omium.org, gregkh@...uxfoundation.org, torvalds@...ux-foundation.org, scott.branden@...adcom.com, weiyongjun1@...wei.com, nayna@...ux.ibm.com, ebiggers@...gle.com, ardb@...nel.org, nramas@...ux.microsoft.com, lszubowi@...hat.com, linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org, linux-security-module@...r.kernel.org, James.Bottomley@...senPartnership.com, pjones@...hat.com, glin@...e.com, konrad.wilk@...cle.com Subject: [PATCH RFC v2 05/12] integrity: restrict INTEGRITY_KEYRING_MOK to restrict_link_by_system_trusted_or_ca Set the restriction check for INTEGRITY_KEYRING_MOK keys to restrict_link_by_system_trusted_or_ca. This will only allow keys into the mok keyring that are either a CA or trusted by a key contained within the builtin or secondary trusted keyring. Signed-off-by: Eric Snowberg <eric.snowberg@...cle.com> --- v1: Initial version v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok keyring gets created even when it isn't enabled --- security/integrity/digsig.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index e07334504ef1..2f6898c89f60 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -132,7 +132,7 @@ int __init integrity_init_keyring(const unsigned int id) goto out; } - if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING)) + if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) && id != INTEGRITY_KEYRING_MOK) return 0; restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); @@ -140,6 +140,11 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; + if (id == INTEGRITY_KEYRING_MOK) + restriction->check = restrict_link_by_system_trusted_or_ca; + else + restriction->check = restrict_link_to_ima; + perm |= KEY_USR_WRITE; out: -- 2.18.4
Powered by blists - more mailing lists