Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 217091dd authored by Mimi Zohar's avatar Mimi Zohar
Browse files

ima: define '_ima' as a builtin 'trusted' keyring 



Require all keys added to the IMA keyring be signed by an
existing trusted key on the system trusted keyring.

Changelog:
- define stub integrity_init_keyring() function (reported-by Fengguang Wu)
- differentiate between regular and trusted keyring names.
- replace printk with pr_info (D. Kasatkin)

Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent bcbc9b0c

security/integrity/digsig.c

+29 −1
Original line number Diff line number Diff line
@@ -13,7 +13,9 @@ 
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt



#include <linux/err.h>

#include <linux/sched.h>

#include <linux/rbtree.h>

#include <linux/cred.h>

#include <linux/key-type.h>

#include <linux/digsig.h>
@@ -21,11 +23,19 @@ 


static struct key *keyring[INTEGRITY_KEYRING_MAX];



#ifdef CONFIG_IMA_TRUSTED_KEYRING

static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {

	".evm",

	".module",

	".ima",

};

#else

static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {

	"_evm",

	"_module",

	"_ima",

};

#endif



int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,

			    const char *digest, int digestlen)
@@ -56,3 +66,21 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, 


	return -EOPNOTSUPP;

}



int integrity_init_keyring(const unsigned int id)

{

	const struct cred *cred = current_cred();

	const struct user_struct *user = cred->user;



	keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),

				    KGIDT_INIT(0), cred,

				    ((KEY_POS_ALL & ~KEY_POS_SETATTR) |

				     KEY_USR_VIEW | KEY_USR_READ),

				    KEY_ALLOC_NOT_IN_QUOTA, user->uid_keyring);

	if (!IS_ERR(keyring[id]))

		set_bit(KEY_FLAG_TRUSTED_ONLY, &keyring[id]->flags);

	else

		pr_info("Can't allocate %s keyring (%ld)\n",

			keyring_name[id], PTR_ERR(keyring[id]));

	return 0;

}

security/integrity/ima/Kconfig

+8 −0
Original line number Diff line number Diff line
@@ -123,3 +123,11 @@ config IMA_APPRAISE 
	  For more information on integrity appraisal refer to:

	  <http://linux-ima.sourceforge.net>

	  If unsure, say N.



config IMA_TRUSTED_KEYRING

	bool "Require all keys on the _ima keyring be signed"

	depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING

	default y

	help

	   This option requires that all keys added to the _ima

	   keyring be signed by a key on the system trusted keyring.

security/integrity/ima/ima_appraise.c

+11 −0
Original line number Diff line number Diff line
@@ -381,3 +381,14 @@ int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) 
	}

	return result;

}



#ifdef CONFIG_IMA_TRUSTED_KEYRING

static int __init init_ima_keyring(void)

{

	int ret;



	ret = integrity_init_keyring(INTEGRITY_KEYRING_IMA);

	return 0;

}

late_initcall(init_ima_keyring);

#endif

security/integrity/integrity.h

+7 −0
Original line number Diff line number Diff line
@@ -137,12 +137,19 @@ static inline int integrity_digsig_verify(const unsigned int id, 
#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS

int asymmetric_verify(struct key *keyring, const char *sig,

		      int siglen, const char *data, int datalen);



int integrity_init_keyring(const unsigned int id);

#else

static inline int asymmetric_verify(struct key *keyring, const char *sig,

				    int siglen, const char *data, int datalen)

{

	return -EOPNOTSUPP;

}



static int integrity_init_keyring(const unsigned int id)

{

	return 0;

}

#endif



#ifdef CONFIG_INTEGRITY_AUDIT