• Mimi Zohar's avatar
    ima: define '.ima' as a builtin 'trusted' keyring · 7d2ce232
    Mimi Zohar authored
    Require all keys added to the IMA keyring be signed by an
    existing trusted key on the system trusted keyring.
    
    Changelog v6:
    - remove ifdef CONFIG_IMA_TRUSTED_KEYRING in C code - Dmitry
    - update Kconfig dependency and help
    - select KEYS_DEBUG_PROC_KEYS - Dmitry
    
    Changelog v5:
    - Move integrity_init_keyring() to init_ima() - Dmitry
    - reset keyring[id] on failure - Dmitry
    
    Changelog v1:
    - don't link IMA trusted keyring to user keyring
    
    Changelog:
    - define stub integrity_init_keyring() function (reported-by Fengguang Wu)
    - differentiate between regular and trusted keyring names.
    - replace printk with pr_info (D. Kasatkin)
    - only make the IMA keyring a trusted keyring (reported-by D. Kastatkin)
    - define stub integrity_init_keyring() definition based on
      CONFIG_INTEGRITY_SIGNATURE, not CONFIG_INTEGRITY_ASYMMETRIC_KEYS.
      (reported-by Jim Davis)
    Signed-off-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: default avatarDmitry Kasatkin <d.kasatkin@samsung.com>
    Acked-by: default avatarDavid Howells <dhowells@redhat.com>
    7d2ce232
digsig.c 2.01 KB