Commit 217091dd authored by Mimi Zohar's avatar Mimi Zohar

ima: define '_ima' as a builtin 'trusted' keyring

Require all keys added to the IMA keyring be signed by an
existing trusted key on the system trusted keyring.

Changelog:
- define stub integrity_init_keyring() function (reported-by Fengguang Wu)
- differentiate between regular and trusted keyring names.
- replace printk with pr_info (D. Kasatkin)
Signed-off-by: default avatarMimi Zohar <zohar@us.ibm.com>
parent bcbc9b0c
...@@ -13,7 +13,9 @@ ...@@ -13,7 +13,9 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/err.h> #include <linux/err.h>
#include <linux/sched.h>
#include <linux/rbtree.h> #include <linux/rbtree.h>
#include <linux/cred.h>
#include <linux/key-type.h> #include <linux/key-type.h>
#include <linux/digsig.h> #include <linux/digsig.h>
...@@ -21,11 +23,19 @@ ...@@ -21,11 +23,19 @@
static struct key *keyring[INTEGRITY_KEYRING_MAX]; static struct key *keyring[INTEGRITY_KEYRING_MAX];
#ifdef CONFIG_IMA_TRUSTED_KEYRING
static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
".evm",
".module",
".ima",
};
#else
static const char *keyring_name[INTEGRITY_KEYRING_MAX] = { static const char *keyring_name[INTEGRITY_KEYRING_MAX] = {
"_evm", "_evm",
"_module", "_module",
"_ima", "_ima",
}; };
#endif
int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
const char *digest, int digestlen) const char *digest, int digestlen)
...@@ -35,7 +45,7 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, ...@@ -35,7 +45,7 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
if (!keyring[id]) { if (!keyring[id]) {
keyring[id] = keyring[id] =
request_key(&key_type_keyring, keyring_name[id], NULL); request_key(&key_type_keyring, keyring_name[id], NULL);
if (IS_ERR(keyring[id])) { if (IS_ERR(keyring[id])) {
int err = PTR_ERR(keyring[id]); int err = PTR_ERR(keyring[id]);
pr_err("no %s keyring: %d\n", keyring_name[id], err); pr_err("no %s keyring: %d\n", keyring_name[id], err);
...@@ -56,3 +66,21 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, ...@@ -56,3 +66,21 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
int integrity_init_keyring(const unsigned int id)
{
const struct cred *cred = current_cred();
const struct user_struct *user = cred->user;
keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
KGIDT_INIT(0), cred,
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ),
KEY_ALLOC_NOT_IN_QUOTA, user->uid_keyring);
if (!IS_ERR(keyring[id]))
set_bit(KEY_FLAG_TRUSTED_ONLY, &keyring[id]->flags);
else
pr_info("Can't allocate %s keyring (%ld)\n",
keyring_name[id], PTR_ERR(keyring[id]));
return 0;
}
...@@ -123,3 +123,11 @@ config IMA_APPRAISE ...@@ -123,3 +123,11 @@ config IMA_APPRAISE
For more information on integrity appraisal refer to: For more information on integrity appraisal refer to:
<http://linux-ima.sourceforge.net> <http://linux-ima.sourceforge.net>
If unsure, say N. If unsure, say N.
config IMA_TRUSTED_KEYRING
bool "Require all keys on the _ima keyring be signed"
depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
default y
help
This option requires that all keys added to the _ima
keyring be signed by a key on the system trusted keyring.
...@@ -381,3 +381,14 @@ int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) ...@@ -381,3 +381,14 @@ int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name)
} }
return result; return result;
} }
#ifdef CONFIG_IMA_TRUSTED_KEYRING
static int __init init_ima_keyring(void)
{
int ret;
ret = integrity_init_keyring(INTEGRITY_KEYRING_IMA);
return 0;
}
late_initcall(init_ima_keyring);
#endif
...@@ -137,12 +137,19 @@ static inline int integrity_digsig_verify(const unsigned int id, ...@@ -137,12 +137,19 @@ static inline int integrity_digsig_verify(const unsigned int id,
#ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS
int asymmetric_verify(struct key *keyring, const char *sig, int asymmetric_verify(struct key *keyring, const char *sig,
int siglen, const char *data, int datalen); int siglen, const char *data, int datalen);
int integrity_init_keyring(const unsigned int id);
#else #else
static inline int asymmetric_verify(struct key *keyring, const char *sig, static inline int asymmetric_verify(struct key *keyring, const char *sig,
int siglen, const char *data, int datalen) int siglen, const char *data, int datalen)
{ {
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
static int integrity_init_keyring(const unsigned int id)
{
return 0;
}
#endif #endif
#ifdef CONFIG_INTEGRITY_AUDIT #ifdef CONFIG_INTEGRITY_AUDIT
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment