41c89b64d7
This option creates IMA MOK and blacklist keyrings. IMA MOK is an intermediate keyring that sits between .system and .ima keyrings, effectively forming a simple CA hierarchy. To successfully import a key into .ima_mok it must be signed by a key which CA is in .system keyring. On turn any key that needs to go in .ima keyring must be signed by CA in either .system or .ima_mok keyrings. IMA MOK is empty at kernel boot. IMA blacklist keyring contains all revoked IMA keys. It is consulted before any other keyring. If the search is successful the requested operation is rejected and error is returned to the caller. Signed-off-by: Petko Manolov <petkan@mip-labs.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
63 lines
1.5 KiB
C
63 lines
1.5 KiB
C
/* System keyring containing trusted public keys.
|
|
*
|
|
* Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
|
|
* Written by David Howells (dhowells@redhat.com)
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public Licence
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the Licence, or (at your option) any later version.
|
|
*/
|
|
|
|
#ifndef _KEYS_SYSTEM_KEYRING_H
|
|
#define _KEYS_SYSTEM_KEYRING_H
|
|
|
|
#ifdef CONFIG_SYSTEM_TRUSTED_KEYRING
|
|
|
|
#include <linux/key.h>
|
|
#include <crypto/public_key.h>
|
|
|
|
extern struct key *system_trusted_keyring;
|
|
static inline struct key *get_system_trusted_keyring(void)
|
|
{
|
|
return system_trusted_keyring;
|
|
}
|
|
#else
|
|
static inline struct key *get_system_trusted_keyring(void)
|
|
{
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
#ifdef CONFIG_SYSTEM_DATA_VERIFICATION
|
|
extern int system_verify_data(const void *data, unsigned long len,
|
|
const void *raw_pkcs7, size_t pkcs7_len,
|
|
enum key_being_used_for usage);
|
|
#endif
|
|
|
|
#ifdef CONFIG_IMA_MOK_KEYRING
|
|
extern struct key *ima_mok_keyring;
|
|
extern struct key *ima_blacklist_keyring;
|
|
|
|
static inline struct key *get_ima_mok_keyring(void)
|
|
{
|
|
return ima_mok_keyring;
|
|
}
|
|
static inline struct key *get_ima_blacklist_keyring(void)
|
|
{
|
|
return ima_blacklist_keyring;
|
|
}
|
|
#else
|
|
static inline struct key *get_ima_mok_keyring(void)
|
|
{
|
|
return NULL;
|
|
}
|
|
static inline struct key *get_ima_blacklist_keyring(void)
|
|
{
|
|
return NULL;
|
|
}
|
|
#endif /* CONFIG_IMA_MOK_KEYRING */
|
|
|
|
|
|
#endif /* _KEYS_SYSTEM_KEYRING_H */
|