Commit 56edb6c2 authored by Eric Snowberg's avatar Eric Snowberg Committed by Jarkko Sakkinen
Browse files

KEYS: store reference to machine keyring 



Expose the .machine keyring created in integrity code by adding
a reference.  Store a reference to the machine keyring in
system keyring code. The system keyring code needs this to complete
the keyring link to the machine keyring.

Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent 45fcd5e5

certs/system_keyring.c

+9 −0
Original line number Diff line number Diff line
@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; 
#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING

static struct key *secondary_trusted_keys;

#endif

#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING

static struct key *machine_trusted_keys;

#endif

#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING

static struct key *platform_trusted_keys;

#endif
@@ -91,6 +94,12 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void 
	return restriction;

}

#endif

#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING

void __init set_machine_trusted_keys(struct key *keyring)

{

	machine_trusted_keys = keyring;

}

#endif



/*

 * Create the trusted keyrings

include/keys/system_keyring.h

+8 −0
Original line number Diff line number Diff line
@@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( 
#define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted

#endif



#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING

extern void __init set_machine_trusted_keys(struct key *keyring);

#else

static inline void __init set_machine_trusted_keys(struct key *keyring)

{

}

#endif



extern struct pkcs7_message *pkcs7;

#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING

extern int mark_hash_blacklisted(const char *hash);

security/integrity/digsig.c

+2 −0
Original line number Diff line number Diff line
@@ -112,6 +112,8 @@ static int __init __integrity_init_keyring(const unsigned int id, 
	} else {

		if (id == INTEGRITY_KEYRING_PLATFORM)

			set_platform_trusted_keys(keyring[id]);

		if (id == INTEGRITY_KEYRING_MACHINE)

			set_machine_trusted_keys(keyring[id]);

		if (id == INTEGRITY_KEYRING_IMA)

			load_module_cert(keyring[id]);

	}