lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH RFC v2 11/12] integrity: Do not allow mok keyring updates following init
Date
The mok keyring is setup during init.  No additional keys should be allowed
to be added afterwards. Leave the permission as read only.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v2: Initial version
---
security/integrity/digsig.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index be4860c596b9..3a12cc85b528 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -145,7 +145,8 @@ int __init integrity_init_keyring(const unsigned int id)
else
restriction->check = restrict_link_to_ima;

- perm |= KEY_USR_WRITE;
+ if (id != INTEGRITY_KEYRING_MOK)
+ perm |= KEY_USR_WRITE;

out:
return __integrity_init_keyring(id, perm, restriction);
--
2.18.4
\
 
 \ /
  Last update: 2021-07-26 19:16    [W:0.092 / U:4.756 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site