[mirror_ubuntu-artful-kernel.git] / security / integrity / ima / ima_mok.c

/*
 * Copyright (C) 2015 Juniper Networks, Inc.
 *
 * Author:
 * Petko Manolov <petko.manolov@konsulko.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation, version 2 of the
 * License.
 *
 */

#include <linux/export.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/cred.h>
#include <linux/err.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <keys/system_keyring.h>


struct key *ima_blacklist_keyring;

/*
 * Allocate the IMA blacklist keyring
 */
__init int ima_mok_init(void)
{
	struct key_restriction *restriction;

	pr_notice("Allocating IMA blacklist keyring.\n");

	restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
	if (!restriction)
		panic("Can't allocate IMA blacklist restriction.");

	restriction->check = restrict_link_by_builtin_trusted;

	ima_blacklist_keyring = keyring_alloc(".ima_blacklist",
				KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
				(KEY_POS_ALL & ~KEY_POS_SETATTR) |
				KEY_USR_VIEW | KEY_USR_READ |
				KEY_USR_WRITE | KEY_USR_SEARCH,
				KEY_ALLOC_NOT_IN_QUOTA,
				restriction, NULL);

	if (IS_ERR(ima_blacklist_keyring))
		panic("Can't allocate IMA blacklist keyring.");

	set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
	return 0;
}
device_initcall(ima_mok_init);
Commit	Line	Data
41c89b64 PM	1	/*
	2	* Copyright (C) 2015 Juniper Networks, Inc.
	3	*
	4	* Author:
	5	* Petko Manolov <petko.manolov@konsulko.com>
	6	*
	7	* This program is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU General Public License as
	9	* published by the Free Software Foundation, version 2 of the
	10	* License.
	11	*
	12	*/
	13
	14	#include <linux/export.h>
	15	#include <linux/kernel.h>
	16	#include <linux/sched.h>
	17	#include <linux/cred.h>
	18	#include <linux/err.h>
92cc9166	19	#include <linux/init.h>
2b6aa412	20	#include <linux/slab.h>
a511e1af	21	#include <keys/system_keyring.h>
41c89b64 PM	22
41c89b64 PM	23
41c89b64 PM	24	struct key *ima_blacklist_keyring;
	25
	26	/*
56104cf2	27	* Allocate the IMA blacklist keyring
41c89b64 PM	28	*/
	29	__init int ima_mok_init(void)
	30	{
2b6aa412 MM	31	struct key_restriction *restriction;
2b6aa412 MM	32
56104cf2	33	pr_notice("Allocating IMA blacklist keyring.\n");
41c89b64	34
2b6aa412 MM	35	restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
	36	if (!restriction)
	37	panic("Can't allocate IMA blacklist restriction.");
	38
	39	restriction->check = restrict_link_by_builtin_trusted;
	40
41c89b64 PM	41	ima_blacklist_keyring = keyring_alloc(".ima_blacklist",
	42	KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
	43	(KEY_POS_ALL & ~KEY_POS_SETATTR) \|
	44	KEY_USR_VIEW \| KEY_USR_READ \|
	45	KEY_USR_WRITE \| KEY_USR_SEARCH,
5ac7eace	46	KEY_ALLOC_NOT_IN_QUOTA,
2b6aa412	47	restriction, NULL);
41c89b64	48
56104cf2 DH	49	if (IS_ERR(ima_blacklist_keyring))
56104cf2 DH	50	panic("Can't allocate IMA blacklist keyring.");
501f1bde	51
501f1bde	52	set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
41c89b64 PM	53	return 0;
41c89b64 PM	54	}
92cc9166	55	device_initcall(ima_mok_init);