David Howells d7b0efadc3 certs: Fix blacklist flag type confusion ... [ Upstream commit 4993e1f947 ] KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(), as these only take KEY_ALLOC_* flags. KEY_FLAG_KEEP has the same value as KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update() uses it. LSMs using the key_alloc hook don't check that flag. KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot write to the blacklist keyring, so it is not possible to remove a key/hash from it. Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set KEY_FLAG_KEEP on the new key. blacklist_init() can then, correctly, pass this to keyring_alloc(). We can also use this in ima_mok_init() rather than setting the flag manually. Note that this doesn't fix an observable bug with the current implementation but it is required to allow addition of new hashes to the blacklist in the future without making it possible for them to be removed. Fixes: 734114f878 ("KEYS: Add a system blacklist keyring") Reported-by: Mickaël Salaün <mic@linux.microsoft.com> Signed-off-by: David Howells <dhowells@redhat.com> cc: Mickaël Salaün <mic@linux.microsoft.com> cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-03-04 11:37:59 +01:00
..
ima.h	ima: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
ima_api.c	ima: Support additional conditionals in the KEXEC_CMDLINE hook function	2020-07-20 13:28:16 -04:00
ima_appraise.c	integrity-v5.10	2020-10-15 15:58:18 -07:00
ima_asymmetric_keys.c	ima: Support additional conditionals in the KEXEC_CMDLINE hook function	2020-07-20 13:28:16 -04:00
ima_crypto.c	ima: Don't modify file descriptor mode on the fly	2020-12-30 11:54:17 +01:00
ima_fs.c	fs/kernel_file_read: Add "offset" arg for partial reads	2020-10-05 13:37:04 +02:00
ima_init.c	ima: Call ima_calc_boot_aggregate() in ima_eventdigest_init()	2020-06-03 17:20:43 -04:00
ima_kexec.c	ima: Free IMA measurement buffer after kexec syscall	2021-03-04 11:37:50 +01:00
ima_main.c	integrity-v5.10	2020-10-15 15:58:18 -07:00
ima_modsig.c	ima: Move comprehensive rule validation checks out of the token parser	2020-07-20 13:28:15 -04:00
ima_mok.c	certs: Fix blacklist flag type confusion	2021-03-04 11:37:59 +01:00
ima_policy.c	integrity-v5.10	2020-10-15 15:58:18 -07:00
ima_queue.c	ima: Remove semicolon at the end of ima_get_binary_runtime_size()	2020-09-15 13:47:41 -04:00
ima_queue_keys.c	ima: Support additional conditionals in the KEXEC_CMDLINE hook function	2020-07-20 13:28:16 -04:00
ima_template.c	Minor fixes for v5.9.	2020-08-11 14:30:36 -07:00
ima_template_lib.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
ima_template_lib.h	Replace HTTP links with HTTPS ones: security	2020-08-06 12:00:05 -07:00
Kconfig	Minor fixes for v5.9.	2020-08-11 14:30:36 -07:00
Makefile	IMA: Update KBUILD_MODNAME for IMA files to ima	2020-02-28 14:32:58 -05:00