David Howells 56104cf2b8 IMA: Use the the system trusted keyrings instead of .ima_mok ... Add a config option (IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) that, when enabled, allows keys to be added to the IMA keyrings by userspace - with the restriction that each must be signed by a key in the system trusted keyrings. EPERM will be returned if this option is disabled, ENOKEY will be returned if no authoritative key can be found and EKEYREJECTED will be returned if the signature doesn't match. Other errors such as ENOPKG may also be returned. If this new option is enabled, the builtin system keyring is searched, as is the secondary system keyring if that is also enabled. Intermediate keys between the builtin system keyring and the key being added can be added to the secondary keyring (which replaces .ima_mok) to form a trust chain - provided they are also validly signed by a key in one of the trusted keyrings. The .ima_mok keyring is then removed and the IMA blacklist keyring gets its own config option (IMA_BLACKLIST_KEYRING). Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>		2016-04-11 22:49:15 +01:00
..
ima.h	ima: measure and appraise the IMA policy itself	2016-02-21 09:34:22 -05:00
ima_api.c	ima: define a new hook to measure and appraise a file already in memory	2016-02-20 22:35:08 -05:00
ima_appraise.c	ima: remove firmware and module specific cached status info	2016-02-21 09:06:13 -05:00
ima_crypto.c	ima: calculate the hash of a buffer using aynchronous hash(ahash)	2016-02-18 17:14:44 -05:00
ima_fs.c	ima: measure and appraise the IMA policy itself	2016-02-21 09:34:22 -05:00
ima_init.c	ima: separate 'security.ima' reading functionality from collect	2016-02-18 17:13:32 -05:00
ima_main.c	ima: measure and appraise the IMA policy itself	2016-02-21 09:34:22 -05:00
ima_mok.c	IMA: Use the the system trusted keyrings instead of .ima_mok	2016-04-11 22:49:15 +01:00
ima_policy.c	ima: require signed IMA policy	2016-02-21 09:34:23 -05:00
ima_queue.c	integrity: fix checkpatch errors	2014-03-07 12:15:45 -05:00
ima_template.c	ima: separate 'security.ima' reading functionality from collect	2016-02-18 17:13:32 -05:00
ima_template_lib.c	ima: separate 'security.ima' reading functionality from collect	2016-02-18 17:13:32 -05:00
ima_template_lib.h	ima: wrap event related data to the new ima_event_data structure	2015-05-21 13:59:28 -04:00
Kconfig	IMA: Use the the system trusted keyrings instead of .ima_mok	2016-04-11 22:49:15 +01:00
Makefile	IMA: Use the the system trusted keyrings instead of .ima_mok	2016-04-11 22:49:15 +01:00