Eric Snowberg 1573d595e2 integrity: Load mokx variables into the blacklist keyring ... [ Upstream commit ebd9c2ae36 ] During boot the Secure Boot Forbidden Signature Database, dbx, is loaded into the blacklist keyring. Systems booted with shim have an equivalent Forbidden Signature Database called mokx. Currently mokx is only used by shim and grub, the contents are ignored by the kernel. Add the ability to load mokx into the blacklist keyring during boot. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Suggested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/c33c8e3839a41e9654f41cc92c7231104931b1d7.camel@HansenPartnership.com/ Link: https://lore.kernel.org/r/20210122181054.32635-5-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428674320.677100.12637282414018170743.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433313205.902181.2502803393898221637.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529607422.163428.13530426573612578854.stgit@warthog.procyon.org.uk/ # v3 Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-30 08:47:30 -04:00
..
apparmor	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
bpf	bpf: Implement bpf_local_storage for inodes	2020-08-25 15:00:04 -07:00
integrity	integrity: Load mokx variables into the blacklist keyring	2021-06-30 08:47:30 -04:00
keys	KEYS: trusted: Fix memory leak on object td	2021-05-19 10:12:50 +02:00
loadpin	LSM: Add "contents" flag to kernel_read_file hook	2020-10-05 13:37:03 +02:00
lockdown	Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2020-06-02 17:36:24 -07:00
safesetid	LSM: SafeSetID: Fix warnings reported by test bot	2020-10-13 09:17:36 -07:00
selinux	selinux: add proper NULL termination to the secclass_map permissions	2021-05-14 09:49:59 +02:00
smack	smackfs: restrict bytes count in smackfs write functions	2021-03-07 12:34:05 +01:00
tomoyo	tomoyo: recognize kernel threads correctly	2021-03-09 11:11:15 +01:00
yama	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
commoncap.c	security: commoncap: fix -Wstringop-overread warning	2021-05-11 14:47:36 +02:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-08-20 11:25:03 -07:00
inode.c
Kconfig	Replace HTTP links with HTTPS ones: security	2020-08-06 12:00:05 -07:00
Kconfig.hardening	security: allow using Clang's zero initialization for stack variables	2020-06-16 02:06:23 -07:00
lsm_audit.c	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-19 18:27:29 +01:00
Makefile	device_cgroup: Cleanup cgroup eBPF device filter code	2020-04-13 14:41:54 -04:00
min_addr.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
security.c	LSM: Add "contents" flag to kernel_read_file hook	2020-10-05 13:37:03 +02:00