path: root/include/keys
diff options
authorDavid Howells <>2016-04-07 09:45:23 +0100
committerDavid Howells <>2016-04-11 22:49:15 +0100
commit56104cf2b8d20eed32c14eac8ac574c35377ab38 (patch)
tree7fc12f22e49f9b799c998245f226906db293255e /include/keys
parentd3bfe84129f65e0af2450743ebdab33d161d01c9 (diff)
IMA: Use the the system trusted keyrings instead of .ima_mok
Add a config option (IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY) that, when enabled, allows keys to be added to the IMA keyrings by userspace - with the restriction that each must be signed by a key in the system trusted keyrings. EPERM will be returned if this option is disabled, ENOKEY will be returned if no authoritative key can be found and EKEYREJECTED will be returned if the signature doesn't match. Other errors such as ENOPKG may also be returned. If this new option is enabled, the builtin system keyring is searched, as is the secondary system keyring if that is also enabled. Intermediate keys between the builtin system keyring and the key being added can be added to the secondary keyring (which replaces .ima_mok) to form a trust chain - provided they are also validly signed by a key in one of the trusted keyrings. The .ima_mok keyring is then removed and the IMA blacklist keyring gets its own config option (IMA_BLACKLIST_KEYRING). Signed-off-by: David Howells <> Signed-off-by: Mimi Zohar <>
Diffstat (limited to 'include/keys')
1 files changed, 2 insertions, 11 deletions
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 614424029de7..fbd4647767e9 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -33,28 +33,19 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
#define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
-extern struct key *ima_mok_keyring;
extern struct key *ima_blacklist_keyring;
-static inline struct key *get_ima_mok_keyring(void)
- return ima_mok_keyring;
static inline struct key *get_ima_blacklist_keyring(void)
return ima_blacklist_keyring;
-static inline struct key *get_ima_mok_keyring(void)
- return NULL;
static inline struct key *get_ima_blacklist_keyring(void)
return NULL;