[PATCH RFC v2 11/12] integrity: Do not allow mok keyring updates following init
From: Eric Snowberg <eric.snowberg@oracle.com>
Date: 2021-07-26 17:15:30
Also in:
keyrings, linux-integrity, linux-security-module, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
The mok keyring is setup during init. No additional keys should be allowed to be added afterwards. Leave the permission as read only. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> --- v2: Initial version --- security/integrity/digsig.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index be4860c596b9..3a12cc85b528 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c@@ -145,7 +145,8 @@ int __init integrity_init_keyring(const unsigned int id) else restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + if (id != INTEGRITY_KEYRING_MOK) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction);
--
2.18.4