[PATCH v2 4/4] KEYS: Enabled ima policy to measure keys added to builtin_trusted_keys keyring
From: Lakshmi Ramasubramanian <hidden>
Date: 2019-10-23 23:40:06
Also in:
keyrings, linux-integrity, lkml
Subsystem:
extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers:
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Updated ima policy handler to check if the ima policy enables measurement of keys added to the builtin_trusted_keys keyring. With this patch measurement of keys added to the builtin_trusted_keys keyring is enabled end-to-end. Signed-off-by: Lakshmi Ramasubramanian <redacted> --- security/integrity/ima/ima_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 6df7f641ff66..944636076152 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c@@ -370,7 +370,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, { int i; - if (func == KEXEC_CMDLINE) { + if ((func == KEXEC_CMDLINE) || (func == BUILTIN_TRUSTED_KEYS)) { if ((rule->flags & IMA_FUNC) && (rule->func == func)) return true; return false;
@@ -959,6 +959,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) entry->func = POLICY_CHECK; else if (strcmp(args[0].from, "KEXEC_CMDLINE") == 0) entry->func = KEXEC_CMDLINE; + else if (strcmp(args[0].from, + "BUILTIN_TRUSTED_KEYS") == 0) + entry->func = BUILTIN_TRUSTED_KEYS; else result = -EINVAL; if (!result)
--
2.17.1