diff options
| author |   Mimi Zohar <zohar@linux.vnet.ibm.com> | 2015-11-10 09:00:38 -0500 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2015-12-15 10:01:43 -0500 |
| commit | 501f1bde66525f94403a5b78832a9218ef9b1c14 (patch) | |
| tree | 545dfefd2c92a70ece125a4a0625190e97972cdf /security/integrity | |
| parent | KEYS: prevent keys from being removed from specified keyrings (diff) | |
| download | linux-dev-501f1bde66525f94403a5b78832a9218ef9b1c14.tar.xz linux-dev-501f1bde66525f94403a5b78832a9218ef9b1c14.zip | |
IMA: prevent keys on the .ima_blacklist from being removed
Set the KEY_FLAGS_KEEP on the .ima_blacklist to prevent userspace
from removing keys from the keyring.
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/integrity')
| -rw-r--r-- | security/integrity/ima/ima_mok.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c index 18e37f57f512..8dad9a2b8e47 100644 --- a/security/integrity/ima/ima_mok.c +++ b/security/integrity/ima/ima_mok.c @@ -47,7 +47,9 @@ __init int ima_mok_init(void) if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring)) panic("Can't allocate IMA MOK or blacklist keyrings."); set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags); + set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags); + set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); return 0; } |