From cb1aa3823c9280f2bb8218cdb5cb05721e0376b1 Mon Sep 17 00:00:00 2001 From: Lakshmi Ramasubramanian Date: Wed, 11 Dec 2019 08:47:05 -0800 Subject: KEYS: Call the IMA hook to measure keys Call the IMA hook from key_create_or_update() function to measure the payload when a new key is created or an existing key is updated. This patch adds the call to the IMA hook from key_create_or_update() function to measure the key on key create or update. Signed-off-by: Lakshmi Ramasubramanian Cc: David Howells Cc: Jarkko Sakkinen Signed-off-by: Mimi Zohar --- security/keys/key.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'security/keys') diff --git a/security/keys/key.c b/security/keys/key.c index 764f4c57913e..718bf7217420 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include "internal.h" @@ -936,6 +937,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, goto error_link_end; } + ima_post_key_create_or_update(keyring, key, payload, plen, + flags, true); + key_ref = make_key_ref(key, is_key_possessed(keyring_ref)); error_link_end: @@ -965,6 +969,12 @@ error: } key_ref = __key_update(key_ref, &prep); + + if (!IS_ERR(key_ref)) + ima_post_key_create_or_update(keyring, key, + payload, plen, + flags, false); + goto error_free_prep; } EXPORT_SYMBOL(key_create_or_update); -- cgit v1.2.3-59-g8ed1b