diff options
| author | Eric Snowberg <eric.snowberg@oracle.com> | 2023-05-22 19:09:43 -0400 |
|---|---|---|
| committer | Jarkko Sakkinen <jarkko@kernel.org> | 2023-08-17 20:12:35 +0000 |
| commit | 90f6f691a706754e33d2d0c6fa2e1dacedb477f6 (patch) | |
| tree | 21f58a26b3370ff62708d5f18bb3b501180456fc /security/integrity/digsig.c | |
| parent | 4cfb908054456ad8b6b8cd5108bbdf80faade8cd (diff) | |
| download | linux-90f6f691a706754e33d2d0c6fa2e1dacedb477f6.tar.gz linux-90f6f691a706754e33d2d0c6fa2e1dacedb477f6.tar.bz2 linux-90f6f691a706754e33d2d0c6fa2e1dacedb477f6.zip | |
integrity: Enforce digitalSignature usage in the ima and evm keyrings
After being vouched for by a system keyring, only allow keys into the .ima
and .evm keyrings that have the digitalSignature usage field set.
Link: https://lore.kernel.org/all/41dffdaeb7eb7840f7e38bc691fbda836635c9f9.camel@linux.ibm.com
Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Acked-and-tested-by: Mimi Zohar <zohar@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Diffstat (limited to 'security/integrity/digsig.c')
| -rw-r--r-- | security/integrity/digsig.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 6f31ffe23c48..d0704b1597d4 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -34,9 +34,9 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY -#define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted +#define restrict_link_to_ima restrict_link_by_digsig_builtin_and_secondary #else -#define restrict_link_to_ima restrict_link_by_builtin_trusted +#define restrict_link_to_ima restrict_link_by_digsig_builtin #endif static struct key *integrity_keyring_from_id(const unsigned int id) |