Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2015 Juniper Networks, Inc. |
| 3 | * |
| 4 | * Author: |
| 5 | * Petko Manolov <petko.manolov@konsulko.com> |
| 6 | * |
| 7 | * This program is free software; you can redistribute it and/or |
| 8 | * modify it under the terms of the GNU General Public License as |
| 9 | * published by the Free Software Foundation, version 2 of the |
| 10 | * License. |
| 11 | * |
| 12 | */ |
| 13 | |
| 14 | #include <linux/export.h> |
| 15 | #include <linux/kernel.h> |
| 16 | #include <linux/sched.h> |
| 17 | #include <linux/cred.h> |
| 18 | #include <linux/err.h> |
Paul Gortmaker | 92cc916 | 2015-12-09 17:37:16 -0500 | [diff] [blame] | 19 | #include <linux/init.h> |
David Howells | a511e1a | 2016-04-06 16:14:26 +0100 | [diff] [blame] | 20 | #include <keys/system_keyring.h> |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 21 | |
| 22 | |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 23 | struct key *ima_blacklist_keyring; |
| 24 | |
| 25 | /* |
David Howells | 56104cf | 2016-04-07 09:45:23 +0100 | [diff] [blame] | 26 | * Allocate the IMA blacklist keyring |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 27 | */ |
| 28 | __init int ima_mok_init(void) |
| 29 | { |
David Howells | 56104cf | 2016-04-07 09:45:23 +0100 | [diff] [blame] | 30 | pr_notice("Allocating IMA blacklist keyring.\n"); |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 31 | |
| 32 | ima_blacklist_keyring = keyring_alloc(".ima_blacklist", |
| 33 | KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), |
| 34 | (KEY_POS_ALL & ~KEY_POS_SETATTR) | |
| 35 | KEY_USR_VIEW | KEY_USR_READ | |
| 36 | KEY_USR_WRITE | KEY_USR_SEARCH, |
David Howells | 5ac7eac | 2016-04-06 16:14:24 +0100 | [diff] [blame] | 37 | KEY_ALLOC_NOT_IN_QUOTA, |
David Howells | a511e1a | 2016-04-06 16:14:26 +0100 | [diff] [blame] | 38 | restrict_link_by_builtin_trusted, NULL); |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 39 | |
David Howells | 56104cf | 2016-04-07 09:45:23 +0100 | [diff] [blame] | 40 | if (IS_ERR(ima_blacklist_keyring)) |
| 41 | panic("Can't allocate IMA blacklist keyring."); |
Mimi Zohar | 501f1bd | 2015-11-10 09:00:38 -0500 | [diff] [blame] | 42 | |
Mimi Zohar | 501f1bd | 2015-11-10 09:00:38 -0500 | [diff] [blame] | 43 | set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); |
Petko Manolov | 41c89b6 | 2015-12-02 17:47:55 +0200 | [diff] [blame] | 44 | return 0; |
| 45 | } |
Paul Gortmaker | 92cc916 | 2015-12-09 17:37:16 -0500 | [diff] [blame] | 46 | device_initcall(ima_mok_init); |