tree 714a6be7606cb6646c7b182bae136ef26bc9692e
parent 4a420896f12d2d043602f134ae18ad6be5b9d9dd
author Mat Martineau <mathew.j.martineau@linux.intel.com> 1488415449 -0800
committer Mat Martineau <mathew.j.martineau@linux.intel.com> 1491340212 -0700

KEYS: Add KEYCTL_RESTRICT_KEYRING

Keyrings recently gained restrict_link capabilities that allow
individual keys to be validated prior to linking.  This functionality
was only available using internal kernel APIs.

With the KEYCTL_RESTRICT_KEYRING command existing keyrings can be
configured to check the content of keys before they are linked, and
then allow or disallow linkage of that key to the keyring.

To restrict a keyring, call:

  keyctl(KEYCTL_RESTRICT_KEYRING, key_serial_t keyring, const char *type,
         const char *restriction)

where 'type' is the name of a registered key type and 'restriction' is a
string describing how key linkage is to be restricted. The restriction
option syntax is specific to each key type.

Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>