IMA: prevent keys on the .ima_blacklist from being removed
authorMimi Zohar <zohar@linux.vnet.ibm.com>
Tue, 10 Nov 2015 14:00:38 +0000 (09:00 -0500)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Tue, 15 Dec 2015 15:01:43 +0000 (10:01 -0500)
Set the KEY_FLAGS_KEEP on the .ima_blacklist to prevent userspace
from removing keys from the keyring.

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
security/integrity/ima/ima_mok.c

index 18e37f57f5128288e4e27de0bc23c3060a993718..8dad9a2b8e4700b3ab9b7c5f9f808cd08fbea9fc 100644 (file)
@@ -47,7 +47,9 @@ __init int ima_mok_init(void)
        if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring))
                panic("Can't allocate IMA MOK or blacklist keyrings.");
        set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags);
+
        set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags);
+       set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
        return 0;
 }