diff options
| author | Mimi Zohar <zohar@linux.ibm.com> | 2020-01-23 17:24:35 -0500 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.ibm.com> | 2020-01-23 17:24:35 -0500 |
| commit | d54e17b4066612d88c4ef3e5fb3115f12733763d (patch) | |
| tree | 3290001b6ae913d289b6eedb60f59acce50d64bf /security/integrity/ima/ima_asymmetric_keys.c | |
| parent | 5c7bac9fb2c5929a3b8600c45a972aabf9f410b5 (diff) | |
| parent | 5b3014b95272a432b7705142f7081967fc1547f9 (diff) | |
Merge branch 'next-integrity.defer-measuring-keys' into next-integrity
From patch set cover letter:
The IMA subsystem supports measuring asymmetric keys when the key is
created or updated[1]. But keys created or updated before a custom IMA
policy is loaded are currently not measured. This includes keys added,
for instance, to either the .ima or .builtin_trusted_keys keyrings, which
happens early in the boot process.
Measuring the early boot keys, by design, requires loading a custom IMA
policy. This change adds support for queuing keys created or updated
before a custom IMA policy is loaded. The queued keys are processed when
a custom policy is loaded. Keys created or updated after a custom policy
is loaded are measured immediately (not queued). In the case when a
custom policy is not loaded within 5 minutes of IMA initialization, the
queued keys are freed.
[1] https://lore.kernel.org/linux-integrity/20191211164707.4698-1-nramas@linux.microsoft.com/
Diffstat (limited to 'security/integrity/ima/ima_asymmetric_keys.c')
| -rw-r--r-- | security/integrity/ima/ima_asymmetric_keys.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_asymmetric_keys.c b/security/integrity/ima/ima_asymmetric_keys.c index fea2e7dd3b09..7678f0e3e84d 100644 --- a/security/integrity/ima/ima_asymmetric_keys.c +++ b/security/integrity/ima/ima_asymmetric_keys.c @@ -30,6 +30,8 @@ void ima_post_key_create_or_update(struct key *keyring, struct key *key, const void *payload, size_t payload_len, unsigned long flags, bool create) { + bool queued = false; + /* Only asymmetric keys are handled by this hook. */ if (key->type != &key_type_asymmetric) return; @@ -37,6 +39,12 @@ void ima_post_key_create_or_update(struct key *keyring, struct key *key, if (!payload || (payload_len == 0)) return; + if (ima_should_queue_key()) + queued = ima_queue_key(keyring, payload, payload_len); + + if (queued) + return; + /* * keyring->description points to the name of the keyring * (such as ".builtin_trusted_keys", ".ima", etc.) to |