2021-11-16 00:21:53

by Eric Snowberg

Subject: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init

The machine keyring is setup during init. No additional keys should be
allowed to be added afterwards. Leave the permission as read only.

Signed-off-by: Eric Snowberg <[email protected]>
---
v2: Initial version
v4: Unmodified from v2
v5: Rename to machine keyring
v6: Add additional comment (suggested by Jarkko)
v7: Unmodified from v6
---
security/integrity/digsig.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 8c315be8ad99..910fe29a5037 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -140,7 +140,13 @@ int __init integrity_init_keyring(const unsigned int id)
return -ENOMEM;

restriction->check = restrict_link_to_ima;
- perm |= KEY_USR_WRITE;
+
+ /*
+ * No additional keys shall be allowed to load into the machine
+ * keyring following init
+ */
+ if (id != INTEGRITY_KEYRING_MACHINE)
+ perm |= KEY_USR_WRITE;

out:
return __integrity_init_keyring(id, perm, restriction);
--
2.18.4

2021-11-17 13:19:02

by Mimi Zohar

Subject: Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init

On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> The machine keyring is setup during init. No additional keys should be
> allowed to be added afterwards. Leave the permission as read only.
>
> Signed-off-by: Eric Snowberg <[email protected]>

Reviewed-by: Mimi Zohar <[email protected]>