Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932318Ab2HPTKc (ORCPT ); Thu, 16 Aug 2012 15:10:32 -0400 Received: from e7.ny.us.ibm.com ([32.97.182.137]:50020 "EHLO e7.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932107Ab2HPTK2 (ORCPT ); Thu, 16 Aug 2012 15:10:28 -0400 Message-ID: <1345144127.3402.2.camel@falcor.watson.ibm.com> Subject: Re: [RFC v2 2/7] keys: initialize root uid and session keyrings early From: Mimi Zohar To: Josh Boyer Cc: Dmitry Kasatkin , jmorris@namei.org, rusty@rustcorp.com.au, dhowells@redhat.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Mimi Zohar Date: Thu, 16 Aug 2012 15:08:47 -0400 In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.3 (3.2.3-3.fc16) Content-Transfer-Encoding: 7bit Mime-Version: 1.0 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12081619-5806-0000-0000-00001877DE95 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2166 Lines: 67 On Thu, 2012-08-16 at 14:26 -0400, Josh Boyer wrote: > On Wed, Aug 15, 2012 at 2:43 PM, Dmitry Kasatkin > wrote: > > From: Mimi Zohar > > > > In order to create the integrity keyrings (eg. _evm, _ima, _modules), > > root's uid and session keyrings need to be initialized early. > > > > Signed-off-by: Mimi Zohar > > --- > > security/keys/Makefile | 1 + > > security/keys/root_keyring.c | 18 ++++++++++++++++++ > > 2 files changed, 19 insertions(+) > > create mode 100644 security/keys/root_keyring.c > > > > diff --git a/security/keys/Makefile b/security/keys/Makefile > > index 504aaa0..c93ce8d 100644 > > --- a/security/keys/Makefile > > +++ b/security/keys/Makefile > > @@ -18,6 +18,7 @@ obj-y := \ > > obj-$(CONFIG_KEYS_COMPAT) += compat.o > > obj-$(CONFIG_PROC_FS) += proc.o > > obj-$(CONFIG_SYSCTL) += sysctl.o > > +obj-$(CONFIG_INTEGRITY_SIGNATURE) += root_keyring.o > > > > # > > # Key types > > diff --git a/security/keys/root_keyring.c b/security/keys/root_keyring.c > > new file mode 100644 > > index 0000000..f6662eb > > --- /dev/null > > +++ b/security/keys/root_keyring.c > > @@ -0,0 +1,18 @@ > > +/* > > + * Copyright (C) 2012 IBM Corporation > > + * > > + * Author: > > + * Mimi Zohar > > + * > > + * This program is free software; you can redistribute it and/or modify > > + * it under the terms of the GNU General Public License as published by > > + * the Free Software Foundation, version 2 of the License. > > + */ > > + > > +#include "internal.h" > > +static int __init init_root_keyring(void) > > +{ > > + return install_user_keyrings(); > > +} > > + > > +late_initcall(init_root_keyring); > > -- > > Why is this in an entirely new file instead of just being added to > process_keys.c ? > > josh Only when "CONFIG_INTEGRITY_SIGNATURE" is selected, does this get built. Mimi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/