Hi James,

Lots of changes this time.  This pull request adds support, by Dmitry
Kasatkin, for: making the EVM keyring a trusted keyring, such that only
keys signed by a key on the system keyring can be loaded onto the EVM
keyring, loading the EVM keys onto the EVM trusted keyring by the
kernel, enabling EVM when either the x509 or symmetric keys are
available and loading the EVM symmetric key from hardware.

As described by Mark Baushke and Petko Manalov at LSS 2015 in their talk
"IMA/EVM: Real Applications for Embedded Networking Systems", this pull
request includes support for two new IMA trusted keyrings named .ima_mok
and .ima_blacklist.  Keys being loaded on either the EVM or IMA trusted
keyrings can be validated against either the system trusted keyring or
the intermediary .ima_mok keyring and prevented from being loaded if on
the .ima_blacklist keyring.

Lastly, support for extending and displaying the IMA policy.



The following changes since commit ebd68df3f24b318d391d15c458d6f43f340ba36a:

  Sync to Linus v4.4-rc2 for LSM developers. (2015-11-23 22:46:28 +1100)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity.git next

for you to fetch changes up to 92cc916638a48f285736cd5541536e2e1b73ecf8:

  security/integrity: make ima/ima_mok.c explicitly non-modular (2015-12-15 
10:01:43 -0500)

Arnd Bergmann (1):
      evm: EVM_LOAD_X509 depends on EVM

Dmitry Kasatkin (5):
      integrity: define '.evm' as a builtin 'trusted' keyring
      evm: load an x509 certificate from the kernel
      evm: enable EVM when X509 certificate is loaded
      evm: provide a function to set the EVM key from the kernel
      evm: reset EVM status when file attributes change

Mimi Zohar (3):
      KEYS: prevent keys from being removed from specified keyrings
      IMA: prevent keys on the .ima_blacklist from being removed
      ima: update appraise flags after policy update completes

Paul Gortmaker (1):
      security/integrity: make ima/ima_mok.c explicitly non-modular

Petko Manolov (3):
      IMA: policy can now be updated multiple times
      IMA: create machine owner and blacklist keyrings
      IMA: allow reading back the current IMA policy

 crypto/asymmetric_keys/x509_public_key.c |   2 +
 include/keys/system_keyring.h            |  24 +++
 include/linux/evm.h                      |   7 +
 include/linux/key.h                      |   1 +
 security/integrity/Kconfig               |  11 ++
 security/integrity/digsig.c              |  14 +-
 security/integrity/digsig_asymmetric.c   |  14 ++
 security/integrity/evm/Kconfig           |  17 ++
 security/integrity/evm/evm.h             |   3 +
 security/integrity/evm/evm_crypto.c      |  54 +++++-
 security/integrity/evm/evm_main.c        |  32 +++-
 security/integrity/evm/evm_secfs.c       |  12 +-
 security/integrity/iint.c                |   1 +
 security/integrity/ima/Kconfig           |  44 ++++-
 security/integrity/ima/Makefile          |   1 +
 security/integrity/ima/ima.h             |  23 ++-
 security/integrity/ima/ima_fs.c          |  42 ++++-
 security/integrity/ima/ima_init.c        |   2 +-
 security/integrity/ima/ima_mok.c         |  55 ++++++
 security/integrity/ima/ima_policy.c      | 293 +++++++++++++++++++++++++++----
 security/integrity/integrity.h           |  13 +-
 security/keys/key.c                      |   6 +-
 security/keys/keyctl.c                   |  56 ++++--
 23 files changed, 643 insertions(+), 84 deletions(-)
 create mode 100644 security/integrity/ima/ima_mok.c

To unsubscribe from this list: send the line "unsubscribe 
linux-security-module" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to