Require all keys added to the EVM keyring be signed by an existing trusted key on the system trusted keyring.
Signed-off-by: Dmitry Kasatkin <[email protected]> --- security/integrity/evm/Kconfig | 8 ++++++++ security/integrity/evm/evm_main.c | 2 ++ 2 files changed, 10 insertions(+) diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index df20a2f..3f9098c6 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -43,3 +43,11 @@ config EVM_EXTRA_SMACK_XATTRS additional info to the calculation, requires existing EVM labeled file systems to be relabeled. +config EVM_TRUSTED_KEYRING + bool "Require all keys on the _evm keyring be signed" + depends on EVM && SYSTEM_TRUSTED_KEYRING + select INTEGRITY_TRUSTED_KEYRING + default n + help + This option requires that all keys added to the _evm + keyring be signed by a key on the system trusted keyring. diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 4c00adb..8a11920 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -447,6 +447,8 @@ static int __init init_evm(void) evm_init_config(); + integrity_init_keyring(INTEGRITY_KEYRING_EVM); + error = evm_init_secfs(); if (error < 0) { pr_info("Error registering secfs\n"); -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
