Difference since v5 of the patches:
- better description of patch #3;
- added missing IMA_DIGSIG_REQUIRED & IMA_PERMIT_DIRECTIO flags;
This patch-set consists of three separate patches that do the following:
1) Allows multiple writes to the IMA policy. This is considered useful to do in
a long lived systems with multiple tenants and where reboots are not
recommended. The new IMA rules are appended to the existing ones, effectively
forming a queue. The code also replaces the mutexes with RCU read locks.
2) Adds two more system keyrings - .ima_mok, which is used to create a simple CA
hierarchy for the trusted IMA keyring and .ima_blacklist, which keeps all
revoked IMA keys. When the IMA_TRUSTED_KEYRING is enabled it is impossible to
import a key into .ima if it has not been signed by a key in either .system or
.ima_mok keyrings. Before performing signature checks .ima_blacklist is
consulted first and if an offending key is found the requested operation is
rejected.
3) Allows reading back the current IMA policy.It is often useful to be able to
read back the IMA policy. It is even more important after introducing
CONFIG_IMA_WRITE_POLICY. This option allows the root user to see the current
policy rules.
Petko Manolov (3):
IMA policy can now be updated multiple times.
Create IMA machine owner and blacklist keyrings;
Allows reading back the current IMA policy.
crypto/asymmetric_keys/x509_public_key.c | 2 +
include/keys/system_keyring.h| 24 +++
security/integrity/digsig_asymmetric.c | 14 ++
security/integrity/ima/Kconfig | 39 +
security/integrity/ima/Makefile | 1 +
security/integrity/ima/ima.h | 15 +-
security/integrity/ima/ima_fs.c | 42 -
security/integrity/ima/ima_mok.c | 54 ++
security/integrity/ima/ima_policy.c | 286 +++
9 files changed, 441 insertions(+), 36 deletions(-)
create mode 100644 security/integrity/ima/ima_mok.c
--
2.6.2
--
To unsubscribe from this list: send the line "unsubscribe
linux-security-module" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
