1 /* 2 * Copyright (C) 2015 Juniper Networks, Inc. 3 * 4 * Author: 5 * Petko Manolov <petko.manolov@konsulko.com> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation, version 2 of the 10 * License. 11 * 12 */ 13 14 #include <linux/export.h> 15 #include <linux/kernel.h> 16 #include <linux/sched.h> 17 #include <linux/cred.h> 18 #include <linux/err.h> 19 #include <linux/init.h> 20 #include <keys/asymmetric-type.h> 21 22 23 struct key *ima_mok_keyring; 24 struct key *ima_blacklist_keyring; 25 26 /* 27 * Allocate the IMA MOK and blacklist keyrings 28 */ 29 __init int ima_mok_init(void) 30 { 31 pr_notice("Allocating IMA MOK and blacklist keyrings.\n"); 32 33 ima_mok_keyring = keyring_alloc(".ima_mok", 34 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 35 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 36 KEY_USR_VIEW | KEY_USR_READ | 37 KEY_USR_WRITE | KEY_USR_SEARCH, 38 KEY_ALLOC_NOT_IN_QUOTA, NULL); 39 40 ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 41 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 42 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 43 KEY_USR_VIEW | KEY_USR_READ | 44 KEY_USR_WRITE | KEY_USR_SEARCH, 45 KEY_ALLOC_NOT_IN_QUOTA, NULL); 46 47 if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring)) 48 panic("Can't allocate IMA MOK or blacklist keyrings."); 49 set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags); 50 51 set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags); 52 set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); 53 return 0; 54 } 55 device_initcall(ima_mok_init); 56