Merge branch 'next-integrity.defer-measuring-keys' into next-integrity

Browse source

From patch set cover letter:

The IMA subsystem supports measuring asymmetric keys when the key is
created or updated[1]. But keys created or updated before a custom IMA
policy is loaded are currently not measured.  This includes keys added,
for instance, to either the .ima or .builtin_trusted_keys keyrings, which
happens early in the boot process.

Measuring the early boot keys, by design, requires loading a custom IMA
policy.  This change adds support for queuing keys created or updated
before a custom IMA policy is loaded.  The queued keys are processed when
a custom policy is loaded.  Keys created or updated after a custom policy
is loaded are measured immediately (not queued).  In the case when a
custom policy is not loaded within 5 minutes of IMA initialization, the
queued keys are freed.

[1] https://lore.kernel.org/linux-integrity/20191211164707.4698-1-nramas@linux.microsoft.com/

...

This commit is contained in:

Mimi Zohar 2020-01-23 17:24:35 -05:00

parent 5c7bac9fb2 5b3014b952

commit d54e17b406

7 changed files with 220 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

security/integrity/ima/Kconfig

View file

1

security/integrity/ima/Makefile

View file

24

security/integrity/ima/ima.h

View file

8

security/integrity/ima/ima_asymmetric_keys.c

View file

8

security/integrity/ima/ima_init.c

View file

3

security/integrity/ima/ima_policy.c

View file

171

security/integrity/ima/ima_queue_keys.c

View file