Messages in this thread Patch in this message | | | From | Dmitry Kasatkin <> | Subject | [PATCH 09/20] evm: create '_evm' as a builtin 'trusted' keyring | Date | Wed, 23 Apr 2014 16:30:27 +0300 |
| |
Require all keys added to the EVM keyring be signed by an existing trusted key on the system trusted keyring.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> --- security/integrity/evm/Kconfig | 8 ++++++++ security/integrity/evm/evm_main.c | 2 ++ 2 files changed, 10 insertions(+)
diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index df20a2f..3f9098c6 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -43,3 +43,11 @@ config EVM_EXTRA_SMACK_XATTRS additional info to the calculation, requires existing EVM labeled file systems to be relabeled. +config EVM_TRUSTED_KEYRING + bool "Require all keys on the _evm keyring be signed" + depends on EVM && SYSTEM_TRUSTED_KEYRING + select INTEGRITY_TRUSTED_KEYRING + default n + help + This option requires that all keys added to the _evm + keyring be signed by a key on the system trusted keyring. diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 4c00adb..8a11920 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -447,6 +447,8 @@ static int __init init_evm(void) evm_init_config(); + integrity_init_keyring(INTEGRITY_KEYRING_EVM); + error = evm_init_secfs(); if (error < 0) { pr_info("Error registering secfs\n"); -- 1.8.3.2
| |