Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1304896
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [RFC PATCH 05/15] KEYS: Add an alloc flag to convey the builtinness of a key |
| Date | 2016-01-08 19:40 +0100 |
| Message-ID | <qOK7b-2eA-79@gated-at.bofh.it> (permalink) |
| References | <qOK78-2eA-21@gated-at.bofh.it> |
| Organization | Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 |
Add KEY_ALLOC_BUILT_IN to convey that a key should have KEY_FLAG_BUILTIN
set rather than setting it after the fact.
Signed-off-by: David Howells <dhowells@redhat.com>
---
certs/system_keyring.c | 4 ++--
include/linux/key.h | 1 +
security/keys/key.c | 2 ++
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index e7f286413276..dc18869ff680 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -84,12 +84,12 @@ static __init int load_system_certificate_list(void)
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ),
KEY_ALLOC_NOT_IN_QUOTA |
- KEY_ALLOC_TRUSTED);
+ KEY_ALLOC_TRUSTED |
+ KEY_ALLOC_BUILT_IN);
if (IS_ERR(key)) {
pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
PTR_ERR(key));
} else {
- set_bit(KEY_FLAG_BUILTIN, &key_ref_to_ptr(key)->flags);
pr_notice("Loaded X.509 cert '%s'\n",
key_ref_to_ptr(key)->description);
key_ref_put(key);
diff --git a/include/linux/key.h b/include/linux/key.h
index 7321ab8ef949..5f5b1129dc92 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -219,6 +219,7 @@ extern struct key *key_alloc(struct key_type *type,
#define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */
#define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */
#define KEY_ALLOC_TRUSTED 0x0004 /* Key should be flagged as trusted */
+#define KEY_ALLOC_BUILT_IN 0x0008 /* Key is built into kernel */
extern void key_revoke(struct key *key);
extern void key_invalidate(struct key *key);
diff --git a/security/keys/key.c b/security/keys/key.c
index 09ef276c4bdc..b28755131687 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -296,6 +296,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
key->flags |= 1 << KEY_FLAG_IN_QUOTA;
if (flags & KEY_ALLOC_TRUSTED)
key->flags |= 1 << KEY_FLAG_TRUSTED;
+ if (flags & KEY_ALLOC_BUILT_IN)
+ key->flags |= 1 << KEY_FLAG_BUILTIN;
#ifdef KEY_DEBUGGING
key->magic = KEY_DEBUG_MAGIC;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 10/15] X.509: Extract signature digest and make self-signed cert checks earlier David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 03/15] KEYS: Generalise system_verify_data() to provide access to internal content David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 05/15] KEYS: Add an alloc flag to convey the builtinness of a key David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 12/15] X.509: Move the trust validation code out to its own file David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 11/15] PKCS#7: Make the signature a pointer rather than embedding it David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 01/15] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 06/15] KEYS: Add a facility to restrict new links into a keyring David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 02/15] X.509: Don't treat self-signed keys specially David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
[RFC PATCH 07/15] KEYS: Allow authentication data to be stored in an asymmetric key David Howells <dhowells@redhat.com> - 2016-01-08 19:40 +0100
Re: [RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-08 20:00 +0100
Re: [RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-08 20:30 +0100
Re: [RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings David Howells <dhowells@redhat.com> - 2016-01-12 01:40 +0100
Re: [RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 03:50 +0100
Re: [RFC PATCH 00/15] KEYS: Restrict additions to 'trusted' keyrings David Howells <dhowells@redhat.com> - 2016-01-12 01:40 +0100
csiph-web