Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1313446
| From | Mimi Zohar <zohar@linux.vnet.ibm.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the builtinness of a key [ver #2] |
| Date | 2016-01-20 20:00 +0100 |
| Message-ID | <qT693-27H-13@gated-at.bofh.it> (permalink) |
| References | <qSCNI-78i-3@gated-at.bofh.it> <qSCNI-78i-23@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, 2016-01-19 at 11:30 +0000, David Howells wrote:
> Add KEY_ALLOC_BUILT_IN to convey that a key should have KEY_FLAG_BUILTIN
> set rather than setting it after the fact.
>
> Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
> ---
>
> certs/system_keyring.c | 4 ++--
> include/linux/key.h | 1 +
> security/keys/key.c | 2 ++
> 3 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 2570598b784d..f4180326c2e1 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -84,12 +84,12 @@ static __init int load_system_certificate_list(void)
> ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
> KEY_USR_VIEW | KEY_USR_READ),
> KEY_ALLOC_NOT_IN_QUOTA |
> - KEY_ALLOC_TRUSTED);
> + KEY_ALLOC_TRUSTED |
> + KEY_ALLOC_BUILT_IN);
> if (IS_ERR(key)) {
> pr_err("Problem loading in-kernel X.509 certificate (%ld)\n",
> PTR_ERR(key));
> } else {
> - set_bit(KEY_FLAG_BUILTIN, &key_ref_to_ptr(key)->flags);
> pr_notice("Loaded X.509 cert '%s'\n",
> key_ref_to_ptr(key)->description);
> key_ref_put(key);
> diff --git a/include/linux/key.h b/include/linux/key.h
> index 7321ab8ef949..5f5b1129dc92 100644
> --- a/include/linux/key.h
> +++ b/include/linux/key.h
> @@ -219,6 +219,7 @@ extern struct key *key_alloc(struct key_type *type,
> #define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */
> #define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */
> #define KEY_ALLOC_TRUSTED 0x0004 /* Key should be flagged as trusted */
> +#define KEY_ALLOC_BUILT_IN 0x0008 /* Key is built into kernel */
>
> extern void key_revoke(struct key *key);
> extern void key_invalidate(struct key *key);
> diff --git a/security/keys/key.c b/security/keys/key.c
> index 07a87311055c..48dbfa543bcb 100644
> --- a/security/keys/key.c
> +++ b/security/keys/key.c
> @@ -296,6 +296,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
> key->flags |= 1 << KEY_FLAG_IN_QUOTA;
> if (flags & KEY_ALLOC_TRUSTED)
> key->flags |= 1 << KEY_FLAG_TRUSTED;
> + if (flags & KEY_ALLOC_BUILT_IN)
> + key->flags |= 1 << KEY_FLAG_BUILTIN;
>
> #ifdef KEY_DEBUGGING
> key->magic = KEY_DEBUG_MAGIC;
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 10/20] X.509: Retain the key verification data [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 01/20] KEYS: Add an alloc flag to convey the builtinness of a key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
Re: [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the builtinness of a key [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100
[RFC PATCH 06/20] PKCS#7: Make trust determination dependent on contents of trust keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
Re: [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:40 +0100
[RFC PATCH 14/20] KEYS: Generalise x509_request_asymmetric_key() [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 08/20] KEYS: Allow authentication data to be stored in an asymmetric key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 15/20] KEYS: Move the point of trust determination to __key_link() [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 13/20] X.509: Move the trust validation code out to its own file [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 19/20] certs: Add a secondary system keyring that can be added to dynamically [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:40 +0100
Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:30 +0100
[RFC PATCH 11/20] X.509: Extract signature digest and make self-signed cert checks earlier [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
[RFC PATCH 09/20] KEYS: Add identifier pointers to public_key_signature struct [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-20 18:30 +0100
Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100
csiph-web