Merge tag 'keys-next-20160303' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next

5 files changed, 12 insertions, 25 deletions

diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index 21d756832b75..979be65d22c4 100644
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -36,6 +36,7 @@ config INTEGRITY_ASYMMETRIC_KEYS
         select ASYMMETRIC_KEY_TYPE
         select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
         select PUBLIC_KEY_ALGO_RSA
+        select CRYPTO_RSA
         select X509_CERTIFICATE_PARSER
         help
           This option enables digital signature verification using
@@ -45,7 +46,6 @@ config INTEGRITY_TRUSTED_KEYRING
         bool "Require all keys on the integrity keyrings be signed"
         depends on SYSTEM_TRUSTED_KEYRING
         depends on INTEGRITY_ASYMMETRIC_KEYS
-        select KEYS_DEBUG_PROC_KEYS
         default y
         help
            This option requires that all keys added to the .ima and
diff --git a/security/integrity/digsig_asymmetric.c b/security/integrity/digsig_asymmetric.c
index 5ade2a7517a6..80052ed8d467 100644
--- a/security/integrity/digsig_asymmetric.c
+++ b/security/integrity/digsig_asymmetric.c
@@ -16,6 +16,7 @@
 #include <linux/ratelimit.h>
 #include <linux/key-type.h>
 #include <crypto/public_key.h>
+#include <crypto/hash_info.h>
 #include <keys/asymmetric-type.h>
 #include <keys/system_keyring.h>
 
@@ -94,7 +95,7 @@ int asymmetric_verify(struct key *keyring, const char *sig,
         if (siglen != __be16_to_cpu(hdr->sig_size))
                 return -EBADMSG;
 
-        if (hdr->hash_algo >= PKEY_HASH__LAST)
+        if (hdr->hash_algo >= HASH_ALGO__LAST)
                 return -ENOPKG;
 
         key = request_asymmetric_key(keyring, __be32_to_cpu(hdr->keyid));
@@ -103,16 +104,13 @@ int asymmetric_verify(struct key *keyring, const char *sig,
 
         memset(&pks, 0, sizeof(pks));
 
-        pks.pkey_hash_algo = hdr->hash_algo;
+        pks.pkey_algo = "rsa";
+        pks.hash_algo = hash_algo_name[hdr->hash_algo];
         pks.digest = (u8 *)data;
         pks.digest_size = datalen;
-        pks.nr_mpi = 1;
-        pks.rsa.s = mpi_read_raw_data(hdr->sig, siglen);
-
-        if (pks.rsa.s)
-                ret = verify_signature(key, &pks);
-
-        mpi_free(pks.rsa.s);
+        pks.s = hdr->sig;
+        pks.s_size = siglen;
+        ret = verify_signature(key, &pks);
         key_put(key);
         pr_debug("%s() = %d\n", __func__, ret);
         return ret;
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index c7a111cc7d89..e08935cf343f 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -90,7 +90,7 @@ struct ima_digest_data {
 struct signature_v2_hdr {
         uint8_t type;           /* xattr type */
         uint8_t version;        /* signature format version */
-        uint8_t hash_algo;      /* Digest algorithm [enum pkey_hash_algo] */
+        uint8_t hash_algo;      /* Digest algorithm [enum hash_algo] */
         uint32_t keyid;         /* IMA key identifier - not X509/PGP specific */
         uint16_t sig_size;      /* signature size */
         uint8_t sig[0];         /* signature payload */
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 907c1522ee46..c721e398893a 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -9,7 +9,6 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/seq_file.h>
 #include <linux/file.h>
@@ -18,8 +17,6 @@
 #include <keys/user-type.h>
 #include <keys/big_key-type.h>
 
-MODULE_LICENSE("GPL");
-
 /*
  * Layout of key payload words.
  */
@@ -212,18 +209,8 @@ long big_key_read(const struct key *key, char __user *buffer, size_t buflen)
         return ret;
 }
 
-/*
- * Module stuff
- */
 static int __init big_key_init(void)
 {
         return register_key_type(&key_type_big_key);
 }
-
-static void __exit big_key_cleanup(void)
-{
-        unregister_key_type(&key_type_big_key);
-}
-
-module_init(big_key_init);
-module_exit(big_key_cleanup);
+device_initcall(big_key_init);
diff --git a/security/keys/key.c b/security/keys/key.c
index 09ef276c4bdc..b28755131687 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -296,6 +296,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
                 key->flags |= 1 << KEY_FLAG_IN_QUOTA;
         if (flags & KEY_ALLOC_TRUSTED)
                 key->flags |= 1 << KEY_FLAG_TRUSTED;
+        if (flags & KEY_ALLOC_BUILT_IN)
+                key->flags |= 1 << KEY_FLAG_BUILTIN;
 
 #ifdef KEY_DEBUGGING
         key->magic = KEY_DEBUG_MAGIC;