Merge tag 'keys-next-20160505' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into next

5 files changed, 42 insertions, 35 deletions

diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
index 979be65d22c4..da9565891738 100644
--- a/security/integrity/Kconfig
+++ b/security/integrity/Kconfig
@@ -35,7 +35,6 @@ config INTEGRITY_ASYMMETRIC_KEYS
         default n
         select ASYMMETRIC_KEY_TYPE
         select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-        select PUBLIC_KEY_ALGO_RSA
         select CRYPTO_RSA
         select X509_CERTIFICATE_PARSER
         help
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 8ef15118cc78..4304372b323f 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -18,6 +18,8 @@
 #include <linux/cred.h>
 #include <linux/key-type.h>
 #include <linux/digsig.h>
+#include <crypto/public_key.h>
+#include <keys/system_keyring.h>
 
 #include "integrity.h"
 
@@ -40,6 +42,12 @@ static bool init_keyring __initdata = true;
 static bool init_keyring __initdata;
 #endif
 
+#ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
+#define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
+#else
+#define restrict_link_to_ima restrict_link_by_builtin_trusted
+#endif
+
 int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
                             const char *digest, int digestlen)
 {
@@ -83,10 +91,9 @@ int __init integrity_init_keyring(const unsigned int id)
                                     ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                      KEY_USR_VIEW | KEY_USR_READ |
                                      KEY_USR_WRITE | KEY_USR_SEARCH),
-                                    KEY_ALLOC_NOT_IN_QUOTA, NULL);
-        if (!IS_ERR(keyring[id]))
-                set_bit(KEY_FLAG_TRUSTED_ONLY, &keyring[id]->flags);
-        else {
+                                    KEY_ALLOC_NOT_IN_QUOTA,
+                                    restrict_link_to_ima, NULL);
+        if (IS_ERR(keyring[id])) {
                 err = PTR_ERR(keyring[id]);
                 pr_info("Can't allocate %s keyring (%d)\n",
                         keyring_name[id], err);
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index e54a8a8dae94..5487827fa86c 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -155,23 +155,33 @@ config IMA_TRUSTED_KEYRING
 
            This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING
 
-config IMA_MOK_KEYRING
-        bool "Create IMA machine owner keys (MOK) and blacklist keyrings"
+config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
+        bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)"
+        depends on SYSTEM_TRUSTED_KEYRING
+        depends on SECONDARY_TRUSTED_KEYRING
+        depends on INTEGRITY_ASYMMETRIC_KEYS
+        select INTEGRITY_TRUSTED_KEYRING
+        default n
+        help
+          Keys may be added to the IMA or IMA blacklist keyrings, if the
+          key is validly signed by a CA cert in the system built-in or
+          secondary trusted keyrings.
+
+          Intermediate keys between those the kernel has compiled in and the
+          IMA keys to be added may be added to the system secondary keyring,
+          provided they are validly signed by a key already resident in the
+          built-in or secondary trusted keyrings.
+
+config IMA_BLACKLIST_KEYRING
+        bool "Create IMA machine owner blacklist keyrings (EXPERIMENTAL)"
         depends on SYSTEM_TRUSTED_KEYRING
         depends on IMA_TRUSTED_KEYRING
         default n
         help
-           This option creates IMA MOK and blacklist keyrings.  IMA MOK is an
-           intermediate keyring that sits between .system and .ima keyrings,
-           effectively forming a simple CA hierarchy.  To successfully import a
-           key into .ima_mok it must be signed by a key which CA is in .system
-           keyring.  On turn any key that needs to go in .ima keyring must be
-           signed by CA in either .system or .ima_mok keyrings. IMA MOK is empty
-           at kernel boot.
-
-           IMA blacklist keyring contains all revoked IMA keys.  It is consulted
-           before any other keyring.  If the search is successful the requested
-           operation is rejected and error is returned to the caller.
+           This option creates an IMA blacklist keyring, which contains all
+           revoked IMA keys.  It is consulted before any other keyring.  If
+           the search is successful the requested operation is rejected and
+           an error is returned to the caller.
 
 config IMA_LOAD_X509
         bool "Load X509 certificate onto the '.ima' trusted keyring"
diff --git a/security/integrity/ima/Makefile b/security/integrity/ima/Makefile
index a8539f9e060f..9aeaedad1e2b 100644
--- a/security/integrity/ima/Makefile
+++ b/security/integrity/ima/Makefile
@@ -8,4 +8,4 @@ obj-$(CONFIG_IMA) += ima.o
 ima-y := ima_fs.o ima_queue.o ima_init.o ima_main.o ima_crypto.o ima_api.o \
          ima_policy.o ima_template.o ima_template_lib.o
 ima-$(CONFIG_IMA_APPRAISE) += ima_appraise.o
-obj-$(CONFIG_IMA_MOK_KEYRING) += ima_mok.o
+obj-$(CONFIG_IMA_BLACKLIST_KEYRING) += ima_mok.o
diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
index 676885e4320e..74a279957464 100644
--- a/security/integrity/ima/ima_mok.c
+++ b/security/integrity/ima/ima_mok.c
@@ -17,38 +17,29 @@
 #include <linux/cred.h>
 #include <linux/err.h>
 #include <linux/init.h>
-#include <keys/asymmetric-type.h>
+#include <keys/system_keyring.h>
 
 
-struct key *ima_mok_keyring;
 struct key *ima_blacklist_keyring;
 
 /*
- * Allocate the IMA MOK and blacklist keyrings
+ * Allocate the IMA blacklist keyring
  */
 __init int ima_mok_init(void)
 {
-        pr_notice("Allocating IMA MOK and blacklist keyrings.\n");
-
-        ima_mok_keyring = keyring_alloc(".ima_mok",
-                              KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
-                              (KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                              KEY_USR_VIEW | KEY_USR_READ |
-                              KEY_USR_WRITE | KEY_USR_SEARCH,
-                              KEY_ALLOC_NOT_IN_QUOTA, NULL);
+        pr_notice("Allocating IMA blacklist keyring.\n");
 
         ima_blacklist_keyring = keyring_alloc(".ima_blacklist",
                                 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
                                 (KEY_POS_ALL & ~KEY_POS_SETATTR) |
                                 KEY_USR_VIEW | KEY_USR_READ |
                                 KEY_USR_WRITE | KEY_USR_SEARCH,
-                                KEY_ALLOC_NOT_IN_QUOTA, NULL);
+                                KEY_ALLOC_NOT_IN_QUOTA,
+                                restrict_link_by_builtin_trusted, NULL);
 
-        if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring))
-                panic("Can't allocate IMA MOK or blacklist keyrings.");
-        set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags);
+        if (IS_ERR(ima_blacklist_keyring))
+                panic("Can't allocate IMA blacklist keyring.");
 
-        set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags);
         set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
         return 0;
 }