Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security layer updates from James Morris:
 "In terms of changes, there's general maintenance to the Smack,
  SELinux, and integrity code.

  The IMA code adds a new kconfig option, IMA_APPRAISE_SIGNED_INIT,
  which allows IMA appraisal to require signatures.  Support for reading
  keys from rootfs before init is call is also added"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (23 commits)
  selinux: Remove security_ops extern
  security: smack: fix out-of-bounds access in smk_parse_smack()
  VFS: refactor vfs_read()
  ima: require signature based appraisal
  integrity: provide a hook to load keys when rootfs is ready
  ima: load x509 certificate from the kernel
  integrity: provide a function to load x509 certificate from the kernel
  integrity: define a new function integrity_read_file()
  Security: smack: replace kzalloc with kmem_cache for inode_smack
  Smack: Lock mode for the floor and hat labels
  ima: added support for new kernel cmdline parameter ima_template_fmt
  ima: allocate field pointers array on demand in template_desc_init_fields()
  ima: don't allocate a copy of template_fmt in template_desc_init_fields()
  ima: display template format in meas. list if template name length is zero
  ima: added error messages to template-related functions
  ima: use atomic bit operations to protect policy update interface
  ima: ignore empty and with whitespaces policy lines
  ima: no need to allocate entry for comment
  ima: report policy load status
  ima: use path names cache
  ...

1 files changed, 36 insertions, 2 deletions

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 8d4fbff8b87c..5e3bd72b299a 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -14,7 +14,7 @@
 
 #include <linux/err.h>
 #include <linux/sched.h>
-#include <linux/rbtree.h>
+#include <linux/slab.h>
 #include <linux/cred.h>
 #include <linux/key-type.h>
 #include <linux/digsig.h>
@@ -63,7 +63,7 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
         return -EOPNOTSUPP;
 }
 
-int integrity_init_keyring(const unsigned int id)
+int __init integrity_init_keyring(const unsigned int id)
 {
         const struct cred *cred = current_cred();
         int err = 0;
@@ -84,3 +84,37 @@ int integrity_init_keyring(const unsigned int id)
         }
         return err;
 }
+
+int __init integrity_load_x509(const unsigned int id, char *path)
+{
+        key_ref_t key;
+        char *data;
+        int rc;
+
+        if (!keyring[id])
+                return -EINVAL;
+
+        rc = integrity_read_file(path, &data);
+        if (rc < 0)
+                return rc;
+
+        key = key_create_or_update(make_key_ref(keyring[id], 1),
+                                   "asymmetric",
+                                   NULL,
+                                   data,
+                                   rc,
+                                   ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                    KEY_USR_VIEW | KEY_USR_READ),
+                                   KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_TRUSTED);
+        if (IS_ERR(key)) {
+                rc = PTR_ERR(key);
+                pr_err("Problem loading X.509 certificate (%d): %s\n",
+                       rc, path);
+        } else {
+                pr_notice("Loaded X.509 cert '%s': %s\n",
+                          key_ref_to_ptr(key)->description, path);
+                key_ref_put(key);
+        }
+        kfree(data);
+        return 0;
+}