Commit cb1aa382 authored by Lakshmi Ramasubramanian's avatar Lakshmi Ramasubramanian Committed by Mimi Zohar

KEYS: Call the IMA hook to measure keys

Call the IMA hook from key_create_or_update() function to measure
the payload when a new key is created or an existing key is updated.

This patch adds the call to the IMA hook from key_create_or_update()
function to measure the key on key create or update.
Signed-off-by: default avatarLakshmi Ramasubramanian <nramas@linux.microsoft.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: default avatarMimi Zohar <zohar@linux.ibm.com>
parent 88e70da1
...@@ -101,6 +101,20 @@ static inline void ima_add_kexec_buffer(struct kimage *image) ...@@ -101,6 +101,20 @@ static inline void ima_add_kexec_buffer(struct kimage *image)
{} {}
#endif #endif
#if defined(CONFIG_IMA) && defined(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE)
extern void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
const void *payload, size_t plen,
unsigned long flags, bool create);
#else
static inline void ima_post_key_create_or_update(struct key *keyring,
struct key *key,
const void *payload,
size_t plen,
unsigned long flags,
bool create) {}
#endif /* CONFIG_IMA && CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE */
#ifdef CONFIG_IMA_APPRAISE #ifdef CONFIG_IMA_APPRAISE
extern bool is_ima_appraise_enabled(void); extern bool is_ima_appraise_enabled(void);
extern void ima_inode_post_setattr(struct dentry *dentry); extern void ima_inode_post_setattr(struct dentry *dentry);
......
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
#include <linux/security.h> #include <linux/security.h>
#include <linux/workqueue.h> #include <linux/workqueue.h>
#include <linux/random.h> #include <linux/random.h>
#include <linux/ima.h>
#include <linux/err.h> #include <linux/err.h>
#include "internal.h" #include "internal.h"
...@@ -936,6 +937,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, ...@@ -936,6 +937,9 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
goto error_link_end; goto error_link_end;
} }
ima_post_key_create_or_update(keyring, key, payload, plen,
flags, true);
key_ref = make_key_ref(key, is_key_possessed(keyring_ref)); key_ref = make_key_ref(key, is_key_possessed(keyring_ref));
error_link_end: error_link_end:
...@@ -965,6 +969,12 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, ...@@ -965,6 +969,12 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
} }
key_ref = __key_update(key_ref, &prep); key_ref = __key_update(key_ref, &prep);
if (!IS_ERR(key_ref))
ima_post_key_create_or_update(keyring, key,
payload, plen,
flags, false);
goto error_free_prep; goto error_free_prep;
} }
EXPORT_SYMBOL(key_create_or_update); EXPORT_SYMBOL(key_create_or_update);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment