summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMimi Zohar <zohar@linux.vnet.ibm.com>2015-11-10 09:00:38 -0500
committerOleksandr Suvorov <oleksandr.suvorov@toradex.com>2020-05-25 13:57:21 +0300
commitcfb7de7f8fbcb7f274453d06387e857ac5590f6d (patch)
tree8493d0706a1dbf00b9dfff92007051dec72ef0bd
parent4e55d7920b094ef7966b38fdfebb5dd30ca5eeec (diff)
IMA: prevent keys on the .ima_blacklist from being removed
commit 501f1bde66525f94403a5b78832a9218ef9b1c14 upstream Set the KEY_FLAGS_KEEP on the .ima_blacklist to prevent userspace from removing keys from the keyring. Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
-rw-r--r--security/integrity/ima/ima_mok.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c
index 18e37f57f512..8dad9a2b8e47 100644
--- a/security/integrity/ima/ima_mok.c
+++ b/security/integrity/ima/ima_mok.c
@@ -47,7 +47,9 @@ __init int ima_mok_init(void)
if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring))
panic("Can't allocate IMA MOK or blacklist keyrings.");
set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags);
+
set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags);
+ set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
return 0;
}