028db3e290
This reverts merge 0f75ef6a9cff49ff612f7ce0578bced9d0b38325 (and thus
effectively commits
7a1ade847596 ("keys: Provide KEYCTL_GRANT_PERMISSION")
2e12256b9a76 ("keys: Replace uid/gid/perm permissions checking with an ACL")
that the merge brought in).
It turns out that it breaks booting with an encrypted volume, and Eric
biggers reports that it also breaks the fscrypt tests [1] and loading of
in-kernel X.509 certificates [2].
The root cause of all the breakage is likely the same, but David Howells
is off email so rather than try to work it out it's getting reverted in
order to not impact the rest of the merge window.
[1] https://lore.kernel.org/lkml/20190710011559.GA7973@sol.localdomain/
[2] https://lore.kernel.org/lkml/20190710013225.GB7973@sol.localdomain/
Link: https://lore.kernel.org/lkml/CAHk-=wjxoeMJfeBahnWH=9zShKp2bsVy527vo3_y8HfOdhwAAw@mail.gmail.com/
Reported-by: Eric Biggers <ebiggers@kernel.org>
Cc: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
51 lines
1.2 KiB
C
51 lines
1.2 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2015 Juniper Networks, Inc.
|
|
*
|
|
* Author:
|
|
* Petko Manolov <petko.manolov@konsulko.com>
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/cred.h>
|
|
#include <linux/err.h>
|
|
#include <linux/init.h>
|
|
#include <linux/slab.h>
|
|
#include <keys/system_keyring.h>
|
|
|
|
|
|
struct key *ima_blacklist_keyring;
|
|
|
|
/*
|
|
* Allocate the IMA blacklist keyring
|
|
*/
|
|
__init int ima_mok_init(void)
|
|
{
|
|
struct key_restriction *restriction;
|
|
|
|
pr_notice("Allocating IMA blacklist keyring.\n");
|
|
|
|
restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
|
|
if (!restriction)
|
|
panic("Can't allocate IMA blacklist restriction.");
|
|
|
|
restriction->check = restrict_link_by_builtin_trusted;
|
|
|
|
ima_blacklist_keyring = keyring_alloc(".ima_blacklist",
|
|
KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
|
|
(KEY_POS_ALL & ~KEY_POS_SETATTR) |
|
|
KEY_USR_VIEW | KEY_USR_READ |
|
|
KEY_USR_WRITE | KEY_USR_SEARCH,
|
|
KEY_ALLOC_NOT_IN_QUOTA,
|
|
restriction, NULL);
|
|
|
|
if (IS_ERR(ima_blacklist_keyring))
|
|
panic("Can't allocate IMA blacklist keyring.");
|
|
|
|
set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags);
|
|
return 0;
|
|
}
|
|
device_initcall(ima_mok_init);
|