-
- Downloads
Merge branch 'next-integrity.defer-measuring-keys' into next-integrity
From patch set cover letter: The IMA subsystem supports measuring asymmetric keys when the key is created or updated[1]. But keys created or updated before a custom IMA policy is loaded are currently not measured. This includes keys added, for instance, to either the .ima or .builtin_trusted_keys keyrings, which happens early in the boot process. Measuring the early boot keys, by design, requires loading a custom IMA policy. This change adds support for queuing keys created or updated before a custom IMA policy is loaded. The queued keys are processed when a custom policy is loaded. Keys created or updated after a custom policy is loaded are measured immediately (not queued). In the case when a custom policy is not loaded within 5 minutes of IMA initialization, the queued keys are freed. [1] https://lore.kernel.org/linux-integrity/20191211164707.4698-1-nramas@linux.microsoft.com/
No related branches found
No related tags found
Showing
- security/integrity/ima/Kconfig 6 additions, 0 deletionssecurity/integrity/ima/Kconfig
- security/integrity/ima/Makefile 1 addition, 0 deletionssecurity/integrity/ima/Makefile
- security/integrity/ima/ima.h 24 additions, 0 deletionssecurity/integrity/ima/ima.h
- security/integrity/ima/ima_asymmetric_keys.c 8 additions, 0 deletionssecurity/integrity/ima/ima_asymmetric_keys.c
- security/integrity/ima/ima_init.c 7 additions, 1 deletionsecurity/integrity/ima/ima_init.c
- security/integrity/ima/ima_policy.c 3 additions, 0 deletionssecurity/integrity/ima/ima_policy.c
- security/integrity/ima/ima_queue_keys.c 171 additions, 0 deletionssecurity/integrity/ima/ima_queue_keys.c
Loading
Please register or sign in to comment