From: Mimi Zohar Date: Tue, 10 Nov 2015 14:00:38 +0000 (-0500) Subject: IMA: prevent keys on the .ima_blacklist from being removed X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=501f1bde66525f94403a5b78832a9218ef9b1c14;p=linux-beck.git IMA: prevent keys on the .ima_blacklist from being removed Set the KEY_FLAGS_KEEP on the .ima_blacklist to prevent userspace from removing keys from the keyring. Signed-off-by: Mimi Zohar --- diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c index 18e37f57f512..8dad9a2b8e47 100644 --- a/security/integrity/ima/ima_mok.c +++ b/security/integrity/ima/ima_mok.c @@ -47,7 +47,9 @@ __init int ima_mok_init(void) if (IS_ERR(ima_mok_keyring) || IS_ERR(ima_blacklist_keyring)) panic("Can't allocate IMA MOK or blacklist keyrings."); set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_mok_keyring->flags); + set_bit(KEY_FLAG_TRUSTED_ONLY, &ima_blacklist_keyring->flags); + set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); return 0; }