Merge remote-tracking branch 'integrity/next-integrity'

diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 53917a3..2a723fd 100644 (file)
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -536,9 +536,17 @@ static int bzImage64_cleanup(void *loader_data)
 #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG
 static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len)
 {
-       return verify_pefile_signature(kernel, kernel_len,
-                                      VERIFY_USE_SECONDARY_KEYRING,
-                                      VERIFYING_KEXEC_PE_SIGNATURE);
+       int ret;
+
+       ret = verify_pefile_signature(kernel, kernel_len,
+                                     VERIFY_USE_SECONDARY_KEYRING,
+                                     VERIFYING_KEXEC_PE_SIGNATURE);
+       if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
+               ret = verify_pefile_signature(kernel, kernel_len,
+                                             VERIFY_USE_PLATFORM_KEYRING,
+                                             VERIFYING_KEXEC_PE_SIGNATURE);
+       }
+       return ret;
 }
 #endif
 

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 8172871..c05c29a 100644 (file)
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys;
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
 static struct key *secondary_trusted_keys;
 #endif
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+static struct key *platform_trusted_keys;
+#endif
 
 extern __initconst const u8 system_certificate_list[];
 extern __initconst const unsigned long system_certificate_list_size;
@@ -237,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len,
 #else
                trusted_keys = builtin_trusted_keys;
 #endif
+       } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+               trusted_keys = platform_trusted_keys;
+#else
+               trusted_keys = NULL;
+#endif
+               if (!trusted_keys) {
+                       ret = -ENOKEY;
+                       pr_devel("PKCS#7 platform keyring is not available\n");
+                       goto error;
+               }
        }
        ret = pkcs7_validate_trust(pkcs7, trusted_keys);
        if (ret < 0) {
                if (ret == -ENOKEY)
-                       pr_err("PKCS#7 signature not signed with a trusted key\n");
+                       pr_devel("PKCS#7 signature not signed with a trusted key\n");
                goto error;
        }
 
@@ -266,3 +280,10 @@ error:
 EXPORT_SYMBOL_GPL(verify_pkcs7_signature);
 
 #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */
+
+#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
+void __init set_platform_trusted_keys(struct key *keyring)
+{
+       platform_trusted_keys = keyring;
+}
+#endif

diff --git a/fs/namei.c b/fs/namei.c
index a85deb5..314e4af 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3462,6 +3462,7 @@ struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode, int open_flag)
                inode->i_state |= I_LINKABLE;
                spin_unlock(&inode->i_lock);
        }
+       ima_post_create_tmpfile(inode);
        return child;
 
 out_err:

diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 359c2f9..42a93ed 100644 (file)
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -61,5 +61,13 @@ static inline struct key *get_ima_blacklist_keyring(void)
 }
 #endif /* CONFIG_IMA_BLACKLIST_KEYRING */
 
+#if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \
+       defined(CONFIG_SYSTEM_TRUSTED_KEYRING)
+extern void __init set_platform_trusted_keys(struct key *keyring);
+#else
+static inline void set_platform_trusted_keys(struct key *keyring)
+{
+}
+#endif
 
 #endif /* _KEYS_SYSTEM_KEYRING_H */

diff --git a/include/linux/ima.h b/include/linux/ima.h
index b5e16b8..dc12fbc 100644 (file)
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -18,6 +18,7 @@ struct linux_binprm;
 #ifdef CONFIG_IMA
 extern int ima_bprm_check(struct linux_binprm *bprm);
 extern int ima_file_check(struct file *file, int mask);
+extern void ima_post_create_tmpfile(struct inode *inode);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
 extern int ima_load_data(enum kernel_load_data_id id);
@@ -56,6 +57,10 @@ static inline int ima_file_check(struct file *file, int mask)
        return 0;
 }
 
+static inline void ima_post_create_tmpfile(struct inode *inode)
+{
+}
+
 static inline void ima_file_free(struct file *file)
 {
        return;

diff --git a/include/linux/verification.h b/include/linux/verification.h
index cfa4730..018fb5f 100644 (file)
--- a/include/linux/verification.h
+++ b/include/linux/verification.h
@@ -17,6 +17,7 @@
  * should be used.
  */
 #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL)
+#define VERIFY_USE_PLATFORM_KEYRING  ((struct key *)2UL)
 
 /*
  * The use to which an asymmetric key is being put.

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index f45d6ed..e19c2eb 100644 (file)
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -87,6 +87,9 @@ static int __integrity_init_keyring(const unsigned int id, key_perm_t perm,
                pr_info("Can't allocate %s keyring (%d)\n",
                        keyring_name[id], err);
                keyring[id] = NULL;
+       } else {
+               if (id == INTEGRITY_KEYRING_PLATFORM)
+                       set_platform_trusted_keys(keyring[id]);
        }
 
        return err;

diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c
index 43e2dc3..c37d081 100644 (file)
--- a/security/integrity/evm/evm_crypto.c
+++ b/security/integrity/evm/evm_crypto.c
@@ -173,8 +173,7 @@ static void hmac_add_misc(struct shash_desc *desc, struct inode *inode,
        crypto_shash_update(desc, (const u8 *)&hmac_misc, sizeof(hmac_misc));
        if ((evm_hmac_attrs & EVM_ATTR_FSUUID) &&
            type != EVM_XATTR_PORTABLE_DIGSIG)
-               crypto_shash_update(desc, &inode->i_sb->s_uuid.b[0],
-                                   sizeof(inode->i_sb->s_uuid));
+               crypto_shash_update(desc, (u8 *)&inode->i_sb->s_uuid, UUID_SIZE);
        crypto_shash_final(desc, digest);
 }
 

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index 5ecaa3d..b6d9f14 100644 (file)
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -563,7 +563,6 @@ static int __init init_evm(void)
 {
        int error;
        struct list_head *pos, *q;
-       struct xattr_list *xattr;
 
        evm_init_config();
 
@@ -580,11 +579,8 @@ static int __init init_evm(void)
 error:
        if (error != 0) {
                if (!list_empty(&evm_config_xattrnames)) {
-                       list_for_each_safe(pos, q, &evm_config_xattrnames) {
-                               xattr = list_entry(pos, struct xattr_list,
-                                                  list);
+                       list_for_each_safe(pos, q, &evm_config_xattrnames)
                                list_del(pos);
-                       }
                }
        }
 

diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 4ffac4f..357edd1 100644 (file)
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -396,6 +396,33 @@ int ima_file_check(struct file *file, int mask)
 }
 EXPORT_SYMBOL_GPL(ima_file_check);
 
+/**
+ * ima_post_create_tmpfile - mark newly created tmpfile as new
+ * @file : newly created tmpfile
+ *
+ * No measuring, appraising or auditing of newly created tmpfiles is needed.
+ * Skip calling process_measurement(), but indicate which newly, created
+ * tmpfiles are in policy.
+ */
+void ima_post_create_tmpfile(struct inode *inode)
+{
+       struct integrity_iint_cache *iint;
+       int must_appraise;
+
+       must_appraise = ima_must_appraise(inode, MAY_ACCESS, FILE_CHECK);
+       if (!must_appraise)
+               return;
+
+       /* Nothing to do if we can't allocate memory */
+       iint = integrity_inode_get(inode);
+       if (!iint)
+               return;
+
+       /* needed for writing the security xattrs */
+       set_bit(IMA_UPDATE_XATTR, &iint->atomic_flags);
+       iint->ima_file_status = INTEGRITY_PASS;
+}
+
 /**
  * ima_post_path_mknod - mark as a new inode
  * @dentry: newly created dentry
@@ -413,9 +440,13 @@ void ima_post_path_mknod(struct dentry *dentry)
        if (!must_appraise)
                return;
 
+       /* Nothing to do if we can't allocate memory */
        iint = integrity_inode_get(inode);
-       if (iint)
-               iint->flags |= IMA_NEW_FILE;
+       if (!iint)
+               return;
+
+       /* needed for re-opening empty files */
+       iint->flags |= IMA_NEW_FILE;
 }
 
 /**

diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 389a298..347108f 100644 (file)
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -60,11 +60,11 @@ static int blksize;
 static struct crypto_shash *hash_tfm;
 
 enum {
-       Opt_err = -1, Opt_new, Opt_load, Opt_update
+       Opt_new, Opt_load, Opt_update, Opt_err
 };
 
 enum {
-       Opt_error = -1, Opt_default, Opt_ecryptfs, Opt_enc32
+       Opt_default, Opt_ecryptfs, Opt_enc32, Opt_error
 };
 
 static const match_table_t key_format_tokens = {