Commit | Line | Data |
---|---|---|
41c89b64 PM |
1 | /* |
2 | * Copyright (C) 2015 Juniper Networks, Inc. | |
3 | * | |
4 | * Author: | |
5 | * Petko Manolov <petko.manolov@konsulko.com> | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public License as | |
9 | * published by the Free Software Foundation, version 2 of the | |
10 | * License. | |
11 | * | |
12 | */ | |
13 | ||
14 | #include <linux/export.h> | |
15 | #include <linux/kernel.h> | |
16 | #include <linux/sched.h> | |
17 | #include <linux/cred.h> | |
18 | #include <linux/err.h> | |
92cc9166 | 19 | #include <linux/init.h> |
a511e1af | 20 | #include <keys/system_keyring.h> |
41c89b64 PM |
21 | |
22 | ||
41c89b64 PM |
23 | struct key *ima_blacklist_keyring; |
24 | ||
25 | /* | |
56104cf2 | 26 | * Allocate the IMA blacklist keyring |
41c89b64 PM |
27 | */ |
28 | __init int ima_mok_init(void) | |
29 | { | |
56104cf2 | 30 | pr_notice("Allocating IMA blacklist keyring.\n"); |
41c89b64 PM |
31 | |
32 | ima_blacklist_keyring = keyring_alloc(".ima_blacklist", | |
33 | KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), | |
34 | (KEY_POS_ALL & ~KEY_POS_SETATTR) | | |
35 | KEY_USR_VIEW | KEY_USR_READ | | |
36 | KEY_USR_WRITE | KEY_USR_SEARCH, | |
5ac7eace | 37 | KEY_ALLOC_NOT_IN_QUOTA, |
a511e1af | 38 | restrict_link_by_builtin_trusted, NULL); |
41c89b64 | 39 | |
56104cf2 DH |
40 | if (IS_ERR(ima_blacklist_keyring)) |
41 | panic("Can't allocate IMA blacklist keyring."); | |
501f1bde | 42 | |
501f1bde | 43 | set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); |
41c89b64 PM |
44 | return 0; |
45 | } | |
92cc9166 | 46 | device_initcall(ima_mok_init); |