1 /* 2 * Copyright (C) 2015 Juniper Networks, Inc. 3 * 4 * Author: 5 * Petko Manolov <petko.manolov@konsulko.com> 6 * 7 * This program is free software; you can redistribute it and/or 8 * modify it under the terms of the GNU General Public License as 9 * published by the Free Software Foundation, version 2 of the 10 * License. 11 * 12 */ 13 14 #include <linux/export.h> 15 #include <linux/kernel.h> 16 #include <linux/sched.h> 17 #include <linux/cred.h> 18 #include <linux/err.h> 19 #include <linux/init.h> 20 #include <keys/system_keyring.h> 21 22 23 struct key *ima_blacklist_keyring; 24 25 /* 26 * Allocate the IMA blacklist keyring 27 */ 28 __init int ima_mok_init(void) 29 { 30 pr_notice("Allocating IMA blacklist keyring.\n"); 31 32 ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 33 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 34 (KEY_POS_ALL & ~KEY_POS_SETATTR) | 35 KEY_USR_VIEW | KEY_USR_READ | 36 KEY_USR_WRITE | KEY_USR_SEARCH, 37 KEY_ALLOC_NOT_IN_QUOTA, 38 restrict_link_by_builtin_trusted, NULL); 39 40 if (IS_ERR(ima_blacklist_keyring)) 41 panic("Can't allocate IMA blacklist keyring."); 42 43 set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); 44 return 0; 45 } 46 device_initcall(ima_mok_init); 47