1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2015 Juniper Networks, Inc. 4 * 5 * Author: 6 * Petko Manolov <petko.manolov@konsulko.com> 7 */ 8 9 #include <linux/export.h> 10 #include <linux/kernel.h> 11 #include <linux/sched.h> 12 #include <linux/cred.h> 13 #include <linux/err.h> 14 #include <linux/init.h> 15 #include <linux/slab.h> 16 #include <keys/system_keyring.h> 17 18 19 static struct key_acl integrity_blacklist_keyring_acl = { 20 .usage = REFCOUNT_INIT(1), 21 .nr_ace = 2, 22 .aces = { 23 KEY_POSSESSOR_ACE(KEY_ACE_SEARCH | KEY_ACE_WRITE), 24 KEY_OWNER_ACE(KEY_ACE_VIEW | KEY_ACE_READ | KEY_ACE_WRITE | KEY_ACE_SEARCH), 25 } 26 }; 27 28 struct key *ima_blacklist_keyring; 29 30 /* 31 * Allocate the IMA blacklist keyring 32 */ 33 __init int ima_mok_init(void) 34 { 35 struct key_restriction *restriction; 36 37 pr_notice("Allocating IMA blacklist keyring.\n"); 38 39 restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); 40 if (!restriction) 41 panic("Can't allocate IMA blacklist restriction."); 42 43 restriction->check = restrict_link_by_builtin_trusted; 44 45 ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 46 KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 47 &integrity_blacklist_keyring_acl, 48 KEY_ALLOC_NOT_IN_QUOTA, 49 restriction, NULL); 50 51 if (IS_ERR(ima_blacklist_keyring)) 52 panic("Can't allocate IMA blacklist keyring."); 53 54 set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); 55 return 0; 56 } 57 device_initcall(ima_mok_init); 58