lkml.org 
[lkml]   [2014]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH v6 0/6] ima: extending secure boot certificate chain of trust
Date
The original patches extended the secure boot signature chain of trust
to IMA-appraisal, by allowing only certificates signed by a 'trusted'
key on the system_trusted_keyring to be added to the IMA keyring.

Instead of allowing public keys, with certificates signed by any key
on the system trusted keyring, to be added to a trusted keyring, this
patch set further restricts the certificates to those signed by a
particular key, or the builtin keys, on the system keyring.

Other than the "KEYS: validate certificate trust only with builtin keys"
patch, which is included in this patch set for completeness, but can be
deferred until the UEFI key patches are upstreamed, these patches are
ready to be upstreamed. David, how do you want to go forward with
this patchset. Did you want to take them?

thanks,

Mimi

Dmitry Kasatkin (3):
KEYS: make partial key id matching as a dedicated function
KEYS: validate certificate trust only with selected owner key
KEYS: validate certificate trust only with builtin keys

Mimi Zohar (3):
KEYS: special dot prefixed keyring name bug fix
KEYS: verify a certificate is signed by a 'trusted' key
ima: define '.ima' as a builtin 'trusted' keyring

Documentation/kernel-parameters.txt | 5 ++
crypto/asymmetric_keys/asymmetric_keys.h | 2 +
crypto/asymmetric_keys/asymmetric_type.c | 51 +++++++++------
crypto/asymmetric_keys/x509_public_key.c | 109 ++++++++++++++++++++++++++++++-
include/keys/system_keyring.h | 10 ++-
include/linux/key.h | 1 +
kernel/system_keyring.c | 1 +
security/integrity/digsig.c | 28 ++++++++
security/integrity/ima/Kconfig | 10 +++
security/integrity/ima/ima.h | 12 ++++
security/integrity/ima/ima_main.c | 10 ++-
security/integrity/integrity.h | 5 ++
security/keys/keyctl.c | 6 +-
13 files changed, 225 insertions(+), 25 deletions(-)

--
1.8.1.4



\
 
 \ /
  Last update: 2014-06-24 17:41    [W:1.452 / U:0.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site