1b886d83cSThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only 241c89b64SPetko Manolov /* 341c89b64SPetko Manolov * Copyright (C) 2015 Juniper Networks, Inc. 441c89b64SPetko Manolov * 541c89b64SPetko Manolov * Author: 641c89b64SPetko Manolov * Petko Manolov <petko.manolov@konsulko.com> 741c89b64SPetko Manolov */ 841c89b64SPetko Manolov 941c89b64SPetko Manolov #include <linux/export.h> 1041c89b64SPetko Manolov #include <linux/kernel.h> 1141c89b64SPetko Manolov #include <linux/sched.h> 1241c89b64SPetko Manolov #include <linux/cred.h> 1341c89b64SPetko Manolov #include <linux/err.h> 1492cc9166SPaul Gortmaker #include <linux/init.h> 152b6aa412SMat Martineau #include <linux/slab.h> 16a511e1afSDavid Howells #include <keys/system_keyring.h> 1741c89b64SPetko Manolov 1841c89b64SPetko Manolov 1941c89b64SPetko Manolov struct key *ima_blacklist_keyring; 2041c89b64SPetko Manolov 2141c89b64SPetko Manolov /* 2256104cf2SDavid Howells * Allocate the IMA blacklist keyring 2341c89b64SPetko Manolov */ ima_mok_init(void)24*a32ad904SAustin Kimstatic __init int ima_mok_init(void) 2541c89b64SPetko Manolov { 262b6aa412SMat Martineau struct key_restriction *restriction; 272b6aa412SMat Martineau 2856104cf2SDavid Howells pr_notice("Allocating IMA blacklist keyring.\n"); 2941c89b64SPetko Manolov 302b6aa412SMat Martineau restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); 312b6aa412SMat Martineau if (!restriction) 322b6aa412SMat Martineau panic("Can't allocate IMA blacklist restriction."); 332b6aa412SMat Martineau 342b6aa412SMat Martineau restriction->check = restrict_link_by_builtin_trusted; 352b6aa412SMat Martineau 3641c89b64SPetko Manolov ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 3741c89b64SPetko Manolov KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 38028db3e2SLinus Torvalds (KEY_POS_ALL & ~KEY_POS_SETATTR) | 39028db3e2SLinus Torvalds KEY_USR_VIEW | KEY_USR_READ | 40028db3e2SLinus Torvalds KEY_USR_WRITE | KEY_USR_SEARCH, 414993e1f9SDavid Howells KEY_ALLOC_NOT_IN_QUOTA | 424993e1f9SDavid Howells KEY_ALLOC_SET_KEEP, 432b6aa412SMat Martineau restriction, NULL); 4441c89b64SPetko Manolov 4556104cf2SDavid Howells if (IS_ERR(ima_blacklist_keyring)) 4656104cf2SDavid Howells panic("Can't allocate IMA blacklist keyring."); 4741c89b64SPetko Manolov return 0; 4841c89b64SPetko Manolov } 4992cc9166SPaul Gortmaker device_initcall(ima_mok_init); 50