141c89b64SPetko Manolov /* 241c89b64SPetko Manolov * Copyright (C) 2015 Juniper Networks, Inc. 341c89b64SPetko Manolov * 441c89b64SPetko Manolov * Author: 541c89b64SPetko Manolov * Petko Manolov <petko.manolov@konsulko.com> 641c89b64SPetko Manolov * 741c89b64SPetko Manolov * This program is free software; you can redistribute it and/or 841c89b64SPetko Manolov * modify it under the terms of the GNU General Public License as 941c89b64SPetko Manolov * published by the Free Software Foundation, version 2 of the 1041c89b64SPetko Manolov * License. 1141c89b64SPetko Manolov * 1241c89b64SPetko Manolov */ 1341c89b64SPetko Manolov 1441c89b64SPetko Manolov #include <linux/export.h> 1541c89b64SPetko Manolov #include <linux/kernel.h> 1641c89b64SPetko Manolov #include <linux/sched.h> 1741c89b64SPetko Manolov #include <linux/cred.h> 1841c89b64SPetko Manolov #include <linux/err.h> 1992cc9166SPaul Gortmaker #include <linux/init.h> 20a511e1afSDavid Howells #include <keys/system_keyring.h> 2141c89b64SPetko Manolov 2241c89b64SPetko Manolov 2341c89b64SPetko Manolov struct key *ima_blacklist_keyring; 2441c89b64SPetko Manolov 2541c89b64SPetko Manolov /* 2656104cf2SDavid Howells * Allocate the IMA blacklist keyring 2741c89b64SPetko Manolov */ 2841c89b64SPetko Manolov __init int ima_mok_init(void) 2941c89b64SPetko Manolov { 3056104cf2SDavid Howells pr_notice("Allocating IMA blacklist keyring.\n"); 3141c89b64SPetko Manolov 3241c89b64SPetko Manolov ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 3341c89b64SPetko Manolov KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 3441c89b64SPetko Manolov (KEY_POS_ALL & ~KEY_POS_SETATTR) | 3541c89b64SPetko Manolov KEY_USR_VIEW | KEY_USR_READ | 3641c89b64SPetko Manolov KEY_USR_WRITE | KEY_USR_SEARCH, 375ac7eaceSDavid Howells KEY_ALLOC_NOT_IN_QUOTA, 38a511e1afSDavid Howells restrict_link_by_builtin_trusted, NULL); 3941c89b64SPetko Manolov 4056104cf2SDavid Howells if (IS_ERR(ima_blacklist_keyring)) 4156104cf2SDavid Howells panic("Can't allocate IMA blacklist keyring."); 42501f1bdeSMimi Zohar 43501f1bdeSMimi Zohar set_bit(KEY_FLAG_KEEP, &ima_blacklist_keyring->flags); 4441c89b64SPetko Manolov return 0; 4541c89b64SPetko Manolov } 4692cc9166SPaul Gortmaker device_initcall(ima_mok_init); 47