1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0-only 2*4882a593Smuzhiyun /* 3*4882a593Smuzhiyun * Copyright (C) 2015 Juniper Networks, Inc. 4*4882a593Smuzhiyun * 5*4882a593Smuzhiyun * Author: 6*4882a593Smuzhiyun * Petko Manolov <petko.manolov@konsulko.com> 7*4882a593Smuzhiyun */ 8*4882a593Smuzhiyun 9*4882a593Smuzhiyun #include <linux/export.h> 10*4882a593Smuzhiyun #include <linux/kernel.h> 11*4882a593Smuzhiyun #include <linux/sched.h> 12*4882a593Smuzhiyun #include <linux/cred.h> 13*4882a593Smuzhiyun #include <linux/err.h> 14*4882a593Smuzhiyun #include <linux/init.h> 15*4882a593Smuzhiyun #include <linux/slab.h> 16*4882a593Smuzhiyun #include <keys/system_keyring.h> 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun 19*4882a593Smuzhiyun struct key *ima_blacklist_keyring; 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun /* 22*4882a593Smuzhiyun * Allocate the IMA blacklist keyring 23*4882a593Smuzhiyun */ ima_mok_init(void)24*4882a593Smuzhiyunstatic __init int ima_mok_init(void) 25*4882a593Smuzhiyun { 26*4882a593Smuzhiyun struct key_restriction *restriction; 27*4882a593Smuzhiyun 28*4882a593Smuzhiyun pr_notice("Allocating IMA blacklist keyring.\n"); 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); 31*4882a593Smuzhiyun if (!restriction) 32*4882a593Smuzhiyun panic("Can't allocate IMA blacklist restriction."); 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun restriction->check = restrict_link_by_builtin_trusted; 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun ima_blacklist_keyring = keyring_alloc(".ima_blacklist", 37*4882a593Smuzhiyun KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), 38*4882a593Smuzhiyun (KEY_POS_ALL & ~KEY_POS_SETATTR) | 39*4882a593Smuzhiyun KEY_USR_VIEW | KEY_USR_READ | 40*4882a593Smuzhiyun KEY_USR_WRITE | KEY_USR_SEARCH, 41*4882a593Smuzhiyun KEY_ALLOC_NOT_IN_QUOTA | 42*4882a593Smuzhiyun KEY_ALLOC_SET_KEEP, 43*4882a593Smuzhiyun restriction, NULL); 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun if (IS_ERR(ima_blacklist_keyring)) 46*4882a593Smuzhiyun panic("Can't allocate IMA blacklist keyring."); 47*4882a593Smuzhiyun return 0; 48*4882a593Smuzhiyun } 49*4882a593Smuzhiyun device_initcall(ima_mok_init); 50