diff options
| author | Dmitry Kasatkin <dmitry.kasatkin@gmail.com> | 2015-09-10 22:06:15 +0300 |
|---|---|---|
| committer | Mimi Zohar <zohar@linux.vnet.ibm.com> | 2015-10-09 15:31:18 -0400 |
| commit | 72e1eed8abb11c79749266d433c817ce36732893 (patch) | |
| tree | 6afb6aa08f190047c5d7d15178d3ba56780a5789 /security/Kconfig | |
| parent | 049e6dde7e57f0054fdc49102e7ef4830c698b46 (diff) | |
integrity: prevent loading untrusted certificates on the IMA trusted keyring
If IMA_LOAD_X509 is enabled, either directly or indirectly via
IMA_APPRAISE_SIGNED_INIT, certificates are loaded onto the IMA
trusted keyring by the kernel via key_create_or_update(). When
the KEY_ALLOC_TRUSTED flag is provided, certificates are loaded
without first verifying the certificate is properly signed by a
trusted key on the system keyring. This patch removes the
KEY_ALLOC_TRUSTED flag.
Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Cc: <stable@vger.kernel.org> # 3.19+
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'security/Kconfig')
0 files changed, 0 insertions, 0 deletions