Tyler Hicks c6f45c5b07 ima: Fail rule parsing when asymmetric key measurement isn't supportable ...

[ Upstream commit 48ce1ddce1 ]

Measuring keys is currently only supported for asymmetric keys. In the
future, this might change.

For now, the "func=KEY_CHECK" and "keyrings=" options are only
appropriate when CONFIG_IMA_MEASURE_ASYMMETRIC_KEYS is enabled. Make
this clear at policy load so that IMA policy authors don't assume that
these policy language constructs are supported.

Fixes: 2b60c0eced ("IMA: Read keyrings= option from the IMA policy")
Fixes: 5808611ccc ("IMA: Add KEY_CHECK func to measure keys")
Suggested-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2020-10-29 10:11:15 +01:00

..

apparmor

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

bpf

bpf: lsm: Initialize the BPF LSM hooks

2020-03-30 01:34:00 +02:00

integrity

ima: Fail rule parsing when asymmetric key measurement isn't supportable

2020-10-29 10:11:15 +01:00

keys

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

loadpin

block: move block-related definitions out of fs.h

2020-06-24 09:16:02 -06:00

lockdown

Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2020-06-02 17:36:24 -07:00

safesetid

security/safesetid: Replace rcu_swap_protected() with rcu_replace_pointer()

2019-10-30 08:45:57 -07:00

selinux

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

smack

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

tomoyo

treewide: Use fallthrough pseudo-keyword

2020-08-23 17:36:59 -05:00

yama

sysctl: pass kernel pointers to ->proc_handler

2020-04-27 02:07:40 -04:00

commoncap.c

exec: Compute file based creds only once

2020-05-29 22:00:54 -05:00

device_cgroup.c

device_cgroup: Fix RCU list debugging warning

2020-08-20 11:25:03 -07:00

inode.c

Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2019-07-19 10:42:02 -07:00

Kconfig

Replace HTTP links with HTTPS ones: security

2020-08-06 12:00:05 -07:00

Kconfig.hardening

security: allow using Clang's zero initialization for stack variables

2020-06-16 02:06:23 -07:00

lsm_audit.c

audit: purge audit_log_string from the intra-kernel audit API

2020-07-21 11:12:31 -04:00

Makefile

device_cgroup: Cleanup cgroup eBPF device filter code

2020-04-13 14:41:54 -04:00

min_addr.c

sysctl: pass kernel pointers to ->proc_handler

2020-04-27 02:07:40 -04:00

security.c

security: Fix hook iteration and default value for inode_copy_up_xattr

2020-06-23 16:39:23 -07:00