Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar...

[sfrench/cifs-2.6.git] / security / integrity / digsig.c

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 37869214c2434054fdaf39e2bb9e1a3f8cfc0afc..f9f3c8ffe7864e1f9b6441f0e6c1aa3cabdfc322 100644 (file)
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -1,13 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-only
 /*
  * Copyright (C) 2011 Intel Corporation
  *
  * Author:
  * Dmitry Kasatkin <dmitry.kasatkin@intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, version 2 of the License.
- *
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
@@ -51,7 +47,8 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 
        if (!keyring[id]) {
                keyring[id] =
-                       request_key(&key_type_keyring, keyring_name[id], NULL);
+                       request_key(&key_type_keyring, keyring_name[id],
+                                   NULL, NULL);
                if (IS_ERR(keyring[id])) {
                        int err = PTR_ERR(keyring[id]);
                        pr_err("no %s keyring: %d\n", keyring_name[id], err);
@@ -74,14 +71,14 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen,
 }
 
 static int __init __integrity_init_keyring(const unsigned int id,
-                                          key_perm_t perm,
+                                          struct key_acl *acl,
                                           struct key_restriction *restriction)
 {
        const struct cred *cred = current_cred();
        int err = 0;
 
        keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0),
-                                   KGIDT_INIT(0), cred, perm,
+                                   KGIDT_INIT(0), cred, acl,
                                    KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL);
        if (IS_ERR(keyring[id])) {
                err = PTR_ERR(keyring[id]);
@@ -99,10 +96,7 @@ static int __init __integrity_init_keyring(const unsigned int id,
 int __init integrity_init_keyring(const unsigned int id)
 {
        struct key_restriction *restriction;
-       key_perm_t perm;
-
-       perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW
-               | KEY_USR_READ | KEY_USR_SEARCH;
+       struct key_acl *acl = &internal_keyring_acl;
 
        if (id == INTEGRITY_KEYRING_PLATFORM) {
                restriction = NULL;
@@ -117,14 +111,14 @@ int __init integrity_init_keyring(const unsigned int id)
                return -ENOMEM;
 
        restriction->check = restrict_link_to_ima;
-       perm |= KEY_USR_WRITE;
+       acl = &internal_writable_keyring_acl;
 
 out:
-       return __integrity_init_keyring(id, perm, restriction);
+       return __integrity_init_keyring(id, acl, restriction);
 }
 
-int __init integrity_add_key(const unsigned int id, const void *data,
-                            off_t size, key_perm_t perm)
+static int __init integrity_add_key(const unsigned int id, const void *data,
+                                   off_t size, struct key_acl *acl)
 {
        key_ref_t key;
        int rc = 0;
@@ -133,7 +127,7 @@ int __init integrity_add_key(const unsigned int id, const void *data,
                return -EINVAL;
 
        key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric",
-                                  NULL, data, size, perm,
+                                  NULL, data, size, acl ?: &internal_key_acl,
                                   KEY_ALLOC_NOT_IN_QUOTA);
        if (IS_ERR(key)) {
                rc = PTR_ERR(key);
@@ -153,7 +147,6 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
        void *data;
        loff_t size;
        int rc;
-       key_perm_t perm;
 
        rc = kernel_read_file_from_path(path, &data, &size, 0,
                                        READING_X509_CERTIFICATE);
@@ -162,21 +155,19 @@ int __init integrity_load_x509(const unsigned int id, const char *path)
                return rc;
        }
 
-       perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ;
-
        pr_info("Loading X.509 certificate: %s\n", path);
-       rc = integrity_add_key(id, (const void *)data, size, perm);
+       rc = integrity_add_key(id, data, size, NULL);
 
        vfree(data);
        return rc;
 }
 
 int __init integrity_load_cert(const unsigned int id, const char *source,
-                              const void *data, size_t len, key_perm_t perm)
+                              const void *data, size_t len, struct key_acl *acl)
 {
        if (!data)
                return -EINVAL;
 
        pr_info("Loading X.509 certificate: %s\n", source);
-       return integrity_add_key(id, data, len, perm);
+       return integrity_add_key(id, data, len, acl);
 }