diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2023-11-02 06:53:22 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2023-11-02 06:53:22 -1000 |
| commit | ba90b3a07c74f5a37597e63e6865b8deaf3982ca (patch) | |
| tree | 62cfd59804b087c1ca8280b0818a4286110e97af | |
| parent | 20c0d4fe1f8a911f4366571cac32749e9c0d10c6 (diff) | |
| parent | 0b59cd533b2029039172edcfdabe5240bfa9904c (diff) | |
| download | linux-crypto-ba90b3a07c74f5a37597e63e6865b8deaf3982ca.tar.gz linux-crypto-ba90b3a07c74f5a37597e63e6865b8deaf3982ca.zip | |
Merge tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
Pull integrity updates from Mimi Zohar:
"Four integrity changes: two IMA-overlay updates, an integrity Kconfig
cleanup, and a secondary keyring update"
* tag 'integrity-v6.7' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
ima: detect changes to the backing overlay file
certs: Only allow certs signed by keys on the builtin keyring
integrity: fix indentation of config attributes
ima: annotate iint mutex to avoid lockdep false positive warnings
| -rw-r--r-- | crypto/asymmetric_keys/restrict.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 6b69ea40..afcd4d10 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -102,6 +102,10 @@ int restrict_link_by_signature(struct key *dest_keyring, if (use_builtin_keys && !test_bit(KEY_FLAG_BUILTIN, &key->flags)) ret = -ENOKEY; + else if (IS_BUILTIN(CONFIG_SECONDARY_TRUSTED_KEYRING_SIGNED_BY_BUILTIN) && + !strcmp(dest_keyring->description, ".secondary_trusted_keys") && + !test_bit(KEY_FLAG_BUILTIN, &key->flags)) + ret = -ENOKEY; else ret = verify_signature(key, sig); key_put(key); |