integrity: define '.evm' as a builtin 'trusted' keyring
authorDmitry Kasatkin <dmitry.kasatkin@huawei.com>
Thu, 22 Oct 2015 18:26:10 +0000 (21:26 +0300)
committerMimi Zohar <zohar@linux.vnet.ibm.com>
Mon, 23 Nov 2015 19:30:02 +0000 (14:30 -0500)
commitf4dc37785e9b3373d0cb93125d5579fed2af3a43
treeb1bed1b8038d92770cc9881a1ad57b97e1b57dc3
parentebd68df3f24b318d391d15c458d6f43f340ba36a
integrity: define '.evm' as a builtin 'trusted' keyring

Require all keys added to the EVM keyring be signed by an
existing trusted key on the system trusted keyring.

This patch also switches IMA to use integrity_init_keyring().

Changes in v3:
* Added 'init_keyring' config based variable to skip initializing
  keyring instead of using  __integrity_init_keyring() wrapper.
* Added dependency back to CONFIG_IMA_TRUSTED_KEYRING

Changes in v2:
* Replace CONFIG_EVM_TRUSTED_KEYRING with IMA and EVM common
  CONFIG_INTEGRITY_TRUSTED_KEYRING configuration option
* Deprecate CONFIG_IMA_TRUSTED_KEYRING but keep it for config
  file compatibility. (Mimi Zohar)

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>
Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
security/integrity/Kconfig
security/integrity/digsig.c
security/integrity/evm/evm_main.c
security/integrity/ima/Kconfig
security/integrity/ima/ima.h
security/integrity/ima/ima_init.c
security/integrity/integrity.h