diff options
| -rw-r--r-- | security/integrity/evm/Kconfig | 17 | ||||
| -rw-r--r-- | security/integrity/evm/evm_main.c | 7 | ||||
| -rw-r--r-- | security/integrity/iint.c | 1 | ||||
| -rw-r--r-- | security/integrity/integrity.h | 8 |
4 files changed, 33 insertions, 0 deletions
diff --git a/security/integrity/evm/Kconfig b/security/integrity/evm/Kconfig index bf19723cf117..913532c5db4f 100644 --- a/security/integrity/evm/Kconfig +++ b/security/integrity/evm/Kconfig @@ -42,3 +42,20 @@ config EVM_EXTRA_SMACK_XATTRS additional info to the calculation, requires existing EVM labeled file systems to be relabeled. +config EVM_LOAD_X509 + bool "Load an X509 certificate onto the '.evm' trusted keyring" + depends on INTEGRITY_TRUSTED_KEYRING + default n + help + Load an X509 certificate onto the '.evm' trusted keyring. + + This option enables X509 certificate loading from the kernel + onto the '.evm' trusted keyring. A public key can be used to + verify EVM integrity starting from the 'init' process. + +config EVM_X509_PATH + string "EVM X509 certificate path" + depends on EVM_LOAD_X509 + default "/etc/keys/x509_evm.der" + help + This option defines X509 certificate path. diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c index 75b7e3031d2a..519de0a0ba72 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -472,6 +472,13 @@ out: } EXPORT_SYMBOL_GPL(evm_inode_init_security); +#ifdef CONFIG_EVM_LOAD_X509 +void __init evm_load_x509(void) +{ + integrity_load_x509(INTEGRITY_KEYRING_EVM, CONFIG_EVM_X509_PATH); +} +#endif + static int __init init_evm(void) { int error; diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 3d2f5b45c8cb..2de9c820903f 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -254,4 +254,5 @@ out: void __init integrity_load_keys(void) { ima_load_x509(); + evm_load_x509(); } diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 07726a731727..5efe2ecc538d 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -170,6 +170,14 @@ static inline void ima_load_x509(void) } #endif +#ifdef CONFIG_EVM_LOAD_X509 +void __init evm_load_x509(void); +#else +static inline void evm_load_x509(void) +{ +} +#endif + #ifdef CONFIG_INTEGRITY_AUDIT /* declarations */ void integrity_audit_msg(int audit_msgno, struct inode *inode, |