diff mbox series

[v3,14/14] integrity: change ima link restriction to include mok keys

Message ID 20210812021855.3083178-15-eric.snowberg@oracle.com (mailing list archive)
State New
Headers show
Series Enroll kernel keys thru MOK | expand

Commit Message

Eric Snowberg Aug. 12, 2021, 2:18 a.m. UTC
With the introduction of the mok keyring, the end-user may choose to
trust Machine Owner Keys (MOK) within the kernel. If they have chosen to
trust them, the .mok keyring will contain these keys.  If not, the mok
keyring will always be empty.  Update the restriction check to allow the
ima keyring to also trust mok keys when the secondary keyring is also

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
v3: Initial version
 security/integrity/digsig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series


diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 996bea950972..1419ff4fc2b9 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -34,7 +34,7 @@  static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
-#define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
+#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_ca_trusted
 #define restrict_link_to_ima restrict_link_by_builtin_trusted