| /Linux-v5.10/security/keys/ |
| D | keyring.c | 76 static int keyring_instantiate(struct key *keyring,
78 static void keyring_revoke(struct key *keyring);
79 static void keyring_destroy(struct key *keyring);
80 static void keyring_describe(const struct key *keyring, struct seq_file *m);
81 static long keyring_read(const struct key *keyring,
107 static void keyring_publish_name(struct key *keyring) in keyring_publish_name() argument
111 if (keyring->description && in keyring_publish_name()
112 keyring->description[0] && in keyring_publish_name()
113 keyring->description[0] != '.') { in keyring_publish_name()
115 list_add_tail(&keyring->name_link, &ns->keyring_name_list); in keyring_publish_name()
[all …]
|
| D | process_keys.c | 223 struct key *keyring; in install_thread_keyring_to_cred() local
228 keyring = keyring_alloc("_tid", new->uid, new->gid, new, in install_thread_keyring_to_cred()
232 if (IS_ERR(keyring)) in install_thread_keyring_to_cred()
233 return PTR_ERR(keyring); in install_thread_keyring_to_cred()
235 new->thread_keyring = keyring; in install_thread_keyring_to_cred()
270 struct key *keyring; in install_process_keyring_to_cred() local
275 keyring = keyring_alloc("_pid", new->uid, new->gid, new, in install_process_keyring_to_cred()
279 if (IS_ERR(keyring)) in install_process_keyring_to_cred()
280 return PTR_ERR(keyring); in install_process_keyring_to_cred()
282 new->process_keyring = keyring; in install_process_keyring_to_cred()
[all …]
|
| D | key.c | 424 struct key *keyring, in __key_instantiate_and_link() argument
431 key_check(keyring); in __key_instantiate_and_link()
453 if (keyring) { in __key_instantiate_and_link()
454 if (test_bit(KEY_FLAG_KEEP, &keyring->flags)) in __key_instantiate_and_link()
457 __key_link(keyring, key, _edit); in __key_instantiate_and_link()
499 struct key *keyring, in key_instantiate_and_link() argument
517 if (keyring) { in key_instantiate_and_link()
518 ret = __key_link_lock(keyring, &key->index_key); in key_instantiate_and_link()
522 ret = __key_link_begin(keyring, &key->index_key, &edit); in key_instantiate_and_link()
526 if (keyring->restrict_link && keyring->restrict_link->check) { in key_instantiate_and_link()
[all …]
|
| D | internal.h | 95 extern int __key_link_lock(struct key *keyring,
99 extern int __key_link_begin(struct key *keyring,
102 extern int __key_link_check_live_key(struct key *keyring, struct key *key);
103 extern void __key_link(struct key *keyring, struct key *key,
105 extern void __key_link_end(struct key *keyring,
112 extern struct key *keyring_search_instkey(struct key *keyring,
115 extern int iterate_over_keyring(const struct key *keyring,
176 extern void keyring_gc(struct key *keyring, time64_t limit);
177 extern void keyring_restriction_gc(struct key *keyring,
|
| D | request_key.c | 79 struct key *keyring = info->data; in umh_keys_init() local
81 return install_session_keyring_to_cred(cred, keyring); in umh_keys_init()
89 struct key *keyring = info->data; in umh_keys_cleanup() local
90 key_put(keyring); in umh_keys_cleanup()
121 struct key *key = rka->target_key, *keyring, *session, *user_session; in call_sbin_request_key() local
137 keyring = keyring_alloc(desc, cred->fsuid, cred->fsgid, cred, in call_sbin_request_key()
141 if (IS_ERR(keyring)) { in call_sbin_request_key()
142 ret = PTR_ERR(keyring); in call_sbin_request_key()
147 ret = key_link(keyring, authkey); in call_sbin_request_key()
193 ret = call_usermodehelper_keys(request_key, argv, envp, keyring, in call_sbin_request_key()
[all …]
|
| /Linux-v5.10/security/integrity/ |
| D | digsig.c | 22 static struct key *keyring[INTEGRITY_KEYRING_MAX]; variable
46 if (!keyring[id]) { in integrity_keyring_from_id()
47 keyring[id] = in integrity_keyring_from_id()
49 if (IS_ERR(keyring[id])) { in integrity_keyring_from_id()
50 int err = PTR_ERR(keyring[id]); in integrity_keyring_from_id()
52 keyring[id] = NULL; in integrity_keyring_from_id()
57 return keyring[id]; in integrity_keyring_from_id()
63 struct key *keyring; in integrity_digsig_verify() local
68 keyring = integrity_keyring_from_id(id); in integrity_digsig_verify()
69 if (IS_ERR(keyring)) in integrity_digsig_verify()
[all …]
|
| D | digsig_asymmetric.c | 22 static struct key *request_asymmetric_key(struct key *keyring, uint32_t keyid) in request_asymmetric_key() argument
43 if (keyring) { in request_asymmetric_key()
47 kref = keyring_search(make_key_ref(keyring, 1), in request_asymmetric_key()
58 if (keyring) in request_asymmetric_key()
60 name, keyring->description, in request_asymmetric_key()
82 int asymmetric_verify(struct key *keyring, const char *sig, in asymmetric_verify() argument
101 key = request_asymmetric_key(keyring, be32_to_cpu(hdr->keyid)); in asymmetric_verify()
|
| D | Kconfig | 29 to "lock" certain keyring to prevent adding new keys.
53 keyring.
56 bool "Provide keyring for platform/firmware trusted keys"
60 Provide a separate, distinct keyring for platform trusted keys, which
81 Enable loading of keys to the .platform keyring and blacklisted
82 hashes to the .blacklist keyring for powerpc based platforms.
|
| D | integrity.h | 200 int asymmetric_verify(struct key *keyring, const char *sig,
203 static inline int asymmetric_verify(struct key *keyring, const char *sig, in asymmetric_verify() argument
211 int ima_modsig_verify(struct key *keyring, const struct modsig *modsig);
213 static inline int ima_modsig_verify(struct key *keyring, in ima_modsig_verify() argument
|
| /Linux-v5.10/certs/ |
| D | Kconfig | 23 Provide a system keyring to which trusted keys can be added. Keys in
24 the keyring are considered to be trusted. Keys may be added at will
27 keys already in the keyring.
29 Keys in this keyring are used by module signature checking.
32 string "Additional X.509 keys for default system keyring"
37 system keyring. Any certificate used for module signing is implicitly
40 NOTE: If you previously provided keys for the system keyring in the
50 system keyring without recompiling the kernel.
61 bool "Provide a keyring to which extra trustable keys may be added"
64 If set, provide a keyring to which extra keys may be added, provided
[all …]
|
| /Linux-v5.10/Documentation/security/ |
| D | digsig.rst | 63 * @keyring: keyring to search key in
75 int digsig_verify(struct key *keyring, const char *sig, int siglen,
82 to generate signatures, to load keys into the kernel keyring.
84 When the key is added to the kernel keyring, the keyid defines the name
91 -3 --alswrv 0 0 keyring: _ses
92 603976250 --alswrv 0 -1 \_ keyring: _uid.0
95 170323636 --alswrv 0 0 \_ keyring: _module
96 548221616 --alswrv 0 0 \_ keyring: _ima
97 128198054 --alswrv 0 0 \_ keyring: _evm
100 1 key in keyring:
|
| /Linux-v5.10/security/integrity/ima/ |
| D | ima_asymmetric_keys.c | 27 void ima_post_key_create_or_update(struct key *keyring, struct key *key, in ima_post_key_create_or_update() argument
41 queued = ima_queue_key(keyring, payload, payload_len); in ima_post_key_create_or_update()
62 keyring->description, KEY_CHECK, 0, in ima_post_key_create_or_update()
63 keyring->description); in ima_post_key_create_or_update()
|
| D | ima_queue_keys.c | 66 static struct ima_key_entry *ima_alloc_key_entry(struct key *keyring, in ima_alloc_key_entry() argument
77 entry->keyring_name = kstrdup(keyring->description, in ima_alloc_key_entry()
93 keyring->description, in ima_alloc_key_entry()
103 bool ima_queue_key(struct key *keyring, const void *payload, in ima_queue_key() argument
109 entry = ima_alloc_key_entry(keyring, payload, payload_len); in ima_queue_key()
|
| D | Kconfig | 207 keyring.
219 and verified by a public key on the trusted IMA keyring.
231 and verified by a key on the trusted IMA keyring.
255 bool "Require all keys on the .ima keyring be signed (deprecated)"
262 keyring be signed by a key on the system trusted keyring.
279 IMA keys to be added may be added to the system secondary keyring,
289 This option creates an IMA blacklist keyring, which contains all
290 revoked IMA keys. It is consulted before any other keyring. If
295 bool "Load X509 certificate onto the '.ima' trusted keyring"
300 loaded on the .ima trusted keyring. These public keys are
[all …]
|
| /Linux-v5.10/fs/cifs/ |
| D | cifs_spnego.c | 193 struct key *keyring; in init_cifs_spnego() local
208 keyring = keyring_alloc(".cifs_spnego", in init_cifs_spnego()
213 if (IS_ERR(keyring)) { in init_cifs_spnego()
214 ret = PTR_ERR(keyring); in init_cifs_spnego()
226 set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags); in init_cifs_spnego()
227 cred->thread_keyring = keyring; in init_cifs_spnego()
231 cifs_dbg(FYI, "cifs spnego keyring: %d\n", key_serial(keyring)); in init_cifs_spnego()
235 key_put(keyring); in init_cifs_spnego()
|
| /Linux-v5.10/Documentation/security/keys/ |
| D | core.rst | 10 other keys. Processes each have three standard keyring subscriptions that a
68 actual "key". In the case of a keyring, this is a list of keys to which
69 the keyring links; in the case of a user-defined key, it's an arbitrary
116 (+) "keyring"
140 * Each process subscribes to three keyrings: a thread-specific keyring, a
141 process-specific keyring, and a session-specific keyring.
143 The thread-specific keyring is discarded from the child when any sort of
144 clone, fork, vfork or execve occurs. A new keyring is created only when
147 The process-specific keyring is replaced with an empty one in the child on
149 shared. execve also discards the process's process keyring and creates a
[all …]
|
| D | request-key.rst | 46 does not need to link the key to a keyring to prevent it from being immediately
63 The userspace interface links the key to a keyring associated with the process
96 keyring that contains a link to auth key V.
104 Kerberos TGT key). It just requests the appropriate key, and the keyring
105 search notes that the session keyring has auth key V in its bottom level.
152 A search of any particular keyring proceeds in the following fashion:
155 firstly calls key_permission(SEARCH) on the keyring it's starting with,
158 2) It considers all the non-keyring keys within that keyring and, if any key
164 3) It then considers all the keyring-type keys in the keyring it's currently
165 searching. It calls key_permission(SEARCH) on each keyring, and if this
[all …]
|
| /Linux-v5.10/scripts/ |
| D | extract-sys-certs.pl | 21 my $keyring = $ARGV[1];
154 open FD, ">$keyring" || die $keyring;
157 die "$keyring" if (!defined($len));
158 die "Short write on $keyring\n" if ($len != $size);
159 close(FD) || die $keyring;
|
| /Linux-v5.10/include/keys/ |
| D | system_keyring.h | 15 extern int restrict_link_by_builtin_trusted(struct key *keyring,
26 struct key *keyring,
68 extern void __init set_platform_trusted_keys(struct key *keyring);
70 static inline void set_platform_trusted_keys(struct key *keyring) in set_platform_trusted_keys() argument
|
| /Linux-v5.10/net/dns_resolver/ |
| D | dns_key.c | 331 struct key *keyring; in init_dns_resolver() local
344 keyring = keyring_alloc(".dns_resolver", in init_dns_resolver()
349 if (IS_ERR(keyring)) { in init_dns_resolver()
350 ret = PTR_ERR(keyring); in init_dns_resolver()
360 set_bit(KEY_FLAG_ROOT_CAN_CLEAR, &keyring->flags); in init_dns_resolver()
361 cred->thread_keyring = keyring; in init_dns_resolver()
365 kdebug("DNS resolver keyring: %d\n", key_serial(keyring)); in init_dns_resolver()
369 key_put(keyring); in init_dns_resolver()
|
| /Linux-v5.10/include/linux/ |
| D | key.h | 382 extern key_ref_t key_create_or_update(key_ref_t keyring,
394 extern int key_link(struct key *keyring,
402 extern int key_unlink(struct key *keyring,
412 extern int restrict_link_reject(struct key *keyring,
417 extern int keyring_clear(struct key *keyring);
419 extern key_ref_t keyring_search(key_ref_t keyring,
424 extern int keyring_add_key(struct key *keyring,
427 extern int keyring_restrict(key_ref_t keyring, const char *type,
|
| D | key-type.h | 172 struct key *keyring,
177 struct key *keyring,
183 struct key *keyring, in key_negate_and_link() argument
186 return key_reject_and_link(key, timeout, ENOKEY, keyring, authkey); in key_negate_and_link()
|
| D | digsig.h | 47 int digsig_verify(struct key *keyring, const char *sig, int siglen,
52 static inline int digsig_verify(struct key *keyring, const char *sig, in digsig_verify() argument
|
| /Linux-v5.10/fs/crypto/ |
| D | keyring.c | 135 static struct key *search_fscrypt_keyring(struct key *keyring, in search_fscrypt_keyring() argument
143 key_ref_t keyref = make_key_ref(keyring, true /* possessed */); in search_fscrypt_keyring()
203 struct key *keyring; in allocate_filesystem_keyring() local
209 keyring = keyring_alloc(description, GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, in allocate_filesystem_keyring()
213 if (IS_ERR(keyring)) in allocate_filesystem_keyring()
214 return PTR_ERR(keyring); in allocate_filesystem_keyring()
221 smp_store_release(&sb->s_master_keys, keyring); in allocate_filesystem_keyring()
238 struct key *keyring; in fscrypt_find_master_key() local
247 keyring = smp_load_acquire(&sb->s_master_keys); in fscrypt_find_master_key()
248 if (keyring == NULL) in fscrypt_find_master_key()
[all …]
|
| /Linux-v5.10/Documentation/crypto/ |
| D | asymmetric-keys.rst | 338 1) Restrict using the kernel builtin trusted keyring
343 The kernel builtin trusted keyring will be searched for the signing key.
344 If the builtin trusted keyring is not configured, all links will be
354 signing key. If the secondary trusted keyring is not configured, this
359 3) Restrict using a separate key or keyring
362 - "key_or_keyring:<key or keyring serial number>[:chain]"
368 serial number for a keyring.
371 within the destination keyring will also be searched for signing keys.
373 certificate in order (starting closest to the root) to a keyring. For
374 instance, one keyring can be populated with links to a set of root
[all …]
|
