path: root/init
diff options
authorDmitry Kasatkin <d.kasatkin@samsung.com>2014-11-05 17:01:15 +0200
committerMimi Zohar <zohar@linux.vnet.ibm.com>2014-11-17 23:12:01 -0500
commitc9cd2ce2bc6313aafa33f8e28d29a8690252f219 (patch)
tree6918661e956daa2bb688ea70103df3cc8859e246 /init
parentfd5f4e9054acbf4f22fac81a358baf3c27aa42ac (diff)
integrity: provide a hook to load keys when rootfs is ready
Keys can only be loaded once the rootfs is mounted. Initcalls are not suitable for that. This patch defines a special hook to load the x509 public keys onto the IMA keyring, before attempting to access any file. The keys are required for verifying the file's signature. The hook is called after the root filesystem is mounted and before the kernel calls 'init'. Changes in v3: * added more explanation to the patch description (Mimi) Changes in v2: * Hook renamed as 'integrity_load_keys()' to handle both IMA and EVM keys by integrity subsystem. * Hook patch moved after defining loading functions Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com> Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Diffstat (limited to 'init')
1 files changed, 5 insertions, 1 deletions
diff --git a/init/main.c b/init/main.c
index e8ae1fef0908..2c1928d08b78 100644
--- a/init/main.c
+++ b/init/main.c
@@ -78,6 +78,7 @@
#include <linux/context_tracking.h>
#include <linux/random.h>
#include <linux/list.h>
+#include <linux/integrity.h>
#include <asm/io.h>
#include <asm/bugs.h>
@@ -1026,8 +1027,11 @@ static noinline void __init kernel_init_freeable(void)
* Ok, we have completed the initial bootup, and
* we're essentially up and running. Get rid of the
* initmem segments and start the user-mode stuff..
+ *
+ * rootfs is available now, try loading the public keys
+ * and default modules
- /* rootfs is available now, try loading default modules */
+ integrity_load_keys();

Privacy Policy