Re: [PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-10-02 Thread Mimi Zohar
On Thu, 2015-09-10 at 22:06 +0300, Dmitry Kasatkin wrote: > If IMA_LOAD_X509 is enabled either directly or indirectly via > IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted > keyring from the kernel. Due to the overlook, KEY_ALLOC_TRUSTED was used in > the >

Re: [PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-10-02 Thread Mimi Zohar
On Thu, 2015-09-10 at 22:06 +0300, Dmitry Kasatkin wrote: > If IMA_LOAD_X509 is enabled either directly or indirectly via > IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted > keyring from the kernel. Due to the overlook, KEY_ALLOC_TRUSTED was used in > the >

Re: [PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-09-23 Thread Dmitry Kasatkin
Hi, Apply this patch, please... Dmitry On Thu, Sep 10, 2015 at 10:06 PM, Dmitry Kasatkin wrote: > If IMA_LOAD_X509 is enabled either directly or indirectly via > IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted > keyring from the kernel. Due to the overlook,

Re: [PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-09-23 Thread Dmitry Kasatkin
Hi, Apply this patch, please... Dmitry On Thu, Sep 10, 2015 at 10:06 PM, Dmitry Kasatkin wrote: > If IMA_LOAD_X509 is enabled either directly or indirectly via > IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted > keyring from the kernel.

[PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-09-10 Thread Dmitry Kasatkin
If IMA_LOAD_X509 is enabled either directly or indirectly via IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted keyring from the kernel. Due to the overlook, KEY_ALLOC_TRUSTED was used in the key_create_or_update() to create keys within the kernel, which caused overriding

[PATCH 1/1] integrity: prevent loading untrusted certificates to IMA trusted keyring

2015-09-10 Thread Dmitry Kasatkin
If IMA_LOAD_X509 is enabled either directly or indirectly via IMA_APPRAISE_SIGNED_INIT, it enables certificate loading to the IMA trusted keyring from the kernel. Due to the overlook, KEY_ALLOC_TRUSTED was used in the key_create_or_update() to create keys within the kernel, which caused overriding