Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
openeuler
Kernel
提交
9e3ff386
K
Kernel
项目概览
openeuler
/
Kernel
12 个月 前同步成功
通知
5
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
K
Kernel
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
9e3ff386
编写于
2月 09, 2012
作者:
J
James Morris
浏览文件
操作
浏览文件
下载
差异文件
Merge branch 'next-queue' into next
上级
2eb6038c
4c2c3927
变更
10
显示空白变更内容
内联
并排
Showing
10 changed file
with
28 addition
and
3 deletion
+28
-3
Documentation/networking/dns_resolver.txt
Documentation/networking/dns_resolver.txt
+4
-0
Documentation/security/keys.txt
Documentation/security/keys.txt
+4
-0
drivers/char/tpm/Kconfig
drivers/char/tpm/Kconfig
+0
-1
fs/cifs/cifsacl.c
fs/cifs/cifsacl.c
+1
-0
fs/nfs/idmap.c
fs/nfs/idmap.c
+1
-0
include/linux/key.h
include/linux/key.h
+1
-0
net/dns_resolver/dns_key.c
net/dns_resolver/dns_key.c
+1
-0
security/integrity/ima/Kconfig
security/integrity/ima/Kconfig
+1
-1
security/integrity/ima/ima_policy.c
security/integrity/ima/ima_policy.c
+1
-0
security/keys/keyctl.c
security/keys/keyctl.c
+14
-1
未找到文件。
Documentation/networking/dns_resolver.txt
浏览文件 @
9e3ff386
...
...
@@ -102,6 +102,10 @@ implemented in the module can be called after doing:
If _expiry is non-NULL, the expiry time (TTL) of the result will be
returned also.
The kernel maintains an internal keyring in which it caches looked up keys.
This can be cleared by any process that has the CAP_SYS_ADMIN capability by
the use of KEYCTL_KEYRING_CLEAR on the keyring ID.
===============================
READING DNS KEYS FROM USERSPACE
...
...
Documentation/security/keys.txt
浏览文件 @
9e3ff386
...
...
@@ -554,6 +554,10 @@ The keyctl syscall functions are:
process must have write permission on the keyring, and it must be a
keyring (or else error ENOTDIR will result).
This function can also be used to clear special kernel keyrings if they
are appropriately marked if the user has CAP_SYS_ADMIN capability. The
DNS resolver cache keyring is an example of this.
(*) Link a key into a keyring:
...
...
drivers/char/tpm/Kconfig
浏览文件 @
9e3ff386
...
...
@@ -5,7 +5,6 @@
menuconfig TCG_TPM
tristate "TPM Hardware Support"
depends on HAS_IOMEM
depends on EXPERIMENTAL
select SECURITYFS
---help---
If you have a TPM security chip in your system, which
...
...
fs/cifs/cifsacl.c
浏览文件 @
9e3ff386
...
...
@@ -556,6 +556,7 @@ init_cifs_idmap(void)
/* instruct request_key() to use this special keyring as a cache for
* the results it looks up */
set_bit
(
KEY_FLAG_ROOT_CAN_CLEAR
,
&
keyring
->
flags
);
cred
->
thread_keyring
=
keyring
;
cred
->
jit_keyring
=
KEY_REQKEY_DEFL_THREAD_KEYRING
;
root_cred
=
cred
;
...
...
fs/nfs/idmap.c
浏览文件 @
9e3ff386
...
...
@@ -198,6 +198,7 @@ int nfs_idmap_init(void)
if
(
ret
<
0
)
goto
failed_put_key
;
set_bit
(
KEY_FLAG_ROOT_CAN_CLEAR
,
&
keyring
->
flags
);
cred
->
thread_keyring
=
keyring
;
cred
->
jit_keyring
=
KEY_REQKEY_DEFL_THREAD_KEYRING
;
id_resolver_cache
=
cred
;
...
...
include/linux/key.h
浏览文件 @
9e3ff386
...
...
@@ -155,6 +155,7 @@ struct key {
#define KEY_FLAG_IN_QUOTA 3
/* set if key consumes quota */
#define KEY_FLAG_USER_CONSTRUCT 4
/* set if key is being constructed in userspace */
#define KEY_FLAG_NEGATIVE 5
/* set if key is negative */
#define KEY_FLAG_ROOT_CAN_CLEAR 6
/* set if key can be cleared by root without permission */
/* the description string
* - this is used to match a key against search criteria
...
...
net/dns_resolver/dns_key.c
浏览文件 @
9e3ff386
...
...
@@ -281,6 +281,7 @@ static int __init init_dns_resolver(void)
/* instruct request_key() to use this special keyring as a cache for
* the results it looks up */
set_bit
(
KEY_FLAG_ROOT_CAN_CLEAR
,
&
keyring
->
flags
);
cred
->
thread_keyring
=
keyring
;
cred
->
jit_keyring
=
KEY_REQKEY_DEFL_THREAD_KEYRING
;
dns_resolver_cache
=
cred
;
...
...
security/integrity/ima/Kconfig
浏览文件 @
9e3ff386
...
...
@@ -9,7 +9,7 @@ config IMA
select CRYPTO_HMAC
select CRYPTO_MD5
select CRYPTO_SHA1
select TCG_TPM if
!S390
&& !UML
select TCG_TPM if
HAS_IOMEM
&& !UML
select TCG_TIS if TCG_TPM
help
The Trusted Computing Group(TCG) runtime Integrity
...
...
security/integrity/ima/ima_policy.c
浏览文件 @
9e3ff386
...
...
@@ -62,6 +62,7 @@ static struct ima_measure_rule_entry default_rules[] = {
{.
action
=
DONT_MEASURE
,.
fsmagic
=
SYSFS_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
DONT_MEASURE
,.
fsmagic
=
DEBUGFS_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
DONT_MEASURE
,.
fsmagic
=
TMPFS_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
DONT_MEASURE
,.
fsmagic
=
RAMFS_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
DONT_MEASURE
,.
fsmagic
=
SECURITYFS_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
DONT_MEASURE
,.
fsmagic
=
SELINUX_MAGIC
,.
flags
=
IMA_FSMAGIC
},
{.
action
=
MEASURE
,.
func
=
FILE_MMAP
,.
mask
=
MAY_EXEC
,
...
...
security/keys/keyctl.c
浏览文件 @
9e3ff386
...
...
@@ -388,11 +388,24 @@ long keyctl_keyring_clear(key_serial_t ringid)
keyring_ref
=
lookup_user_key
(
ringid
,
KEY_LOOKUP_CREATE
,
KEY_WRITE
);
if
(
IS_ERR
(
keyring_ref
))
{
ret
=
PTR_ERR
(
keyring_ref
);
/* Root is permitted to invalidate certain special keyrings */
if
(
capable
(
CAP_SYS_ADMIN
))
{
keyring_ref
=
lookup_user_key
(
ringid
,
0
,
0
);
if
(
IS_ERR
(
keyring_ref
))
goto
error
;
if
(
test_bit
(
KEY_FLAG_ROOT_CAN_CLEAR
,
&
key_ref_to_ptr
(
keyring_ref
)
->
flags
))
goto
clear
;
goto
error_put
;
}
ret
=
keyring_clear
(
key_ref_to_ptr
(
keyring_ref
));
goto
error
;
}
clear:
ret
=
keyring_clear
(
key_ref_to_ptr
(
keyring_ref
));
error_put:
key_ref_put
(
keyring_ref
);
error:
return
ret
;
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录