Pull security subsystem updates from James Morris: "Highlights: - A new LSM, "LoadPin", from Kees Cook is added, which allows forcing of modules and firmware to be loaded from a specific device (this is from ChromeOS, where the device as a whole is verified cryptographically via dm-verity). This is disabled by default but can be configured to be enabled by default (don't do this if you don't know what you're doing). - Keys: allow authentication data to be stored in an asymmetric key. Lots of general fixes and updates. - SELinux: add restrictions for loading of kernel modules via finit_module(). Distinguish non-init user namespace capability checks. Apply execstack check on thread stacks" * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (48 commits) LSM: LoadPin: provide enablement CONFIG Yama: use atomic allocations when reporting seccomp: Fix comment typo ima: add support for creating files using the mknodat syscall ima: fix ima_inode_post_setattr vfs: forbid write access when reading a file into memory fs: fix over-zealous use of "const" selinux: apply execstack check on thread stacks selinux: distinguish non-init user namespace capability checks LSM: LoadPin for kernel file loading restrictions fs: define a string representation of the kernel_read_file_id enumeration Yama: consolidate error reporting string_helpers: add kstrdup_quotable_file string_helpers: add kstrdup_quotable_cmdline string_helpers: add kstrdup_quotable selinux: check ss_initialized before revalidating an inode label selinux: delay inode label lookup as long as possible selinux: don't revalidate an inode's label when explicitly setting it selinux: Change bool variable name to index. KEYS: Add KEYCTL_DH_COMPUTE command ...
Showing the changes to include/uapi (1 of 82 files). Show all
Unified · Split
| @@ -12,6 +12,8 @@ · 11 unmodified lines | ||
| 12 | 12 | #ifndef _LINUX_KEYCTL_H |
| 13 | 13 | #define _LINUX_KEYCTL_H |
| 14 | 14 | |
| 15 | +#include <linux/types.h> | |
| 16 | + | |
| 15 | 17 | /* special process keyring shortcut IDs */ |
| 16 | 18 | #define KEY_SPEC_THREAD_KEYRING -1 /* - key ID for thread-specific keyring */ |
| 17 | 19 | #define KEY_SPEC_PROCESS_KEYRING -2 /* - key ID for process-specific keyring */ |
| @@ -57,5 +59,13 @@ · 39 unmodified lines | ||
| 57 | 59 | #define KEYCTL_INSTANTIATE_IOV 20 /* instantiate a partially constructed key */ |
| 58 | 60 | #define KEYCTL_INVALIDATE 21 /* invalidate a key */ |
| 59 | 61 | #define KEYCTL_GET_PERSISTENT 22 /* get a user's persistent keyring */ |
| 62 | +#define KEYCTL_DH_COMPUTE 23 /* Compute Diffie-Hellman values */ | |
| 63 | + | |
| 64 | +/* keyctl structures */ | |
| 65 | +struct keyctl_dh_params { | |
| 66 | + __s32 private; | |
| 67 | + __s32 prime; | |
| 68 | + __s32 base; | |
| 69 | +}; | |
| 60 | 70 | |
| 61 | 71 | #endif /* _LINUX_KEYCTL_H */ |