GitHubMirror/sys
1
0
Fork 0
mirror of https://github.com/rwinkhart/sys.git synced 2026-08-28 04:46:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

unix: add KEYCTL_RESTRICT_KEYRING capabilities

Browse Source 
Asymmetric keyrings can require key payloads to be X.509 certificates
signed by a key in a different keyring. This can be helpful for rotating
keys on a live machines for subsystems like IMA while preventing local
tampering.

Tested locally by applying the "key_or_keyring:<id>" restriction to a
keyring.

Change-Id: Ia8dcb343abc5f405d374c357d5cac3d5181d7159
Reviewed-on: https://go-review.googlesource.com/c/sys/+/178400
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
This commit is contained in:
Eric Chiang
2019-09-20 19:08:10 +00:00
committed by Tobias Klauser
parent 0c1ff786ef
commit ef0ce17483
14 changed files with 418 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
unix/zsyscall_linux_amd64.go
+30
View File
@@ -305,6 +305,36 @@ func keyctlDH(cmd int, arg2 *KeyctlDHParams, buf []byte) (ret int, err error) {
// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
func keyctlRestrictKeyringByType(cmd int, arg2 int, keyType string, restriction string) (err error) {
var _p0 *byte
_p0, err = BytePtrFromString(keyType)
if err != nil {
return
}
var _p1 *byte
_p1, err = BytePtrFromString(restriction)
if err != nil {
return
}
_, _, e1 := Syscall6(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0)
if e1 != 0 {
err = errnoErr(e1)
}
return
}
// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
func keyctlRestrictKeyring(cmd int, arg2 int) (err error) {
_, _, e1 := Syscall(SYS_KEYCTL, uintptr(cmd), uintptr(arg2), 0)
if e1 != 0 {
err = errnoErr(e1)
}
return
}
// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
_, _, e1 := Syscall6(SYS_PTRACE, uintptr(request), uintptr(pid), uintptr(addr), uintptr(data), 0, 0)
if e1 != 0 {