tree 296bf0ce66c4b5b6ab7423e2d149e9be466b0f6e
parent a47c7a6c8aff0563c0ef4adf299268f3c27af0f6
author Dmitry Kasatkin <dmitry.kasatkin@huawei.com> 1445538370 +0300
committer Dmitry Kasatkin <dmitry.kasatkin@huawei.com> 1445538917 +0300

integrity: define '.evm' as a builtin 'trusted' keyring

Require all keys added to the EVM keyring be signed by an
existing trusted key on the system trusted keyring.

This patch also switches IMA to use integrity_init_keyring().

Changes in v3:
* Added 'init_keyring' config based variable to skip initializing
  keyring instead of using  __integrity_init_keyring() wrapper.
* Added dependency back to CONFIG_IMA_TRUSTED_KEYRING

Changes in v2:
* Replace CONFIG_EVM_TRUSTED_KEYRING with IMA and EVM common
  CONFIG_INTEGRITY_TRUSTED_KEYRING configuration option
* Deprecate CONFIG_IMA_TRUSTED_KEYRING but keep it for config
  file compatibility. (Mimi Zohar)

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@huawei.com>