Mimi Zohar
d00a1c72f7
keys: add new trusted key-type ...
Define a new kernel key-type called 'trusted'. Trusted keys are random
number symmetric keys, generated and RSA-sealed by the TPM. The TPM
only unseals the keys, if the boot PCRs and other criteria match.
Userspace can only ever see encrypted blobs.
Based on suggestions by Jason Gunthorpe, several new options have been
added to support additional usages.
The new options are:
migratable= designates that the key may/may not ever be updated
(resealed under a new key, new pcrinfo or new auth.)
pcrlock=n extends the designated PCR 'n' with a random value,
so that a key sealed to that PCR may not be unsealed
again until after a reboot.
keyhandle= specifies the sealing/unsealing key handle.
keyauth= specifies the sealing/unsealing key auth.
blobauth= specifies the sealed data auth.
Implementation of a kernel reserved locality for trusted keys will be
investigated for a possible future extension.
Changelog:
- Updated and added examples to Documentation/keys-trusted-encrypted.txt
- Moved generic TPM constants to include/linux/tpm_command.h
(David Howell's suggestion.)
- trusted_defined.c: replaced kzalloc with kmalloc, added pcrlock failure
error handling, added const qualifiers where appropriate.
- moved to late_initcall
- updated from hash to shash (suggestion by David Howells)
- reduced worst stack usage (tpm_seal) from 530 to 312 bytes
- moved documentation to Documentation directory (suggestion by David Howells)
- all the other code cleanups suggested by David Howells
- Add pcrlock CAP_SYS_ADMIN dependency (based on comment by Jason Gunthorpe)
- New options: migratable, pcrlock, keyhandle, keyauth, blobauth (based on
discussions with Jason Gunthorpe)
- Free payload on failure to create key(reported/fixed by Roberto Sassu)
- Updated Kconfig and other descriptions (based on Serge Hallyn's suggestion)
- Replaced kzalloc() with kmalloc() (reported by Serge Hallyn)
Signed-off-by: David Safford <safford@watson.ibm.com>
Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
2010-11-29 08:55:25 +11:00
oom: document obsolete oom_adj tunable
2010-11-12 07:55:31 -08:00
delay-accounting: reimplement -c for getdelays.c to report information on a target command
2010-10-27 18:03:17 -07:00
ACPI: introduce module parameter acpi.aml_debug_output
2010-08-14 23:02:14 -04:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
OMAP: DSS: Fix documentation regarding 'vram' kernel parameter
2010-11-10 20:51:14 +09:00
Blackfin: document SPI CS limitations with CPHA=0
2010-08-06 12:55:52 -04:00
Documentation: remove anticipatory scheduler info
2010-11-11 12:09:59 +01:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
cgroup: add clone_children control file
2010-10-27 18:03:09 -07:00
Documentation/: it's -> its where appropriate
2010-04-23 02:09:52 +02:00
doc: fix console doc typo
2010-02-24 13:51:32 +01:00
[CPUFREQ] Processor Clocking Control interface driver
2010-01-13 10:55:16 -05:00
Documentation/development-process: more staging info
2010-11-18 15:00:47 -08:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Merge branch 'sh-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6
2010-11-25 06:58:19 +09:00
Fix spelling of 'platform' in comments and doc
2010-02-05 12:22:34 +01:00
[media] lmedm04: driver for DM04/QQBOX updated to version 1.60
2010-10-22 22:22:47 -02:00
lkdtm: add debugfs access and loosen KPROBE ties
2010-03-06 11:26:32 -08:00
fbdev: Update documentation index file.
2010-11-18 15:01:54 +09:00
Documentation: make configfs example code simpler, clearer
2010-11-18 15:00:46 -08:00
firmware: Update hotplug script
2010-08-05 13:53:34 -07:00
Documentation: change email address for Hans Koch
2010-11-18 15:00:46 -08:00
i2c-i801: Add PCI idents for Patsburg 'IDF' SMBus controllers
2010-10-31 21:07:00 +01:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
HID: ntrig: add documention
2010-08-30 15:25:18 +02:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
2010-10-28 12:13:00 -07:00
Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2010-08-04 15:31:02 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Merge branch 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6
2010-10-28 16:18:59 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
KVM: Document that KVM_GET_SUPPORTED_CPUID may return emulated values
2010-10-24 10:52:48 +02:00
thinkpad-acpi: untangle ACPI/vendor backlight selection
2010-08-16 11:54:50 -04:00
Documentation: led drivers lp5521 and lp5523
2010-11-12 07:55:32 -08:00
Merge branch 'v2.6.36-rc8' into for-2.6.37/barrier
2010-10-19 09:13:04 +02:00
Documentation: short descriptions for bh1770glc and apds990x drivers
2010-10-26 16:52:14 -07:00
mmc: add erase, secure erase, trim and secure trim operations
2010-08-12 08:43:30 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Documentation/: it's -> its where appropriate
2010-04-23 02:09:52 +02:00
docs: Add neigh/gc_thresh3 and route/max_size documentation.
2010-11-12 14:03:20 -08:00
Documentation: pci.txt: fix typo
2010-07-11 22:17:45 +02:00
pcmcia: use autoconfiguration feature for ioports and iomem
2010-09-29 17:20:24 +02:00
PM / OPP: Hide OPP configuration when SoCs do not provide an implementation
2010-11-11 01:51:26 +01:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
2010-10-22 20:30:48 -07:00
rcu: Add tracing data to support queueing models
2010-09-23 09:16:53 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
sched: Remove USER_SCHED from documentation
2010-04-02 20:12:01 +02:00
[SCSI] megaraid_sas: Version and documentation update
2010-10-26 11:11:12 -05:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
sh: clkfwk: Kill off unused clk_set_rate_ex().
2010-11-15 18:25:12 +09:00
Merge branch 'topic/hda' into for-linus
2010-10-25 10:40:05 +02:00
spi/ep93xx: implemented driver for Cirrus EP93xx SPI controller
2010-05-25 00:23:16 -06:00
Restrict unprivileged access to kernel syslog
2010-11-12 07:55:32 -08:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Documentation/timers/hpet_example.c: add supporting info for hpet_example
2010-10-26 16:52:11 -07:00
tracing, vmscan: add trace events for LRU list shrinking
2010-10-26 16:52:07 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
USB: teach "devices" file about Wireless and SuperSpeed USB
2010-10-22 10:21:40 -07:00
[media] Support for Elgato Video Capture
2010-10-22 20:55:43 -02:00
mm: highmem documentation
2010-10-26 16:52:08 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
watchdog: docs: add an entry for imx2_wdt
2010-07-01 16:02:55 +00:00
Merge branch 'x86-irq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
2010-10-22 08:54:21 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
add random binaries to .gitignore
2010-04-08 11:34:34 +02:00
mmc: add erase, secure erase, trim and secure trim operations
2010-08-12 08:43:30 -07:00
AppArmor: update Maintainer and Documentation
2010-08-02 15:35:15 +10:00
Documentation/: it's -> its where appropriate
2010-04-23 02:09:52 +02:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
documentation: fix almost duplicate filenames (IO/io-mapping.txt)
2010-07-20 17:49:30 +00:00
Documentation/: it's -> its where appropriate
2010-04-23 02:09:52 +02:00
Documentation update broken web addresses
2010-07-11 21:55:42 +02:00
Document Linux's circular buffering capabilities
2010-03-24 16:31:22 -07:00
Coccinelle: Fix documentation
2010-10-28 00:32:23 +02:00
documentation: fix erroneous email address.
2010-08-11 23:04:10 +09:30
topology/sysfs: Provide book id and siblings attributes
2010-09-09 20:41:25 +02:00
CRED: Fix __task_cred()'s lockdep check and banner comment
2010-07-29 15:16:18 -07:00
Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6
2010-10-28 09:35:11 -07:00
Documentation: DMA-API-HOWTO.txt: rename ARCH_KMALLOC_MINALIGN to ARCH_DMA_MINALIGN
2010-08-14 11:56:46 -07:00
dma-mapping: remove dma_is_consistent API
2010-08-11 08:59:21 -07:00
Merge branch 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-kconfig
2010-02-25 14:43:57 -08:00
Dynamic Debug: Introduce ddebug_query= boot parameter
2010-10-22 10:16:42 -07:00
Documentation/edac.txt: Reflect the sysfs changes at the document
2010-05-10 11:49:30 -03:00
doc: fix Defaultd -> Defaults typo in EISA doc
2010-02-05 12:22:39 +01:00
Documentation/email-clients.txt: update gmail information
2010-03-12 15:52:35 -08:00
i2c: Mark i2c_adapter.id as deprecated
2010-11-15 22:40:38 +01:00
Documentation/gpio.txt: explain poll/select usage
2010-11-18 15:00:46 -08:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
init/main.c: improve usability in case of init binary failure
2010-03-06 11:26:29 -08:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
ipmi: add parameter to limit CPU usage in kipmid
2010-03-12 15:52:39 -08:00
docbook: warn on unused doc entries
2010-09-11 16:49:21 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
cgroups: make swap accounting default behavior configurable
2010-11-25 06:50:45 +09:00
keys: add new trusted key-type
2010-11-29 08:55:25 +11:00
kobject: documentation: Update to refer to kset-example.c.
2010-03-19 07:12:20 -07:00
kprobes: Update document about irq disabled state in kprobe handler
2010-10-14 08:55:27 +02:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
led-class: always implement blinking
2010-11-12 07:55:32 -08:00
Documentation/fs/: split txt and source files
2010-03-12 15:52:35 -08:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
Document Linux's circular buffering capabilities
2010-03-24 16:31:22 -07:00
mutex: Fix annotations to include it in kernel-locking docbook
2010-09-03 08:19:51 +02:00
panic: Add taint flag TAINT_FIRMWARE_WORKAROUND ('I')
2010-05-19 08:37:43 +01:00
Documentation/padata.txt: fix typos etc.
2010-08-11 08:59:18 -07:00
doc: capitalization and other minor fixes in pnp doc
2010-02-05 12:22:44 +01:00
Documentation: remove anticipatory scheduler info
2010-11-11 12:09:59 +01:00
Document the rfkill sysfs ABI
2010-03-10 17:09:33 -05:00
variable name fix to Documentation/rt-mutex-design.txt
2010-06-05 17:39:09 +02:00
Documentation/: it's -> its where appropriate
2010-04-23 02:09:52 +02:00
update email address
2010-07-19 10:56:54 +02:00
Documentation: -stable rules: upstream commit ID requirement reworded
2010-04-22 15:24:56 -07:00
Documentation: update SubmitChecklist for O=objdir and kconfig testing
2010-05-24 07:31:20 -07:00
Documentation: update broken web addresses.
2010-08-04 15:21:40 +02:00
SubmittingPatches: add more about patch descriptions
2010-08-09 20:45:05 -07:00
Fix typos in comments
2010-03-16 11:47:56 +01:00
documentation: update sysrq.txt magic sysrq keys
2010-10-26 17:32:41 -07:00
TOMOYO: Update version to 2.3.0
2010-08-02 15:35:10 +10:00
Documentation/volatile-considered-harmful.txt: correct cpu_relax() documentation
2010-03-24 16:31:20 -07:00
workqueue: add and use WQ_MEM_RECLAIM flag
2010-10-11 15:20:26 +02:00
d00a1c72f7
