tree 14ce6db6429e41389747bc98c87c0c3005899cb4
parent 0c1ff786ef13daa914a3351c5e6b0321aed5960e
author Eric Chiang <ericchiang@google.com> 1558470956 -0700
committer Tobias Klauser <tobias.klauser@gmail.com> 1569006490 +0000

unix: add KEYCTL_RESTRICT_KEYRING capabilities

Asymmetric keyrings can require key payloads to be X.509 certificates
signed by a key in a different keyring. This can be helpful for rotating
keys on a live machines for subsystems like IMA while preventing local
tampering.

Tested locally by applying the "key_or_keyring:<id>" restriction to a
keyring.

Change-Id: Ia8dcb343abc5f405d374c357d5cac3d5181d7159
Reviewed-on: https://go-review.googlesource.com/c/sys/+/178400
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>