diff options
| author | Eric Biggers <ebiggers@kernel.org> | 2026-08-02 16:00:53 -0700 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-08-10 18:34:21 +1000 |
| commit | d9506e82ced5784c220a1ff77c24b6b7d6e4de08 (patch) | |
| tree | a43df7d0a147c7fa5aadbcf6048b6c0246d9cbc5 | |
| parent | 188bb9ad86c3b2d527385328a30c1d9510253202 (diff) | |
| download | linux-next-d9506e82ced5784c220a1ff77c24b6b7d6e4de08.tar.gz linux-next-d9506e82ced5784c220a1ff77c24b6b7d6e4de08.zip | |
crypto: af_alg - Make cbc(paes) privileged-only
So far the only reported use cases for cbc(paes) have involved processes
running as root. Therefore, make af_alg_restrict=1 allow only
privileged use of this algorithm for now.
Fixes: 947d62c09436 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | crypto/algif_skcipher.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c index 4c86b1993bde..68b48d805e92 100644 --- a/crypto/algif_skcipher.c +++ b/crypto/algif_skcipher.c @@ -41,7 +41,7 @@ static const struct af_alg_allowlist_entry skcipher_allowlist[] = { { "cbc(aes)", true }, /* iwd */ { "cbc(des)", true }, /* iwd */ { "cbc(des3_ede)", true }, /* iwd */ - { "cbc(paes)", false }, /* caam and others */ + { "cbc(paes)", true }, /* caam and others */ { "ctr(aes)", true }, /* iwd */ { "ecb(aes)", true }, /* iwd, bluez */ { "ecb(des)", true }, /* iwd */ |