[PATCH 1/3] crypto: af_alg - Make cbc(paes) privileged-only

[Eric Biggers <ebiggers@kernel.org>]

So far the only reported use cases for cbc(paes) have involved processes
running as root.  Therefore, make af_alg_restrict=1 allow only
privileged use of this algorithm for now.

Fixes: 947d62c09436 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 crypto/algif_skcipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 4c86b1993bde..68b48d805e92 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -41,7 +41,7 @@ static const struct af_alg_allowlist_entry skcipher_allowlist[] = {
 	{ "cbc(aes)", true }, /* iwd */
 	{ "cbc(des)", true }, /* iwd */
 	{ "cbc(des3_ede)", true }, /* iwd */
-	{ "cbc(paes)", false }, /* caam and others */
+	{ "cbc(paes)", true }, /* caam and others */
 	{ "ctr(aes)", true }, /* iwd */
 	{ "ecb(aes)", true }, /* iwd, bluez */
 	{ "ecb(des)", true }, /* iwd */
-- 
2.55.0