mbox series

[0/3] Add digitalSignature enforcement keyring restrictions

Message ID 20230508220708.2888510-1-eric.snowberg@oracle.com
Headers show
Series Add digitalSignature enforcement keyring restrictions | expand

Message

Eric Snowberg May 8, 2023, 10:07 p.m. UTC 
X.509 certificates may contain a key usage extension [1]. The key usage
extension defines the purpose of the certificate. One area of
interest is the digitalSignature. The digitalSignature usage is
typically used for code signing (integrity). 

Within the "Add CA enforcement key restrictions" [2] series, the
digitalSignature is being saved.  This series builds upon the previous
one and adds restrictions based on the digitalSignature usage.  

A new keyring restriction called restrict_link_by_digsig is added. The new
restriction only allows keys that contain digitalSignature usage within
it.

The first two keyrings to use this restriction are the .ima and .evm
keyrings.  With this update, only keys containing a digitalSignature 
will be allowed in either keyring.

1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
2. https://lore.kernel.org/all/20230329220231.h6afgarrvdlwwdjc@kernel.org/T/

Eric Snowberg (3):
  KEYS: DigitalSignature link restriction
  integrity: Enforce digitalSignature usage in the ima and evm keyrings
  integrity: Remove EXPERIMENTAL from Kconfig

 certs/system_keyring.c            | 52 +++++++++++++++++++++++++++++++
 crypto/asymmetric_keys/restrict.c | 44 ++++++++++++++++++++++++++
 include/crypto/public_key.h       | 11 +++++++
 include/keys/system_keyring.h     | 11 +++++++
 security/integrity/digsig.c       |  4 +--
 security/integrity/evm/Kconfig    |  3 +-
 security/integrity/ima/Kconfig    |  5 +--
 7 files changed, 125 insertions(+), 5 deletions(-)


base-commit: ac9a78681b921877518763ba0e89202254349d1b

Comments

Jarkko Sakkinen May 10, 2023, 10:31 p.m. UTC | #1 
On Tue May 9, 2023 at 1:07 AM EEST, Eric Snowberg wrote:
> X.509 certificates may contain a key usage extension [1]. The key usage
> extension defines the purpose of the certificate. One area of
> interest is the digitalSignature. The digitalSignature usage is
> typically used for code signing (integrity). 
>
> Within the "Add CA enforcement key restrictions" [2] series, the
> digitalSignature is being saved.  This series builds upon the previous
> one and adds restrictions based on the digitalSignature usage.  
>
> A new keyring restriction called restrict_link_by_digsig is added. The new
> restriction only allows keys that contain digitalSignature usage within
> it.
>
> The first two keyrings to use this restriction are the .ima and .evm
> keyrings.  With this update, only keys containing a digitalSignature 
> will be allowed in either keyring.

... and disallowed if not (for completeness)?

Maybe you want to say that "With this update, keys can be filtered based
on digitalSignature"?

I know, it is only cover letter, not a big deal...

>
> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
> 2. https://lore.kernel.org/all/20230329220231.h6afgarrvdlwwdjc@kernel.org/T/
>
> Eric Snowberg (3):
>   KEYS: DigitalSignature link restriction
>   integrity: Enforce digitalSignature usage in the ima and evm keyrings
>   integrity: Remove EXPERIMENTAL from Kconfig
>
>  certs/system_keyring.c            | 52 +++++++++++++++++++++++++++++++
>  crypto/asymmetric_keys/restrict.c | 44 ++++++++++++++++++++++++++
>  include/crypto/public_key.h       | 11 +++++++
>  include/keys/system_keyring.h     | 11 +++++++
>  security/integrity/digsig.c       |  4 +--
>  security/integrity/evm/Kconfig    |  3 +-
>  security/integrity/ima/Kconfig    |  5 +--
>  7 files changed, 125 insertions(+), 5 deletions(-)
>
>
> base-commit: ac9a78681b921877518763ba0e89202254349d1b
> -- 
> 2.27.0


BR, Jarkko