From patchwork Wed Nov 24 04:41:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518317 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9E92C433EF for ; Wed, 24 Nov 2021 04:47:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230005AbhKXEuc (ORCPT ); Tue, 23 Nov 2021 23:50:32 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:3400 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229623AbhKXEub (ORCPT ); Tue, 23 Nov 2021 23:50:31 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4UG7B006066; Wed, 24 Nov 2021 04:41:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=IsuOpev9dtIowVHmPnU6Z92IKthwrgBPSZ16xs0tP2M=; b=i+hUvXcL4g7jcQ0peRze3lxbuT6hxA0aUQiDD6wgbZAF8PdX7Al7sYpsWh5k1CzkSJjD JtZcaWjoWdlQN+N8RaSB4tJENHnF6wxhnDbDCQQRJzUwyE3vXKlTUU7578UyZjaDFXk9 ZDCuOAkIzXNjkaomXszKMoKvpS7ombQMmtWuvgCdtpWZI97NKq42ikpHga60oxRrcwlv jLxIOzPLw4viyILR0MVaK6UZQvnjRBocAF927aYvKzgWDcjldkhbuGKyQnDHAKA9TkNS ZreX72BNabNIg7QyEEgRcCdOpxNllRUE1/UZjaKGlmDeoOKsjeGZ9JdwPyopQN4lBOVf 4Q== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg46fewj0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:41:58 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4fXBs181923; Wed, 24 Nov 2021 04:41:57 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2106.outbound.protection.outlook.com [104.47.70.106]) by userp3020.oracle.com with ESMTP id 3ch5tgp37y-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:41:56 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=e8hz31mQAht35chJErJFaZrnyglJZwHKtFiD0eazFRUm297anVWipBSSgUqBTfkwVKQraTFquVIxLrfpXW74YydHBKuHx6R/VsPe/cSXovI8k02AmvkAelBeCxVtCe4i5OpPdJyzEXctWdek2IfthXY/6MCC510zn/RNmzh7SwmPmw8QhwKepMX4KCK3rP6CTO4weI5lhTpvP+kUFDuHBhzGWYfaRz7OuQgIfKwcCXlwKiKYFsn/S374dan2LDwLmwj0bc8zTw21X2b482/6G3iSNIYgzxIZn6+dvAf6cGa3jTMqn+HBahilyzZaJzz+tHwVmw88/CwrZj37YwAulA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IsuOpev9dtIowVHmPnU6Z92IKthwrgBPSZ16xs0tP2M=; b=FSK9NNflxL3VV9Jw3Jy2hKWaKVedLdUC320dD9zA1gvAYtrWjTxdk8qgl0oGcImk85AH8E3A7CLoRymSLZvvrMpuwX51rsCpdbvYTuAPTI1C9+F6gEsGVYpcCqbG6bE63oG2aMrejM6vTfIAU/3at00lrUg1hCUfR3zVfO5K9KGEqi5yzkMvx0eCMocHhGsbnTDc1eRU5udrtIpWEjADaZ/qUf/aNs0ziU3J3E0gRBNeuxv196H61trYy8qlFGiunjawDypcB3fpi53zhoDgfgdjvzD+sgxeGHS4MQhaqTpy+AY7v/aAvu4fGvgLMrqQjH23TUjAIRsFvTycVdu3gA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IsuOpev9dtIowVHmPnU6Z92IKthwrgBPSZ16xs0tP2M=; b=T0F1OwDa0roHjv68QMHb1FHJfAYlC76rYqz/B9nyH69iZyILt5uxYfPvgdnKM2eTKYIo1pNzHhPw9j7URV24nw917xb7t2bOe78iVbi2bbYhRZlIuEOrWssOjJElljF82XhIkNt1jBfKXoXJ2TPZlzsjYnDRjqbGWsmgL93FwP8= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:41:55 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:41:55 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 01/17] KEYS: Create static version of public_key_verify_signature Date: Tue, 23 Nov 2021 23:41:08 -0500 Message-Id: <20211124044124.998170-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:41:51 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e2f9b308-7bfe-43f5-f5ec-08d9af04bda6 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3173; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: LcfnNR7SUZRwnMwfykqLixioibzi+ZSLn9Cn4oSaX0kRPqXXFNIGTOzJP2DqH+5h7ERJyxh2wpqGHvvUljWkWQ7QuO0gfn+laVef1RLlbdEwPio8tPYVPI4HHixuwQn0jmneGqwivehLGH/aQJMujY4LxmwcX3RBwWiRUNrO39kZr5vq18HPD8fBQOQPnmVcft8s8xLabERhbCVL8lGZLji1O5dtBap4RYAPtIkBmohTn4cs2hiU2VxHnTovC4/HNk8+R6DtUibOvr0LQcipKut+2neBK63W4EPY3WU9S0XpA3Zj2MotuowGi5DhhbVTIWAM7owQ9WC4T/DOf4W1UBfXqdEgz+r2t1+LX8NWKNcxkII/PuqXcGef726BLxII1vdldB4H3jTPT0NAi61RRFjyVVvoLavtwz39jt86kMHDpe8lh6iBDKATSGcvXKHp0oZ/4gTZT+NVKyHqTXiAsa3qjuB4h5mSbmvpiJSzsOvb44COgofGAyu+KhiQ2YxYaDsxds0cJP4YDfL5WnmI8TldVJYWZ0W6TQMId17U70FyMPC7OgRZmyKUqOSl5s5CfdC7U5kHuICSRI2MFQxsRp4tMXgID2OtKf1WHs1LT3TO+6AniPML0dEiBhHFAOcTYOskk67bPVbsBWtNo+nD9Dn4uKUaAlds6wH/JbWQUkSIb0QHzjnOFKJW59+M1EgSkEGxe+lR3EOuECy8uc3VLHiCx+lBrVzG0gCI+/GVlmE= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: aRKE8tHWIA8LgPQbF2dZf9I9F0zx7g92uEIykewolc9QpnOGSbvzHgYE/iP47b8h3xaXqmRM+p3pgU3/S9BZZu9LCHodf/NOBHnLQnpXwEBiab/M4fQ0jhPrvZaitIVqVBn6jNwilvp3pRhSTe3ZluQjwXaATizjy3EelyasNJS5OPTN1DcB8RnfN7vMGKChYXlTtAl6tmv5C9qGaZZ00rJbvBprDUmrEqOJRBng+AC2tvdgcsK7Ayt5yf/Z/LXBCy9l8ojW0k0c4b2p8OIJ37uOvLu56eAVtt0/C6eExbE5kRoG/P9/+XdZ/9GPoqiaTE1vDR39C3tVSh1XASGMj9WJnzwhE1UGSn1NQnduK3g2+IhIt8pJnevXzqGMs+yJY1YfuYBuGIfppiuQlu7VfhNm0iRqoPhTl61VKCg9v9KG9wC+RSAk/ms/AOXsrlbMeasFOR/lKAAecdvCtZZdelIcFUceE9Iz9T9dbHmwcZd8vlykySiiShXSKdhw+y7+FrGgOvX1N0cDr2obzaDB2dWuv5VjyNnVp8FDyV9vkIU5ZxhsYG8UalleJW10Fo347ubgMKw7FOXUvdFkvkxGsliBykUeeBIy821BtikQVml7pT94zKkdnBwbqOPm0+6Wd2Ou7ViOiJn3VesmHipYgtzFt9OcsoIGrrozXtRURyqyga8iTfRsTLJFzR+qmTcuu5+qc4GK5Bsfvh8VcYbYh69L95HKTRKu70x82xjhVYU6XTq7MN+dWQnP1/3R05UAscbY0SexJRcR63QC6cMdJnB1xN5WT8CJAARtaveslBvd0mVbthDEjDO/JKxNxV6r7PPntUOV4EmX5tIqfWNuNLJZvDMETU2dUWACGaoEW6HgzELudQz6z7zo2Q/xTPFxmlMJRa1bz4AUTuPoh2TityTzUlf55UlForogqUkSJZf0ENPTdne8H47IkhM/iJo05LV5m4cVnd8yzJMg4jABf++zFY61HD+ZybMM33kujoBUbCo2h6OzJLNV4Y+GXZOE3+GmQKs8UWLO5uxk0rKpffQKFAKyqP61cvzJp0ppI9LymTqsQWGUOmMSj2uXrt/A2I1ED56iGdJzuOux3yifRdaMk21ZoJ/NDpyHBKsbpVPOisytGhN4YBYs+5GhhxtUZWgO8/PzxYRJ/s6jfiUsTjMzmj8ySFqsXyX/qYsylIsoTRQIwFQ11avHnN+6l7pyki8B/43u+OEy9n4jnzZMPti5lxHR3dwCz8uQX+FC7wKgGRdwEj2A+LZPF8mhxvt7RUZ1oUDVd/gQTaSk8y07Z++I5uLgB1mzggHM/pj/9Bpn9L5fbcj2ktTKUMMddXm0OBI4H3fP5/2LHng66S0MLsETHYbY0Fni5m19FH09ZpgMqgJfsZhehvM+/sfijardpGZRWDe24Gi7iZ5bhKQ8TB1c8u4CbgJ4PM2eH9WMDHgNqMssv9hnFsOf2twkoCCm6AyHMJYHjEojLPIDE/Atg/EKjn0tlJZC3r9HfTVGRIQUBP9Exn14B4sl6+0oup+RkLUOgHWFPF+OUus7q554pE2s/gkpYOvSUsXxVvAo4uwhtl1NaGeXbuOdoUuJLgaEvqL20zXOjfGSXEiYRLFnELCoKZ8SNp9fMOjcpDLYJq7GjpUTPdtPSvOmCg3tNDC0bd0gDHGXwG1GUVnsxP3ElQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: e2f9b308-7bfe-43f5-f5ec-08d9af04bda6 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:41:54.9088 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: sIMwkYNfVI4eRnP1uotzAoiW7x7OXQy1dQ7syntN7g+QLzEN1k3n6Oki6MPUBBqXb5X2cW8VyKaiWnwOjYyfX/1jyvl0w9J74di5Cm4w5ro= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 spamscore=0 phishscore=0 adultscore=0 suspectscore=0 malwarescore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: -cjUQdVIa9FLkRf3ArQiZ6Bip9dSvPkm X-Proofpoint-ORIG-GUID: -cjUQdVIa9FLkRf3ArQiZ6Bip9dSvPkm Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The kernel test robot reports undefined reference to public_key_verify_signature when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined. Create a static version in this case and return -EINVAL. Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v7: Initial version v8: Code unmodified from v7 added Mimi's Reviewed-by --- include/crypto/public_key.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index f603325c0c30..a9b2e600b7cc 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -80,7 +80,16 @@ extern int create_signature(struct kernel_pkey_params *, const void *, void *); extern int verify_signature(const struct key *, const struct public_key_signature *); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) int public_key_verify_signature(const struct public_key *pkey, const struct public_key_signature *sig); +#else +static inline +int public_key_verify_signature(const struct public_key *pkey, + const struct public_key_signature *sig) +{ + return -EINVAL; +} +#endif #endif /* _LINUX_PUBLIC_KEY_H */ From patchwork Wed Nov 24 04:41:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518321 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4207C433EF for ; Wed, 24 Nov 2021 04:43:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241243AbhKXEqS (ORCPT ); Tue, 23 Nov 2021 23:46:18 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:3790 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241093AbhKXEqG (ORCPT ); Tue, 23 Nov 2021 23:46:06 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2vhEq017967; Wed, 24 Nov 2021 04:42:02 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=KshTpDO5KzkSzwU6DyhzNW2eanPPaAMXQ0sjS6wGVW0=; b=NL2Qv04TUX8HjafHaflvhwXWa+yEIRLniJHlqav94Og31VSOnbuoJLLJchETQ+/K6tU4 cD56pZGcECzgdmq5WuCyFP/bGXH34400ZZejszFYaXAPi/P3bcEceOgaUs/TljtGzenJ asUVjsUgwKpoWklExn2IXlV4QT3V+5l/imHYWxgOSEFM4gsqtT//q4DmqeKmx6yfTPXi HGGraYQ5G7C5ybmvKZcSpHKZc0xC3eJMRsw9YtTG4WvQIjgcP0GWL3Uz9tWKhNcZ74p4 KJGKMwtqjBg6SbBIjvvBCMttpMf6Fvwx/ZRxfzYxAszAhW2JRWXDSUg0VgggTVeVRM4r Hg== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpd1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:01 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f4Hr025236; Wed, 24 Nov 2021 04:42:00 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2105.outbound.protection.outlook.com [104.47.70.105]) by aserp3020.oracle.com with ESMTP id 3ceru6am8c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:00 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aZGbOpA/Swi5MNU0nGwfPOK0oJunTaHJTDanDeB+EAbtWpEX8owbZ7j8VYORUq404YB543+AsIkioBYq+us4vX/Z/bvdC4GF0z6x+uI3oyFmCl5hc0MDe6l4WVK6chvlKlnJfzfRjpYjjvH73/ACsXcb/P1wySMPicIabcPWA+P8hCbx6xZECwYlLxOsD4acpkO0R+G9naU86zxWfR5nwB1smxtM4aeZO1aGYo2FRGsi4O+XNbAkM7w0C47bjA8m5jB8ZmUTOTMoMX8XsU248A3xAeuSywUqKEUNGtYpCP2I6X8GbawcZ+7lf86wr7R9zXyhGAcZvknRNucCVa+nSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KshTpDO5KzkSzwU6DyhzNW2eanPPaAMXQ0sjS6wGVW0=; b=ZX24CJSGlw6SYIsyjB3tyRcpcK9V2tV58E0ifUmEs+Uc7lI3GJ6JRXteQ3nF9Wb8tVrtjUUwgpz8bmdmb2UbQw7JeQFQKNdjFqj5eJS6eZ6TCqi1PX/EV07eI1CSkx60FYfIsKuk4PEZkZZM4vAQThdzDPAc+pfau8cDSUmqb3+1Efn8xDEEVwHl/4nhpHv+eu8C1mpHBuczwpXVdrgGeFSWo51qmnA1XsG88LmDs0ZeKA7LzasV40IRoPyOTz3B55m4IaBsVZYnyxyAPt79LcIQDKIpc84RAAv/jRQqZ43H0TuiMAFG3+aNaXoL5srWP+P5g7GrspjHq/Iuppe/+Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KshTpDO5KzkSzwU6DyhzNW2eanPPaAMXQ0sjS6wGVW0=; b=T+JUj4R77sIjIlaATQK9qmWaZ68DAcH8fnVW9wgSgzTBbauanzL1H/Q3fJwoNZbMdxXebWYEX4Mbq4gMFtZB9R2FjUH6gIQCn9qgysFjaV2B9abxlw49kLzb3TIzCz+0KgvNjgYijasAidTnWNWBbpi+9aj+7ZgjIBaq+cSvduo= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:41:58 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:41:58 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 02/17] integrity: Fix warning about missing prototypes Date: Tue, 23 Nov 2021 23:41:09 -0500 Message-Id: <20211124044124.998170-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:41:55 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 247c203f-72ad-4014-834e-08d9af04bfd4 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:115; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: P7rcBXg/gm2BQQpREvFVxqMvttaMnrtTPpByYKCO5ixPgHKkcR5iFoFWNBU3jiw9gj1A1Yr+aGV3fHBJdqJk6wl9Vk2fRVYEpEy/uzSvmXhUo7DyAF9sVhaBKebhcvt/wN7OtoCHpkvxcKxDVvciaByomgzBv/Zyq6M+FSRZfW87OF/Jz3YwyuLW/SQTn2ZSAusSWrif9Z0Adi6fbZNTTk2sGomDdqcCFuwqDhwiDdZLDqq4LvKcJR2aMtssmM0ef4vLsYKMu0E+PqBVHKc1feSDGNcB/oHviSm2U3ek7X4nQgDGY7RY0DWbE+QRxRVrkSwA5HBI5bz/4mgxvE3TrjYkGTnhxtiCxV1fCHwHABeZtSgYdsvaB4+++aCHar+Gd1rtgkZ8WWQfx/2QR8j/ifDaIFmeyqfpldUg8EAlGEJZal3qZ76i31K+Ur4NJ+bmBquLxR5/6G8sJhBfNcbt3zLdN3f0sd+DjGnNX3vavmbM/XNSRcxU2L1KDKogFJYhSVW71XFC8XpoizYnQHS5ehQva7UtXmWMGuj5+3gqjPZJoCWuNs4itxE67HvlmLbHMoSsVWldnR/+7184aYbvrNcDgOjj2Z29POkZoZURnU6mTMKjrt3RYIYd+pRqr3w74QfMgnY8Tasno44t0qWSUM1b7lhlb1jOlJ7yhNSdqjGDQb/2qjtSRzm6NAMdwG5hoiJPNf+HmqKYgMdrYTuN2h7KxirX56kbk7V2GYW22l8= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: i8ShooSxg13yg5NjL7CzOVaTKypcTKizbYThKmzcGiG6SSN3YViyOmjEY7gjmrUAwc7lST7nycDE9zGqozXKmambzxITjMAAK6Nmo82mpMyaNspZMGA9c+Qrgmz5isULLkjmFtYqguHcSg8pYB5P4KIqzQCgh5xulPIsVDy6YWOrm6DljJtrcCd3+wylNvlJ7cPHyRfCHD9N60I/yBCEmg6h2eZ2bWDewMSZrgG84qlWH+lBbjUzh4l3Xa4gTfCglRd1jJ6Yd8CqO2+iA+bs0Z7CXC8e5K9aj45RDMDCZN2c4e1xwkK71FoVPIPBEmZfynuboCQ2hMNd2B85cKB3Vh4vh6AjjIITjl3dXely2kCA7gm8FiXU3GQ801aZZRgnwpskmbfCVFDI5wrcWd1iBhvt8dOTr3agYeHU+ts1P6NvhVQsgezIQu2PZDjxBCrx+jPzHqsh4n4ysR4Mys2kzzvUYBfngRRKsK/kFcXSfDS0e3dMpQtLf765ZQFDa6m2pYW5GujbQDGVqBcdZFK4SBySBvNopuIFzCYIcwcfIHPomNAzIlC3r/eT8S7sCoGSeOUibATDCMZXzCve/UNp0maAXtDun/EAOvd/pFLthCPJsgGCvH6Rn0/vSYhCz4SZQRw53S8I4vB72MfX7UJHDkAG8zrJ0n7kaAHspQw4xYGiU5wQbgfErc/mqwILl3pGBNv00rfa0/Ydk7xpfCXwAjEv0bjGI4FcCjkulz7YOQca5qUST1b/HcX3cb2d8zA49Hz2N35C/tV1fohq3rrnAJ5BunRcmurM176waVbcnpxd1MtdTpPHy3lps1A9I6jzjEqfmD1Us4hgV7PzeGbYAAB0LHgQlSZts5XneNPrKfHQLn7Z0EpMWZdcHyrxr0psF0hjW4AhSY/k8eCVOjHGbuQ19j13psEpvTEPlfkR9F23VxmLh1pwZmZU/8L7wjfFqiWKdT9C4xEaC2XXJOYmeb2F9o5c2gmlltDAx2f29qy0wf98GSe1f2flxgzziY7cqJ64wxhyZolp/FnV9mK1t7gARTY9FexmN7ckm9jXEa7CzyUPNCmihTlZEtiiEQbjLwI353VtoCKd4A3uR5j1DatrHzEWERGv6xsJIre6YF1hizAunN+AQ1nhg9z20mNsNhJ+s0K5dmLTxvIhTEjxUe7MkXXtSMbVRyl2bEebuJI07vvJfIaVId817a9Qx1UCqJFYjgCkJSnJzR8XBS1p42gfO5HcsuXikfaHnzWEGUKWNMu3nH1DUppnFRFPwRQ4iUClTfi6UzOhIVbZhyXZlUlo0BwG3eeCYe2mBw9g0dFfllXtlhSTVaCT8HW2Ja+64hs1rzwswkLrdQuuG2jx3qNluAqTHS0rNoA4TKmcsWEwn505/2sROJcl2im/i3WEbTSVkqYhnaWZlxkENwut4jqyxuhtseYkh8HDf3V3xjgRpQ4n9RYK22HYlUKWx7m2RsK2xsUoxFxp8h7cNWZmG+8y8xUJiTyiv9aYMBF2yyIOCNhMURuRZ1dIa3r8OSTgeczOipokk9zlatdNZSa8Pcc4iFQxsA6dHiO5+FD0craVAfjIszPUbq+XyzhDO3VqAocgUozC9Zw01HK7EnsSZjfXyiBPcaCUhxOuhsRT7/9oq75brMTbWj80CGF1HvHS9MQLzLdl+gxeIDl+sitnjw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 247c203f-72ad-4014-834e-08d9af04bfd4 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:41:58.4404 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rG8pp3VYm2a+WmMwK5iWxoO+s/Ke4eO9JpKqKxkNT+lBemn4XjruR1HCpJTJEjOFgiaSYlMBUyn/XvsSAtb4nvMf4UCbqI26lQTpt+HoO3Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: AZLGD8RpId_qpZ9c8Znpjzy0FRHZJnra X-Proofpoint-ORIG-GUID: AZLGD8RpId_qpZ9c8Znpjzy0FRHZJnra Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org make W=1 generates the following warning in keyring_handler.c security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~ security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~~ Add the missing prototypes by including keyring_handler.h. Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v7: Initial version v8: Code unmodified from v7 added Mimi's Reviewed-by --- security/integrity/platform_certs/keyring_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..e9791be98fd9 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -9,6 +9,7 @@ #include #include #include "../integrity.h" +#include "keyring_handler.h" static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; static efi_guid_t efi_cert_x509_sha256_guid __initdata = From patchwork Wed Nov 24 04:41:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86925C433F5 for ; Wed, 24 Nov 2021 04:44:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240998AbhKXEpx (ORCPT ); Tue, 23 Nov 2021 23:45:53 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:49410 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240961AbhKXEpr (ORCPT ); Tue, 23 Nov 2021 23:45:47 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO30Ehd017974; Wed, 24 Nov 2021 04:42:08 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=vXbaDwbvqrki0Z72mfYDTmwq72frT8KllnQcUTmkhFc=; b=X2ym2q0AKQK27rM/9NJXoeHRwr/Mxi8Rkeeam2/iQl6A8ReVFOwHsrp/dNG9qoNyWkuq EokZjbV1r6lvOs/6I6mDKu5Xg+CZTeHKyoSdN3tg2zfeHlw9qSfp6KYqsWDrL08eutrF HS9g1h2o7Wbn2RTFLtb1v8cwyIedBQY2ZAGLAg5KlQu3Siosy4W472r9z3ymXiSeOHcD +xcavygvAalraXTG2VEQjGBr4DcJrK+FJocyflhl+Yl0Uyebevv+663vlyYyqM7C2GcT RhF7ifBgSt90Ix5/DXBTSW+dri/2Yo8AC1ptnQrPw2TiY7t/gvC9X7NgKpE4z3yI/pGs Eg== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpdp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:07 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f4j7025303; Wed, 24 Nov 2021 04:42:03 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2109.outbound.protection.outlook.com [104.47.70.109]) by aserp3020.oracle.com with ESMTP id 3ceru6ama4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:03 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HAuiybgD6HcbauuFH9EYxALJtmYDALuY0oNAjrDa7uv6fbLmmiGk8lBGkONNE4HXZsA737q0TViavzJPZumgmJQajgVT3XxkE+JIo8kezsLT2Gr16xlFBUx9XbSHfGgwLqb9DvFOAT90trtJj1xskvhSHM7IEis1xo4g6Y96b3TgpcZf2YCQkmntIZQBg+9tQSncRvQgWq/JRIepGTiVyUt2ZJvzsxVD92jszaXg4p2Dcf0f2sgWyGSvSBNYtdy5bYz7k1T3olu+cpyoZ+ZlH1vT73gZ+KlM1buMgomEx3Ac5WjyNnSkyklNkovjrjbxAAzDNkwzOrA+RkwreA4mFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vXbaDwbvqrki0Z72mfYDTmwq72frT8KllnQcUTmkhFc=; b=I0I8iSzaSU8jrta84vY6CEA+kDfiFfa6hYLU0qkmeDQaOJid4ZCBmOm2hVmO/U2e8iuh2Me9iZsezyZ7cDkPNwxgApbVZITv8KrU6KUb1Ni85LHJSodiyPjZoCy6Q+30099rNYJhvsK+y+BHHo3pYEyDLHik2pJa+is0SeWgQdHJ28Laxw4KBjWEPh2Pvct8ebLHQGONsnZgQCyZPapOyMCgW+NY4orXd1GVQIFiMX1dLYDzJhZMm95NPqFVskYZ2tCSUcDyC+6hcTzko/A3BEWwKxOjPJTK53ipAXb3AkIdLnpu6B+HmlaMZRjPmIZ5QgUgp70YW2Bd3H2kBMdg8w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vXbaDwbvqrki0Z72mfYDTmwq72frT8KllnQcUTmkhFc=; b=KUiBfnG2wHNkdBJz5ts8AoYtXer0hWJJ7rzzYRwaK5lSwbUNqbrqNo2bI1PXzYoI0f2Y2usahoo/f4QdLwbOCT1g1QnO75JO0LtpebeJBXCfQ7lbtXd4DTO6eU0CfQ8M04zSynWgnDmKdrtUpLxFr95xsKlZPrTKoC9dd8UGCNE= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:01 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:01 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 03/17] integrity: Introduce a Linux keyring called machine Date: Tue, 23 Nov 2021 23:41:10 -0500 Message-Id: <20211124044124.998170-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:41:58 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 1969bf7c-262f-4b99-3221-08d9af04c172 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 2TYtR9OK4OBPLYLNzBLgIxP6MVsTLLe5I3cdS13YeMPaSMd25n6NqBDqtwB35u6b3k4TjPyDqqLCI4CB55pHzpYvwt9i4CQgxEHOyXPWGTzfZ+ztq8Gqq9KspflJBNvGnJw9CdcortoN7MOvGs/cmJjG87G77gpacbGuZIpEwizhqXJSA8D6hDHBTmGyBc5rjrOz+iucSrXUsbB/7Ca7dAfV+OLYZ9zahmVNgdMmFac4ch0ilA7RQ5mAUa4HnJh9xevyJ6ARUoKQDUNvU993TnIKOfZ9V4susQEzhDCnwuFOHu0uxeupwjpehYz7aGuo4eFjKdI3Y4InhHo7FAbxx3L0LjiqmZXIYBu/CxXi/QlhiGf/UCGoEnnk8bJL2y93lUmgnEkJb/YaFubXu2CWOSAQuv8Rh6XZ0rWMAanhqGEQrSBGNNz4frEeusfpy5jru0ZqsInaiLuyazXAayDJY3RNA79ROf8xJNC8h+E0NKPSnjE2wNCrMD5FyUFMkvaGm2WFx9qniLJpR5oLrZzw/ff5eS1boXgs0+vs5B2Jobimtgoaw3+6vTGJ86lKXiRBUU+HQgO9bDG9Ud2ej5WyEYhBRWq4Jks24dIME1BKPu3Hi4k1dV7KaH4s+cIUiFPe1zcc/OkEXOth1qJmBC0fqj8nJr8JWX8EssyiimZezqn73Yeemo7LamAw/Z6+I1QwGwXMyG9qOz7UWZrnQxlJ1+NrL7z8HimdxOkFxhAKa6g= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: FanqufMJdOGC4dbtniej58hqB8dYkJ09WOjsaBiT+5fwulCJn9S/TeZ7v6BhN16QrvvTAFLH4IevajSbMTuLVilg6lPZpEjd7rdsgaKzJwaUDuE1aW+Wvoeo/6GOKWWWpQmRBuOwHC5zBu6iqqcJZbvAiZzkjGGzlfsuDkemST0yrFWAVBXMJ0U8CzZmpvi5efgdo5UWut3Xfha9AfhmWvgfR5xD3YJPdeOnaEfr9oXlQzU2l4UyFCAobaoCAIw7o5Z4cD4540FoEWA4zd+UqIPnJyiLLpG8FkIJGf99VJ5saj19Rn3eCR+r9WEdOy3yYUl4zLXQwwXOrie060gTPjXznMMskIVWUu6fxLVlRBbG7Hg2LQ9RjYzBIj0kRkQpzQ19Xwm/jpSgympSZAXFdRzN8j+Keg0eDCwjX3M71DLvMwaU+7in2EAZ8q3sUZIXZ8Wb8ucye/Lt5Fv2GFzM0ucZzTHT2nL8k2WIid8AzNfAL4R2a4VcR5s9vIwgd53sP0yeo0E88BYt8UqFewgFz91adxN58pm4f2JdJkehHMMSdqKXGJ67GR/pVkQ3XtZoL1sYqSn1tLkC3qgd53PiQBAS14OI24mBWqRLWH9teMgXo2clEG5unPrcbsqkEUzmrFchyF3JasjYHIjzH0A3ALCoqCHhABjGWBPpkj65OiRr2rD0vOH2KR2BtfEWCCtfoNsgEVD0quOHjROJcLau9GcoC+ZiIUNGwaeexvjssB57QjlTjwk/5w11TOGbQaFWGqnNOCRz4tUj+W6zNziQPxP50szMsTLyY7UP++NlhkEY4En0YkkGdlnCrO7EUX/beknHpO0jI0GW9vQGO1kdE5Lf5L0jYTc0OscVFAh54rII8JxV/kycIQjsx4EkpV4eRwmhawZPNVZqV3TdVRtDnMiSVPrHAk41TDEZXlHEVcY9qla/VOhWCRvqZ8zvQdtqWTGP3IHRVyfiw2iUKuqadDBLzxexHCaqXc73whdydQdwyiaWpRCKepc0aNt+FtFXBtV4NitaB6PPCoBBaAOn+1dlIYAAoxBvJnxn3giVMR+FnAESl3zYDVMQwfe03aV3LzoO9+t0vrj2ikfWP7Y3BmXdxl+H0amh3marF0c+QAWHnZv4Klb7lLMxQa+TncwDuMr1KO+O5seinoD3D53nB81TIyVBS74BFw1bgnfwzIpKk3W0c8a6ai+KY5QU4Y7jkH8GVU3PhOPhBp5qWmwhIs80G8ssHqxBm1TzCb0Z67WPW6g+4b5u4m0CTfQJxAk6vtBpUcUWVbiPLCVba6AeHUtcLypDFbbQwQPZKYGsfrploy53eQg3VkQDD2kDwyF9VmRR67aXkvTfwLk5IxIL4Qqlw6wCz5ajzD3uTIIwkLg4tF2q3cfJaOyY6Rs3LMxzq8JKnVXj50iF4kCNTpGYarw2jLU3gpNVVAmcQ0mMZH6oKHW+vWn8Ai5kBs/GGV57B/461LIFhgVcAjm3/2mwv6lU9jZNKaW2bIrVMRcrXhyhKj0taN6qYIwN6wkrUBQQEAp1PJA6rWJqqVpCeN9s2Xn/RND811bnysXeit2SGw2V2XliJVSPKFv/lDBJjHhn4bijqDNUm4EQe53TbRKhdUi26WjDLxjZ/BNO14dnJYx/gQWtPR7buFXm8Zw9A7CHGjsgYjo11iVOGHuONih/wA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1969bf7c-262f-4b99-3221-08d9af04c172 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:01.1853 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: x/8mRqaJXAWon9195HeB1V8otn37+1ONT+FUQi2o3ssa3hzEoKSZ5xZRTkFXXtnyNReUsk/PIeb8/VOsculG3OVgm5V1o+pKbWgpRez9WjY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: b4ZcVZQM4ZCYITciLdS2XokJsefzwCcC X-Proofpoint-ORIG-GUID: b4ZcVZQM4ZCYITciLdS2XokJsefzwCcC Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Many UEFI Linux distributions boot using shim. The UEFI shim provides what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure Boot DB and MOK keys to validate the next step in the boot chain. The MOK facility can be used to import user generated keys. These keys can be used to sign an end-users development kernel build. When Linux boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux .platform keyring. Define a new Linux keyring called machine. This keyring shall contain just MOK CA keys and not the remaining keys in the platform keyring. This new machine keyring will be used in follow on patches. Unlike keys in the platform keyring, keys contained in the machine keyring will be trusted within the kernel if the end-user has chosen to do so. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen --- v1: Initial version v2: Removed destory keyring code v3: Unmodified from v2 v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" v5: Rename to machine keyring v6: Depend on EFI in kconfig (suggested by Mimi) Test to see if ".platform" keyring is configured in add_to_machine_keyring (suggested by Mimi) v7: Depend on LOAD_UEFI_KEYS instead EFI for mokvar code v8: Code unmodified from v7 added Mimi's Reviewed-by --- security/integrity/Kconfig | 12 ++++++ security/integrity/Makefile | 1 + security/integrity/digsig.c | 1 + security/integrity/integrity.h | 12 +++++- .../platform_certs/machine_keyring.c | 42 +++++++++++++++++++ 5 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 security/integrity/platform_certs/machine_keyring.c diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 71f0177e8716..12879dec251d 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -62,6 +62,18 @@ config INTEGRITY_PLATFORM_KEYRING provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. +config INTEGRITY_MACHINE_KEYRING + bool "Provide a keyring to which CA Machine Owner Keys may be added" + depends on SECONDARY_TRUSTED_KEYRING + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on LOAD_UEFI_KEYS + help + If set, provide a keyring to which CA Machine Owner Keys (MOK) may + be added. This keyring shall contain just CA MOK keys. Unlike keys + in the platform keyring, keys contained in the .machine keyring will + be trusted within the kernel. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 7ee39d66cf16..d0ffe37dc1d6 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o +integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_uefi.o \ platform_certs/keyring_handler.o diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 3b06a01bd0fd..8c315be8ad99 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif ".platform", + ".machine", }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 547425c20e11..730771eececd 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_PLATFORM 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_MACHINE 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, { } #endif + +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +#else +static inline void __init add_to_machine_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c new file mode 100644 index 000000000000..ea2ac2f9f2b5 --- /dev/null +++ b/security/integrity/platform_certs/machine_keyring.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Machine keyring routines. + * + * Copyright (c) 2021, Oracle and/or its affiliates. + */ + +#include "../integrity.h" + +static __init int machine_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE); + if (rc) + return rc; + + pr_notice("Machine keyring initialized\n"); + return 0; +} +device_initcall(machine_keyring_init); + +void __init add_to_machine_keyring(const char *source, const void *data, size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm); + + /* + * Some MOKList keys may not pass the machine keyring restrictions. + * If the restriction check does not pass and the platform keyring + * is configured, try to add it into that keyring instead. + */ + if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, + data, len, perm); + + if (rc) + pr_info("Error adding keys to machine keyring %s\n", source); +} From patchwork Wed Nov 24 04:41:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518325 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8506C4321E for ; Wed, 24 Nov 2021 04:42:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240952AbhKXEpq (ORCPT ); Tue, 23 Nov 2021 23:45:46 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:46946 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234585AbhKXEpp (ORCPT ); Tue, 23 Nov 2021 23:45:45 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2xVs1017989; Wed, 24 Nov 2021 04:42:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=KLpRB1cGYDUcvbeqsx/XmH1lHNSjBsK6VNGjn/B9LVE=; b=PVTg5kRrS+OhXxIuFNvrmTXQNIzTPjivihOhIneWXtFI7KbZyuQPR9S0r9ubBfMnxRt6 PV+b0+0nVRrv+xPizWCbwxuDhUnP4t6lGETtPvdDEdmf4OJumakgcAzw/hEYe9/6Ju+2 jsgzVzPHEBp1eP/O+R/oqpO//sNF7dGQfzveyderr2JmFhJRbZ7aB4lt9PkmFO8ZdBLA HL5Ijf2CgV6CkVNufLbiqL9FHz8n35VbND1tYfCPM2LaexqJ1R6hgT/mWg1tcoJC94SA H1qbyhMrOBowgAjaVIXmanjQJ2tpT5MiExvXD3PauSwg5pWV6ept8atSPhlIQnxExzT6 fQ== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpdw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:07 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4enQk136963; Wed, 24 Nov 2021 04:42:06 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2104.outbound.protection.outlook.com [104.47.70.104]) by aserp3030.oracle.com with ESMTP id 3ceq2fbuf0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:05 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=AiAnJEp1+3T3DKxfmpldtkfRHRkoeAFh9P+oL+ZQiiDA1fBluyoRFXz1b5krDIOtMF+tJC8w8SW2AVF6bBoQWb/CviDApsWhZfoq2w5W0ZC+Aw0QEu39xgYNkw83nQveuWEllPuYhw9kZZY/wGUxotT7fZ4rJpDIrs3ZkVNym/eniP9QjEw+8b135AQAMfxAMEJ36fA5XbhMuHgqEyPEvHhAE+enOV54VQUfdCucICWWNXO3jVSFtpy31O0EJfU6AWU7CE7ACjQYEdq4THBvaWZArTc+XONrWXbB95EHIdJtlTSykpuXsWq4V6r/dJr83f741kbOT8y+jCeHtvWaDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KLpRB1cGYDUcvbeqsx/XmH1lHNSjBsK6VNGjn/B9LVE=; b=m5thF4Yjok1p4v2zFZCDyf+35SG7yAiDwY3xtZxvVLafDwLi0INDJjN2cfHWGvIRVVKUF1LwrFMeG0e2UftPAasA+IfcHJyW1ugxrz0mSnN1XUs3RjjfI7zjW9S4l8iEb3s5R6TKt7/Ei6SnEKRKnSJj96PJjEI8DxZdo5sT7iTXXZs+hs1xgVNb/lAaqkTiP0KHbG4bKcCvASrKYvSorK8OAceFc4VrBd7YcySYvS94W0W+Gh0D6tYp8foyCDcOgd6Wj/KLywcK+IXmVrF0tuLH49Bqn4o9TIg988HINAWMaz3N1kjhelcIJVluTgXYqHAiBNGrpqahqupyTuTGUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KLpRB1cGYDUcvbeqsx/XmH1lHNSjBsK6VNGjn/B9LVE=; b=bqnpWSrd4//OTdhoMuZ48IuSkMaZcMi2fhniWIKOFHpZmxH4SOJlZ1cXD8BOhlM9/iS4p8DAADsSrNTQ9vRGtW6IE6me4pm0f3nSFbWPVtYx1s3qdNVAZwxPuMSyEomDF5ayL0knav3N5MM+Gf+aXfwV5NAzS2BjIopImxfRkBM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:04 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:04 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 04/17] integrity: Do not allow machine keyring updates following init Date: Tue, 23 Nov 2021 23:41:11 -0500 Message-Id: <20211124044124.998170-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:01 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 1bac9187-fa2e-4dfa-8932-08d9af04c30c X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3968; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: bpzq0qeaI4+St/zdBWfKd2MLhfp9YZN0ZTgzsXTlo4rdjtCuOSBpA8LJMypFFJXFN8x+ubz0WHJXcldhVxXTs9vCoDwpRgHRqec/QsYSTpYI0cN7hacBuqnLtdcHlrgd18TN0inKHuhp5pyXnZYhMrqpPmECq33LJUfHpZlsZzfu87xTscj6F9N36OUea43bhMwGIgbKw9+5VFa4Scq4Edb5ZStrGe0I550TZyNYyFUAbkF42LzmoubKyzSLsbDoDi1DGkvxEp2IE0VqOZcBkINTZDe5NG/ZxY+/I+Nnik+rPqWPe1xlJfRVSDLs+HSa6UyhFIXjd0VDuT80/tK+BKypVg+fj8dCUw+iaSul/vK8XcwXsWr01zo6E8ZUZFZQ3wkjE6CejeOXbUXyroqYVl5YCOTqzIWDkYmA2xWU57H0zfuPmDcHxPTLPbtLVvsBQhWzVOwQ8H5rcvFs4ymMpnln5GG9g1jl7VqQ5tAFZm02mkorqivJbGqnO6YoxZV5/8OX9gsboohi0+3LMWEKeFwAZ187WiCLjfjwMasvMMraHDX69/isQi0Hq5tSIClP1Ys5oHR+nioOx3QooMudFluQqEM6LQnyXEnU0fMLLeAtJcoeRbwAKZbk9lzTVF9o4pFSiENlpJlfcCqsI8nMe5l426a7QBzbvEij11oqnVEJxXEygjsJvZcSlZQvW5dA0Gax0dMHzdFy/Q6U+17c77hRlBOCoSTYQhlX128Fpdg= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(15650500001)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: AlOX9FNJ6ys90aHOl8f/6e2OWD4dCZgbCqWE9En/lSfZmZYxE+txRYJzAIRlM8S+/SIXCYwrkxDw0OJ4hALVBy4glVY2GLgpE29a7HiN2LtUz9Z2c38CcsH7ZjVOlUe0QrOAHU2CJ0GYDygvhfvNK4R+OTGOP+ctSsnb7dEvFetB9GsS4RRMX2hS9wt6+5NI6h7NLUDeHjQuXtbrXrlxaLsmomICpn/d+/7pOkjzH7UUTr4uPl/U2G7h017ZTGq5gc+HF39r9wv1zo8V1bu1BGxRKh6NdzERtKZ/l1WT2dWI3JJ6+Y4SsNxAC5V8BksiJdJQgiRvMGdtfB9vstTo/HvYNGOUPDC87r8EWFjpMCdMtfg/p2bQXyDjnE0EamcudAAzMKWxN1Vx0a7NBc28dEJJ+KtWQeV/LCyzWeDVJQyyPqPNM/xWt4gXrC8ENxT6iFbKQlwHY99swB91Vfx/qPvcUdJI8rKbnOymA2gluf1G9j8rIAg9cPOqg5gkcDOtwtI4Xou5Lfen3USaMt2praQKR5RRQYcQ8TrvcdfOgn8or4LCDuII9MvGRZcLP4RMDe+rQcUTbD3Fk2DcDTV4Q0r5SE/BKHZNsu2S0ruwVlCOUv9gyq+Lnm2Ba3xlWR30avFF9rDguRtVf9r5/3Xyclpe2KU2nK/v6dANMlNuLA3d0l2ToEJCH+M/xnj/Q6Mo23zbVN5p64gPdxpW7LxYc9ogria0xL0X2Iirg0dwVBwYKeach2OQ96wHN26rhcg4SH5ZmBCi1GEt43HeK8O6OaD3a/re9uluvkfLuo1jQnXTOoblkt01VdWcEYl3JJtYDOiEgxSjMgJ2FrqCGs1c+d0ObP1uozSS+OxQdaXvyTi8TGhCSkSgJv6Bq5KAJcRzIV7RxvpS0I5wej9foV6P3N12Abcc6FTMwJFyaHMnKGRUPJ8VXrNahqdPqXcSXHRHWSETNkKE07mJLBgvhBis46i71IpXp9V4GyS5vpWSs7mR9Tj6vPYevVU7/vcfALzNUgF1vCcO1Zj2FW+D6tsk/0ozOVlEzb8tJ715AwX+1JDaMRfz7nQ2HYX17wPRvq0YoDTBYnMLs+qcIaMUtLPp6kXJoIqhSRX+d4rCnhNmhYfR2mXuvPApxKFhMVlANTdimG1tidTETK58YtGb+LdzpTUTHgvRQo088IrRgdBvBqwS8Zg0JmzvJtPFVfmeTy5GJhr2JmD0KaDeb02Aw7FckQzB973D9KxKLALhLWEBhSXX0jWylA2zIcSQPUwBABxpshev60aqejP/87X8tHffvL+pqssqTrem69g0od1JIFBmUyPyovDW0hQTe5a/cTnm4XeldoVvM5jQdDUCL21SfkBoOxKffYILZyaUGzl30e2DxoNX3LZ2IM9oSN7JuT2tAEJn38YwViYPTW9dQK/tdeA39egiMzWIv1wKnTQi1IDYh3iTOWM9hntTM8cAKBmBDYr1wZkTlTGlAGIs98Gkx353+ZYbm0mAK1i33qRbeUlW9i2s+gd99lt2pgOGGFN9b8PQFLvxzDr5eokTW2yrDx34J7PR15aBDmkITSGAqFWBhYZnPSieIhOvUh9HK/BMdLmztKFCRZOr/QCY56fwREnEU8N2yxiHNLXno0QpH/XKDKyfbZBuhuwfKSdHvqAnajkCN49UIBoPI3EmdQw9oQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1bac9187-fa2e-4dfa-8932-08d9af04c30c X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:03.9143 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7RIuUa9wdWE/j65m4vio5p/uzND1iHqk1iF9m2acv8Nq/mn3SAnmF2FHpbqexe6fSggm2TauMh3jGPv/SSTD2Ov5QO3axKJlvPTEjANwLi4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 spamscore=0 bulkscore=0 suspectscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: Pp4dHcrNsWgZ7Vm1EnoVOb_CInAOmdRT X-Proofpoint-ORIG-GUID: Pp4dHcrNsWgZ7Vm1EnoVOb_CInAOmdRT Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org The machine keyring is setup during init. No additional keys should be allowed to be added afterwards. Leave the permission as read only. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v2: Initial version v4: Unmodified from v2 v5: Rename to machine keyring v6: Add additional comment (suggested by Jarkko) v7: Unmodified from v6 v8: Code unmodified from v7 added Mimi's Reviewed-by --- security/integrity/digsig.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 8c315be8ad99..910fe29a5037 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -140,7 +140,13 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + + /* + * No additional keys shall be allowed to load into the machine + * keyring following init + */ + if (id != INTEGRITY_KEYRING_MACHINE) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction); From patchwork Wed Nov 24 04:41:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518324 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0CEDC4332F for ; Wed, 24 Nov 2021 04:42:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240971AbhKXEpu (ORCPT ); Tue, 23 Nov 2021 23:45:50 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:47694 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240946AbhKXEpp (ORCPT ); Tue, 23 Nov 2021 23:45:45 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2pLtn011710; Wed, 24 Nov 2021 04:42:11 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=xnEwvXThkwoWyz/p0kAfm8DNajatzhYt2fjx2KY9n/s=; b=z9tuR0MJTY4aW6VRubBtS1d8qbPrXnNDHDin/x1HtIJLwoTQftrQQDCA5tqZ2ia8mlQ5 0Voi/CTq4yibgxUwk6ZlPXrz31tUQP8rmpqXXHfETXP/vtgKRtgXMTGeKuXofnt2yB2o FBVX1KIOUvj5CgODS+M+KWS+G/I/OguDX9eXSe9jB1vG5sgUO4b4dpT1jSy9vDMdMtx3 Pjpo2npDUUpiDJp7Zy8wYVWvFfZrP9fwDOSV1TYQhuDVM1yh1c+uSyjdSX4pReaNPI/1 4nwM+TwNF+s0nWmUAeHSOhB1932uOEGavg7PHkMnAmGDCMzAMlsilSISLOyWB2MeSY4t 4Q== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg5gje9e6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:10 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4enjX136975; Wed, 24 Nov 2021 04:42:09 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2105.outbound.protection.outlook.com [104.47.70.105]) by aserp3030.oracle.com with ESMTP id 3ceq2fbufs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:09 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZY24TV4dMm3CS2PrFh+vhO5obuTMk6kgsf4WQHclfKFcb4JdJsamoa1Ni8LJF/Jr2kEc32cbgsDbYm0hoU10D1iLgk1UdjDxSL6QHzcyVdm/5di2wsQzGXpDTUUIiv2jLVbO5nV4qSJ89FoL0/0Wk1skpfA0EfmWylAGdkZcUAWQhl7j2Aoat2hcy5ZYOSgeEOZOfom6dfFr1jEKMwiNKJnouk0/jvaV/TYlhftKzA+uj3R+/WkL+uav+2G7PT7dTY6ylv8ARqV/Lnv/KcQO4LLNp+KemUYukYdUBhBaKYF37ngVnGVIb1aLIRM8sVUUx/utGGb4KtvmeFQu/w2j0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xnEwvXThkwoWyz/p0kAfm8DNajatzhYt2fjx2KY9n/s=; b=H00lDPkc0+ScwMyWYnf5OPWys+iSjNftHhVHYjLCTB1a64mjj3D4x6zmADivjz8Fo6rTxeMxRIQYd8bML+RUvEQ3VuGj1O5rnkb4pszZH5CgbshJUsmW8pyHwNGcA9p77YfDs8wPjIyfazLZBKQG5YtCGyb0rqShTUcrHR1LQWorubOkEeRM45HIwxrRHpp+zcL1LLPDcZaPTXfnkFpJWzJc4JKv39DghWU3iyQFQDkZyoGeykqXyUkhMpDsS5p4JTPMY67uWrRSrnrchLZYQqIThzfB9GGvb2xATTO36pKqQhhGK568y2rfjKWTIA7QEfbWuj9pUrXesDaexj5YRQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xnEwvXThkwoWyz/p0kAfm8DNajatzhYt2fjx2KY9n/s=; b=pVAP97b8/9C6ehIPxe+ypZh+/kWUr4Ln5vWGCA7JguayFhIgxXP8vGGU8qX517ipVzaNgn2l+u7N7CB2SzJZlryN8DDdjx2Z5PQFc98fBxzuvkT58m9dFHCewZa/GHKUH99h1i0EZvIePTccu5Cw5PRkotvjhWKVvfigvGbqgLk= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:07 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:07 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 05/17] X.509: Parse Basic Constraints for CA Date: Tue, 23 Nov 2021 23:41:12 -0500 Message-Id: <20211124044124.998170-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:04 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7c439d02-3b05-4009-fc38-08d9af04c4da X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5797; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ta1Jus2Q03wrBIjHI+LR1zFJz62QOowUP5OzY3eKM2QLhhpgKAxjNgLDnsONq34v2q+Dvs1LbuXDmZ//KLbEgVNDBnu/q5I7XKAi8KbvUD7L5NgTdZnYKkUDVuizE1SosCLJ5Io7UDyormnMH2tS3ZPWW3Y8MpjFBrROPGxFlUyfFf0rBEqgnOanekKfb4ALYVWByWuRXeJF7URyTujdXxTJmzDPk/vqB7cF6Pd5C0MPH7/H2/j3RUkPmSUKrcsMQ5krZEYfkeBxyRuBsGamVnXgj6BFLTm+rMIg182Lc/okjjWpm0LTHCZ2LMG4ifY/PuwO3KY/n5xtqhLqx3ePFlO4Anr9ZaJ3mXIseckXcxb1x2Iy+p+QRvizMeiCue2pQ87RMW/J3JRYYRfFJ7nLefGPV8GNmjIqhHt5uFu2Gy3cFogXCjTFTxKY363d0A3oVJFptjx/PqvDCi5/9AVlfJNzjvSDbKDmvrfVKvVNSB2rmKdWlhoKXnaC+VghL3RZZFUk2DPDcst2cxxZ0kUU1HAfcI6s84lc1HhDCFIkF7U8rH16rvyWVGdtK+anzIh+Pik7hEfYwS5cgTZIriZUMt5p/9xScafungR9LNqi8nZC/MfBpgRwY9IcSctduGluGOXXsZoYEDISHa/rUTxcWHq1NtNcfF6DaUD6YO/lnihqXLwq0PGtEyNTs1SQcXs8qypO9mVnAoKaIOl4vApiLeub7gMv0HO9zb9eh8MD1TY= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8kGnXol7D9A87D5jJdFM0GO0tubKcmgBVPnHP/UbCDrcHaj+aOclwCxJ27ljkblKDNpduRDa+mU5b9C2hcpf0X+CHujBnnpCG69vtxCqeQSF7NplczOgN6BYIBIBLaGbNyffr+r/c9AFakgP7Rd/3YVQFSe2u0ciDJRw4CeIHnsWzwpIUvL/KD2udt5EWc7E76/gk1Kwi6bbds3lCtgOw2h7zEWa0M0tjG1pv92ajUzZHiBWYydTjzu9ffv1TMxMjiR6eh5Kqn2g36MIUqxEtzz4xJSvLdfuOoaz9T8O2jewDNClIB8AjQ6GcrPBaulLRI3QWB/WxPEnxYUDyplwhsJoHmM91MTA5VpTYfjJaQg3NShIGfqjodqDdKWQSczV4Q36NHdknIyeyra5PpRq1KKnBASfqe6rR0QGTxIoRGJlDfv5HYFVFvgjq0PQZnqwBlVZiovuvL+7etqTcQEAf7AQOKIaB8cpCnGoyNo6vhiYQyahj987iyzKPgE1n+AXcQULr1lDd0wcgews3FvMgdoDmXBo9mTGS02kxtJqslIpOLZDfCDSCUbw8+IhOTMAZbK0Vz88LIMako1/AzxkCPGw+wxgplUHW8A79v53o+derNM5C0+cNGu2A5blCaDgoY9MBZCSI6qCijaWqfWkSpgAKaJva2hzIkT2BDlKZjCjBemM+ZE/IncipciGbeGhwieCraPglmEN8zqDEQ57agAmQD4xghK7HTiYRxBjrAASnykzXJFjqrLEcL3K16aox5Q1AYmJ/6L2Oge53oiixtNPDoQR/6DnO5PtSwRk/FZoEuAfgOewAmrN1TFVXcP8QOpxs7kie4Mi+5uCh5qr7penEZX261pbRdMMQUt32Zxz+jmuYqjjzNUADgHAAtD8p+54N1/TLWUPjUSPMPNMVnrUXfTDEVcKviA/ILpPFUTK5goVCh/Fh1wEEtYElSqSHHWghzxTR25c9M5muAe21cOJSxlJmFv2R0/lRIf8PE5vYu3E75BYOjLXl+MIshs1cMVU4CWS44Xq5vWBaUMyDWoT8wqOgNim33al/sJKW4wtb6mgLkMk1FFjrRuIOFDYZcweReO5VSBGumy0z19+rxyEJ9IZPOtwSb9cLed8qQ4Ma9oZGOfPfTcRTrDzOz+41Mk9H6TnxSA9sloaXKppqtRiPx4Q4U2gJABt3kU1NIy5U+HaWoGf9Ua5c1eUHEbdF1kucK3FTA+K6UuuURupXKglEg9MZB7aFJbR2DreFuQLNTIpE3YHHnr4K9tE/YFbAkzAgl3T6knK7+HhfVRM6vefxpYCUecDNepNZc822Vbf0dwrFrDwhFoFgCGrt65RvaCanS3bqnEDhX4QFXZxNKGYM2X9nPkFarhCYOyFfPwLFeMi4kljefYZrMzpPVuUrP0Oo80y4IOYklWxvPz486mCD5dTg94wDcGPdZxVas4Ye+vGmZCXHUDNKVHs8hsIDIjolL1ZxIcYwWJFFJpyPxPklokTYcv7AIPDIUEznaNLl4rDBakXBhNZsloyifbgdmnMojX5Q7f8ofhNdoXCTX/VXZuLqCv4EJDWdjs5SkaouSy3iAERpCu3lwIcTiYISnelDHiZH3YiSUtR7jq6BL1Vc9AnJIjz52V2SW33T0F+2SDJPqQ/ZWuhqLWq5uK+t6pX5jKLgDPjB6/qHeBJWg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7c439d02-3b05-4009-fc38-08d9af04c4da X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:06.9162 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RjOHWxFKgSspvNH1ZvPwcl6AeVWF7JtwiYG9eDoJ8g0jucGD20d/Tuv46hYL5cRpfWXVPQUMpImUwhuNyIRX6LAzNNn1cLoIuizOemCAXqI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 spamscore=0 bulkscore=0 suspectscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: Co-t4PIr814KqwtStCG67L458RpKEMLq X-Proofpoint-ORIG-GUID: Co-t4PIr814KqwtStCG67L458RpKEMLq Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Parse the X.509 Basic Constraints. The basic constraints extension identifies whether the subject of the certificate is a CA. BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } If the CA is true, store it in a new public_key field call key_is_ca. This will be used in a follow on patch that requires knowing if the public key is a CA. Signed-off-by: Eric Snowberg --- v7: Initial version v8: Moved key_is_ca after key_is_private, recommended by Mimi --- crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++ include/crypto/public_key.h | 1 + 2 files changed, 10 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 6d003096b5bc..f4299b8a4926 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -571,6 +571,15 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_basicConstraints) { + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; + if (v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) + ctx->cert->pub->key_is_ca = true; + } + return 0; } diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index a9b2e600b7cc..72dcbc06ef9c 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -26,6 +26,7 @@ struct public_key { void *params; u32 paramlen; bool key_is_private; + bool key_is_ca; const char *id_type; const char *pkey_algo; }; From patchwork Wed Nov 24 04:41:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517030 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35764C4321E for ; Wed, 24 Nov 2021 04:42:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240988AbhKXEpw (ORCPT ); Tue, 23 Nov 2021 23:45:52 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:48540 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240954AbhKXEpq (ORCPT ); Tue, 23 Nov 2021 23:45:46 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2fhmP011762; Wed, 24 Nov 2021 04:42:14 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=bvXxjYGT3h2SNgYJLIBmSebaLZWXkiEYQkpU0HByrOg=; b=lnlDfL3xbtRWKnBbXDUX98/hkrt3O1PcOQoLhAzn87var60sYXFqq+Tn9iNTTcztvtrG +Uzq1XTVTNDWOLuZF8Imt0CdB0ye1XNu57/uHQOtSeLC5vkckevYBCFjGkVjFoFDFjp6 xKW4MMyyzg1uW++aNpZo2725aXxpbLScrVbcf/b+6inLWAGOepOAy6isjNM1iXZg/AK+ m1BSSHYHdl7S4Kmy/2bWqGwxxA44u+AXdi5e0uTEOk82ElW53Tu1dC6PfALzRjTB3VNr UzENUuKO70nY8nFOwg/DuoK4IffagXQ+XMX2CQ2pNRcsP6XwZEgzjV8oYyzNTJq2sOZA dg== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg5gje9eb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:14 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4edig036824; Wed, 24 Nov 2021 04:42:12 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2105.outbound.protection.outlook.com [104.47.70.105]) by userp3030.oracle.com with ESMTP id 3cep50s5wd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:12 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=KKqlLMphWkz/kl89lSwKaqDc3ZjyA//zJtgqtTc6USRO6uTJSiIr9Ed9+HYOhVPgP6zW19Q7Q2e/0P0QSxyIXiI0lkeGJK8MFfTFt2r/6qJvjnmiGZFYXh2j5Bivz8UeHybdRMdZnKXBpcFTViNrZQmHCfjT0QLC8ttUb08gxi1qNy5toYqiIBcoNywNQrg/uyyrHsym4ipDL31fIoUPjI3Bx8ZKtPDFJrskC+FTe0kYs0WfV0DHpbuTlXsMTGiXuWzZz+bWI/j6jeCrutrCcufR6kOYay/FpIsbyf9by04Sk7/BMtcqPnzLBefZmjkdi0wczKDIVea0BINSOGArvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bvXxjYGT3h2SNgYJLIBmSebaLZWXkiEYQkpU0HByrOg=; b=ZJV7+c/UY8M50jOHFTOrM74logit3fbq4oJZMJj2+swCOPKeaImHR0ajSbGNQ7Kb7fhD1yBcNeCdwOHeoIm1V7LlsWpHdulI12C5Fo5bW6puJOkgL5e1s+5501zA3Gx9WM+7FBxGNo3mhOfiOVqE7z1dP8jm07L1QclVhuOu/8IBw5FFekYXG0AYxF7uhmougW20N3dvvL56mLWTV6KV6VzB/v9/oNIxJryj+Ym0aoSZBf/kc9bwYyNwT5UUTAK59MmHyFNm2CTD/ZAcHiWdesSv02hJn4oJ89BVY2ZLYRZmq+5QHbLJS9jAEVyDeVQlX0TbPmhV6p+LglIwVQuxsg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=bvXxjYGT3h2SNgYJLIBmSebaLZWXkiEYQkpU0HByrOg=; b=sZ7v3b1nTyTH5KDl0MnAhI1idk9ASHmFFiRhSicrmzssFQAupfYjwHZbG7jTeNAOLivgGo+yUW4Ob4oKhiFfs9puz6BC1y8BEOVo3m4GwpC7YR5DSMeUrDy8KQtpSjyCR0MRkhCF0gwwz37wtXNznEN1UFyVFgZd5G/QDjWqeJI= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:10 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:10 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 06/17] KEYS: CA link restriction Date: Tue, 23 Nov 2021 23:41:13 -0500 Message-Id: <20211124044124.998170-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:07 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 03347e19-07b4-4a97-7783-08d9af04c6d7 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:9508; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: IsNptWKhu8LpBy5yteVaVXkoJE2TeDnjYn8+npyzlsY6VTJIZv4Sw9z4Fv9NRpTTKSvbsYUaXywXfGkmo9baN9CNgwNG3Gxwdcm3qG8DK79NWblin0sqzG4UoDVyYFoCHQO6QqqEpB7zbfEwX2EZN4or8OyrRhL1/VQhfGe5zS3wL4Ah6fkUQ7WbjGh95c5N5p/m1FdRgNtki7Z3MkttA79bQ5FDPcXXBtRW8xSoy6XOEdRUj7rL6LTtXMdrSgsMzQSTXONc+gVwY3L8NkFyaOV7SQDjUI0h8NObRuRGHBo5uLsmOp3DnwJVC6+aikbAqGLGu/ogfIjig8QEOTGxMd6dCEiwJjwIEfMx17TJc5W1yujUKYjPxhCebIkEOJFCsbqlrDH7fk0sPeBGPaQ+VbgsodhGBvt4C8psn8w503krlmEj6LS+4LxyGguIY4fE3wYkHH0kUaS2BItYuEl91J9zP2NIsOyDEBkBVZClhxmkfU2Z65bYzZN7a4DHC4Rc6LSf+3UhwaR2Jekxc3xppBQPvkZjzrAQLc4yy3XfsqcfrWwQSNMc02zHKsX0xUpkht4hNZQsXB8Y/tKo/7L/gVPYyINUtQq2m7EYpL4koBJa7pG9oTM7HjDXWIXb0XAuEPF4N9apLjZw2/OfEvzGaZUifw+MAqtIiQBkeYfTLx2vjHB7aEwWZTJcuX2L2I39ytIG0lBo6quLM7x4CHyHoIOeldhK1QvObHaWMzd40AM= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: zl8CPIHU86XDwPJrATuCcAQnXIJFJLlNnvQVn0r96F5KR4djx+izoj0mdq9Uyq11geLdv2BAT97PtY8EJC9b7Vx6khJmAGgsVqPljSOOEv+rGREkReYP2Lr4euNbStJZgVdoX870IMwRpk7amzlO3os9Me5HjmqD+WJshBYb8eqbU0OBQuprNytgmkwHeo7xbCzSNgcS9tZUBc6g3zwRVaPeOi60lOfP1ibqVhEipy/nkTj4ZH6LUPSIWV91E2t7Ti4hVpeWk30/8HjdA7hf20rZ+ZJ5pJjriD5IVCcOGstVNHTDBvgT8HGNUG6M1VP+yBZZTuP+PHw20MFW7kalLojrJuoHq/XwqUKgjOCNUFvAhzm6MWITXydgRKoqIY+I4l9HjonqW73SmkhNKuvI18mLHLxUrHHoW9vAiVME70P44v9nGiDh5ccmtW6e3gu0GndhNNqiz3chR6+wZcuwW2p/pyhiZwtQMFKkmi3WfNHBn/dAIkxF3LmnZ1IHD2vIW/GSROtTp4jXzRoKky+CeEnyQU1N/s8sKiZe4NLN1Wl3hio3vz1IrDYzS/tUKoa7AZ+DJX1pyvl9pclqVtUyfDgrVS8MqUBVu2ybSnOYRohK8UnTfA6AzTha2P1t4D785bP8wp3znsFewSy6hJMrN7uHbNnLMFDyN6Ex82pzaYvFCSbnOqEs2Agq9IQfvj6cnYMiLduNpdvFToqam2RzXfZwGBKLgblUClPYfsg0jllZYOTx8bBxEwQNuBD0hUkYTjhW6kW8Bsc8GKtNUcudwEUNJn/AoHwHW8lbms/mYgdovhy6fHBN+xUCoTE8UhQ1A9UcvapOSch0275I+946B7LM9fplxENObGulcFi3BVCOWmFuh4pGAVAGeYurETLf4wSrmdN7KY08sN3eQ101NKw839Us1HBjH/H1YyWUbqjh6hBh/xufzc98lcXIXk/nreSc+YTR3Fde5qyXfcHW4RAY41mVUzHlyQ4t8cK/j9drToGfZyYJby083656jjsh3XX2jEmaoDXY3iyGdnmd/nCP93FmBBE0T2t2cYNx8uB7n8oigXqIM9KF50WnXfxltC+8Zgh4Abo7neaa1x3x1RHysHo90eq51BHtfyky/mkYFlMAWrH4vsfp4kz4a54I6MDauKUvkNZaGburT8eL6wx2UIj8ecbGzFIEYiqrQmh/1FfORkQvQUzIQ19XnTQv12wbl1z9n0eF6QoviXQ4Fg1DXVnmpDlm6LIzBifZ4OA2iA2CyIfJRe/XTO9EmfKVJ7uND2TIPJovIcN439CZaTTzIsJJvuqWi1y2/GL1a8sBCId4v845kuVFXk1+sGhu24uh0MA3330Q4wuMNj18hcGM8ozzW5wppuZ6ygjDxD+4RxrDPpaQe8ChbLcyzBQ0Bx5CEeS0uLz1lV+sr7CuoSlrgv96Vfnuiyys45kgfZSm+1rKoo5DK5vPu/IvS8rNQExR8yyzoOca6WrDHlXFXe44JbIIOV2Mz0PKo3bkx3MtoVxvfjexoYhCiNMn2Cdlcg2ezdhQmCieV78RZBXicRig3O6d8JmqduhbxI/dgS2ne+4sRjHhBpBaRwJtIRDhXQMCBNY2P3e8LkScg508u0mdKAt5b5O891SMSV2A2UByRTFo89hfQJJgTLlz3tROA0MFKKtJJuupgXnfwEZtQA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 03347e19-07b4-4a97-7783-08d9af04c6d7 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:10.2535 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: pVTrawcshi82ZXvqc0HqX0WmsTJcw7xvic1VOxvf0Po66HOpjd5WlbMLPmiR3LQPSbjmtNZdadfy+cyrDBgeM0Sj9sFfjSXzUTwtVoVda6g= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: 9ZIcgZvZ1sto9nTS8Q3jghwjasXoP6Id X-Proofpoint-ORIG-GUID: 9ZIcgZvZ1sto9nTS8Q3jghwjasXoP6Id Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed secondary keyring references v3: Removed restrict_link_by_system_trusted_or_ca Simplify restrict_link_by_ca - only see if the key is a CA Did not add __init in front of restrict_link_by_ca in case restriction could be resued in the future v6: Unmodified from v3 v7: Check for CA restruction in public key v8: Fix issue found by build bot when asym keys not defined in the config --- crypto/asymmetric_keys/restrict.c | 43 +++++++++++++++++++++++++++++++ include/crypto/public_key.h | 15 +++++++++++ 2 files changed, 58 insertions(+) diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 84cefe3b3585..a891c598a2aa 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -108,6 +108,49 @@ int restrict_link_by_signature(struct key *dest_keyring, return ret; } +/** + * restrict_link_by_ca - Restrict additions to a ring of CA keys + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @trust_keyring: Unused. + * + * Check if the new certificate is a CA. If it is a CA, then mark the new + * certificate as being ok to link. + * + * Returns 0 if the new certificate was accepted, -ENOKEY if the + * certificate is not a CA. -ENOPKG if the signature uses unsupported + * crypto, or some other error if there is a matching certificate but + * the signature check cannot be performed. + */ +int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + const struct public_key_signature *sig; + const struct public_key *pkey; + + if (type != &key_type_asymmetric) + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; + + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + + pkey = payload->data[asym_crypto]; + if (!pkey) + return -ENOPKG; + + if (!pkey->key_is_ca) + return -ENOKEY; + + return public_key_verify_signature(pkey, sig); +} + static bool match_either_id(const struct asymmetric_key_ids *pair, const struct asymmetric_key_id *single) { diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 72dcbc06ef9c..06e34d3340c4 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -72,6 +72,21 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, const union key_payload *payload, struct key *trusted); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_KEY_TYPE) +extern int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring); +#else +static inline int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + return 0; +} +#endif + extern int query_asymmetric_key(const struct kernel_pkey_params *, struct kernel_pkey_query *); From patchwork Wed Nov 24 04:41:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517031 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BAB7C41535 for ; Wed, 24 Nov 2021 04:42:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240962AbhKXEpr (ORCPT ); Tue, 23 Nov 2021 23:45:47 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:47262 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240532AbhKXEpp (ORCPT ); Tue, 23 Nov 2021 23:45:45 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4RqBk029976; Wed, 24 Nov 2021 04:42:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=rl09tLZmrDubEtA1E/PjCH1B2Vwg0EodjnyFR/cKoBE=; b=wEe1Cr7ZPxfasSU6IwhsVVWOgGcv1t7Rc+CpQt89nwfu19/RR8i9sdH7Zs4ExABV822W Z14xmKV5TXEVQTnvOgrwN1etu6/zQsL/wtl+xsLWVsfbS2DPdDZ4Oe+/mVKCHPGP2Tsu ncRuIhtAl3FqOsyXxtylgayW4ywkoHEWtcoBwz//EVADsvK0S+TGZVSD59xkuGJug4Wt FN3PR2swpMJJI5Gv+cDnnObgr2icRRk7EqUDv87i+bqLZHP+o8BTEalyvC8L1o1oLu7j ZEa6SmWJAIAeFP1voC1o6sLTtGmfj7bVzeNzjguv75vPvyo+VR8pgtZ0NT+nj4veMRlr CQ== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg55g76qb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:16 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f4T8025298; Wed, 24 Nov 2021 04:42:15 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2101.outbound.protection.outlook.com [104.47.70.101]) by aserp3020.oracle.com with ESMTP id 3ceru6amew-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:15 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=MZquMxMQY/pPyAau2m3PScV6PSXCIQb3CHOL5qJETp3gXnzEphUFCkWvX3JU8ZN4E1E/lzKqMXQwgEhF3m6rz8olhCrBDz4/SGJee1xqms2bpZQEtKxmgqb4vr80tFwjt88jUo2SSGhDl+q6tymIo8w10JP3m3xiG/GOeJ42Ef9svE3sj5ncZAjy91unLnB+N6Slly7v3RrAuocAeTeqQb0aUaejZDve0IlDm4oTReNQCi5IZ0MdTKomgJwbhgjLM+xaMLuBW4R3WiY4UgTtZ2Hl3jkJU3Kbk0oxyfzvKIMqs1KyyTX5zf8XkzfShrWKgDXFwNKi16kXLnFwvItEBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rl09tLZmrDubEtA1E/PjCH1B2Vwg0EodjnyFR/cKoBE=; b=OAJueotFEOG1a1kAoNKqKVq7QwlK00blTleZvF5IFir0lNgJu8382MZ1lkAis0gfFrQhzxkZdBgNUYowpPxmZvWD3tdbHb9Tge3F5pQ6fzNj48t2ms8xZe5C08J2/iLxNYVToZvAjVsSX8288NV/i4XjGZRpNSWxAtXJ/5ddiuD1i/43smij4+/WrVt0RSVvPAlBOucj7corTuzW+Tj+uoylYHlV0Z2m88aTN9Yl+xLFBWxGiqsMi1TwMzubKrrVOCfj0j4Qi9tdWFKmkhSSvbJJnrLdECdCpMOwD8ov5L0534k1duY/0no0m+aHugt5Ejdw2+3Emb6jTd729mwbig== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rl09tLZmrDubEtA1E/PjCH1B2Vwg0EodjnyFR/cKoBE=; b=W8fPf+ERuZ5/l6D6iA9XrDwbPY+RI3oviCzzbLdSGe40kFnErYxqlK+p+Cur7E9N281K14uS0Eq/uMXv9LDC/vIzciEV1Iqi9o13pM4rMyGEYV/a8Lw7I2P1ntnDS9f6masDzxMhMZdqXH+NC7X00qqfWbyA4psbFZif+KjBIXE= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:13 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:13 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 07/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Date: Tue, 23 Nov 2021 23:41:14 -0500 Message-Id: <20211124044124.998170-8-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:10 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9fe09eab-3884-43e5-7865-08d9af04c892 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4502; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: QS4eGzyd4iN8cVzs3ugxPbhXlVAAIg2e7nhD7V7+frxAgn27Eznmmo1l3uTZgGbtt4sqj5JF5//4DbMvxK+a/emCVRBvxxl4KjQ0P/PBAcjYKldV5FPK6p4AOwzPuooA+EX5SrEW3ZoV3bavh5MaruAEv41a/AyWYwbBmKnKn9QMlJMVbdNoB4uZvEQ+zca60q0F8Q4Ib8kK6Fi8Xm7Z9gKNAg6kJoe2ET8z4vje8FVT8qSzTjpEqAaYByawwJMfh/yME3M1ZGsQrbiLqYulQHMrjruuhsWhjAIfjzE2W8Ob7zGS4U4lfHhEw5FCp0OlkHIbUf6OYY3VdFGFLwQEZG1oqITYjcL7uZW/Pob8XxohhHIbnJ6wxgAvQk+Rl8ocf0y8GsolQ3a7+PA0kB2LCzdzE/1r/tyzS+i17WRzOY43pnEIuGxcTNI9cRxEbwqt+/MsZ4RayTKRkI+9hc9AzQJPYYDDxKryG9M4p2fn7FChaURHz+yyGXme2SU+HTfSSvkre482hzOYlgROip0xa7V8IjNHWplR+uS5cn+83dFbcSJmxxhGLUz8QS1hD/CMGj62EtaxlJAtISdWDJkR5+eyFnisMQUZD+zZ4jSq3AFO7PGSdR3BLZqrojgKifTaIrLFIw6TdyJACGD8d/Vvxar5U3thzJqZYp9QJGTNIGSj+RH2ssxV0m0IDG0g8tXFqBPY+8WY7mpynAU/C7tGSNMOUVmst3XFHVOCf2xH8mY= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: IWYt5K5JgM8aM4KA/1SIqB0VZzVJMyqO3fWncgzVu5U7AMNmjKlFEtYvzzstmu9yKl6xUSLodGpRPPM+6SE1KNB17Xrn931+pcRBmULgh3AdVBX64wLRPrxpkPcItUegxaP+PE2pzu7j0V+ogu4fx0OBpq6cL4zRfbUjj8jJ/+JAhON7NDX827xiWbDIPIrFcfHOtIqrfLjpv1Gjm71tfDcviy9JSunByGhOeRM0/bICIZ8onE3ak8Py5xvg0qtlI+WdnSxdGYmtxCccH/1AVCvhG4ouL9W/XW7LM5vb0EobZqxYKCIgq3JcNmgNaM7pEoxytMh3TQwOrE20IoDmHh8NHW2+IlrU2UxVoq7SWk6VoUDzoT/XiBG6zofVOqQkYyLl9M+bYnNwXFjvbBcyzzM4JnYxJA7Wrv7nSDjcNZebPlG8olrmBDdjY76JXnCpWWPRsHB3svz58v944mJn3z8CXXLLGweuXaWzV1e5nXY6tan1WFopztSREsyeo+iPHp9aqPh581RSOJnynqSKNOjfOVnk9i5VhmfLcqYjtuqUvCUp3Wn9LuYLaIjEmA/KaSVjAKPm/JEzavW6j2TST4JeJWn51j3LxX+jJY+Z1437H1TCgec6j0/EY/rsxdMWYE+CCRkvpB0UMr3OZIm6ss1TMYRIDJC1adl8DEFpi15rU5VR/7lpmaIKYLsI4YcvSJEH7VHYr+4/aqZV9Usu3txnqwyu/7XBRlTSDH+2PRsTlQLDloKP+/Y/j61Dtj4pr4iKKGDygOgCwwPgvs9goEfTd6BXWfqKZyCFBUD2Eab1OyEfp/vlLNZoxb++3s19nLADjAOUKcMAyMbquof4TuPrF+iOFk0ns2BRyLc8eGCWqwYpLX3oZFMPwUyc0/CKpqZq5LrW6NN51yRxJ2A/QExRGad7l36aj8xwQkx6KErMs4btrPEcTY69AhhmETsM1QsRxgcy31LACJD8GWhf4C/Cr69E2S0cW8Z94ezSg3agc5w2dMrTo3Qbdc9hM5wiVyp1y066QMeKNy58lgiz/uLENF4pTCLdEEuKmUWI+BlPshRuqBeHIE0SOA49qsLX6BelGgz/n1c0LCAiEHvSRfeIm5IACr97dMmsYpnWHPJ8lr5FtWhzzQJKyX2WukyyWWkQ0zu1nAOlvEuJkaZ9vOwPQBzFEMDcQuoWjOHkJ+cjD4VaYHr5g/n+gfKZBY0vwH4UzRbtUpwLcgih6iE2A54aEFbxdXqX5at3dvv5ELGv2l8wzy/wyQpeG98vfrK8xNmEElAgK6JUbZPYfDpj1hxfwq50Vp5l/AiVpAS01DyXUbHrg9+009CxpHvgO3GvEb4L68/8gf18CPdDtQl2VjH6hXdq76JXc8JsmDsct4vMkufYUrKpqs27CsAZNs4e3rckwNgjLGN5mc75HnJNY2HV/ahv8u5++t5ThctghAYRtzTNvgOb/cl+B+w8rifPs76tBzmhpGmlPEID+c0fqXhrVR25fN2zHhWg1R/3lO+QQrmS8tbJTG2Ic8wSOGCvhBDIkXY4QApm3n9/UgquJ6808xFiOl7quZrMu8bqyxqu5Qq4EqQzgPVIDsgbkSZtIUprVzxde2U7KJcIjEDQh7s4NTaGoFK8fiXs3GJ8Qfg/yaIycg/yYSXb6sqfNcy+c5N0+JA8/9SRg8QVizsjfg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9fe09eab-3884-43e5-7865-08d9af04c892 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:13.1250 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 9aAc2tpCWHUMZeVb4vvZ5fjIL6mPZzdoUY06jv4Kx8Q3RIyvf442Y1qH6q+3VFSwkKv5n+hO1lfKOXRyBnEwZEbITXcGN83js9AiuAM3KFo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-ORIG-GUID: 5xYJVHHetiEcw9BmYQgHpbLMfBbn8A2i X-Proofpoint-GUID: 5xYJVHHetiEcw9BmYQgHpbLMfBbn8A2i Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to restrict_link_by_ca. This will only allow CA keys into the machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v1: Initial version v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok keyring gets created even when it isn't enabled v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca v4: removed unnecessary restriction->check set v5: Rename to machine keyring v6: split line over 80 char (suggested by Mimi) v8: Unmodified from v6 --- security/integrity/digsig.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 910fe29a5037..e7dfc55a7c55 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id) goto out; } - if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING)) + if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) && + id != INTEGRITY_KEYRING_MACHINE) return 0; restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); if (!restriction) return -ENOMEM; - restriction->check = restrict_link_to_ima; + if (id == INTEGRITY_KEYRING_MACHINE) + restriction->check = restrict_link_by_ca; + else + restriction->check = restrict_link_to_ima; /* * No additional keys shall be allowed to load into the machine From patchwork Wed Nov 24 04:41:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C0AFC433EF for ; Wed, 24 Nov 2021 04:44:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241235AbhKXErW (ORCPT ); Tue, 23 Nov 2021 23:47:22 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:23110 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241297AbhKXEq2 (ORCPT ); Tue, 23 Nov 2021 23:46:28 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4aFFU029981; Wed, 24 Nov 2021 04:42:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=98HWcp3RjTT+twGfMcSXQUhAoK9z8Bg5Y8ejQ1oirUc=; b=A0SDipaYrFTImMy37NUF3NlJyOao4AnFhDcAkZGfNyMlm8qB1F4EdqH40MmLaYGl5JW7 vxnh/YpC9uD3RgFTPdVaVtIN5cAHPl7IAHvzsSVqmmI0ANoM7IlF/uoFzcVUcld6s3KR 8nrabY7+sHHKljUnB+THROa3XvoQI2C20BzfRDTTxmlAPcX1zREHzqxa5h9r6agYVucq gEbZkQJ0OD3IVKcHou5iOnRkgNhhUgKBJlqHrii80saZoO+2pXGYaDDmp5dCVzV4/oiI mUnu3jvmF3NdOUekQp/pJcd2C/XZMJevReOliqTaWaoZzsCsJJFH257aQiyG8FqsGgn4 qg== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg55g76qg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:19 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f47R025282; Wed, 24 Nov 2021 04:42:18 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2106.outbound.protection.outlook.com [104.47.70.106]) by aserp3020.oracle.com with ESMTP id 3ceru6amfq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:18 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aCrVhaXzJqmqSY3olhQjGv2dIlihpSmKIXzS9fmzAbd9qPWi/kkEK94hZelL66v/Z/CYR35igJO1LOVVxn8ViL0uXLIF121IPKGvoqqj+dIYvuWUI6guuZeJUDh9XsVODFKtUZXepHZ2X5MN3K902YoLpqU+6IB8+d8Kvy/1x1oFziQSHn5LC82UIPVz0iBApmucMfaRtEn1/KkpVlGAlmfK1R4THjOHf6s15Fn66JCnCpFC4+tIC8JlkBWGdcSJ+iPp0lHBbHvuI+CGWyk2A7bt/Xy7MRPLgyCZ269qFQ5Dd1apc6USRjf1gKAPmGUrpff/87lx+K/cqUUd6kT7Bg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=98HWcp3RjTT+twGfMcSXQUhAoK9z8Bg5Y8ejQ1oirUc=; b=WyKf1eNwgnXFx6cCv9vb8687XJT1TPvtIwzt+tig/U4uGyy25SDzHOmkql4pM59kMjOt3cDeQS24wz8veuuZfWwcLC/OKOlM1qv/aHpD8bYCGLpiUUmMim2zo6tA8b498xNMoQ1rK++RTcsVBiwXAnE1r66KAtOMrnuy80x7JHhJhcTmJToyrkiqcDvXtQczIniyiSGkV6mV80CbAfl3BMmBL31pM/LmvZoQQyzHJTaWIsL8ZCPX/9/EW2ObZJ/37eQSO8yGhu0SClFPY3q/xaZDR0hnYY9AtBk8f91fSBI0Nw/qGO2pMwhuaMMSjH2tNWehEI3yEOiY8RrG5OdXkA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=98HWcp3RjTT+twGfMcSXQUhAoK9z8Bg5Y8ejQ1oirUc=; b=D/YNJKVr5jJ+zHxy6shzMjrBCXVZzrhfzJsP9BFKTJZHJUnLFEt0OEQ/qbn8vZevffvk+7qi186+w8se0QD8xmJfqtqpX16Typw8OvfCL6DxRCa78hV94qiv+udCQcmjpy+Vu1XoLDl+noWU4ecVIRx06WBu0U0sekCtQ/1NX8M= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:16 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:16 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 08/17] integrity: add new keyring handler for mok keys Date: Tue, 23 Nov 2021 23:41:15 -0500 Message-Id: <20211124044124.998170-9-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:13 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7b8d0dcb-3131-4320-c122-08d9af04ca5b X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: I6WqQxUvOye4wbudDmrKlz8KKSkudH/KZua8x1/qAhB6TIPcNhxM1WeS9aoVtr5a06MKdkG8Bix6V4ruIwWhV9Q6YVJrQbMmrS6i/fJt2xHK4RXHfo0+rIRDNWau+Go1L92gP83uSbtD1kG0Hw7inRlJ5i2xT2luqhxVeBZOFpdPOBLX5JMqHQYJgWrjnyoe/5Iv2U54yjkllUCAOH+Kd1Brp5AT8XUCgaq2KEHmqwbqCNf/Xnqkv7zkbyg079Z1EjS2OtT4mFKzkeBM3NmqjD82uUjD5hVPIuiM5TbYBtSZL/XU0LF+v+AVoL3lpqOm2FLnq5eqMsAQ21s8GB20CQey73mpRN8iHV83AzGH+Fjxcf9byl1nXVoIHUW5Q5iRQP8i7cJ1S4yyYJ08isL1xTSpTFbtsmnN/6fnaCGn5szl52hOW2JQxJQzHM5v+dKtoVdZdixk3fVxncuUwYArZskx+LLXJsOds66dthM1LnXXJAgRJVAI5zj7CKANW9mnTkQBRmdtXb2XGO9sZnrE8ikbyBnbm0h5BY3Wc/0vl/owNCT8QcQAB3nuRvEAOAAe1/dt0WjhtAhheVElBfzE5vajKI12qZwTKNLYUc7ISqauh8PYDJnuO3j8o25smfoI/kwkoKvYf7SUO5UCLe8Y2eimCOQu3bm7EHx0cP1jyoxNQKam3PVLZqKXRiP/8y2hzAQldXUIPlVtL+e2Vx3HESlrBX6SVZih4XrtOrjUEt8= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 4tgPo7PF/9skYI3L35K6rWIZpLG0Le733FKwm77jDlU+32SJgdDPT9D7DAc9H5yxPQRYh4/Z7fIWpmcgoRPnNUWj3E7FJ+Re0NC/dJj7jzh6q3sIFdtHCsaQlBa/z8TzNjww+mtj5FBfooLRhoOo9O+q779kD/NxTXMMQYkyRrMjw8qiDbfkboWPNWm7L9nsIaAOkKyZELFoSG1dybAhXXTb+lkszMTXxC7XZ1reobX9C83FW/MQ4hsCvxywitAonOgs9wM6dQRnT7QNYAt7RCLjCq3yypZmpdasGTSmAKjmuBGgJwmAXCLuciY31NMQyPHUqj5Va4EPcrZ7P8HUR3y6zDGW29Pny1yLTGN5Ni4cV1AGTLnaKq2cAs+LIt9V9WaaVqAPsGmDTOQH6/o6pzoI7bPBuWJpYfzLszQnXbl3ZJSCi+yXQB78jXCJFw2m56G1V9P2F6wRaeWo8YDow4xlRWjSMNLlMElrHudk2lVGNnItdsbsuqD8R1Zxd0iQwTM0KhZWUAkNV1GJrIKmlL1w2NW38rCDu73AOtuMGm9H98wvyStvH2gSADnQDryWhy+VSxIU5wLxG1ubiAF6cISZid9vLn4YoBPSHdZyFCrDn+X+ulHLaSubtMmbjlMzcxvRgiAhSXlZ9QRSMN1e0llPdJ939eE9AqP9Jv6V3bxp5hAONUd4z0JiYl0qyzeKUNJ7iyRZaqCaokmbPLx1RkbOVxQJezXPJc5apgOrazA8yaZpJA2EyBIQzonbGYCWU+kPlBL2rHFz6I+melVgT67t8Zc+96ghIgFF1a/xaUZ6Y/pSKrK3wTl9iU4CUbIvzXChCKqYRzIp1hJDC7ZklF9r7OlUBPt9O5xZmL33e3WkDE/EFY8y6uWmAxJR2yPwZFbDmxlliddHWr6sX7D+Th3nZoqaL0RKjeGwmyAAOppw0RdsWvNXxIAsGh7CrFU+OAVatwn79WdtBBHuruRYLCMoYGI55QOnuvpUxkTfdXyYFmblH+wc3FwuvaMtPRpzsHyFqdXVExYztP0q0X3O028i6mzh7/PqYDp77nkG32ZDx2fNf3H+SJjj7+kr5HSo9G56cgg3UB9SrdPjNrCsRdHfX7xiwluWto4stkAaJC38RWQHt9Xq7zW8IYxrMtPKx0Y/d6zHpo9O4pwpS2R2VbIt+3yHXQDF0AQv64sv0psrMUHs8Fubyd2CZZwvbNbAzTxWez36QihKWlGpKveAcbsJSF8C8NiUFbC1Db7/HkJzTFmKlKvglmHu4vgd5CHvmBkFnZJO0GITRO7GfdgyOobALYqsk7ofB/dAU1T6tVhN4T5hbBgeRnhAmYZKK7up9hYl/eps3hFLLxvoZarLdYMhG/IiDjMUfD77k03212hHlwr0uuqbhX4FSoLocmD3ZQvbRhNnSxtKmbbQcXAPKKmZyMCzSg+xjG31w7bUT5YW4zkSvVAAkA36zIXaKqgyJXYHARKxRLQ0Jt36oeEBecWXxQk+tLIRLm0NIAANZS9VxU9Q54n8kEDihbtxtNYtoXGlk9gCLiMhkBqaT0eA1h3XAeue+bFYez9s7CQ5HgunScE0+I0K6fPuiityQJ3IoyBuzWK2NCzyU5vCS5RwoQrCpia/sO/ryECs3+2NlpIowwcfEq35NBy8pYojtVMPbNkElrGkYCdKkmnE6QKX9w== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7b8d0dcb-3131-4320-c122-08d9af04ca5b X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:16.1527 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 9F/Ncv8WpZNNz7lXEX2R4GffzyUkBxQX4DextCzMPLPl2V8ZnXQxd+fAzuKK504FvBGUnf+CIwPOC08rWW38KlO1Ix4Kqf+KJ9vuqs2BE1Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-ORIG-GUID: AO6MVFETP-sO3BZwrT7nOcldRMUDSPMR X-Proofpoint-GUID: AO6MVFETP-sO3BZwrT7nOcldRMUDSPMR Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v7: Unmodified from v5 v8: Code unmodified from v7 added Mimi's Reviewed-by --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index e9791be98fd9..4872850d081f 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -67,7 +67,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -76,6 +76,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index f290f78c3f30..c1bfd1cd7cc3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -94,7 +94,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -109,7 +109,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc); From patchwork Wed Nov 24 04:41:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518322 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8232C4167D for ; Wed, 24 Nov 2021 04:43:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241139AbhKXEqK (ORCPT ); Tue, 23 Nov 2021 23:46:10 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:63476 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241050AbhKXEqB (ORCPT ); Tue, 23 Nov 2021 23:46:01 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO38EDk017970; Wed, 24 Nov 2021 04:42:28 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=1nsmYtI3+4/ks8z9rHRMknYrI/iOwgFypAECJWcFQYs=; b=mB1LoDk//YLed4LReUe2wcMMrCiv1XLC2AG0IE1DwhnCUvekgdsEyKV5ls4UchNShbvS esC8LejAd50BhMXTMN4QjT8x0jkMB2hzP0Tc8wH5BotnqkaKM1ODKrrDBPMACiHHVDdL 91fyNrVvDXzKoA6LC0kYhNXnprgke0Y5+mQSk+ziwXo+qkRSeuZEay/A1DjSUJdiG9iP qmk4nddo9rwnFx6L919xRWe1p4mpfF+Ri066A5jYkTqh17ppIQ5p/lq2syL2AVyz55lX GB1P5+hM+hChSOEixgcOm7g9ZTWGQgn1a4t1gu5UxjXNom1Wc/K0uPkrx1miCU6hLxu2 kQ== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpet-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:23 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4eeMg036966; Wed, 24 Nov 2021 04:42:21 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2105.outbound.protection.outlook.com [104.47.70.105]) by userp3030.oracle.com with ESMTP id 3cep50s67j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:20 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M9tU+E3htlsy6eYjwKvvzKGISmU24Ly5kwT4PrcK1fhm5FQZZmPOhNHgl8pSKVaMPmFrROdKutimfuXXdqWaWTGHdOwk8nb6SS6uY+cLDVUoqasHQJQ5/8OIYEB/MVm0caeUtHuuGruRCDWdtuAwhCHMbRW9k+qrzZBfh0H+ZdvNDZfeFqO4ZYjfB0NdXJvOz8gzGrn7ZVgK3uobbHvN1atx+6iRxRa2kcTqw8ZiewguKNIcvrjwub/gZhtFJenOjE4shCRq3LZTPGbKlc+/Yk4/EZjIhBdAqZqYxBopGnT5kGYoXSu8MpVZmEyPDsh/0olNQvLdKhKketaEdf//2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1nsmYtI3+4/ks8z9rHRMknYrI/iOwgFypAECJWcFQYs=; b=jLBFRiAROLrQXI/9eB0NabGg6QExpRRYEVj91P+mXt0C+OJZXMH7ja4UrtTlA+1qCqqgCXOKrgCCtUARcD8N9CS4DZep7zetfBLkHMLi1k2ntfv3ABtqBLkdc3Quur1jMx1ML4YFt9+dmGZXXG0ma0zipf6b9uMoeaqb7JDk4skBPWQRLvclMI6GE86JwAG7VYZZ9+4RDNxr6gCHLdi1YGvTgSoxXqodyYFm9WCcxTCKCAiyQeC+7HAONPzhgCCiipdBwtw/1mm84j4XTJJ8HTdKIXvCgTVDlw2AXd7jPatveovjjkqLFAs2DzsekAYguhVZqzvm674ABiUGWe036A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1nsmYtI3+4/ks8z9rHRMknYrI/iOwgFypAECJWcFQYs=; b=A+7ZXSYJZVwXUg8USOoLL4/5l2CznWfaFI7tWpBduCTBP3An+OzaxJ31JyKJFbfIHP2NV5wwEUjVeF5r5o2hzhD16u1Q4DnvnbbDpovicAM08iyv8Ln+cyyTnXTaLfUhkbyoivr6Nrp2NLNQDF85dTQ97ebiMeervD/KwZA4fEY= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:19 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:19 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 09/17] KEYS: Rename get_builtin_and_secondary_restriction Date: Tue, 23 Nov 2021 23:41:16 -0500 Message-Id: <20211124044124.998170-10-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:16 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8c5634b3-c97f-4614-4fdc-08d9af04cc03 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4125; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: qKqAYgvYORb3zKQH35wNbrRRFm8nkKVIdCnBSDq74jYvqVE1qV0RPkIzD309Ozm/mW0loBdrGfse/8W3IVEkVh1kRP9OLQg3FYODm/PGwYAcK7xNhj8vWeXkaVEQJuhmkusOQEHhmf3vPh6gyeHFeX7aft/0VrpC4joBsNL5Cb+ngjhUZGLiei73TQtnwZIaMGlJWBAhCh0d2HUQPFJDPD7VkuMIPheTP1RPqOeG0ECWqMIP7S8UG6vBvBm0/GcBArQ3sU2txNc4aIZfS4CMiG8II4h1J81Sdo97cpSoVteYYKt5g7Us4MYCFWJktNPNQ7ezxKrE9Ehs+2KbYBkX6U5d0L5jnqRqwNfMxAqf5DnQ8UNCWZtI40mkvRhbKKdvMiVR9B90zYuBJ9x2GgsrsfwzE5LB0B+aM76CEB4hZxqFP7qUzxeoeKrpnB8yiJ6A0tmgdaJo7Lx9xJNsnACJftaqWQRZbl0e9yGoQp8/ltCQDa12fs9og/IIGTfeMBX2LUt4TPD57kZh7YTpsfCty+AExOfl/RB1g5+t5k06OGvEKKw1v/5wJFD5UrFrphB9yEswL3cW5P/0GlhxB6z+dTG5KviqE3zC63WoOHuE4b6WuxuBmDLazIrWHifptAa2SSLTzFHspG5OnN5XNamMPg/qjfU1lZNWeR/4ydTGtvn4va+y/CXc1Z010+uZb9mWeTFQmFbQ+UvVDMc7GUk0faSz3pOOzzZskorbeeccA9A= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6yIPQHfJ+5F98dpFm0nYDCRc47DupPSEFBUpCww5nJZzGWnkFvKBsgumtb3U0ksd/aVfkWNjkkhIQ+L9zYI19F1UbNE2miSUhbQ/tCpcYzkjOAu0RTCr1LjVtBiandRne+hYjBGYO/WXo7fu7n2r5H1Ups3quayBcYnM0MGQNrLGcN7njPNbHZ2VYLWn4B80bcqDSJMHCjwXOMJe4nrd9Yt4tFoRZoQC3royaP1+l3S65ivR4zC9R86i7yt5KpEICsCws0a86T6ihHR4W1bGG6mC4ivqmJuQrhZ7KFhqS5wtvJ7n/z6b2csMMJAHfHwvrrW28iMDOV257HnwlF9KtR11qoCvc8Rsx44Vwez+XcYYl8d9NsxMPz0jp/odKtKrUn8BvCfKaz6AWa6aw3zdM/5lmbMrAtmrEg4l13nOzpjJUTXUAeM+ZRdGkNJ1o2GnvQ87pNvS+1VNYAdVdfq6/ttidc8VhudPMPlqO+usOsRC/yv/7fAAwE0BiHX8pTdzygRAIpfXlyaNalJ6iCB1tWe7WKjdNPdwuOyyavdWiE+ikPDb51PYuSANwbfHsO2VNQ+aJu5uNNjgXB+V54g9ZOFwI4k7jMAXvcOGPGmkbdKJYuXo4tjfX7rQhLdEiek8CWcwEZ+7iRuKxK99zmZMXnhaw5Qk07Rg40tVMyRp2DqLWzY9l0grpagSrsLDno0hQCwsF81ZbtQWtOMm7D4jZC3MbhkexR/RX5HfGQFqTXHUEJgqf274lTDzAloTifDGpuzFLJkLCDnMdPeYECurCbYsRdo9+YRE3X2qyXjY5yfvJTi2RfQoHoYvC75WFsnLTPemSp1rsW+C7oT/+oaz7+VzhJtD4MZsRbwW+PMU+0GL8hhz5dPa17E70eNsF3WbOkMtshzh9xiwk8HRHiGYMwAh0mTylBc/XMGh83MUDpASPwSY/HKyQ3CVk+scKbNc93BQqVDZEfBFC/aQBbP1SDuaGr5URwZf9CnTh5ML2kXYxUcN2BI0+cv5Hs7yUnSitfZYc3FOFexvFK5zpMc0hKm3JE18xrcCa04utnq1YcFKRx4PdcFZbxWBv9uh+ge9CjCqGQyMcni+GfHBzxflDOAMy0DjrVKaU1J/LKv8UIKxQqzWZM7NO0hALvfP3OlZrKrOYvxXQXIzWT2wsm0PgDiFUWvTBYu+oHJmBGcLIzgQFy/toqOidR2Lsw+eLiH31yx9Gm7VtISax+O/pGrwJCcGFs6FLNFkO0q8fOXIY/6i9H73RYRkyTzuCa+dBLr2dDHJSoFnZ0VA4tlgU4IAurO90FrEprkL80UgqarO1CU09oBWcd6uaWVnu/1dj49lLDuy5G1b2kr8oPq6zbmeT+VtbwUZw541pNWDD/P1wuZ0LBlQRKhWWMO4NkZpZIPiiUvzLteORtoIQDERpy0N7XV3TVoJhbJnPEHwHLjP8OlbxD9dYkNAmS1f7dtWVpXzkxSqdO/GtsW1PzYMhJASaEjWhqmuLfKbqFTurYQjOUg0CWGWXzkvo7uRdkZ4VL4O2c1Q0CJuZh6kPRcaAyAGfaoSe4ma24y4NlqZDstc1r7bNc1wL1Sk4lWwPLfRIfYEYoZrGlADD/JMU49K9O0e289SY3GK5GPMXSrB/voKNFTsIcwWVDK5ZqR88CLM/PDnHVCeOSEgkWRF0no+JxVNoQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8c5634b3-c97f-4614-4fdc-08d9af04cc03 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:18.8857 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: e4QXtEfX+9GjwEYxhnLENSVWTMjZ0cE/aRVXgspyc0diGwhuqgCGIUJX5fs+F4DcxTSibfYQIFtQ+I6NcutkTs5uz1UL+b8PWwOTHqFHeYQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: dFrCczW406bMiQDONS-AWpvgFTjvNlWn X-Proofpoint-ORIG-GUID: dFrCczW406bMiQDONS-AWpvgFTjvNlWn Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org In preparation for returning either the existing restrict_link_by_builtin_and_secondary_trusted or the upcoming restriction that includes the trusted builtin, secondary and machine keys, to improve clarity, rename get_builtin_and_secondary_restriction to get_secondary_restriction. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v6: Initial version v7: Unmodified from v7 v8: Code unmodified from v7, added Mimi's Reviewed-by --- certs/system_keyring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 692365dee2bd..8f1f87579819 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -77,7 +77,7 @@ int restrict_link_by_builtin_and_secondary_trusted( * Allocate a struct key_restriction for the "builtin and secondary trust" * keyring. Only for use in system_trusted_keyring_init(). */ -static __init struct key_restriction *get_builtin_and_secondary_restriction(void) +static __init struct key_restriction *get_secondary_restriction(void) { struct key_restriction *restriction; @@ -117,7 +117,7 @@ static __init int system_trusted_keyring_init(void) KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE), KEY_ALLOC_NOT_IN_QUOTA, - get_builtin_and_secondary_restriction(), + get_secondary_restriction(), NULL); if (IS_ERR(secondary_trusted_keys)) panic("Can't allocate secondary trusted keyring\n"); From patchwork Wed Nov 24 04:41:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518320 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86ED4C433F5 for ; Wed, 24 Nov 2021 04:43:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241168AbhKXEqL (ORCPT ); Tue, 23 Nov 2021 23:46:11 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:63620 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241052AbhKXEqB (ORCPT ); Tue, 23 Nov 2021 23:46:01 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4RqBn029976; Wed, 24 Nov 2021 04:42:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=77+ZIdPcr4ZosBsLOc5sX3qoDHqT8aH8dtBTB6lugMY=; b=aW1CugKyvSml1qD7QBmdF34yE+mTxaIAqnrIGCT27ya+q9dkp5GDUsAIHBKxrnK+7Gnr yDgtt+eo9CxQ40O0OeDi+GAnULNjr4DDugnnqz2V4h4dV0u+Z0boE4KY2Ls/RM++fEye T18H6/fVrF/Aoa/FrxlCoy4XnI0lLditTPvmGEEUipcsgo7bV8WWF4T+Pbs73CLgpdvu GQObhyHIWku8Q5shAahMBaUJgkmh287+QvUtGzqrRY0XuhcMbw4vdCNAPrMwqEIaPJY+ 0uLh2C2LPBNweFPBDs1fvDye0EaQBXw9K/t9O4nHqEPE7aeypFykWefMyKwoqoU7Yb+U SA== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg55g76qu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:25 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f46u025272; Wed, 24 Nov 2021 04:42:24 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2101.outbound.protection.outlook.com [104.47.70.101]) by aserp3020.oracle.com with ESMTP id 3ceru6amhd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:23 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Be7fUUku8tSzUxF56VDpyfaUPkQ/4kfWIx6rUI4vBY8mpyd0U174LVr1geOrYemZOSU0DAAFblMwrdhRsOndt2JYtr0W3/CgPPstUBFAc1VLlpEIsKa7O50HDEQ0ML5aXFjJ33k9YM26XGqwA4gkOMfkKhVS0H9xLGirO8B/JDSc7L1+zbXH0OmJ46SQ2Y0IatFhhq1ofrhJOB92hIjHAc/dY5u/yWmKkFYwGJ/09tlQ0UXrWCbaJhn7950wBzz7wST60HLAEKpMI+yV2BlBUkOBWw0+umUrTBy8A6Kh8hF+Xe3LjX0CPY9vzbuqeYOK8VBmXzCFGNpmex5dAEPDgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=77+ZIdPcr4ZosBsLOc5sX3qoDHqT8aH8dtBTB6lugMY=; b=gVsAD48QV0Wbx9/S7b6/CVudRDMIqwgFDkXE8mokc5KoUTF9xBEPDLrrXWrHNi0eWdbxv2kPhyX9XMZwVh4paHGG/v+9k+um8uxqbb4U1k60rOcap1ntgUD1A82ej3xydawttUJIJQKoTam6tYwtgCnEYPMASycgfA2agSjnYt8UiQSCKjvnRKSswukeuUAEZ6DlGzRbv6jm4fq72ffJdQJ+dmBKXhceVRbn/iQ+q69WwZ9ctWl4ldZDlQl4eW15xZ0K4GUoSaE0Yfb6uRb4Iw/KpGL6toFWmXswAL9UbOJ9z5HLVFOAFABpLs+iF6urKikW7DOTmh93iW6eMLFZsQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=77+ZIdPcr4ZosBsLOc5sX3qoDHqT8aH8dtBTB6lugMY=; b=McFLHcqxICMGDdmlp9kTh6Y8Rb/XTtMoiWiAAjZb2LoXDVg6D78J1UrHPutK4u1F5dBoP1ku+VRpnZTCMmtrSw4noPC1iPsCEcfWtr/tlO5nzDCHjlYsYug4LH/XcYqOIh2TInIS5kdHepeMmMWD8sVxdmGr5/I9SZGgULv9cI0= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:22 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:22 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 10/17] KEYS: add a reference to machine keyring Date: Tue, 23 Nov 2021 23:41:17 -0500 Message-Id: <20211124044124.998170-11-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:19 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5aa295e1-450a-481a-1a02-08d9af04cdc9 X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: uBkXHBctGOez2paatYWn1VdqUKU75Ce2JTZIzz5UIm4L4C1CqtDEkiUcWAlpKGB6iurXvs9B+b6Kwg3gV0R4x+VAe0qScw7DY1ToW9GEvQI64Po2qTwrHC0cHQXherBbu0yXycjhMSAUglYj6sVsjSIK68M8vNEEnj5+bC2fPZyv2LaAyu4ZDsnLy4oL7v7OMnYIAEZkgr9lpiuW48sir15dPPwnwEA0jMlCvJkqcW7/kztuUT40FSWyRvAerjv5O4ILUU3KXXd9ulJeUJwlC2J3UJyM4yJhRTyu6jjhkYjLJF12V8f8u1X/8jQLJR2Ix1oGGhjG3+MExP/gLWopSNHQg8nHJAzKUJWJ10WCG5JGv4ayxVsZXlewzl4UYMipLLcMlp0m8mE/IYsDrg6U29xcoKKggs6/O56JRRJ9NHH80/VAQGTWyr9uMBFapWD8sgZcIkjVFRaTofe/2cIokwX+NgyDDLBIgCKVy5B2tNOYq/6aDqpnYlGxGvROugXJcJ+JhiyLlvoKCwjsb+jN9Dd904KEpBIpEYfjpi2G6LsDmzlRZcCWbjZgMoYzWl33FwHjJW0KUi+z/e59nL/4CGLgPO2j9Bt6gBq50oih0vwFUmFjIDhdw7nvYLQlkhcTsH//1TDPslumMwYW0dcMs8+XtMoBgsX4PFXqJ3bJ2ekwFpKzG8qDA9YkokQ/VvbFhckaX2SWrv1ytrERrKBuYb1KfRa/Hep40MOFJ8FIzic= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(83380400001)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: PVtHUw5Un1RBCQYNqnJOPEwZ8iuMP0SXpXlL2VJAHnvQ8cl9rCXGIOfGCfTqUAYzfmDdOJZDjgqD/rZH2mMt+JIA540FDF6EF9K+pECbambFSVmWBT1KerfopZ62JN45Hf5DqOCFyxsGB5goTgXUSi1aN9VKP4tsct833zRfHxHPdiO1fYjSf+rhx+LGe67iVELecaulbJ34oeA+g+Ud6XphDShrermBPl3r5VLXXmeT6hMB/mCh2kBuPt21Gm1tZaWWu/HV5V4yQoL014iOArm/4A0M4dHVHrwtrkfYNvD6cTwN3HE5ephHZxgtgw7uhRNxRBukL1bqsPTvUgZG2rNw185wHdPy6g3EBAA5pUPPUA7pejZEl7oURkRGVSPV9Y8qch5UdwSH42t0CvYuFZQQUP/EUFYESNhmOQkcksnT+7/jknsykn59AFjibxLdiaxAOmSt8DqmJTDwHDdhqJifjw8e6g7w+6bDeZ5u3+C7bmpYsCAyLDa3r6H/XICnKvUxmngEeTTO/bAXVvuA8RSCbp0nCe3pFCBCODdVRz4lgmnFGUItfHbZeFUWORaAXeWJfX41drIkA+PYWiX+TIehKow8Rvxbyum7DmkGy+1pEcT21tdmPmGOjl/cGCJ8ftaISkrizRtyZNotJbrwTgV+k6PxTTq7sxkHUDDCBE883k4JkIyctcWcZr27YAr2zb0+MgH5mVmjg0JLFAuN+8ydg9Z29WS+1MWUr6+2ACvq1eEraqW4LFzfF8fgHrleP9rJRUmdB7DxnxHkb0Yz2JMf6I6WGaqKiCBQaJwAzz6Zv5Gzax83lnKEFOR7qogcHomvu3XDUM4Q/n0A+ql8pcDCjrGFI94KnoE0hat8lBfTJOqKj+KUwyqddRaibP3p24LmNk0QKMhn5mb+3LfmR9WNmaz/BgxcqeSz0y6xyvKQP5ulsMvPZ+m1/FuhcLN8lEtWTCZVwS6o9aLs6El5z212MvxSwda15vYSVZlDAQ99E0TjDvhZ/YoRVw8hsfNTj24i/Ad4v5AMnizUaG2IMK0CoiHTexfjNFcLurmXjYn0o8U7aKuujuhOVhyV8+DE0BcQLjM0QfZe+Jw97vwJS6G72m7D/gsKFpWix8Vczt4hG+BSVfyagS0Pft0fjE7yRLi4fZeqVA2ohQbksnuIdr0amarzkXZxCBokJSHQjgFFyb/avYCJCWETIyrNuqUyHCDiskPQ/3wtnrrSa3UrFii553mLzThilPoygShGWbMXNIM4DNsw5moTOAoL135X2bpx2wnResYEzwUe6PWfI0Cmj5XmZdhrVClsGQe88XM9GPH8Qsbkd/xqnbbqQOvbM//1UFz6+wQaKg/b+PUNde4bcwOuK3lOo+5ignbshkrj7Iu6k7ulup5VDdOkcMsTyyUhzCpIKLaM+bw+sXaOKIbTOsBT5CGbqr6vpQnDc46Zkp5u1nAf3rePp95P/+b53OGfHhj4tBZyP9ZW0KVcCoKQ+Vv0+UtuF/sMIJSAfu7aGQZTKZIEAuC5EMi5QVPrULG6AovgOZ/5uMI1m59S+Glpfz/sReQzcsazDKbqj6EwDM7el1NTvCFOEy5ljIhG/5Re7Bvqn0k+Gjg3fjVE7VwBAmR7N4C2x3qhx0GR+Rr34h7H3Ycg/ZyOrD09D58+i1n9+CLnriUSXm3mEZE5JQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5aa295e1-450a-481a-1a02-08d9af04cdc9 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:21.8796 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /hYUpqsGdGyM5VEIowaRxVL6HWfCtUxGfPgzpFzbUTLswnDoYKsYnoooG7PUNb6kA2fh714w4tIzLHxExNeggZJOJsTkOhq2lQ9kljgyHEw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-ORIG-GUID: h659-a8sXTh92LbCVKQOpcaqE-iF68h7 X-Proofpoint-GUID: h659-a8sXTh92LbCVKQOpcaqE-iF68h7 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Expose the .machine keyring created in integrity code by adding a reference. This makes the machine keyring accessible for keyring restrictions in the future. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v2: Initial version v3: set_mok_trusted_keys only available when secondary is enabled v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v8: Unmodified from v5 --- certs/system_keyring.c | 9 +++++++++ include/keys/system_keyring.h | 8 ++++++++ 2 files changed, 17 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 8f1f87579819..bc7e44fc82c2 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +static struct key *machine_trusted_keys; +#endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; #endif @@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void) return restriction; } #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init set_machine_trusted_keys(struct key *keyring) +{ + machine_trusted_keys = keyring; +} +#endif /* * Create the trusted keyrings diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 6acd3cf13a18..98c9b10cdc17 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern void __init set_machine_trusted_keys(struct key *keyring); +#else +static inline void __init set_machine_trusted_keys(struct key *keyring) +{ +} +#endif + extern struct pkcs7_message *pkcs7; #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING extern int mark_hash_blacklisted(const char *hash); From patchwork Wed Nov 24 04:41:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517029 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8C67C4167B for ; Wed, 24 Nov 2021 04:43:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241120AbhKXEqI (ORCPT ); Tue, 23 Nov 2021 23:46:08 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:61732 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241042AbhKXEp7 (ORCPT ); Tue, 23 Nov 2021 23:45:59 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2pLtw011710; Wed, 24 Nov 2021 04:42:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=xMlCfdFVGWyitMdYY8+0D/BgfNqZdYXGLvgJQGc2sUI=; b=grC/9V5ubBQYgP5ssJiyhA4WrtjWGs0VmFV+NxWBsG/okqV2Ms9br5ffe7FsAuW179XS MpSWBAUB1oLKd0qQ+MjdgTmH89lyJqAXQbI2K1dFbfilbOD5EgizLfikPsTOt8lHiz5k x9em9g9Ak4NDhJUAyZfdpNu4SjafZUS5xv9YlVRvtsBQIm2L0PQSl7b1rkfkohXmqkDV QQGLVxCkEpNy1R5LeBcSYgIgHFpIZFzNTDQ8n+N0EfU6A0QT9eS9//pgKPcQjfe8cDFr ZyXUIQWNstIcwQ662UZFA6GE3oqHme5i45wsR9NZzc0jPvwhY9d1J5VNoE0Eu0z4B3Ts HA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg5gje9f1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:28 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4edmG036817; Wed, 24 Nov 2021 04:42:27 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2104.outbound.protection.outlook.com [104.47.70.104]) by userp3030.oracle.com with ESMTP id 3cep50s6fs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:27 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=BOGQRN433cH+xNzKpC1T9ItOMyLzPLDXsIOKiAibkKBTGobebolANzRCm03+VLMiT67QS8YzVG6Gq9gzaDRfd6S6Wq628SxM8zXDnk8P97fxJGh6bUKZ33U7QPVjBDCD9jNNcuYGa4cpk4aMy+LBMEN1CE01QAyn1vqeW0jRc0k7a2/SYtZg81+A0RX/3qW2CtESeleQ0wJEiaYudFW693N+fmkyVDZN3COvcTy2So9WLpoCY9ZTX1d7IMW7070NOJKq6eNmmerQoMTjNcSTuQA19s1oM1fMThq/uQJAhvJhQe7oC2vjDHcN3aohHYmcnODCinN2zYxyHdd1ZyQ/7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=xMlCfdFVGWyitMdYY8+0D/BgfNqZdYXGLvgJQGc2sUI=; b=kU8phO2XltmDEZn95p92XFWt4zdbCyerdglQIPIkJ9fWuZQiF0D3uit7gnPi+vvNopZgPBnO4uZ6CKYrcRURgg+zeDlohDNybRPloSErKidrNHXUCsiuUcWauTPu75xvOEG9B78YsHvxAUlF/ZeeCIgdgY4LiH4C4CFbo2gPk0InwJHNpYatF7n+mKlw/ngibhW02CbLEMBmEWarcCvHqpEzCN0nnZji2HQzk1p83udTNnezodLnnsB9NaL2kczn5SWr3FZn+wXHEo/PqQJh26wnmw+7FNF/5eqCvcOqtaGr+uf+KLSNWEqtQRxe27TnoY2Ig3WJeaVsni5Y8Qp/EQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=xMlCfdFVGWyitMdYY8+0D/BgfNqZdYXGLvgJQGc2sUI=; b=eF/wlP/iFr09E3ywq3B00zrQa4QpuagEbDm6vKIVU8Uczpa3aRlGR1JoyvfYzlvXtnryupAuDhAGYlHH812JfjsBbzJ/oiiSOQpdeCEpqZPT/p1Jxn+A9cwyl3J+2q+bk2p28gzUnVS4GJ0BvnkEh2zeV8Frg4gqcwK2gXbnjTc= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3957.namprd10.prod.outlook.com (2603:10b6:610:b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4713.19; Wed, 24 Nov 2021 04:42:25 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:25 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 11/17] KEYS: Introduce link restriction for machine keys Date: Tue, 23 Nov 2021 23:41:18 -0500 Message-Id: <20211124044124.998170-12-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:22 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 9e5b7768-42cb-4969-2068-08d9af04cf6a X-MS-TrafficTypeDiagnostic: CH2PR10MB3957: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: G6o3HrS0wjU7OgazH1YQ3Mi3xO5gLIRcNqTY8d4XMNMHJR5tSI7ceT8IH/50rGRQb05OCqrIdPxrNdF/iEiedv6oBM1xNSuf5GsW9VzgoFnpKNEVqDn02Ekken2HtKUFXDoqXZMesuMHjzXOzs4R5/10jx4LPNFCIUyGgfnMfXh9lVmCZNSAv9QcLWl0GzugcZZv0/zrjIe8jsWvXiHQf+sCTKNSmpFW7eMYf8gGN5iqBr34RDz90jvKqZx2RKpM6h9Ghow3TXeYjPwpmr2DXVa2cNYE8NAa38uaiGq3c7oVL7rlRfbnSU59+u6D1wJVIzCbrLZPNdeMYPTedm0yEW5l3slrnPJgECmjjIRRvRQkLgc+3/3nIcaskE53MFFrq6qn7da6FIKRME5hmJ+FCBwmd0umRB6xp4JL0TRlESy2yQCib/fdSt5U3c9z/3+BjnNxtbIW6TIkLRVAK0w5UNQATFZhlxNnnpz/DlkzDlIYVt+WyXcijZfUJM3Us9T1XCLcq/gkxjn6CVkKHfNPT8gSaX+mwabz8qFr59N0XaL/RL9fXjxC00yjgMMGNx1gC6/vTY7weOUw/GiJ9i9e0RibNVJMwF27DWueh9kmUTuXTyWmWV1oWZ+JzP3X/tkPX48l/nereoQUrKvoH4HpKHYeNdpslyt4dLJMecjr5FKXCncbXQfEGYTUUyduRmFVcM19wQnvfqunx8WmZdneeTFeQ2w9sp1XdqPmKbgKjkg= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(6486002)(5660300002)(36756003)(66476007)(921005)(66556008)(186003)(7416002)(8936002)(52116002)(4326008)(956004)(44832011)(316002)(107886003)(38100700002)(38350700002)(66946007)(8676002)(86362001)(2906002)(7696005)(1076003)(508600001)(6666004)(2616005)(26005); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: fgkczo32cuXBaaeBO4oGMDwA7/3roEzzO4OGTdISBLFnqZ2XkRmmrMFASZc9rzbUeHC2YJ4eXbpXcL2X3ITqYsImMAqD2NLmGzBShChqptB3IjA4tEj2vjv7sthz6OQHqheXGrfirGykb6qclhy7VjIHdW8bBKC41MC+w81d6OUIGGaWxDirNSxCY3pKd8S7Kx/L+3clJ4JNHCCchp4Aml5kuQ+yA8JOdCovT/BsAHamdzbrOMY4VuIDGxnRjwAiq4QTF3/br36E7rleCDL1/Oddu6z0yis06sSixBhQAVnhuIfCa+H1Lna6DHrEGNnb1fgA2s9mEMIWWwzza5jq01rMYbf3G27yFrdbiy1i8TeYsr+te8pJKYFnOLNEX6RhGHEwgyx3u+WrK3B2iZvM9sj+yZhaHDkR9ILlb961uz8NsK0vnqHuS1/Qhj9ldYI8aWMC7rgZUmoDfS57IADj1/L1e6h37qD3RTtgPxNIbt6ko4VDU19x1aKi4+/9FJ0fxa0aPfBY5xo60Rw83NuLm5dCaxdArMLIsGw8YflQMKOyoQ8g9vKcFTC+e/rcha66OUr4WNdc6XzWjtq6g+m8Ee1UV1rkAeSeLD1J+4TsPKuZ0JvxVd2ZqIkY2NtbPw0yzYGBAc2mw38tzezv2XCXopI4Jt8dhTRAC9BkyfxbiCYEUAMdhnqOCfEN3owEmiwlU3hlSom1PIHzx6HtE7Eyo0gowmnegNeIZgBlp++AqmEPWd7LleiVEjfkCdDj6IRK3/Dc98BJyrN9piEY1JvR+lqQXz+eGm3776nb5Mb5cqcp2Otw+jdeDscpmcftV1dn3X9+3k2FBMPRs6tgf3C6gWHF+rbZjNfMPOIjwqzr/9/MR/6Zbq3sI1IRK0j4GB4rYr6ApXAw9zfL+Rp+Q80kduQDgL7CAx8ZDK4QV12Tgi2B1ebs6uz6oOmsW0HZDDRwB5Dq1F4d//oVE9eqSTr2SF1/b2Rf2ph9Prw11pSbqXbVqOf8B1CIckzrceny+7TTREhnoZTNCwJqyp9zBwVaOMufx3pSHOB2fQhwMR4FsfPeD9wKQY2twBu1ao8IzVBFDp6HrQsywNE29X54/HVLmafpEp6Xz+cvqkgmn7h1dNU/2tiesd3P1ZSQw8WJ5ab9ppd9VRcLfXevhcSaGwR3ewyNs6z4Honhy+GcZFyS4OBJJvmE4BKCBlCl1NVWqPreReg6VxrBqV7leLJKtLLfpg39nT0T08tM0WsrrhdCKXh40wONCkhZGsiLRTS9djpGF7bXhl1lwPGSu9z9YSmDhPykjHod2l8J+svq1j2x7G6PfjK3lxzawCOqi2qLEYYkn8defdJXThi+Heup4As+c+iCLoLwwKwr4Ml0lHSPMSe14g3PnaZKeHFtXIBsJ1PBEsFsCpHdrlH7oCxurGVsbw/CDikh7/IhX9tUqnLJlxgGFKetFTL1VzScd8kbBaILeXHV6Sr0yrBCtMv7MfObG0mjqg1WmrXZguuzYQi6ObHSaPbbmP321AWFSN9f8krJVqV4i3oQdzyAoXuyoydMnOcmixKMDkakiyPLmIOrN/y2L77Fg9/eUxDXp4UvrxuM+dcvT4rVoSbID+VZqmwIW+Eb7wlExN1oewh0Su+sQqv8E14Z/DQQA1kXgSrgj38lWhTS5WtwsxWbeEICY4VwaQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9e5b7768-42cb-4969-2068-08d9af04cf6a X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:24.9571 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: wlJ3L6VR9TYg2bOPKQIE6J7ex6Tb/esfrycpGJ74d6lzyCug6dxGmgvrCPEUmaqZ9rNtoa9kbOLVtcd77ILMbmXUPFGTCDUsyy4rMzx2uoo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: 3hYKo_I-qoN2PKe5jxPUZzn2VFarWQbU X-Proofpoint-ORIG-GUID: 3hYKo_I-qoN2PKe5jxPUZzn2VFarWQbU Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Introduce a new link restriction that includes the trusted builtin, secondary and machine keys. The restriction is based on the key to be added being vouched for by a key in any of these three keyrings. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v3: Initial version v4: moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v6: Change subject name (suggested by Mimi) Rename restrict_link_by_builtin_secondary_and_ca_trusted to restrict_link_by_builtin_secondary_and_machine (suggested by Mimi) v7: Unmodified from v6 v8: Add missing parameter definitions (suggested by Mimi) --- certs/system_keyring.c | 27 +++++++++++++++++++++++++++ include/keys/system_keyring.h | 6 ++++++ 2 files changed, 33 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index bc7e44fc82c2..8a2fd1dc15db 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -99,6 +99,33 @@ void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; } + +/** + * restrict_link_by_builtin_secondary_and_machine - Restrict keyring addition. + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @restrict_key: A ring of keys that can be used to vouch for the new cert. + * + * Restrict the addition of keys into a keyring based on the key-to-be-added + * being vouched for by a key in either the built-in, the secondary, or + * the machine keyrings. + */ +int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key) +{ + if (machine_trusted_keys && type == &key_type_keyring && + dest_keyring == secondary_trusted_keys && + payload == &machine_trusted_keys->payload) + /* Allow the machine keyring to be added to the secondary */ + return 0; + + return restrict_link_by_builtin_and_secondary_trusted(dest_keyring, type, + payload, restrict_key); +} #endif /* diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 98c9b10cdc17..2419a735420f 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -39,8 +39,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #endif #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key); extern void __init set_machine_trusted_keys(struct key *keyring); #else +#define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted static inline void __init set_machine_trusted_keys(struct key *keyring) { } From patchwork Wed Nov 24 04:41:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518323 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8E1F4C4321E for ; Wed, 24 Nov 2021 04:43:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241098AbhKXEqH (ORCPT ); Tue, 23 Nov 2021 23:46:07 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:61952 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241046AbhKXEqA (ORCPT ); Tue, 23 Nov 2021 23:46:00 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2pLtx011710; Wed, 24 Nov 2021 04:42:33 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=hUKlxTtOvzeYb4U8xz6F7qPCsGX3tNuHOoDdP07nEbU=; b=LsUkA9ofj+xcBrK3X0Hfr7/8p+/vX8D7dkzDRrxldUHIw7qGckPC2G/J0mMKnWOU0Zpk i5i/Ht7FdaObzOXvZxpbhhoqzrObq2sn93Ugj5mzyDVPL13At9NrgWoxuL4tR6BBdoGj 0oMDaBY8+4S+dLE/Ai25lhLVtPNjz4v+I70AKFh7OvRhYzji1RUxblfqBl0464ugpV4o +vmCKV5eKWBrK4b3l4/NZhOzLbTdf8a9A8JfVTTbwkjCm8RF3RAArb46p7GlYFP4IszF X2l6lKyAxCnENoCNED0erTeQQLdAjZBh7isrlnu/dnWu5Zix7ZsX1DU+1Cj5W4KLj4AW HA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg5gje9f5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:32 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4edg5036823; Wed, 24 Nov 2021 04:42:31 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2109.outbound.protection.outlook.com [104.47.55.109]) by userp3030.oracle.com with ESMTP id 3cep50s6k3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:30 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=l0m574RQi3lbybSv5s7P0h84RCq68jZdZih6Hu2dWTgCOJu6Q/afjlTzKWm90PAp+Xk/uV091Cg35jWCLqWP7fuqldoagTriQZkiguXqbRYL/IFb4x3Q4bkedcHdEPckwZa9woXQ1K0cBLT8NAfiDpDZs2jbsUjPNAt2b9baF3xYC0t1vt3bb2RI+QKp0KaEQxTzATTy+Vg0F8OINwdLJp6OAvIHoHRJe876HH5pbo60u9ytb24/z1lokiST5oBnCXUXtPh2B3kMwtsv+Y3hJQJPZcJ6dg2r46uUpu3DsuyPjW7YidHH+NbQ3gSuf1O3X4miMUeQSwEWAeb4X5edMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hUKlxTtOvzeYb4U8xz6F7qPCsGX3tNuHOoDdP07nEbU=; b=eDZSnzZPmVPT3Y2mj9rEFC9ixi/FcQ8KMLMN8dPOnQgUb0dEFNyjd5iMh+ZrpCCYvnEjB40uBlpMhhPTvK1KMs2SQJh8Li5trsTQA4BgNpfr9Q7Vb1c9/McsqnaxXkqZYLn105egwWNXjd70XIScfqp30ZweDgawtne4E+hvG5jJM1wosqaSZpG4G/kydsDV4nL/Nx1v/YBvP5nOFrsQxC0nA1qz8K2CwkMtG5OpnJRkrnZMtY6ubQkXMjCFxuxEyr+nFafMNk/w0DZqOh6QEQNeV5kH/YCqRhpjgYUdUGQuqmT7j1IGwR2Hz8XRUwTKhgIlfKq6uyev7y8Vwqo6pA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hUKlxTtOvzeYb4U8xz6F7qPCsGX3tNuHOoDdP07nEbU=; b=WnKhdkI3B2KTPmxL3eCjARuimnfAhiZO63v1dILMNUg/B1QlfrkJBXRAp40GU+jm+12sQ264O2RoABBW61d8AqIop9Wdy7ycvsquK/rQxnaWiY4yZDx2u3IC3rIRCKWO6i+Z39QrwMUzeWTe9a3xeDbxzwkq9M7tGL7L9KljUMs= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:28 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:27 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 12/17] KEYS: integrity: change link restriction to trust the machine keyring Date: Tue, 23 Nov 2021 23:41:19 -0500 Message-Id: <20211124044124.998170-13-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:25 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 88512a71-2208-47ca-7959-08d9af04d134 X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5236; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: DPCFkDtQhTFGIpI2j7wJ20RVhbSbwYrVJHvan+G8bys/fe9Ylop8is/K0sei3WQR2IgEATUgIBjoOSlSbI8s3xdA0dR+0KE+CjZHHXhIIApAX+9fEg8JyeNmcOtL7nvyzQJwbeFPI0K6um2p97pyqFZ/rlnxYq/bTrAcMEEYG2j3asL7NfMTA2/YsjljDjz6wHWWv5nl9nZD4Y7vOiME3j3rPVbgSoX5Su7dt4fd7jnw38usGLoVbVrfD7oVqIn79xy+ujNgHHCgCqE30V9Ek8kRdPFExZu1169x669fRHLIs9NkJVGs05I14h8dLw4um92GEiBiyRguyGbifOJ4C7w6cdMyDgkgzgIgMUhnjZRjTfIaM17Y9sDwhbGq+7rBIDzYxwg9/MH8tGWACzlGhh4N1UPmlYLrdO0c/klPUA5CLUpvQeGrydr7PJDnJTbZALQpb3ZOIw0dpUG1P3eJKZXJ+aqLje3BqvBouzv58fkSZ3a9kfg0tAcmjBXvMVtcGmZceJJFFvGio+zjGzz9WzgEeRMHmWrHmg9fYzCr0bSSrdLEENtPk0K2QPTBt2QkZ6X9jtruDa1zA5H/8hdFtOHDuKffV+MJp3HtOr16PYpR/f4h7yO/yZcwiYtRZyFSqjYS8fSGDly7PKLvYBQym7SkXKQkXIwlPqfCUIs6aNKCeQVLtr7XndmbtvcAgl9dNvwmXX8QiNFX/WuYfyN5wyHjB+DwAG3dFM1K4QSwPfk= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(83380400001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: +bKYSUPR3J1wpXf6OFFpXPC4mJPWlJc0/lo12ZAIi/c+YvTUB1Z1IUossAqUlqnwxL17eF+Q+TjSqY+3krX8Dh3FdY/uRMOT7PFp0JNbzSfky3DIMyu6SG/z6a/bOB3fgvsNj0CXjxgg5Y98uOSdCIWnT/px7IcKZ5erAu7ae8QRWe4R0mHBWQ9MsKTA0Rg06JbS0b+n3vZfIOxaR6MGJAM37OiznxjdtOZgYSrWTkyiOSTmr8/rctHeN/5htKBYMmTOevA6dGKGsoWFGf4k2VLMTKkfmXyLFukKBJPw0gVyDn862NbnsGKhPlBjfCcHMHSfNcXSI9vIG2soHbOtmqdIN5PxnUi2r0DmnEK4X9hTTg7nsAEYsEEe1hQonWmH82M+xogfgPI1Y8fUg5zQ4sWEOuJDVJP0ThxbFipfZO3toxXjGjBtrFHwhfxCIvhS+8A1PVQ9kFSTL112HRSHR/PhIBa8Pn+QLKnTbwLDrpuoddarQSREWPE1k6ChorjqUote0GswFcDx9brG/s90f7/1/W34fe+Nel63x7CrurnxO+5zWSHWqCsVaV/ipUUHldw1+uQIAZAGezqXy37wtpSbqVKJdgwX7Drvug+IhfN+d7Wd/UAqYIS9WZyvKF91+tbIRgccZTm6zoKJYLiBp8tYfkwUJ05qdo4w/rh6qccmYEF58GJloEjvKzr6C2NfIASuoMnXCG/aNZjSUqPgnYQNz8IWVGXfNThGUmzqRlQYBo52YKIlD7Wj7kE0SIlRJ5mBcDDkmwm4GqS5mZuphL25Kivl5gNUfSTalTjAevjl2g4W9CwgIfzvtZN3dahvZmAUmEjaCP2PgYiPHbvVScei5XmbIamjgqn4Wcd1oQwT3lPca3IUeVKa/n54lwUUNcEp9/QjfWmS7ieeBG7QPoZ0+D251VH02msYtL0mDEmCqVdWSjOTs/KW+niI0RpXwpiMl+jhJenkYs68fUu7nD9IY2n30955OSxhXrhDRG0hHuFfcemVjoZ7y5J0OfOu9NH30QvBrzaoJKoU3DNoJF9QAHMBxNQmksWnPWRYUX9JMULcf4b2jBERyrPRyYyAERGRl/5cE9Se83Xur+sg97R0gVGOifZgKSHr+ahzBY2TyfLYhMvoQ4WEkuXw3USGxcJu+0RZNkOhtr1jK6xnkN9MPHt/f8x5ZasteJW1sVjohfcaVfRWIMxi6FNO9GjuCSH0/ZeBRfA83F8S0mSy79dwAvdike4S0krq0UPdLl4WmXzGgx80TjPqpG+oaQPotiU0QHB+0fDygic6P9V29sBmcaudkUttl6juYCF2wFG9k4bEu9WTmvOprfrChFeTOD/lqaCfUJtd0xvvEo3Qr0uWAazqv8IlhPOQ5tGuM5WnPK/htZlwp69HJ9KeI4RwRRpD/BNeCPcKVJ5mdAmP/vc+oaUj8VTmHU3iLkwHUK2uUNiKCH/DcO8diB1Smr43++uPL0jXcoVEao442bN0UzzpgU1Q2KuayNA//sDLmTHNGEfdNMupd3yYslIB5/IhyvLjIIM9hExJG0K5M5W1tyWtPUCv4NymHhAm7OU13HubeeKey3n6aAKDZv6jZh7a0H6WEL4pg5eAq64sktQ+9Yoh6634OXopY1iQVx06l5I5QWLjgNDaEYZg+xN38qSMQDq5x3X596ajJOwjAP5Nag== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 88512a71-2208-47ca-7959-08d9af04d134 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:27.6293 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: elI2YMwJMB9iupqwmESWJ0o56qMG1B3eRXL91zjlq8/O5TO3mzZIMDA7sPM1BdPcS/k1uuiaqATDiTE5KJwpLEknUeEPCVBdY9Jgope/fnA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: zZ5l-7G7ta7hAKK0aKHgEjdDQ79EjkZ8 X-Proofpoint-ORIG-GUID: zZ5l-7G7ta7hAKK0aKHgEjdDQ79EjkZ8 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org With the introduction of the machine keyring, the end-user may choose to trust Machine Owner Keys (MOK) within the kernel. If they have chosen to trust them, the .machine keyring will contain these keys. If not, the machine keyring will always be empty. Update the restriction check to allow the secondary trusted keyring and ima keyring to also trust machine keys. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v4: Initial version (consolidated two previous patches) v5: Rename to machine keyring v6: Account for restriction being renamed earlier v7: Unmodified from v6 v8: Code unmodified from v7 added Mimi's Reviewed-by --- certs/system_keyring.c | 5 ++++- security/integrity/digsig.c | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 8a2fd1dc15db..07f410918e62 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -89,7 +89,10 @@ static __init struct key_restriction *get_secondary_restriction(void) if (!restriction) panic("Can't allocate secondary trusted keyring restriction\n"); - restriction->check = restrict_link_by_builtin_and_secondary_trusted; + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + restriction->check = restrict_link_by_builtin_secondary_and_machine; + else + restriction->check = restrict_link_by_builtin_and_secondary_trusted; return restriction; } diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index e7dfc55a7c55..74f73f7cc4fe 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -34,7 +34,11 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_machine +#else #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted +#endif #else #define restrict_link_to_ima restrict_link_by_builtin_trusted #endif From patchwork Wed Nov 24 04:41:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2C7BC4332F for ; Wed, 24 Nov 2021 04:43:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241068AbhKXEqE (ORCPT ); Tue, 23 Nov 2021 23:46:04 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:62652 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241047AbhKXEqA (ORCPT ); Tue, 23 Nov 2021 23:46:00 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO2xVsH017989; Wed, 24 Nov 2021 04:42:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=snr3xQmzBk/LUQDKPkNtwD8VZ8jb68osOi5mIh434bw=; b=Y6Bmo9/kLsKwdqIQQvfzbckRh7sK8I+5Heevt8bauv0RdIzntZBfQxeXeBSRWvKK8gG1 PPhGyeEdZ82FguXSI4GnHdWLQXZD7KLi0mf3K8FtYjW8o70Z73Uz9X8p7Zozk4tIIVqu G395h6OVNgVe2/ksRAKbn2YFCZjmybHrBr9azFYk2bu42lbmIeNuBOsbxg9NXHJG4Wqo eyvGujxsVDbDeil4YIYlvprHzUO2ZOG0f02kestnwi5KjvZbB//7JsKSI3Y91G2K5knh Xc6Auwr9tGT7q9gvPEYghRcRCBgEUJFMLKNdzY6ow9XO61sGWoWJdUaoM36OF8q7Ox04 0Q== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpfb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:34 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4epXH137205; Wed, 24 Nov 2021 04:42:33 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2108.outbound.protection.outlook.com [104.47.55.108]) by aserp3030.oracle.com with ESMTP id 3ceq2fbuq3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:33 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=L+WLdDMpTkU3nTv3+ILTQJg1dw3elRxTJRSEbfv6MUnCGePAjdF8NmGamBD55Xp6ZVFSz2k3GxzfIyX5IGcMQmAPNkdemOI4LxweI/As3Y5IlRL8CMtp2OaMOeES0w0eErUYXBTaMXHYXZWZzH9z7x9s4D6RAj7Wmz2WjLrFp5PC5rTGOm31Qip7r60WFvuzF1Y/MFz1aYl+7hEnNwBbBmUPeVE5I/4pZIcB6IJBqyEUqUnillSMrDRBTGSTtxLLvVj86uG0EYBaPjVsNokAGCW/QUy1wOb/H5o5U82o5QSlgaPXNPX04bigr+TdvV0QUfyTD/H2/DbX7bcX3mXrNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=snr3xQmzBk/LUQDKPkNtwD8VZ8jb68osOi5mIh434bw=; b=EQzF/6RipB9QC0i/EzKXFb/oc+dDYoMO73X4/+Ww2qrniZjpe0M7DWc8EPDadqWqxHRquYml24s0gl2G5nSherWrj4oQWA2TksLtIFYH6A55W+aGBUsfyNsxCUk1Lz+zmEjREHFn20KSgH/yhJXJZesgDND4BMKHw3UNMNdowHmwL3BvsQqKeO3WQD8LCDi4rNYdluuapzbER4QP7pgurwEaqF8axONmC75FZdw31Lz2EAhd9lmCQMKFMFdyRkzlJWYv0XBCqDfndrD6QtghZ57O4AZ2Oc2X5OC6psHD0QBcMSz1/Q32JHIObwQWBs2UNTi7IcQWasPtYZYv+ck6og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=snr3xQmzBk/LUQDKPkNtwD8VZ8jb68osOi5mIh434bw=; b=KUML0XwllLW9x5jQOeK9lwDCioUBqrVgn67pw3zh902f/deFlfjFEIMikh42SOAzIgPprqd3ir+zdhs3yfMCHulWWoz5kzD516NlOLsqkWnzEafpbhZoqsEZUfelcr+XzeKecDe3NYZ0+aRrw6/842BnIBnktxnWGtLH2Uip/T4= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:31 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:31 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 13/17] integrity: store reference to machine keyring Date: Tue, 23 Nov 2021 23:41:20 -0500 Message-Id: <20211124044124.998170-14-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:27 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: aeae2ddc-3305-47af-e0fe-08d9af04d32a X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 5lUtTBeMJdOvdWoaHnVEJ4y45kHu1fBZgZZhAsUR2VgxrXamj8uKEcI7vYnOWaw3AzT79n78AIAd4HA1lIihpEl6pYxY4viIU570mqKdmvzfd9OIj4pOg4iqNDemBpPOo3cP8dTYwIP/0OOCiYFM51PYJ/Xq8/Mcrfw2NEAX3PpXsq+iBH1ctfCFPSWrSuQ3Yuz/jPmuvSvpjOwC+7NdNkr7M8E+oQHph9KdaKxUmefYGKi8PQgthTlbBOGId9OLWfQ58vmQp92lozJdPtY7GKjPyy25qeyiybhjm86PEyeFzrB/42DcSmaJRNqO2kXV7YODv3PyyQUmfeW56ORPxxCltFjqi32sWSJNy3c6N64n5aCukyZaEImcHl+eA0MjwdLp2lQR0zVAKKOyn2nmxI6illV9Bd/bAcVOD2yN30qlLPWAp8UE9Ph2akwUO+SuyQ+RFAL0pdwuShQMyDXPaRz47uETD1Nq0gvUqqB54TUmjnc4asC3qvT1AlmgfgBeU+730CO/rNS6MmFABh4e5QgwekfxhmkJSNVHuzPrQ1O8I3MmFhzNX8CTrTlkCTyzlDkvK0Zzj74P9hohP5GeCmMCBQdYa6PYhZYFdA+iiSbDuRdy3B7wOcBjnoRowfveFJLA8tZXEbpJCx9LVWg0kwBxQi2Kzq+wOqZSW42mPd0I55EA3VgC/JjtmCuAC3AAvf8lsXN6MrssrQyPwmaQAS9e3FcFiveZ1j6ewJb1qOQ= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(83380400001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(4744005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: YdH5e+nvujvRQ/r69X8tfxVl9LUZOVYmgtZeJTWt3gYAiCIjW8jf7IPd3yH2IZ5Cguinb8ne3NHbKY/U7P+kiFL/vXLwOTdKuYUvAC4XrEfoBx0L5ezw5MTQG+aJVtcjyOqvbXLAs/mZ5LuOYOLYqBuviJjE0wbNh/re4Mdq3/DYDbCf6fAP3RkdalwomaDFtKOITvPgJjXhOaqfCpwGx1EmLuoaZ0Y9ABQ6ZfZiB7yH2D6uOHypitawUztkGzo7oe9uWN6tFZAjN13fHn3DBBgfkGQ01MR59IeIQ+aK0xReOipx7RA1Oy3uk9xEp9ppF6/YF7jDyBTulobImzWpuo4I6Ms3SnmrmBoDYPzDp5nyGu7APmYK9VEWEE5WUtjIZL/lDuiAxvvLvyK5wjTJKeyHZ/gsOHtTXxT3Xfn18o2Zh+H6AADE/J8D5hkoOgANK0Pk6+hCvt9wy59r+E7+3faUn+4wJvN3g+gvuFXDvWWoWbnIUZFxvdnKY0j15y/G5iWky+QeMGgleH0tFPEB3JoLdEJ5BulWvKgaZmwwfenvyvSoONdmN8XfdD5iTOT58l04VZ+tBn4JjAd5MiIWZMHn8K7i3U+9/iKsEcExymiLk3I5mCfwJGQo1RWBVAnbcNuw196X0z7bjPnYB7tgrRYrSlA4r3G4fhB991ZUCJkogyqr7CkKXryGvH6Kt43U+Z4luRetMzLlxNwzqDe8/zJ5cb+oR9oLTqMAYV//JtHc4ynW0EstZGCv7+0QtnhJWuZaR6N4sCBZLOha3r8gYEt4HPggn3Tz0aDeI1ngW4KVbWqLNOT6RuadKhcx/WuWyn9W9px+cpr2sEWxsJen9q5BoHr3gVylJ/2ZT2w1tlc87tNL66VCC8Yfm69Cjm9h4sCW00gdSSUJn76al9OMtM/o2Lf9z+ZCKyM7qe1LpHvj9GtPv8lVcv1gGnPoSVzg4Bj+ZYwP2WIm98oYVpKGRUhgJvCU0umK2HUimDlUUy9UNz/qm7/CuRZVkO/J/0VQ7D7PfLJ9exUOSZy33yM0s+ceozTPXQCnOo15y2jx2xYG0kLZt5PidOp+oRmHN/RcNDBFhKIWuP1ErThjAiI1hwJH0qPpnghR8OQZLDJCSql5JX17Wk5zoBeksFxWXvfpuKGn9L6wj/wsL882WxfAsTw9dDmJsLWO6nVVxbPhpn3pdYUSaNojo0d02llHuaVWvW87CcvAfNNDru7UyRNr1+8zWulh/mUc/DqIUTJLSk39l2rWWgKybZIVHUjVJPEMw6T+KafqyKKs9u5nxQ6cuzoiZ1S/WBo/+PxTeNz2noCLcYCOCu6mOYXIaDCcDkms3JUYsHU/EzVyA7gWQrAZQBWVEZsx7b/jiLdFp/+BMB4oQxboohFV3Dda/R3gv1RS/ufIdojoa2m3i1o9Mij/psEpdgmM5DBV9qwaWfIzze7qsSRyW6knoDj3i89+qUzL4HuOX5ctKop/srPARXF9duOJsD+X4XfZ4lUSh0j0kX96BxNlAB5ziTE91+F+aw1pE8wCWMrNhciwldcLW82tmQaLSe9BK3rS7XZEpJooawyXAKuwJMIcomlReCwwYV+AanrW68Kih4dSfMvp1z/r5C9bF5ethmemiANrBZMcq168BqrUYKIgB2Dm3PVDvb/rue3vv7obMfVo1/uKtw6Vgg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: aeae2ddc-3305-47af-e0fe-08d9af04d32a X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:30.9607 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7eXKT+VMeKg6mHKKEAw5a+KYVcVjeNWqgwY1IYe1jd3LfSl8gxhAwDQMFGkJkn8vR4AXYVLI8PZpxueUXiQQhDl6JtstqY0N0WO0U3KzWp0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 spamscore=0 bulkscore=0 suspectscore=0 mlxscore=0 mlxlogscore=999 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: e_C2tgCCP4sucOPTNTG3ZMkfvyqRIxN0 X-Proofpoint-ORIG-GUID: e_C2tgCCP4sucOPTNTG3ZMkfvyqRIxN0 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Store a reference to the machine keyring in system keyring code. The system keyring code needs this to complete the keyring link to to machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v2: Initial version v3: Unmodified from v2 v4: Removed trust_moklist check v5: Rename to machine keyring v8: Unmodified from v5 --- security/integrity/digsig.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 74f73f7cc4fe..109b58840d45 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,6 +116,8 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); + if (id == INTEGRITY_KEYRING_MACHINE) + set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); } From patchwork Wed Nov 24 04:41:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517028 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E980CC433F5 for ; Wed, 24 Nov 2021 04:43:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241223AbhKXEqQ (ORCPT ); Tue, 23 Nov 2021 23:46:16 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:1158 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241062AbhKXEqE (ORCPT ); Tue, 23 Nov 2021 23:46:04 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO30Eht017974; Wed, 24 Nov 2021 04:42:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=4vziZsm9hsEsnh0r7QZUE7lhPwNsHADwKbloYVm06uQ=; b=0v2w5SzGIl5zllR/All6Z51HCyOXwPF5xQ0PxnEMWt0nSzk6h7va2pRxuT4Jxfya72Wl fQJbsgRPZvc/1Mfgnc/KnIY8THxtRbUq6oiZIphRUC/LMfJYzmzliacGUG3kVqwRhRwJ MvjYgSV4hVnQf6Ls1mjr13DS5E5g13c4K8VR2qSp6+oKtPqptqAJCmAMkkludky/QKSw IPvRe5X02V48zuY3FtUJMdpWHnknojgbCgSieWJLGYREHG1ZugSqV47cnFcRo9rA4Ata Muf297fWRepSJbHwU2IAU2bfem7UfvUB+N5NZI8A1Whe2RSoE69F5BHwix97lYioSS5y XA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpfm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:38 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4edFp036805; Wed, 24 Nov 2021 04:42:37 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2101.outbound.protection.outlook.com [104.47.55.101]) by userp3030.oracle.com with ESMTP id 3cep50s6tr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:37 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=huDjw1gDPn2HX/lif8p9BzwhQ9/ItXdr6tKIZFXkbfF4qsvzSCQ4VGyNc2lKXL4eYxunHpJye7DaDx5DtxFLDCCOLRUTpwGcVCT7rdDXIxpSn9CCg52NiOHXeXrBQqBImaPlNhlFx8kj74ODdBIKp/HCKnXRi5l5Sb+TS/0TRqQknKLvn89J/wgFW10DnAxDcXIHcogeb+yngKrTIdVJenRyWKzyZn3EePOButxHMVhs0s0UkKxFDWDXStrKYCxNtnJ3PFn4fCClY+wAGvKvy45aFXdnkykjfbIgSlstuDJ+pyGjD7ETeA3UewK9GSEySFE4moxWQRGRao2BJuf1Kw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4vziZsm9hsEsnh0r7QZUE7lhPwNsHADwKbloYVm06uQ=; b=OqTfEn4GLI4eGvoyE4kwdUbAyBm+4/0D0VAYWus1P9/vJewCmrcrNA7V493wavyZSx5frOxU2RHclbuTrsMVmgQLFBELhBtCxKXmDCZPzSViuNL/f8aEqweH/V6e6DfapoCZVx9TdJSkIyAh4JeKibvocT0OInqLbRJzaxQF9rFeSyVVAGEqSaqJR0qz4cshCB/dmNgrUSVwtPMNFvfzOFdHNBXNfbGN0Cc2eZ/dQPyTe4/3NdIjQAVbwHI9n/dqIhu0nROZf9TkU/ug+ElMhWm7wU3xx0oG7Bjn2UKRsLyQZn3sPn0Ctl0j7JK8QkL6EM3drwzolnX7LGkWTvLTBw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4vziZsm9hsEsnh0r7QZUE7lhPwNsHADwKbloYVm06uQ=; b=pg40p8f2XXKoMmkSnYTXYgevscC48ikbeC940ofHSES69PlFtv2UdnDrbS9IsNkYv7Cjx+I4Rt9ZHldJbG+tMsKeGj5ziUaVSskApmnkxf+tT/NMaiuVHCaW30W2k3Y47g3S7Fm1P8NHdtoa+GkfzSKOaPZiHLFFrizScdb89gM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:34 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:34 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 14/17] KEYS: link machine trusted keys to secondary_trusted_keys Date: Tue, 23 Nov 2021 23:41:21 -0500 Message-Id: <20211124044124.998170-15-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:31 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 24923dc1-08f3-49ae-7a3d-08d9af04d53c X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ENN9i7FDtmyWKR8r8VrdEeXlSD6yWjSMvU+T5o1Ei7vOngDeEQY8J2KsqSR+gga4or2o2E31AhiS3wcEka4mDLO62GhDIsO8hqvNMkr4Ct1t4iz7gHQcZeQvzh4zjkQqnAY84Z8QefEg3xkGPhROLiqdbuYUnOJeAJtJtnPu76ydiOn1RTxhZkRQaCrDIy6QIpQpacyVDX/IxSZbWXiOhLLB1AUCEiZmjr2VKg881nWvTrK+jdIk6SgyVYXznhllKQqBRGSv6E7K84/eZ5MMUj/PqxPvTYmwccxEzcVXz1fUVCjWUSEjJ1HUv4MNZ/1+4EGpHHrq4E0FV/Hr/0XhyCnGntyh+6l9jm8odFxH47l6mmNQC3b7vGzAc8Z0e1uHOWEAgGvYQZXTBFq3G1uMZXtZQEdvA7GLbVEasZPOEHAgcFor/SbHByhQilVQ/eiaeCwuthDQ2nFRI//o71bqKJLwa9gO95IdgyLKK1hahCkoCEfpPux/5E5zPeLEDjsUpoSdnTyOpvZh8yWnyrSRx8252wbM+nbdw9yGXzkfOGWxTPN/gzdB9GTjzRna08t+jAEKS9KNY2Nvr8wlX0dMUZXAmbPICpDlazl6mhLrPigiQa1AFYskkH4ENS8NbODU/iCwTWr33Gy4WjcQWyKNXbdpwOGjkZcMfPPjnb5LfGQwb+s0xLAPvI2CkxrRoqUJYqEGolbt4TAmp+u44zediO59NNtVjSdogDY4KEkBy/o= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(4744005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: CUwxmUvyC3BiBp0z2P4h7SiKBS773hXL5xRmepH200SK4PTLI9u5lL6k1ZT1A9bexjlufIvWDUNGFnS0tzOvzGDmzgSitL2yWUJaHGs/4yOovZeMb5irGSJerqeMPwvM3gyK8GG2BNfLUNuuZ8GX35FFwy/y6+MujAd2XqKH4H/geyKVph7r+WTxfd5akSuNBak3tfGaTphYeCNFxiDf2csQQtzDY/PT6PCRLRHtr4XfOEt3Qvw/YsYz64/h/PApuYTbOu1m1yivA10xJZrLIX+KK766a6zDnGHeSZzc0X9tRToBOt4+BbhHBfXcg3CIzUTUy7xNdSSOe3NGpQZVs3ibrssdZA0mGMrDQGAZNMfofMXzYpLHaeb2UVHlVRKkRSE/Mu84RPOCGs9m1w5ERT0YiJkvogKDBL4EU1r2G+bbOGw0JRdmq8RibDZtSxI9TXbl+GmCpwOLeXO/69JxlxfuU5YTM0kPMlPL27Ax/++E20jbtW001jVJo2QwMPFd446WgnilyHQTWaWomMd4lnSJvd6Hg7RaUw++CbyyfawXmEdg7Yxu5H83Vg04AYIJt0k3a/N2FQIJ15N/dfWBS1Hn3iO6vfD6WKXtYosu2Ql/n9OE3dPADDLM9puO7AgWZN1GxpFiXsFaqbYaoBAe18Y5Wnu9/cIwZGGS1J8lUvi+2+BfuUot6EC11ySGFwBDfCtYDz74iK2UDDmT76D0JLftQyB0Oo+zLDIQaUz3G0c5u3lQ3gnJm/XfIEv5WCBzRPHH3E/3/eABfn9UNjOKyJPP00EN6/duGZdt3L+yXYHB8OPcO8X0dTYaSrIKi2v0LzvXVD+3hxDeJvNuaY+gHVZIX/QQQ/6rZ+1NhrY6E9/jLJ/pdJ6GzzHKYk8yMeNba7UbtKNpGBddsFy5gKrFmclymmd9CpuRN2cS7+mPEvpySWcbP12LOSVWlYt7Qd5qHimMN+pTSYysaldU/S1MWA1sxAVPPJigwrk8Fh7InbJYGGH5lwxyJI/t7xmNK7ZV2VJMTFytoGwBprdewqHKSayGJ1bJQCljgPHMXQVVI9Ef2WGsqKUNqKwBL/GsEPOtvLkLMWjucWwXjEIAgl2AVlP3NUB4CdWNeZERvRTwnevomP/Tgjvf612V+6dOfmkeNKxc1ng0iPN7hfEG25/KrWCeq1+ZzeEohtqP6bUdubZfS5y+/YkazDHNk+1MPt+dAFYMQh9FaSXZNNAPg4hkIyNQoajz7ugFurTno6028zUckQUUh4PTbkIpHz7EOB5/Ogp6BXeiS/QPttVPbHAjmK1wtKYYL7hIntcwNvGpcpecygk6N+qM7+B0TGgNyAP7JInsxI+FQWNxZfj9KgeFpcNh5h7Ypb4SY5Ohyo0d+8ZQXkg1viYbYQm/+jatHNbpLFwh/XzXpNi2ygI03eYt03E/6VNngD1AFhUaznyuAu7hI61q/F2JIdLfMuW1Exm6SOWBQevAcLjmGKljujXxBCQepuGsi+JeDwul/uGYOYT0ia8YYkPtDUFGe++NgYO8f0YmH3OlvE7ro79BP3gd3nNyVEbKeN2Zrv0BFPCkz3FpD5pDttuV2taZACBg4zuYEUKVXy27+OIm52tNSrS//b7HxHxEMPzIO9QrGlkAKZSKwLku2i7F9B8H9nh7PmQuU6cdkzHGIfFZUAvMgzERyQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 24923dc1-08f3-49ae-7a3d-08d9af04d53c X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:34.5062 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: SUpAPXTEHBbEG9vwX52HUTO/Xlr5ttJX9Gm6PsGMizskEc3eQznGQwtbHWlfcmNaslk/J52E33/urU7Nee6slpMeZ9w7VOChDUDK+JS5U/Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: M2xTQeEWS3EmWVSzX1gspJpaIyx5J_mK X-Proofpoint-ORIG-GUID: M2xTQeEWS3EmWVSzX1gspJpaIyx5J_mK Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Allow the .machine keyring to be linked to the secondary_trusted_keys. After the link is created, keys contained in the .machine keyring will automatically be searched when searching secondary_trusted_keys. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v3: Initial version v4: Unmodified from v3 v5: Rename to machine keyring v7: Unmodified from v5 v8: Change patch subject name, code unmodified from v7 --- certs/system_keyring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 07f410918e62..463f676857f0 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void) void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; + + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0) + panic("Can't link (machine) trusted keyrings\n"); } /** From patchwork Wed Nov 24 04:41:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518319 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FE45C433F5 for ; Wed, 24 Nov 2021 04:43:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241152AbhKXEqq (ORCPT ); Tue, 23 Nov 2021 23:46:46 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:3770 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241090AbhKXEqG (ORCPT ); Tue, 23 Nov 2021 23:46:06 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO30Ehv017974; Wed, 24 Nov 2021 04:42:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=XKM1ZSW0uNaKofAjerQlXRhjhC++E9LgA7yP5fsFVhQ=; b=goVGY5PULqc6rhGnvSa9YayHzyMzToUvxamGIGKG4vU8zQ6FnGgIYjDZFfpaUaklRvQc 6uIxqwq6T4N4o/fGzDJ8gKYvV687HAYEFRJuESUGJsfHbX1MSWoyIo/NOpi/imcjfPwa Ut4HD6SyTAKokJ1W8u8SsYEu/UWZfHYzGzAuVd0/n9o6mZIj7lzDwjAv4nRqrEsJQOsq /xAQ+HWew8hsRHXM1yQ3716fgWaRDRRwH3BDYndott5PH+7oFbJZz9p12RWph6+y159C 43BQJ5uzMVooH9a2906mMoBwmknXqjVDo+UalWV8hXl5hF5DRUXBD7F6qWBRtyZxH1M/ 1A== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg305dpfq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:41 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4ecKs036773; Wed, 24 Nov 2021 04:42:40 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2105.outbound.protection.outlook.com [104.47.55.105]) by userp3030.oracle.com with ESMTP id 3cep50s6y1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:40 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IgBymT8RhnbfUZreSZQl6A+JDGktS3pnfcuUVqd9r4T155RA8YeRpmb9uzSfjt25miaF5uxcJAcVhufIVzof/7PNARpgyXb6eS4u2trtX6/FV+JOMxEhM++fSx1XpkDmD+n34UsA3AnZb7lWy0UTy0faL+jjaH9NyvBVZnSHXdwK8wuTElkcqfN9WGyKws+MbbItqG13Jcs/xK4y9V+K+ozuVlWQpchaikAX75BaQEsSn30wtIKZoA/frxLLAuzTjGOtY2wmbsXsUeez1Fb2cAd6bxuIatv5sEDZ7v79qeVx62ksViCtJQx823cc4k/QCjDzuFKi4s0uTgy8G7Q05Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=XKM1ZSW0uNaKofAjerQlXRhjhC++E9LgA7yP5fsFVhQ=; b=PIqJtX0UIWrR+W2BFIeGjdSVv06KlGtnKMFld0Dj5F7ZfsYrTRi4DOmSlxO6/tj8HEwHgSNKf7eotGgUT4D0WKFHCortp10oFUGQU2lditn5X0vtGTNs5iACv0tvg5TqMhloRxS2Ori3L3Hvw15WZewDjsOlrkfOu0FSW/cr5Y9uUYsSoPOsHT80AcdUGUSUicCGEtOYkim4rquuUlrMbtMfjvWlFZrmHZtu9/YKZswVdpgGfL0RtcJk0+h3Jn+pmFO1d0hWaAyDefWqyc8MA9OacrZIAtBG9FbCcO7iDEKT4wTuzP651vEd0RGYU5n/SnZHuQo8Ud/hqR5r5BxmIw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=XKM1ZSW0uNaKofAjerQlXRhjhC++E9LgA7yP5fsFVhQ=; b=zRbgvOsCKzlbOKf+0htPi/XisDcLhJX3+h5uuMb54ZHMlcPdAMne63RnZISKiM6W/s6kpDbAfL9VaZ+AqrPtWOQX4Z6lRi/ltYuk/0xPjq8Wk1ERIzXyGm138BuzbbpIJJZBSjz3HxadZTF8PsfmrQCp2ry8yQmFzl4myPB30sA= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:38 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:37 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 15/17] efi/mokvar: move up init order Date: Tue, 23 Nov 2021 23:41:22 -0500 Message-Id: <20211124044124.998170-16-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:34 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 609092ba-d2ef-449e-522a-08d9af04d716 X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1443; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: UMaUem+BRBRSojxnJ/IbQzzgFnNebC3Y2qT4+eUFnvo4VypI2BzHV++T6FNeu2x1AfFT36zEjkCiZm4aCYbs1YddB4w6hfQVOIT7ki82kVeGtXhM0OErczEgb2S1TEqGZyw/YRnedTfjtiZi1JYt8CAe+KrKw5Z3BFZj4Q5Q2C2A7zoxA7P7VuGE1OKmnc8ce3Ymwi1w2OQ5qMnahUKbuaY/BLICh7T4EseUCklDBA0tn/r0vrQi4RSVG+yMVJqsp1eH+cM3vKkUpHi2sqforBKPC7IB7qhUF61ui9hWkWj33CAfEJmKg55sRbB1Rdippo8HLbwWHkjI9qTL1khvfuKI9StCAqeBwKehPGq/991N0fqYXjaSKyHrjbJu32+z2jGtK33AKOaO3EoojwYWDQJZUHQPyea1y82YD9iRUgs5juG2dZEmf0D3A+sLEByHeimKEjY2NWI2KuFWZBC3G2hncqpkvyDix9xxWwUXM5y/lR90zHgJp6vZoi/5hrSXbCWLITY8+XeAap+Mlz7HFyjjN+TsauMHcTM0yYb92sc+qTATHFgrQafBNTrAcqln21+wY8msEDTiBg8enf16NkBQiM3PR7SpIFAlhfPECRCjKTPbpNWXNQ5EtZ3zu9doY4Q9bwZNZ84+a9dSr28+a56gNJZNAKcGIjsgp6Wixg8JpQwVdLpQhSgRVvu6FQPxrVuphT4a7Y3TT5oUH/VDgUb3AozZJH/dsZT8zjKwOPA= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(83380400001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(4744005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: dZ3ovGvWqIhHMPIVTPvdjCiVb5S/lf9nrtEw8dVIv1HbJi5ixT7NGUbzBd+iFoUslJPrx/wQmeg3LJ+bb6CcjoD0KD9DAN1peJEYOHiUQJp3oMh+4M7b1lA540Ip0BLZld3rz1+x1fMA40c4RudSkOmT+I64SPLOSenxpvpCnfobbiwuvXbh4G6uv3XrDzbEdNJGAkv8OYwd9KmMjjMUUWOehWyWTbD8blhzUmvrQ8KCJg372xzld8EhorHi81aMLd9nwt7hxEBJHjrdkeOeskonsoa4PqPGz/UBqTmL6nu8h/nVEcCaXZknbpRE/2INrjRT/is9rKs9to6+5k4sXvtXewtAb4cq94rsalO36oFLy/D13wGjfTdu2OBNEnfKzPlZfxYxg/XRRuLko1HbTkPImQ7o17F0NGyTMPSFLjbQ/zsKg8r1gNpvldqC/v6qMMMPWxkhOjOV+ENiyUhI/fWFJAUyW9A/Wz32BWJCQlFNPsPx/p/dQkjgpVCHf+0e5fm7AXSmjSD4vqBa0ca8hsd45N9imLTVT1VFNRqqqmSBzKgdvytwhd2xxAZXkT3nzsrNnfEsgQ2MJcpwj7qRprW7OgNpeaQdJ4ZHthBUw6v22MEHva4AO1qVWK3LIs58lMdKmmWFuBkmjWlMAjLVffMg/YySUrYz8LwsPly4xYktK6QigfiAyvD/fXisrKgLeh0faV6FZEjwZsQBwgqO4LVM5CjzegOnwmy8w22wCcI2o+f/E+Z6UN/+H5iwsVo10/lDVwa+stMoPZYYdFnCnm3f2i/03QM77FT391W9WW3VKtEvypH1QEXyhiZZzcfZmyywz1aws5wXcnGEKPfMNFyfA6hTL4bAANp4gSx6xwRx5xPIHrU+09jZyzWmGuPCDLmhS+bjRH3wGGa0fCUG7yjWazkvyqfN58Ems2HYsq9GQcoPd8vzbBQcTDPkgZ0i3RkcTC8jTnhtwt3pC1pFIuQhonP6YblhWq4dCHbRxLd0JF0pfCG55kOZ+xAaja5Ouv+5fmeJEoneYpdGZrop6wXIWTPCcvu5sKWPDzDiGil7PL2zAkBinesbgIX3MCvwmtAakvwRoLE+6AbvS6xLVZbZ/N1l1YWPt7KHD6PD8lDrvGiGk9BEfmiZOPguK8ec4mFO9K6rAVJB+9pv/Y61OeRkALfgdzLiyh+O7/CNsySblnlbxY0HJUdVLJQZy809uWN2gW6a1kdX5jh0zxHCNYP3+llUt9G7Yaeq2chqiUG5kh+nYL/QQvtggBAkLHjyC8t6aOkAWUUW/WOdP7aHgC/7ITIj2DybJ89vfJydn5UBdoB3IJe1VQPr/M+bOaZl/7GBpt54eyPmFA8WOLbZbIWn7ZENwLWJpgegKG0dO4eRPWz8hVeTTG5Uk5NWxJicMjtf1Q7ktMAQYTbCINND+vKv77uNardejcmOu8MCozxTeK1mJ0FwEos1BYlMCLFpRtLlXX90aEJAP9zxwbxQgNzOdaXCj7DefVOklCmgX1RHSaA/cP7485F9cbGC9BbGn8PL5INHvF5E0Z3kxKsneAEaYzkoexCaVUUfUwV5lD4GpoZdIfa+2hibWuqw3UB3ui7ZJzgGAJNGO6TVk+Yhuykm6QOEi73Wk9gj79eTPmQRlqc3BimGXXebIrm4eLxu1rJ38KhXAl3BArue1fdsIA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 609092ba-d2ef-449e-522a-08d9af04d716 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:37.5459 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: isEvDzf7Lube8aL+cX0RP/6D9I7UampU+L5tBMsKdALLzpoVeVvr+XmrsXPQqX67S+lQ/XTyKGYfQv+p9GSWEvBNt96z4SacAcAHmvyvnHI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: z7t9CwEMuYeXJMjuSqSI1t3h3qX093ON X-Proofpoint-ORIG-GUID: z7t9CwEMuYeXJMjuSqSI1t3h3qX093ON Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Move up the init order so it can be used by the new machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v7: Initial version v8: Unmodified from v7 --- drivers/firmware/efi/mokvar-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 38722d2009e2..5ed0602c2f75 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -359,4 +359,4 @@ static int __init efi_mokvar_sysfs_init(void) } return err; } -device_initcall(efi_mokvar_sysfs_init); +fs_initcall(efi_mokvar_sysfs_init); From patchwork Wed Nov 24 04:41:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 518318 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72560C4167B for ; Wed, 24 Nov 2021 04:44:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240329AbhKXErP (ORCPT ); Tue, 23 Nov 2021 23:47:15 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:6486 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241131AbhKXEqK (ORCPT ); Tue, 23 Nov 2021 23:46:10 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4Y8e1029966; Wed, 24 Nov 2021 04:42:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=BkWxG+y2SzGi+g+KjdeXKZpEBjv7VUde3CND+S+hRCs=; b=tHhChDyGiVjBbemFioq2DLrfUqPGb1K+N9DXQZEVfb9k/RmRVTr1VSd6q3Eal/6nltjn MzkOZTRLRNZz1/zqAbqVgeGJvv9yF60KEbaVGSqG7AD1N7uY699NIOQi3QsoAdul2BS7 D8JvL94XwnXBkio9cHkuFG36g8j0xuBoFkyM+f3x5s9/7RI7ThrWscohMagpkufBzv5Y lTx3MF3E58LTn4tRqZuIhp05d5C//QB4K4UwBf5rso1HnezbK12BH6aR/gTUptJWw/aa xSmyRjrF01kDZIO+f2VyHkaine3OSiiE+ZMw6/cABBbcIPpUX6xtIuOu04/XFaXe5ndw wQ== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg55g76s1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:45 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4fXmI181888; Wed, 24 Nov 2021 04:42:44 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2102.outbound.protection.outlook.com [104.47.55.102]) by userp3020.oracle.com with ESMTP id 3ch5tgp3wt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:43 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kEFzgva76S6sYfFAuy2d7pL79fDhIF0oyAJRH22xRr8MQMyW4OQL2Mkh8PmE3aV0A2eqxZPXJdvgfkt14iYAzFYMlsXhrnVwdA0SNP3Ec7Sfq/r7+Y9cB7mQbyTWVYJ0Ct3ns2ethO/eLmoeMNVytZiUdEdqJFSJi8hl4DHzMD3RJQ7jg6Q07MqfbKx4akOYvuxWdtvrwyVvZbqAzqLXBgac32LXTiZSUFNERll8H9Mkfr24ToGEqtxHVKM9IqgwhkJ0cC3hnpGs40Xu/0IEb9+F+Eqw1+rXkfjDr0fYPILg2/BHPVsZIx9iBXV5KPfEqmATVnqw3UHbUU59T5ooOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=BkWxG+y2SzGi+g+KjdeXKZpEBjv7VUde3CND+S+hRCs=; b=Vjvab2Kkqro+0y6IWyjzUMSRH0zNZdBVCA2JLTdS+0zIEdO59DAEzI4FVbVPdnIn7QbMg9+EogARjv8iphjlWdwwj5iiH2wPV1XZrOF3b6XBmGcuwCssUs8KP7uJJqjeFHm2ZcV8kpZRfrEvrGR8fFUexNThV6nPZurY6OsFVwfXxI4pZs7/v7mcjbYmHeNUfSSNXh054LuXIUp3/H6UdMWbz8tyfEiW4v8xVYBWBvbfmOi8h4FpaGwBZaffh33tw1KAMUM6Dljdp+92AZkcUNv/KyZwFPrTMvmOtTPQ4Taprv+948VFnelIeFag5gThu/SLxZROTw2C+UHtxTn2QA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BkWxG+y2SzGi+g+KjdeXKZpEBjv7VUde3CND+S+hRCs=; b=KhueD9nitIXl58Bea57r9aYgEKv2k0D8ngOKQ4l7WrpPdDhSmDFvt9GJtqQGn/fycvEEWH/5Axn28qXxbQJoT5TZ/vGr0ifpBYKneJet7SWLoolI+Zg7yRZftJUdgfJj7P65aY7dBdUjuWjniduiqljHRyqptTl3kFup13HOq9U= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:40 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:40 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 16/17] integrity: Trust MOK keys if MokListTrustedRT found Date: Tue, 23 Nov 2021 23:41:23 -0500 Message-Id: <20211124044124.998170-17-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:37 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d5f183ec-6e42-4d5c-09b7-08d9af04d8ee X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BBUnpw6aqnKioclsRNyVfPP2n6mHT+QUFKj1whAAHfWoRnuKZmfqXfK5b+MTSkG9dETGJF7V+7sRBJ50vnyWOqHG8i6M9bo0lt7RC84+pB8dPopdEOr4eyXfDSBSblB2c3bJ/WryrDyQkhD3nn44WP9XSW5QaQXaeji8MyhwJZU0ATsZRcPXnVY+ZMgAv4lVMQOYSRsHVo+9psw9vuPd1BPqRGCjbUbHeJpyOO1XT4ywoLHd18hXu+8lJ62p2Rbkt2s4ZesjSbo3kCUyXK87lIQIzHEH9rwZKEL+B0OKTdAWwrwVIsqPOep0m5cfoZiZyVuVzLZG/TptJJjds0R/4PLPh5e06cRm7q3cLu1JQpny6BqZav3quUDSR98bPYY0nUPce2oDcAYsj9cw5ZWUZKbuPhGbpOFUm8oK3ZlsDVWqfDe2bNBLpgE4HmMhCrboXmAVaM6mNnTXsaad9y6+lcZ+jd009jFYn6f1JEtcDvefQpFkIpTyRlG6ZmNrwNipuemFruya/mt1pVdy249YVE0p/zTwNg5fugGb5BnVGptURf5bdwNdch1hQWT7s0rN7SfzyyNhog+5W3J1vBhNNo8VtfEOoiC25AEdI4tunb5rujMxiWAnRQW/pz0CzrDqFEX7NGc+9zTaiu+mXxrqpy1QSvW6gdeLzKBmT1wB40REyE3QthH6Xs4CMIHgH1a9y7X9mUcXKxmZkPTIND0zSN/wB1tstxsyjL7VOj+LfVQ= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(83380400001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 5HrrjmmHcBBSqFR/vL7z5jk17bbM+tl1peqNcC6XZ1m7/MVbW3ak85lceNAeYOjRsY2jELAHN53TtZaCWgBfaqEErvUXXn+JW1QTxeEXYpUl5TID1NtmbYjU9OwyEaIXkO+s9GeWBE4z+uszdeLLPhP8QoO+z/a3gAUv+ieIo9B6jC8COpqxMyxSTztp+UpUMnW01VaJkBr/LkvT0/5MjX8ZB0zFCeW41X/X+/tjrlq5AY0zIo+QQXT2Wbk6zEsK8H2rlmdsdK4weMGROshpOZda4x8visRbfSyqLff/sLI3NVLOlJQXrkHEA0aIGOOWjwpGPXXo/geIixlBHrwbu0xMNMk+F1HdvxBAsIUQnqzdP4wLXwe18FYwJGDy8liHRPQjhXu+HfitXTvv5RMeRDOrox5NBxe5jEt8Uo9ItGk6AkrETPkHOciUj7jteFiVpPwLFkts8DgrwOV1uHUjhzbEnkj8h9gX5Y+5xnhs9sG7Sx/hQ+PRP+M9VMHzAuq9XBnWZGUIj0icispGrNO7aebTHYjiIpsPBE1FpwN/BrqOaGbkW3Sjt8kCYGr8pDrRyQ2YMmCCVvp6K9HDsrTa60nRso2+DubYlK7CGxpkqm2kPIxC5gCV/BRiWoklKCeaqgN1ZsmtgDJBCC3boIdjKHcCf50a19ouu+emH2XeQkJ6oeUULS/of+osadxKbk+yygtYWcxs2v0vNoxfFMVmLzapJhgY/J6c0Ft27YtgZhPrSnjJFRBXsBBQ6brbiJaDcqoN7zshM9rjUuDO8y+QsH/Z7MzTNlI/iGA7egWNSm1NwG7J9YBfQ2BReBKGHsiQBmbl18qscAMH3oYEjwNDOHmse+2BdOqjDmrIrkq5mFYN3qfKEEscejBu3PTY/5EWgU2RfHNi2QdeKwNWBKxXSmANLyKTINvAszdFse0a0MjKFj9v069yGkeqgpTQehQ1iNcow5QfLGR7BK8Ao7NsYEiOgLj6kGq6FXPpuYrcIG0NjZ6BLVUQiyHzruH5kL9N1qPTJcPNl70dPCeTC8W5PMXUKOsB5LVex2jjKp0xVlpea5QHeTOkU1X2MD1/3ZePvE6W/MGxqH2DywdqkWT1EluM5B50lNJZ+vwH3dxmT1fDT3VMj/vJxShdKqfEGeUcdHzOUEv//NtuvK/V/3BIT7PU7l0e9df1cscR0sF4mpObc95vvEEO968q8xKLVQk7KW3kc89EBaONC7YiEugdey3ihBoDejo0Np0KP1CU2iN3Eypy28fl2vT4bBvlq0CKwtZz3otqbbXVqxzQm6DVyd/2cO54OL9DeUyuINuk8bbtLWbbU/eBd4pFQx+ang1IWeXemJuEH7igSHkUWSiFXD6Cq6N7B4nWLlzNV8YWrC87URyz7mnTe3nXSZrUeXi4KvcIkwjmUE0Yd5wxItN6+GsQlHx9w+Rdr4u8A6w6uH8HESp1YvDtSWztWrqn5VbOdclIyhkMUk9GF0ezLpv/N22BWwhrHw+7Zak+nXyJug3y/TI2UVfjSjLvVU9epOUF42TskZiriRG5RN1ZsXG1MIIDyJU0ygf8ZALHTLYJbNpdcyE9iIhizbmDhVdHpHO6hsFY7lG7uui+JTogWCYQU/c9+Wse4xQrZ7MwYNcEdijwOA72cf6gdOm4s/fZltdHbeFThNLg+uiDPzDOyiYlVA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: d5f183ec-6e42-4d5c-09b7-08d9af04d8ee X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:40.5716 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: h1xlUIO2XG/5najwhuc3x3LkWkfRZl0APKIIQGCEOL7mEQ9gMHwMPbgnJSDTJCTJ727VFwEUDTTbbUROOlkji+5GTTo8qH3C4rCifOkMhgA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 spamscore=0 phishscore=0 adultscore=0 suspectscore=0 malwarescore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-ORIG-GUID: oUjyGVnqnJIdUMNUkZ4oNKTEGuPd7m20 X-Proofpoint-GUID: oUjyGVnqnJIdUMNUkZ4oNKTEGuPd7m20 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org A new Machine Owner Key (MOK) variable called MokListTrustedRT has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themselves that they wish to trust MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the MOK keys should not be trusted within the kernel. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v1: Initial version v2: Removed mok_keyring_trust_setup function v4: Unmodified from v2 v5: Rename to machine keyring v6: Unmodified from v5 v7: Use mokvar table instead of EFI var (suggested by Peter Jones) v8: Unmodified from v7 --- .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index ea2ac2f9f2b5..09fd8f20c756 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -5,6 +5,7 @@ * Copyright (c) 2021, Oracle and/or its affiliates. */ +#include #include "../integrity.h" static __init int machine_keyring_init(void) @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t if (rc) pr_info("Error adding keys to machine keyring %s\n", source); } + +/* + * Try to load the MokListTrustedRT MOK variable to see if we should trust + * the MOK keys within the kernel. It is not an error if this variable + * does not exist. If it does not exist, MOK keys should not be trusted + * within the machine keyring. + */ +static __init bool uefi_check_trust_mok_keys(void) +{ + struct efi_mokvar_table_entry *mokvar_entry; + + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT"); + + if (mokvar_entry) + return true; + + return false; +} From patchwork Wed Nov 24 04:41:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 517027 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78D74C433F5 for ; Wed, 24 Nov 2021 04:43:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241262AbhKXEqV (ORCPT ); Tue, 23 Nov 2021 23:46:21 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:8262 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241174AbhKXEqM (ORCPT ); Tue, 23 Nov 2021 23:46:12 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4RBpY006040; Wed, 24 Nov 2021 04:42:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=qsSHdCnesWgw6P5qUtyD9ZQKk7kKRCyx+Xa4vy7iSOU=; b=ML1/HV4RgtM2UjOO8wOdUo94OGjjA4kXYIfURz6H8cHI84JC/l1A75ZrAsaTnchLTMCc qAiCeBUKwejaIRavTriAA3EGjjpXaJWP6m5OSnKX8B4MCoNl3q0mUVY29gXvz+ejmUH8 qgF6GQk44y/191WWNon0zgwILwS6OhGRnWAMxv82YAEFSPs2euKnGWhmGriGt8ej48Ek mnk0iwQMPxM9xy9GvSZhfte8XXrZfsNPv6iYJ/VxDPMcZfURq1MWFYwE6yFKOGU+maHD 0mlPmMTEQqK1IcsCc+ulRO4hRG0ysF77mN8zyfWL5xXMK30DL8luTK1nG4hnQ6nIdkMq 5Q== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cg46fewk2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:46 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AO4f4Kr025271; Wed, 24 Nov 2021 04:42:46 GMT Received: from nam10-mw2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2101.outbound.protection.outlook.com [104.47.55.101]) by aserp3020.oracle.com with ESMTP id 3ceru6amr0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 24 Nov 2021 04:42:45 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=cQuV2JRgWWOMlhXok/L5Ww+b+OrfLH81wUkMxhKF7JqLAcoLZs3UwIrdFp7JvCu6IX5skFvaVRJMkME8eSrGarVq6ypC8nG5j9xWqW2hXnfaaXHTlA6g0lC0EBvraBpFRKPvhdfbU+IAyHz7a12XfuKaQooZd4B76W1lSGuwoTv7nubZtwcikm7+DaFpP7KjJhyiMsMeiZiH0gMEg7ynxp2ZVFma3VqwWJdccxJ/FWnZgnoflHSZqGJoqBjTKIgliB3waAJJoTTefhPBPzXRE8w5fm8ODG51w4bEqPRLq5wls927Y0X9FHaxoAA0FTUWgBKj0EfokEZimQdL/HFhnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qsSHdCnesWgw6P5qUtyD9ZQKk7kKRCyx+Xa4vy7iSOU=; b=i4yTOWzSVs6Mtian+idS34lTcjWP9mKGcIuquRwG/pEaqHFOzVDFU+/rX6/W9qnxpoJIBktmky4Rm6PVH69vQD+X00qemkj1BczHxw6Vv7zRWgyQ82VsD0IkGrCxksLU/L5EQTjQvn7S9LS4rrbbIKCHol6InvnzWl1WgoB45ZI49QaHqVz0PgYh8IxNZ2FZ2PDCDipupjSAnw8b5TcCgXidfXaofRpLhe0kob6mmDFCFQgE6m4L+8mig6UYspnXbcbjca5GkJ0M/0TvHBrFhFeEcAbI2ioKELPX+OfG7En54EFxD1ikg8hqnHqSTkMRtvu9rxz91wMKrANMCDv/og== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qsSHdCnesWgw6P5qUtyD9ZQKk7kKRCyx+Xa4vy7iSOU=; b=vmRd+xJ3P/w8qDbyPyfbmcxTuHBZRInt3qbi7mKubwzTgnxRzGcI/SfufOS5cLjzcyA1cIxs6UQOTpjoZEuLDYHrDxY+rNIXFTrHBcm75+SbO33Y4Mg8lhISLQTFfBI//uWBqUjATZLUnl4HWssxM/c7UzQJ2upWuj+l8q1BgsM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3894.namprd10.prod.outlook.com (2603:10b6:610:8::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.20; Wed, 24 Nov 2021 04:42:43 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4713.021; Wed, 24 Nov 2021 04:42:43 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v8 17/17] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Date: Tue, 23 Nov 2021 23:41:24 -0500 Message-Id: <20211124044124.998170-18-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com> References: <20211124044124.998170-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.10) by SA9PR13CA0127.namprd13.prod.outlook.com (2603:10b6:806:27::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4734.12 via Frontend Transport; Wed, 24 Nov 2021 04:42:40 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: fdebc47e-3ada-4ed0-3bbd-08d9af04dab8 X-MS-TrafficTypeDiagnostic: CH2PR10MB3894: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: +SmvSwZTgRn3wjtdQpHvBuO8QAPiFnYiXRKMmKNQAUo1b81rFspQm6tK7AJXRCrvUvRUAqoFOB7oJGSORVvww/wlpA6RJrdMOREQWM4HPmhv6F8N8d6zsUjpnm/gwuPh5fKWkHXWxC49+UwG9CQh6B/Fk244/eaqEE+JZs2As4DW05AhWgFJEq383BaEpQfpnrl7bNjvCP7q0iJJynmGI+z+lbNdBUoFQlQASZqpVm5NYvKrvZL9G2zVtDPC3myVxYeCj47klc2WBnYeT+VeoRy5b+IssFuUBvYFYWNQCoQXU7LWujbpRWfFCt/EuQRt8tb9MDrID1HWzyLP6TOuKdHafMXoEjhf9Qat+37MAaMk0lrugfw9Sx1xfHkRFhc847JkaEdv4WFHPk6w2m26cBfzgYXlAZxJ15nvw3JPjpPRv1wxfu4eUCuFFGpqvArTmuOymjV/c8UWigL2knXq8OrmMknlEZ2r1ljnL49zd941q2oG2BhCkpZmts1HsjCvRCjYN7EZSUlpqf5Cy0eCM0vjyZB2U0PiOz0uO9LBUNXqZHy8E6Au1cP+ISzmrFyD4kaKUAIK7/EvxS9hXGajKoCrZB+WngCwYwvsT2twHKd4TSZAzxqy0J7ka3+zhu6BXJPuGfwdnnjfKQHzmKVfF509Np+QD+LOrESuyq10YZkVvKW2t168XrL5Ql0cmDWMMTFEnakeV73UgvU8tZfY8V43diuUOgZWv3t3/frHuMY= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(956004)(921005)(36756003)(86362001)(83380400001)(508600001)(5660300002)(4326008)(2616005)(6486002)(186003)(7696005)(44832011)(26005)(8936002)(66946007)(52116002)(8676002)(7416002)(2906002)(66556008)(66476007)(316002)(107886003)(38350700002)(38100700002)(6666004)(1076003); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: vDCXmJxa7v4fZMIRCTfFeomZWDWenyLsxe4QAAvte4BfnJqXRInr4V3rBpuTXAz1Kfl08ssAdyjSZemqA4SFb7sTgtODhbRfdoqkWs6qRYkLdTBdlwraBmK1Z8+96vxuGLRXMtM1rl9I50xyQQw902n0icNQQAXFczelbUBlIbeYft/9vuI+Ap5s/W8kfj7ODS73gn2p7EqFqN+7WfkhxTuoi1l8MU4ge74WRLN4SNbE2NvFmLKdBLubM31QmoLp7kX0N/63JP9UmmrqiF0frbctJswjhaSxIeBWhvqN4iT3QT8u1IgQvj5mnuOg0iQjkuXdLJ0I8g+XIzT14LHrB2iVBcSGCLBIa0OB5rHMrQiuJ38IXANvKHDzOXSWO93OsddGPFFkGPkq8c6dQgRBnn9ufhqw1bxu0HuqBRNTjtIgmvbj3/ZZwSX9LAh8TktoOMdJcmwKR2bnsQjglN6JC2gWuy6xzyfi47N9m9Fxc4z6tK/LbWi3ejFEPQU1c8dGBYpSKKjvfN7Uozr/Pu0PkRDi5a3FSeOIUOhsHDO/W+Jo3H06l2CK6RLklZy4arbu8EP8+2JJAUGJDD6m7o51du1kzGgciL+7DLipqaQjaXu2UMxNKjssYoFi3D92gKFXeqwXW87sCq8pWXeZyJPar9zSNkqjKSR8JnokZ4pDzuVWFIHu95r4+S5PzBwCW2Wh0NS0IB8Lm7XQFceu9vZMixLpe0AgHV2+Il6z9Y3wDvpPIYGkCCrmap6YrQG1XgprjKAUDaYgrjU6FNDjYwgCFWhw62TcXLio+w1nvZIVkTLChdsj2HiN4k5STSYBRzQY68BLJFRcsS/qyXOizYlgRIkE+hlqxbK2LPAbpN8V8KRrBejIUr8ZgRRItGzr6ECzE3O+tZO1aDTbtiDA6LvjRJPynmq2GStGAaylWDteqGLOVh6M4khV3AGC5L7Y56wKlwCKmFej83TXCCdWfCPkuA5sedmdxrKKgjrzFM+2NPXZoBup2LHhxr81cuUmuMk7aKSQOT5hQAvvBx+X1qM3twNG6/npiPMifdYUfDpp8y0MP6kRHuhqGJEZrcEvhrORroCaK6zQTOU3clFvIYj02F0GBcHb7R6g3ldHAA2BAb06F/+S2HAbKkF8/sLQrZaLwhRZQUlZfQLH6lZyEwk7HOSwTrHDiriC64ShTBeZjNRa7PUCzJ9QK6XqtkseQtx0yGeU6GPuM4drOOqjD1/MTBSwR8rFyKKz0yZ9KmN9tlvKCiuJq84X41T5yLLU7pGsPHyv2E+E8TqguiGAQZBjuDUCCpqiWaY4DrOUHTUIRmz3zsYhw9/5dl2J18SK/VjESiJ0UlFO+9SnTU7ehnsMh6u41gUnRmBtdMXbGBR/Yajn/vjSTp4Ae0l87+RCNTe1Ny8REGbh8Yw5gdqH/C28E6MSFdFsI3wkhHPBmllZ486YCOtFLcIyfAnxQgaPds04mkECDQKYfNP5cYuFIJxk7i6kNfpE3EZ/9xV8PCzdOXZ+oM2GCx97n153LETTC0FwGmlZMddhli4VjmKnborv+lPaSJUhrrTPG61cASh/vQ63qc05MJNN/PZHlzANu1J23QwFNTjMStlO8nVc1Hz8HZSPdBp+aop8rhgvFdcD3km61xInmdl6x3tz1JtVnME22bnKh4Ft/4gcHUvagIBnKg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: fdebc47e-3ada-4ed0-3bbd-08d9af04dab8 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:43.6351 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: EWnfESMjZMfRBXk5EN0euX7e7G6EC1c5tSAcHlvesaHRgikIuuVZdmOnZL7ZeCodv9jg1W8GfwaR+Z3wh+Dan3T/GhPbQOfmPVNoyS7ZNK4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111240026 X-Proofpoint-GUID: j_A-TQTQxQGnAiGpyPclqzu6L4JtujUE X-Proofpoint-ORIG-GUID: j_A-TQTQxQGnAiGpyPclqzu6L4JtujUE Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org With the introduction of uefi_check_trust_mok_keys, it signifies the end- user wants to trust the machine keyring as trusted keys. If they have chosen to trust the machine keyring, load the qualifying keys into it during boot, then link it to the secondary keyring . If the user has not chosen to trust the machine keyring, it will be empty and not linked to the secondary keyring. Signed-off-by: Eric Snowberg Reviewed-by: Darren Kenny --- v4: Initial version v5: Rename to machine keyring v6: Unmodified from v5 v7: Made trust_mok static v8: Unmodified from v7 --- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 5 +++++ .../integrity/platform_certs/keyring_handler.c | 2 +- .../integrity/platform_certs/machine_keyring.c | 16 ++++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 109b58840d45..1de09c7b5f93 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,7 +116,7 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); - if (id == INTEGRITY_KEYRING_MACHINE) + if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 730771eececd..2e214c761158 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source, #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +bool __init trust_moklist(void); #else static inline void __init add_to_machine_keyring(const char *source, const void *data, size_t len) { } +static inline bool __init trust_moklist(void) +{ + return false; +} #endif diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 4872850d081f..1db4d3b4356d 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) { if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) return add_to_machine_keyring; else return add_to_platform_keyring; diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index 09fd8f20c756..7aaed7950b6e 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -8,6 +8,8 @@ #include #include "../integrity.h" +static bool trust_mok; + static __init int machine_keyring_init(void) { int rc; @@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void) return false; } + +bool __init trust_moklist(void) +{ + static bool initialized; + + if (!initialized) { + initialized = true; + + if (uefi_check_trust_mok_keys()) + trust_mok = true; + } + + return trust_mok; +}