From patchwork Tue Sep 14 21:14:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494825 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5F7DC43217 for ; Tue, 14 Sep 2021 21:15:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9FE0B610D1 for ; Tue, 14 Sep 2021 21:15:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234546AbhINVQg (ORCPT ); Tue, 14 Sep 2021 17:16:36 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:52882 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230332AbhINVQd (ORCPT ); Tue, 14 Sep 2021 17:16:33 -0400 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxRgk007081; Tue, 14 Sep 2021 21:14:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=Qe5VXpKX0s9y9o6FNvA7liSiyZSTkEmNO2QX5ulgJBo=; b=tTO8l7jVoVBALqoEipLYDCfSsvqNplke21yn3YMKfZiDZosiAvepv6jKoCQY4gQDXzRn nTKElhq+mOD30l6y6KgE7aR3kSGytqetCC/I5LfdSbivqXy4RFM6m8fionT0b6Lp+SKH F/Ttn08/3DPjuPqIXpo/HaagfopdadXE9Dqhj+9IxF4ZpFkvoNoGfwigLu5nGpl/TfDB XESeUr7yocYNGQNa54KPU0fiiuf7YaxQxnZAZCKKJYLbKZRRuApU+xdwMu5rsQCdRqxD PrxVOcKci9+i2PSRSb4z7l1tMGdfm+MWT1E0nJRw0PkxafVbWAACsPrGniYz11zeOQW6 +Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=Qe5VXpKX0s9y9o6FNvA7liSiyZSTkEmNO2QX5ulgJBo=; b=CuUWhABZaB6yuZPtB7pqRMIBJMoUovZIiZrQzTJLYkAGmfblIsQ81UZ9JGADYedKH6fb FxA+1nVlPZ9UQWW3sKfdHCKZrRIDuuws9o0xiWLXxHvMi7GM1PPDxEruPGq7S7ktdoCQ hjvvkBh2u0E5taxI+/EBKBQAaF5zAwjljKWrF5yKmDV96oGq/xxvvdv/QJgABdz9Ty8c ItcI+mNJ7Z4Ml/4zuHVLtt21MGaGzQ2efczdVNQFrZBvV3EcLdXR4ImsqSx03uwTlNuX dZO1k8CGJ4qmS61BhFE1xfR5Gij8UEJfuTTgQlE1zE8PzxRpHH4Ry4ZQ1mK6WSYQpZQy yA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p4f2xkm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:41 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBAmx178895; Tue, 14 Sep 2021 21:14:40 GMT Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2177.outbound.protection.outlook.com [104.47.56.177]) by userp3030.oracle.com with ESMTP id 3b0hjvqw8y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:40 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jagjCNZDSwoExtMwCVDgzkqXKkRaxJGiIfmG05gsUNqrI1JdxyIryEsMyVso88btkOaHMQdiuCrbUyExtvy2/zjjSnQIVzNrbxOqnheo6JBuEu9pqX3yzxuuvm30cZe/ePzmtMc2cvTDZLOIXmbKPD/iXoh2cXUA8hIECMuyU9vsq9lPNgq4IbegBK3wFLE+F8PMFTQrrNIsV4cqMpjKLM0H3II4VipwEOmMfD4kKcPJJnrdl80C2J3O42vIhlW6SKPOpnsv+UXUlSz2ibkTuVbkHJbRwwLy2XKWgPJz5LpSjBy1aarwFkd8wwAyIjUo2Pg2YqTpHivPO5V9ZHpxZw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Qe5VXpKX0s9y9o6FNvA7liSiyZSTkEmNO2QX5ulgJBo=; b=Vr67U9m+hCalRtrQmIuHK/g9nTpD687gWM19ZYMeWamxpX/b4cSIGKWwmPn1dDCBiEMhv61duE0CeQUdf0BCPG15gLV8zYJ9N5c+O8xC7Tcoghi/4J1DvaS4lRhD3pJq3MhT8L3+wr+wm606eZBtSLLWr2oLIDvWlBNNHV9Zd3uZx2cnnUE9ZbobyWpZKRk5XpPE52HqviXXPBCOO9BXmw0KBawoEncyBgu2O8nUv7iGXoS8AR5dAMq3GAsNkV0pWK0K2zmsJFoPWe3Mmxgrqhnzswg6kEV7LiqOs6mpvntM6Ix8p9mXkkUfsxvo39w/4FE0oASpE3qsU5xJYZ+dmQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Qe5VXpKX0s9y9o6FNvA7liSiyZSTkEmNO2QX5ulgJBo=; b=kB8K1opzWFtcVf2MtrP+wyLOYONQbmF/pdsdMOUeOjERYA2UURVm/f0aDfrxnl5CO6hP+iuLWNUzl8YJSDkxm/hD3VXj5+rGvMMenI+TvebjDVLUIavTPXmu5yvWfDYTzarURg7I9WyBVrP3jHrg+KE67oBXPVcl49aGnYDV97E= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:38 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:38 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 01/13] integrity: Introduce a Linux keyring called machine Date: Tue, 14 Sep 2021 17:14:04 -0400 Message-Id: <20210914211416.34096-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:35 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ad60cbb1-75d4-4b50-d0be-08d977c4a8b0 X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: o7GWLk2IuvneOmVAwhKy5hf3Cxnx3N5yiodAZO5zageYrSRtUBYuJNKqMuHMuc3w0gwkLfNc3KdzKnfZn8j8h8PjxUGbuvkcQoMuwf56plTfM2kpJ9sriwsY3WpS+DS50ckVrBDgeoCizYlM00ui8ZuuQXFV84l5dF6FnV49N0oKf9d29q1NOU3t9z3LV/0snr7EUeM73q74JXHijtRI82KS914wpZHqYNpOECvPUAXE5++1288T+6997XnfnZg4EJ2xfDK3Frr2PoeqwKAufh/zk7V/xMf5AIHySGEBmDGLhmA70Xuyfo6T83LOToAJZtwRv2SNAObiF0nwfjVWWQ2u1Q8K101pSxSchJ8s2Dd1sGByzVHv38WmGlY+8aTKUBp0iBQFFmN6FhOvZ8oargESsfcHIT7lY6EH/CG0/CjFkQfYycTdw4xnoy7ThSNVP5v3jVkheDJ2Oq5luoQE9cc2LUIjX+iTeWg+1TNNkKfruY5QMzR+GcnUr9uP4qifRsIgAGMJ9+0EjT/0tn1m+RHDmGK5pAkktMCEGhL//eRhltYv4ZGQm1dN8Nw4p78RH87iWJdFLkmDyj/NHX72Xw+uWMgsNLr2M+G2pru/BF9PzGXjCIzbYdxAhDiiNt/8Dhi0FE9yVNXvPr9nWiidFZjyt5+yc9XsGyySCP1l8n431dZjP7VSibZLUqx3TAmc4/KWEJZNV3dksScwbWbeqWUSkgWUcpuVD2Jld3sQsUU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gM3yJwImSIDVorBydJKA8/VHJvyJ2pYmnKnheDUuqBAb8kbEDgL1SXnG1bdXNXJBS90xI1QWauFsILPIE3zvlVl7ysPdkhQBegNkrxPURpCShZ2gEVm9eSDvp1K1syoli/O98ckuexztxvQ2IDc+R/kuMGSt/mENs5nEO9fUPnkueVI1niSRsDd836pqqhpARH3udd3654AWCl9c4Z9moRfmuLm/lLBMH9sHxR2W/TxZHjqtNqGxo+cOfxddNM1VCc1m0JV7dL68eWaw7v/tZXg/+3JRjEngopDc7sCDI1rOjRF+RFjgPeRuJFR3602lwFo7wuvVT53matK/B0QaHXcARdh6mWFOp2wHosIkdfEpz9u8vsWArhTUpJ+rUfgw9LmTlvSWoM2XXHkCfQ3isrB6GcZ9/5mreu5LUw74TZH2gFGDLD6gPz3ejPlV3D/bnti+ZEd1AIUnCntvzfrr/WW7nSHZuFQiK7lR/oJvduQeqKLC0g6k2x2geIuyamK2aedjsPHJoHJRI04EqgjzHyyW++kiaKGGbcWkMI66md5iaHa6bXV70TDpo1RvJp9xbKJZUFNef9ktvSntSe/e7JnE3/qABmYAA6e9hyBqlSr3PqBVyIu3ZBFzHwwyZAuzdYvMquTKSUQPSPSDB/XabCQxhcUPXcoXFwx8vFhXQeZoHKUGae4lKQCUN1Yaaou9ROHeGCuPThASn7a5f8aHIOBwSwmqgtom4Wy43XVu/Pievueg8zkIZVe3BKtNnuJfqUDXq7Qf7uarucgLOtaWbMJTK0D07q11o2N1AYKfojG/9smv+x/RstEeJrmIYTvvMolWlEDR/JhP+cT90854H4qUrlBIB16vPWYBSmL43e8IWb/xGPEQUA7x+XiZxrRrxTPtU45rx+qzkoy1yV8k7knidAuWdd21qZFBUyovJv9Wp/GeVeFbn19DrpDIA3522h/ZeVy+D8HESkGuKXeeY6jOTzWXwg5KU3Bz1ZJQAwMeEXpftNUWnbfgjIpfNfKJkHl21AkK7lxf6xWmu5cc28atJz4/byV05ZdzPZkCvKUG6rAfZs701GU/iSuiCSx7QgB79dfVJ7YUd8dUKfQbDnl3HVCO0ZE40WKp+jtofNSKaBPEpNfVbjrrIWe9XtbfJYHiv+HW6TYsoewD8Uzt2jkCg/EBZKVxf8eMb+f4V10PHWMVAmVmy2xSgDzWdqxVqmfank65kyQye1k1Og0Iv9O1y1AF6FFEHxth/oco1UMImrGTJLJLGdPficGPoKLbcrLhYXZGGuRGC4zeAi8LNKNk0Q4YI0zQ+7PnAztBiI990dBWu0iwAZNPD1BrzvYo X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: ad60cbb1-75d4-4b50-d0be-08d977c4a8b0 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:37.9032 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ctEteMhs4v94HMVV6mSmHRgbAs3RzP2Z3HTfEFTp/Rm5mTAk5a+rE89ihEiUVMBbpjbUJbIeNjU6zywsG4ssDDvamXEsuGJnq0fWiy6bGLk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: AfUcMEhIt3DEIPt74CkaEwLn9ZgAAHeN X-Proofpoint-ORIG-GUID: AfUcMEhIt3DEIPt74CkaEwLn9ZgAAHeN Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Many UEFI Linux distributions boot using shim. The UEFI shim provides what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure Boot DB and MOK keys to validate the next step in the boot chain. The MOK facility can be used to import user generated keys. These keys can be used to sign an end-users development kernel build. When Linux boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux .platform keyring. Define a new Linux keyring called machine. This keyring shall contain just MOK CA keys and not the remaining keys in the platform keyring. This new machine keyring will be used in follow on patches. Unlike keys in the platform keyring, keys contained in the machine keyring will be trusted within the kernel if the end-user has chosen to do so. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed destory keyring code v3: Unmodified from v2 v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" v5: Rename to machine keyring v6: Depend on EFI in kconfig (suggested by Mimi) Test to see if ".platform" keyring is configured in add_to_machine_keyring (suggested by Mimi) --- security/integrity/Kconfig | 12 ++++++ security/integrity/Makefile | 1 + security/integrity/digsig.c | 1 + security/integrity/integrity.h | 12 +++++- .../platform_certs/machine_keyring.c | 42 +++++++++++++++++++ 5 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 security/integrity/platform_certs/machine_keyring.c diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 71f0177e8716..5e9b3de46900 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -62,6 +62,18 @@ config INTEGRITY_PLATFORM_KEYRING provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. +config INTEGRITY_MACHINE_KEYRING + bool "Provide a keyring to which CA Machine Owner Keys may be added" + depends on SECONDARY_TRUSTED_KEYRING + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on EFI + help + If set, provide a keyring to which CA Machine Owner Keys (MOK) may + be added. This keyring shall contain just CA MOK keys. Unlike keys + in the platform keyring, keys contained in the .machine keyring will + be trusted within the kernel. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 7ee39d66cf16..d0ffe37dc1d6 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o +integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_uefi.o \ platform_certs/keyring_handler.o diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 3b06a01bd0fd..8c315be8ad99 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif ".platform", + ".machine", }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 547425c20e11..730771eececd 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_PLATFORM 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_MACHINE 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, { } #endif + +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +#else +static inline void __init add_to_machine_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c new file mode 100644 index 000000000000..ea2ac2f9f2b5 --- /dev/null +++ b/security/integrity/platform_certs/machine_keyring.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Machine keyring routines. + * + * Copyright (c) 2021, Oracle and/or its affiliates. + */ + +#include "../integrity.h" + +static __init int machine_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE); + if (rc) + return rc; + + pr_notice("Machine keyring initialized\n"); + return 0; +} +device_initcall(machine_keyring_init); + +void __init add_to_machine_keyring(const char *source, const void *data, size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm); + + /* + * Some MOKList keys may not pass the machine keyring restrictions. + * If the restriction check does not pass and the platform keyring + * is configured, try to add it into that keyring instead. + */ + if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, + data, len, perm); + + if (rc) + pr_info("Error adding keys to machine keyring %s\n", source); +} From patchwork Tue Sep 14 21:14:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49133C4332F for ; Tue, 14 Sep 2021 21:15:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3535E61216 for ; Tue, 14 Sep 2021 21:15:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234740AbhINVQm (ORCPT ); Tue, 14 Sep 2021 17:16:42 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:56020 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234376AbhINVQf (ORCPT ); Tue, 14 Sep 2021 17:16:35 -0400 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxNDi017542; Tue, 14 Sep 2021 21:14:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=Wd4dl4111WWQdtKtBHjoIV7EgY6c1gxrQVwQbd3jMig=; b=R9cLD7su5xPVv3LdmLSmEG4UckvM6VReAEcpdBz7d6qDBSQs+LHedr7JVOntHVW9fpdJ batqdMIH1QtwhLI+FuD4NeprKpHTV5opqb5m5ONQmUmf2xqLC09+petOMXloUKdLQQrw XvSmUOoWO1MzQNTdPQqYmeWm/CC00jPo4OBNVLBP7bu2VJJsfzF8mQa45ahkYqZ2xl30 RRgs03/0/V1Aok0n40hE3V3Wcvq2P5hQ1Pi4BIM8MzzAaIiaWmRaMrCMVEWzWh4hOZrW dGotWHmeNQhTXhyqF9/YKHZeJN0fcelDJc1TlKIXT2VRXsK68COFamJmhIHIE6UQtvjC Qg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=Wd4dl4111WWQdtKtBHjoIV7EgY6c1gxrQVwQbd3jMig=; b=NXyE7bkW24B67bj/DGk9FgFM4ICD8iQYItXgcA4Taj5oTMqscFqaH5GQltw0SwQtHZ4y 3YdqI2vzToEYoodeM2zNty9PNUpVJf1hLJ5i2sClKVoPmoKb5/pznxyh4GjPLwLqq+d0 eZDRj+H1BsqwdvILmEsBIyGU3lKHQPBUoHMW98OyDV4UUwPJycXIEo1OJVHgdEhBQjlm 45czZ7HKKBRIW3bPS/ZIusA5odqGOsFH31Zp43PfwS1dzWrsTjeGk+ZS64VXq/hzsOPt sdZzliRVL1Zx6MHWvsx0ZGP0RzKFX9GVkyMia6nn0TrXUdw5yAgK+FJo6eNU86sw+VkI 6w== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p8taxhs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:44 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELB91F178826; Tue, 14 Sep 2021 21:14:43 GMT Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2176.outbound.protection.outlook.com [104.47.56.176]) by userp3030.oracle.com with ESMTP id 3b0hjvqwb7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:43 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fYVVoY4u5cA91STg90j9H++nZP8ndjJT2AFPgkuP6r5ZGm0ZB/7Z6UaJEjcdLTIilNsvcF4FeWX0FWz3BbzZMj6j7czrr4CI4dRL8ikuSU1sLYaGDwRkTr3Saoy1f+qQazTczwEfC09/jLHr/m/L+jCKi4ckDiDvQq51BP0ZHIPb/szfqHYtdORlzRDyQsNs8YcE3lrgDoWfV83NY9b3lLWwIbPVSTOx6SBtae4PBVrnjFrPJpYE4oYy5BrKlIKZXol+Ik3OMY7z5tiDlnjSiZm3/tt80m7y0m1blFjo+Hakv+M83RYowR4f5UIrxjpvWT0/4Omxg42yHOzlLxXBvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Wd4dl4111WWQdtKtBHjoIV7EgY6c1gxrQVwQbd3jMig=; b=Nekc7cZ7PLIpBOnzg/du9bSQea9gVN+nTOQzLgt0x6C8KureSKhpy19WOcwQ/OUh2jhoRzcurnb3RO9OWo8Ocyxgx89fTM3LppqpL6e4LCe6M9iET9J2EaHZ7pBWjz+zYOsrBg9jVUGhD4mEiHL6K3bDMsBTWOYH91MbPBjQDjG8GCZUHfKCXhS1oimMO88CFxRvRGcjpoKhq2Wqosg5l+ZjRIwNEYCcbiyhSyK5MnwY02UmA38KseI7ujmByO16BYaw2WBjY964RqHDkU+Sz61htbWwFjYrhtp+Fyx0TwyD5ZLMOAdeughuM9m5Gmn6zzcFhpiY3M9eOkWpDfTuDg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Wd4dl4111WWQdtKtBHjoIV7EgY6c1gxrQVwQbd3jMig=; b=QhlG6/qxsOjWKFfB1O9B8Pt3WxxkcqpDsCQBXierbgga/xO5oKfzGGXh0ljaaHZytA8mhNXV+p5gVghmiAJSX4SyU2WMQAMB7oQpL/fvJ/Nk/xK7RDw8K2eiyvbrQxeflp0HqAl993YQEpJvUpOhmQ7IKrg0sGzJo8MWWw+cgrA= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:41 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:41 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 02/13] integrity: Do not allow machine keyring updates following init Date: Tue, 14 Sep 2021 17:14:05 -0400 Message-Id: <20210914211416.34096-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:38 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ed82174b-68fd-44ad-8d9b-08d977c4aa6e X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3968; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BacXOCferyP3DYGzVC4mJ4c/3aj8rBp+jgBu4YyoDit8ksEkzsoFHtFtI7VIgdr/07TtvTZE6BNhvTVOzZDhAdrWxCA+n8GHSDpnITcy5g6RWiZZZ8jiUWvTIjoBrMvocxV7U/tWY6j5GVfLVzdOSiXUWiihsaKitcg1U7Z25gmjb9I+gY8swjh+4U2BzJKpNLgs8XwQ2Yq37x6hh8yVKP5opK9juJdeanaTx9OcCz2np+9KuauI8LpE0VpUgjCFFDiEdjIb6MRdAat1AsR2pYuKLzIC5GE8gi2mMkhOtzHdvi79MpVnEfN9Bx7KGjxI9abkXeNse6HN8c5VVXBVgudP549qhLyd/Ea/Zpbh+tUPvQm9SrrInjTjOM3PkJLbrSn2hP15D16eCIPvM1hySdhWsiZliglNjG26DxwrZLAvGy396NxbmtA1CAwUdqRzDcQxAGBmCwO3RtRmAXeoWvH3l9oEt3u5wLZnTjUgCoaEucXAUAyvkHNIYvLeqitB2UpDIlagvZCpFRSR+GhFRzNBficidL9lwkZsM7c6l8iLvy+vO4af4es+hNavkbH9VP5cUq2NoyP+pKLBkRJwA3ItSP/gEjTEuH4cpzvWH5pG1oyvvwiCxl+KFnnyqTT6Sc5Nbv/EXkgKSXFVzt1cOhph0w2U5di7crKLWvG4VMd8koJ+FXay0jmfhWbkERIa2qn4DoFj5r5p9vkUNstFYY2N17dZ64IRtmmFdWW50tc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(15650500001)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(4744005)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: bS3ererbAEgFj7M40ypo4Nk6ElqCvZkUyFVMKlbJXFUN2UAOniOsvYcwGYj1fngcTxbCL4VpuSBwEL1wS33IcLT2eqMg5LQwW8ZF3F+AG0Vl4L0noVGJN4vIrOYGC9dMTDZcp4fCOCO9XQ9osleDHhKJOqhYdReUYpN7TM+aw/zwxX3svr+HvLaMSmDWU1FxcHuEWB4gfsfvG9z8GoEp2PIM3hnt9BIGE9x5jimQBugELG/I2Kait4ZQznCFC/oe1mvtCI59pQZgoW0QZGtx9MUS0Appd8o5X87xFdEdCKj/SJeQmtiJDedVJP3FtPIIwF7gLljga5GI/UFIiDj62z9h86HGER5EoHmqWDuwEVyMIgLUTNWY3S7PFic3Cikm0XjlsoKCacGs3jcytjT3hRr93Z6I0PguwdoFqftApzq/ty5fzRadSuhdBlyvJivRS+aXdbMz7EwPlsYsSaoaXUNqrSGT2vw3gHQae1XlAw72YmTtOY0Vh9Av+SjV6jJTFiQQ/g80qgxu5QaDp3PB5t40mnR0u0VkGNNNTRUG3IZUSylMSuK7lSN4JPb/i1SB5jxMirZpZZGBzvq8XAX4LryfxEV+zZqbaVcAmhSFn7oLPqHKkSzWi182oAJOgQ/Au9OdN9K81fnlq5KoF8pBhtj0cTBJuaMio8XmQuD1uHPR4+4vxSailsd7ocL3DLrV+SZX0NxkEUf8SjtFEAVbCC+NMfsN8eSh2lwqD4qa67MjwoI/Aozs+mGVt1AXEywDy9wIR5RcG3NuSL3Iqy5MaFY3gZNYZaAAOedAL2c778XzGAtigWwNkJxLRwP8hZ80tKor6S960JTOMOo27Wz6rB2TSyK1VAt5qP11yzR1YkMPU7xFYDqOTa7s9R5g3VvTI7VjRt88AXpos5/gYspb1I6/8raAGbYo4KZLa2KfwNybtk6I1nkjCT2/frTsUMPXsmJVTF6vVtJoRTkUcIcXxZVvS+EXSX6/DerLTLteFVcpd+HocEix9RZyvSaf9/iFYQBWnKLV5eLvNWZvra+0hZJAB+ayVQ8LwTOQFkz4+Rxtjminw93mD0ARucBUmlUdRxaFCC+lyMVZ6kWXkVZNctpjK/39r+m/hYohRRo5LZnf/poJjCZMdF3vH+o6fX1dJzwAWw1Iq3s2AzFQDIeAt2iNGnDNx7ve+7VeoPUDXDkZpBDRPZNgkzlevOUDvU6dwOoqm9dGJj5IDKtHFOgmwoX38KuN4SmhLfb4c5V6lSDLWoGt2YzLOcjcIj3+L7JyIPXbmIaJEekjTBCsZsEg58z1Y/lVxLGY50U1EIH2ONMKGNk6Rv0PdF2/cJO8qiae X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: ed82174b-68fd-44ad-8d9b-08d977c4aa6e X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:40.9369 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hevGY1jknksQtA4yxy0yRs03350R6jHU3p7mkqffYM9OyiPRO4GKB4ibMbE1FsPwpQUErWWFEhyBr1Ixi9d7DgjopdNXD3RBx39zkTOlLlQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: OAjOxhxcwQHrB3jt7tbERmbehz7SX38K X-Proofpoint-ORIG-GUID: OAjOxhxcwQHrB3jt7tbERmbehz7SX38K Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org The machine keyring is setup during init. No additional keys should be allowed to be added afterwards. Leave the permission as read only. Signed-off-by: Eric Snowberg --- v2: Initial version v4: Unmodified from v2 v5: Rename to machine keyring v6: Add additional comment (suggested by Jarkko) --- security/integrity/digsig.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 8c315be8ad99..910fe29a5037 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -140,7 +140,13 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + + /* + * No additional keys shall be allowed to load into the machine + * keyring following init + */ + if (id != INTEGRITY_KEYRING_MACHINE) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction); From patchwork Tue Sep 14 21:14:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494847 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84CDFC433F5 for ; Tue, 14 Sep 2021 21:16:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 66BF361178 for ; Tue, 14 Sep 2021 21:16:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234649AbhINVQi (ORCPT ); Tue, 14 Sep 2021 17:16:38 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:55318 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234125AbhINVQe (ORCPT ); Tue, 14 Sep 2021 17:16:34 -0400 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxaSX026025; Tue, 14 Sep 2021 21:14:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=j8G9XshxXuQ3z4G0CyxnUr/kN8yyH553hc7Hx+LArAI=; b=jpWaOmHEjpNuu8kvkJkzkO855FkiYiW1HN8w+SJ0Ib8idQD2fcy0oRH1YpQ8xLDtvehW zTR1CkcMzv17uGvr5sZaoX+kkhqQ4kwWVzv6BshKzifrgsZAP/1g2DpoFuiqGjNzBvkg 65vBS+cIQ6FQy8mI7WX7pcxe/weE2yu+fK9sGKfJDJcHGLa6xPeu1nu+0uD5A97YsKPi fuYV0MQMt3/uMUHUPRq3qShKYtAnIlXgm/Sjnxv+Q0sm6KjFvJaWejTi9vnxOSgIIdLX CnGb+GR820q89JWLzUzkRss9horOowehA/rZplaQ2muwY49NtmSYsS5jKJKX1BH31jVk Cw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=j8G9XshxXuQ3z4G0CyxnUr/kN8yyH553hc7Hx+LArAI=; b=Uz61wiMWbC1iJVcCmGA0zJlN9eDc5yWplqmWfBGdXAFVgtOrl4uDfaskD9gHDlyaIX2X Xm3BXYTExTSOLGeGHLLVwuvzpTrSP+AYV+F4atajRFznmPxDlvmvAe6az+5D8RwK8WKp SoqZ8eh6vRjR1eULMfOQyiF7ZebEyRttafKqKAFD9CfSgoKTFK6DhY2vY6liMWcf/1hn 8kbNB6vjWxgLRakOKkP/SYRfE3qWe3HX9Qvxn07XlZBnD0yRSPNG68pxKCSCH4Suo527 Ig/nEeKDFfZgR/S5UH1bzONhifCVbnL+wQz+MNUkySAkoMe2jWJjumwMcnqCfdWuD5NJ Vg== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2j4sbcy0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:47 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBB0A179027; Tue, 14 Sep 2021 21:14:46 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2107.outbound.protection.outlook.com [104.47.58.107]) by userp3030.oracle.com with ESMTP id 3b0hjvqwd1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:45 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=drokJ/T9YrDKXBlP3qbEGdQ5O2dZBp63uqtjUJ/4CqZrLXaes+L+qMDjfWj6U7eEa8aMMZ1mvFERHzfIQ/i8/UFL6p2fFIZDRBZDI/TcSGESHtPOW+2w6rDXJlOxJDaqPnS5f9Cxi3eEcvqpwR0dAKLJNmrFihXzlAvmNTcFi/E9jqMOqlNfvN4yvEp3y768yQB8cHmlo3oQ5HM31j9XK9rR5vdhdsTFBLAmrZc1CQGnzs41MFUFEA6fu6gl0rR5uNYhaJUnJjqU12udDQn8V+sWerd1Qjsu26CbPwqyRsshR2eWBCHsqtb64HEH7nTHkqMmeSqWvfSR9maLNMM4cQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=j8G9XshxXuQ3z4G0CyxnUr/kN8yyH553hc7Hx+LArAI=; b=JgyHbAxLk3ePGNM1Rj/F0OpW4YeHo3OZia9+Aub2zhdsAHELL7KwSJ+nQFP/Tb1V+4WC4iliyK5bUYQT0LrriC6UDza7y7OdnXKf8TXrWxOmS46HgCJQwJ1Pb3mBl6HLcQe+srNSaWBNFjPG7BoR6pyHSHPw2Ol2CKMvL7qGn9gY0B28GKlR/oztuTJzRsq33ejhOgd40eJAaJXxGD/UZN5ms8EBJRPEHP9FWPtZSBpbFZ8CY8Q38hZZ+R8mI8F3p6l1iULOZHrmm7DLdlg8gTZalUsyON5buPbEST7Kdhrkh1ce+ZAjBj+vHOCEz/mMSMBsZkZYvx6fcEbrI9dKdA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=j8G9XshxXuQ3z4G0CyxnUr/kN8yyH553hc7Hx+LArAI=; b=XopFC4gMtjv6pBk/Sr9t7M4+K3ebfeGLBwEsJGMevXGldJHRXRm8o5lDt74QYM15qEezJhglo69jsOcgMtOVDj0s4V/TBPu83YhF7cyRgLYs17ZL9jahoehjREzHK6Z+IqhFbAQITutnV/aP4BFHYhZ0KesKg9xanBM4PUu6/98= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:43 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:43 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 03/13] KEYS: CA link restriction Date: Tue, 14 Sep 2021 17:14:06 -0400 Message-Id: <20210914211416.34096-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:41 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bf4ac5e2-c7bc-4158-22aa-08d977c4ac14 X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: AKSRkQqLfDEUhDjx82n/W+M85R0By1hxdFSnzVAC0+OYb6ITKyi5woZinYqwvMdmkZDz7t3Co91WpfKrHk0510dx7lMiQWNlVMEI2Zu8SPY1SaJOJEN6gU42YECgH0tpMJu90tdkqUch1zxeiufGVEsH2D04BCTWuKHZFCFviz7p7zkjqPbmGJjUkdLrJI1GJ4ZNf/ZTCJ7uwg+RKmzoFZd/P6ftga4ChVsUGe19fIZv4ECyqZE45fJ2a4rHrvz9ORK0K2CGvlKdr+AiBOVm0djjlU5Sl56JPk/zxXU6aDrYvZ1Cxur8EC8QzE0FAgj/Mv0MwTxZV6Ighjtfl8AUzOPQuOXFLztL2xJmbn4T4rK9pwXwPXegmejjmtcqfkEzW3QkR5uUjAPCAa4HeLAiPrva0c/yFtgy5Rmq2eiIcqCULXCKQ/n+Y47XK6GJMPdBPRNxGqNeeKcReAQi4Xf/E2T1FGDwrij9Igim8/DwG3H+CBr1sbHJ1I04DhljbKgre6xU8pS+6eC9Xw5NTYvL+e3V3h7C2l7hTIOCbnWa9oxcF7lkSSZCCu39XK2RPBXJkKXF34K46DdPMw1PLcggcJeaCcO5TXN4ujTRHaFXCjQut/x6x3YOqwciCvNFdWL7fN2sMtGnoK13AncTFlEft6kOFrhnREoJaqrBt/8Y0LSHkW3104jH8/YkWrMBh5rL938L5HK6JDaHIelPMeOSsTJ7AK4Ks2HMcLbs4oDz+HU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: v2fWhr0U7wQCRHc3nN6Jd/qiTO0v/XoCPYGGhLNcZhYiolEvN6cL4Q7lsEFRYVFimOdgHjn9IwXK490n0HsmouMu8sr/NuWr+JwMsEcTC3CUwHDy5C4oQoOwd+71kcCx7AOlUMQsBwUH19bCQffIOH9TLI6Gn/8vUsGQv48/b4dcAhN27pQpIGFuKegb6YP9LZ5t+J632hUiC5EAY+uXaCQ13Ol7m1VFSXj1w2bZ195Q/FEcDw7e6hqK9ZHjhE6wvsG1RV8ksmu4t591577M3fGdnzK/FV9gYTUj+7L5P5m3VdeEVhnqTHzrZaLfZ6dgG3yqVyDC02u4n2iWrTpYf1KGmCED2b9mvbSb6yG29Fefu6z7VpYhd3k5qA+WnVBRCci7uFLj3dCMib0ms1fKkpp1REAk1YYeoQ7uJU/LxQuEf2jUJgx8ACsf7KtfGH6SHkMG1VrwyE8rI3/ylg7idYvqt3UujHVkQUC92WLp5rbfnIfslE88zSi2a0W9Ez2adiEZtYEZKFrg4qxAHWOkZ68Kecuwj2r/LdcRegb0TqJ6UqbyP6NHt0gUEzmhckISd7g+tOTHwQgcjLhMdV2FmY2i1X4dX0LpHvfWk+xfnNvIEjkY7ICH7NIJ8JeVa/zPhNxwqYoP+uM+U3Eb7GWorJYpL4abUWbbj2SAJFUFlLfFJ2PUrn5IU9L99FshaId0OUtIBEUnQ/pCAVzfjN1G0WxOb3uizhXB59UxARpQuDLi99oDGFm+D6TCkuPUmXmjF4ykSqdmQS42sxi/b/qn5LbKMdhd3fdP9Ws0uXVTOTkGEjStfQYMf3+Fbq3kZZe3VMzgDm45xWdcWxk9dmEzsmU8wFdciuw64P4+mHqylFNL0SAYFQxwoLMuwQrsY/Ie43SEovQyG56/HlDuleD8AzB4/hlC8QOwKRc/k9a9u7J2tCl/yqeLYg2WL3I7M2Ugln0TfSrKqb/5bShAHHagXI4cweGw+CgzQn1ra52LK1jV2XpDa3Z45f3D4tIJnHoj0mZ8o9WkDJfcyg2A1sFGncF6bM4pcXUy5wxXiKil4jeqBzYwiIRBM4mEkTczI7XQ6GEg5htP89pA2KobQjxxrURe+SAmuA24ExiP+iCqY0WWFuN9XjTVgPdk/lkgeNVIluhMBR/rO/1tJjtmkbcDFfQVNHwmnsGmCUjqaDD498NMjCNNfVUBirHuJgpQAT4uhtHy0pNQ8MqexejJ/liFp91MIpSSOSSaIt0SQ0HW2LJlHbwpifwvbC9RbsUIHlxNI2ksUfCm1Zs4mxzkeq4ejI59eVJpimPOB1CGPLD94cDWzqglIuCVAUDoD7pv3w9t X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: bf4ac5e2-c7bc-4158-22aa-08d977c4ac14 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:43.5803 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: giEDYuFllANQT6mdOD5jdi97XRwL8GunSR3z1DBcqPPBmvrgBPPg1IyRcidgP1uQjj1oeOWmR9E5AQTTYLOKMB6d35y+bNtJJW7z805cFyI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-ORIG-GUID: 0_D7h4TWHhAq9_FPTIHAF6Pxs9uf5z7K X-Proofpoint-GUID: 0_D7h4TWHhAq9_FPTIHAF6Pxs9uf5z7K Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA (self-signed). Signed-off-by: Eric Snowberg Reported-by: kernel test robot Reported-by: kernel test robot --- v1: Initial version v2: Removed secondary keyring references v3: Removed restrict_link_by_system_trusted_or_ca Simplify restrict_link_by_ca - only see if the key is a CA Did not add __init in front of restrict_link_by_ca in case restriction could be resued in the future v6: Unmodified from v3 --- crypto/asymmetric_keys/restrict.c | 40 +++++++++++++++++++++++++++++++ include/crypto/public_key.h | 5 ++++ 2 files changed, 45 insertions(+) diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 84cefe3b3585..9ae43d3f862b 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -108,6 +108,46 @@ int restrict_link_by_signature(struct key *dest_keyring, return ret; } +/** + * restrict_link_by_ca - Restrict additions to a ring of CA keys + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @trusted: Unused. + * + * Check if the new certificate is a CA. If it is a CA, then mark the new + * certificate as being ok to link. + * + * Returns 0 if the new certificate was accepted, -ENOKEY if we could not find + * a matching parent certificate in the trusted list. -ENOPKG if the signature + * uses unsupported crypto, or some other error if there is a matching + * certificate but the signature check cannot be performed. + */ +int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + const struct public_key_signature *sig; + const struct public_key *pkey; + + if (type != &key_type_asymmetric) + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; + + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + + pkey = payload->data[asym_crypto]; + if (!pkey) + return -ENOPKG; + + return public_key_verify_signature(pkey, sig); +} + static bool match_either_id(const struct asymmetric_key_ids *pair, const struct asymmetric_key_id *single) { diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index f603325c0c30..3ef299e2b008 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -71,6 +71,11 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, const union key_payload *payload, struct key *trusted); +extern int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring); + extern int query_asymmetric_key(const struct kernel_pkey_params *, struct kernel_pkey_query *); From patchwork Tue Sep 14 21:14:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494835 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AB79C433EF for ; Tue, 14 Sep 2021 21:15:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 65A6861222 for ; Tue, 14 Sep 2021 21:15:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235056AbhINVQx (ORCPT ); Tue, 14 Sep 2021 17:16:53 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:43052 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234572AbhINVQh (ORCPT ); Tue, 14 Sep 2021 17:16:37 -0400 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxhaN032058; Tue, 14 Sep 2021 21:14:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=hn8O3/aY4KyB48dt0iaqSV1eA5wBgjSoh2yBKjnOEFs=; b=zoOntOw7YldhUgc/GroFICN64sYi54Dl7jMP1KFh55lqtRkK0RSOPOJgwPcvspg1olAh BNbRNMBiagsEXnh/C0sSuHGs4dHwWO0BDFB5zHPP+gyU93n7esU8XJJ5e3FnHltLofpi DBAxvKDY4S1qzWH6eMrs/R2wixeF77CI6xvFyhwAvb6OCDH5Vfe19DyRwa2Vmjy+9pkJ 9UmVGPdTxooTHvMVKkCSgpVo3Z3GtrdJapARt7hdaNxtgQOUKL93rvFBnJA7IHCR5YQz eGIZp0Z+sdVqr5M91wqeZi4/YeH0vnLK3hXK3dBlHO6r2RvW6lgIg0SJrH+WS6IIr0xC AQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=hn8O3/aY4KyB48dt0iaqSV1eA5wBgjSoh2yBKjnOEFs=; b=ue9iEi7qUjF4m4Ad5a5jYVITKslceRfulbahWSTfpJ9wXFRAMBLm8XvOQCVRgz3bYcJ/ 08GupX+omlfuc2lBHfuD4k81ohfTkqYuAusUuaUa+9D9Ff5YxldF6TmowUtku6n0IGqo ziAg1dPc+Bkgg0mDRlbx/BCk8Mjc3pqJDpIgm5n+NjG4K5+mhW/j+Vv9HZZH52fl4njo +X6FY0ESfD68rqn1jjT/So0+ek10mEzhNVp/w+2Ux1+D4NFNH+qO6B5VIX+d5pmikPvA pJLl+L6TStr9kfTYpQeBAKCA4BHQM0poRGoKmeCJbCN/CNCLndp66Kl0TlcKx9UxVh/p DA== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p3mk1c5-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:50 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18EL9UMs196479; Tue, 14 Sep 2021 21:14:48 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2102.outbound.protection.outlook.com [104.47.58.102]) by userp3020.oracle.com with ESMTP id 3b167sp7k8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:48 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CoW1O46KSoR1lXq90Vx0LwIPHojJWnpJa7j+vcufuSMEzAiNgba7Obida/wEoH3IoLRhqdC4ST7FO06e7HTGRQwx72ylK4HZjfMRzLGByCqrZZzKMN4GQSHLP7nsBjrVEVXcKubj9IUialnhoTkGF+vFjel108kStVEPxHatt59ZqLD21xZyw/xLSSQ0ZGuvPKz4YhZA95MIpLoJCRpgPKknG6cXDhFfSwqqfz6br+VfDaBSaMPjyHoUJWB91kSQ5jTHKcgfgK7IYIERCZHMwFibZxP+jYZ3N7N2zEuv1O4/R8AbGwELt+j/TszzCvuClC9yoUHMvkdLqXJc3TtM7g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=hn8O3/aY4KyB48dt0iaqSV1eA5wBgjSoh2yBKjnOEFs=; b=Veb8ZZNqHNSftQe2IvMSCNjwuBOe9t5NtgBui2RUiza3w9ZhbeQyWx+MF4s3HV54LUaLl6imsrwiVTu5suhESjuCSukIersMHZ9j8F6hc8D3yJ+dIK784cpyq/m2A20u0R8AkArQBOWbd2M+pOGhMGvqHX3K2ORHLmhFvdDYW+dWH0sYJAOKan0jXetL6W566pEtJKmNWqgUNy5o1gdPhAUUhUUhYxhEDjYT6yPmUENazDLcTx/jJzlUySTwyapkpXudT9gDjSiTPgs2sr4X5kjK2Gk+CKfdQfDi0QZfJXyAgXxZXskXO0rrZX941r5rSjIKxXVBbnDYDA5kD93vuQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hn8O3/aY4KyB48dt0iaqSV1eA5wBgjSoh2yBKjnOEFs=; b=P4ff0hoERsJZwvUP3AhBR+iM6jE21bRE6ApKmR1aHonLKFMf0pBTwR5E98c4Do8eI2Y86Xg/7zvy4t1RcxYF4UwHQBlEMtQKYKP/HhuSMSj963OMs8ofWlquyqVTfQlEoBuH8bc225Bllm7D+6DcGgeIGkas3BBuz0vyN9RfNXg= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:46 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:46 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 04/13] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Date: Tue, 14 Sep 2021 17:14:07 -0400 Message-Id: <20210914211416.34096-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:43 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 391fe8a0-9b05-4a11-1249-08d977c4adb6 X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3968; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: kWukFXKh5/h+6xMW3frji1i/HRkpJ7kCkExRMnpNKhSBwLk8KF69uSMp4zGG8vGpWu3dMPWaJDcKpO8BGvfGJbjSdjL0khU9P2py4NCdU1AVIMC6F7pI2nonxrRtxiXpkT0bWNZw2YAofIlvaS18tqozds2sdyTetp/9v1UwF53taUrLDM6bs88mx5DWBmtRUoeLw5ZNlxOFfGAlpMVVL8HrkQss+jqG60ock3xfGsz3N0/15HOvYfmg///rQGoTOfEj61qRsqRlTpx+ipNWtYNucMcGDOdjGZutGPF9jCWWAc5EaryclP+/Wzh8qCImSsjncWFj7d+b1ka3ng/HmNvSePW96h2xVbLjGfc0zjqe3DAfhf1++0evU0DOGWNOyCSyYO3moIDqU0o3xiN8AVn6Rt+6hbsTvnUAASOeOTe5qlPc1Fn3+1jVMz0nJFreNVa9fkjYcQ0/PFUlNZSfcguba9vPLiHdQl6DS7lv+WB6mjXXGbEI+D+Ja4fQeSnSE524BXsnqUDMpUzV7ormHdOMf1wLtbhBc5YuJNRwsi9d8ZEgahwMhErDg9O55qWQbOm2QcZ8KEfm2G11x7AdFkIYMXAwlHtEaBUA5pc8gXKeIQREaVh0R+DMKrC7nwLhjCDWJqYNHLrhUe9eDGsMNhRr3sOJ0YnPHMBQ7Ydc1l7DfhTgJEsJclqahpCqydOeG6wwpy8tXKiq6JqD9lCNFOWL3cyn7GV3ccer409Wl88= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: jYXbSgfwpEH2zs2pFzcdavKgR8II17m3BZSeutNtb5xN+8NxkMMSfCIM+AXb+LI0bbXE7dsfz5iXk6J+r+8R5OcczzzWGs8J7OGIaZ1TznScPfsJmYssgg2xm37Pf8Fgk+u5ypovswnH8+weNm57bf9lOMd6PB+sqJh5OSek87LZQg5Os67QgDCoUtyzNP/p/aP61Wx+4FBv60fAiQGxko77rmSzpldgr50gbP+n4rFpct4rwGAqC8Y9rfHLeEyeZNNM9WqVYI4xgLzplbx2srh4Z28AuIP7eZQ/QeC/IR7KDWFEt3iYo6foPBg2Co67p22kuRZRbkmnHvHrwumCtOPDy19HS+D+uTSLsfCl+61AI5Cbsrv+XlqkFWZkKTZR+fhTltsWZw37lPpg/sy/Y1WR1ZPwFkvnuzd0btpczoopUG7YwzC6jf70uwFHND/aYk4HaWrAUQpkqjQBCzGSVZ52NMSC6s8UB26gZgWZGSs/cz9lDNGY0yeL+hgBk49sUIROnDxntjH4HXDhiintP/1zk3GZZWkKeh6ZftuHait+OFinfRACRAdhqBYFi+goDugbmqHdjtS2G4/yqLJtBAU7OMSeKwejH4kICLU2GXHH0ofy3K5S2wwj8PZWw6gzOcL5PG/xGlQ/FHdmBAP/p+1KXmGIxipmM2BiKWETGKYtBdZ+TfHUMrosBkc4fTattXcOOPvbVlB4P/iDxE85fZAbTx6PDlluFwQDzsMwHp5fOVEFofFBGuRabb5bGPxTae1U4zUexjNPTUM8uv0B6500Y3wo+7MwaZQRf2FLD8py2qxMv+6R92nUETuC/dxIo+9emyCSW1FrMpNfaLcb9R10qkmjWtDkw8SFcljnUkDD1aWZgYwwxDNXPl1SwdLFN0NXJvmIbQbUnPA/xNVWK2R8SD4jccoo+E4CZUnVNcPO+2LHdWMTo4iKCBpPaBnADSafAwyYKt2sqmJPctUd7vWj/sY3qK1RKlYSQ4I+cH+ATn2X6o72jU3j5knybabddEAKmHIWdAd1PXIdyqDnLmVg7/be6kDduOaCZ8PyZMhaEkp+OIV7z9V1UuoL5gV1DmzuJlwAq0z0r98dV5zpwa5yQvrn26VP+PezIKrh2ZdM8Cd0Vqq3P/B04hmU3ViIJjUbeoDCmcNvA27u3qMKiU3HrhFxGlLNJ/J8Cc2NBE03PitJCscC79DRlU9Y8xNOZ32fu9R8FmXSLQz+oNHQjvA2dRcgdG0Jk+5WgtW0NIvgzMdB248XIvP25K8tfjyW8iEZNqXbsl/wT2KloJS0b+/Eo691KjRN50ZMHlpJSa/vn6kJVQcH3/4zebQLrzx1 X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 391fe8a0-9b05-4a11-1249-08d977c4adb6 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:46.2745 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: avvrmOahfExnVJTFtlrrQA+XSwHpZz5VMIP3u7sPJLxWXUSCZu2TnMJbs2oMeizNiK7sCun8TD4dGxy9fimlYqRsfafrlgPZMyJRd9ptTlA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 suspectscore=0 phishscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: Sou-9bSDhlmoNvKwxhwYM3FqfgHEnQ0D X-Proofpoint-ORIG-GUID: Sou-9bSDhlmoNvKwxhwYM3FqfgHEnQ0D Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to restrict_link_by_ca. This will only allow CA keys into the machine keyring. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok keyring gets created even when it isn't enabled v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca v4: removed unnecessary restriction->check set v5: Rename to machine keyring v6: split line over 80 char (suggested by Mimi) --- security/integrity/digsig.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 910fe29a5037..e7dfc55a7c55 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id) goto out; } - if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING)) + if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) && + id != INTEGRITY_KEYRING_MACHINE) return 0; restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); if (!restriction) return -ENOMEM; - restriction->check = restrict_link_to_ima; + if (id == INTEGRITY_KEYRING_MACHINE) + restriction->check = restrict_link_by_ca; + else + restriction->check = restrict_link_to_ima; /* * No additional keys shall be allowed to load into the machine From patchwork Tue Sep 14 21:14:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494833 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F3AFC433EF for ; Tue, 14 Sep 2021 21:15:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 059DC61213 for ; Tue, 14 Sep 2021 21:15:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234998AbhINVQv (ORCPT ); Tue, 14 Sep 2021 17:16:51 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:58208 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234524AbhINVQg (ORCPT ); Tue, 14 Sep 2021 17:16:36 -0400 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxZV9025999; Tue, 14 Sep 2021 21:14:51 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=G08I8vxFY8p4pmLHQZKwPUoN1TqrvrDJyza060cmXIg=; b=g6x3JZortoJ4lXQ+TzpdcpRVFjCBxXQvn/SToAgGpHcxfkpPdKWcZgZWFvXxh+r8nW7U lJOQ2m5iD7KhOuzaG8bxyKdKNEo0DPfk2/aO1Gtgid4Du17hhW6gqrB/GR8sh0tC2pbt EdojwHz4Ea9J9tgF4E5CIgG0KmcYJa1tFqxggvnPOQ+YecYleqNH4c8RT5G7mJV02cen W4Yvsw0TtBsDUe/T0dQbkhPO6aWPiDYRP3BmQQlzRy1Z3h3Z6gaAUc+UqVy3PQMAHJmx G/NyjvOUqP9GrqVfUIUAQKmEeCQASy06aZZ3QtehXRCsjGTYp6OezR7ZOpq/T0gkkhVs mg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=G08I8vxFY8p4pmLHQZKwPUoN1TqrvrDJyza060cmXIg=; b=C0ltxTovQd3sjEP/JGEpPrMqSKH3ZA+d/nysZuqOWPLhM6FuV1lQ1iB7P9bm83PJpuQg qFA1bSb+QlsD0gr4m1RlnrBrNsqfgHSlRKnIPcj6UxGoloCLeto4mXVMYJ+eLMoyv6rV oS0J8e6UrNKLBDCnK3G7aqOxdtXvOZDjCx5pllj7+fd6TS6JVtuad6bd1r7cs1xsdxyh iIlwtOtysk+X0UYZx/M55svWvKAVgDasnnQRvlrWIrxDOlyVIlzyqIOV0pM8dmeuhh9s 0C6Xyf/KHQZSFTOmKcaOHHck0xbltM267tfVLelzOeJCpv7B0yheRVpvRDYM6eZpTMS7 bw== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2j4sbcy7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:51 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELAXOE054934; Tue, 14 Sep 2021 21:14:50 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2100.outbound.protection.outlook.com [104.47.58.100]) by aserp3030.oracle.com with ESMTP id 3b0jgdpk0j-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:50 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SMkBHLsjpfuozyqf5KG/Bh4DuDBUCAdZmmYSjZFXD1ii8xxLENCgk1Cj/NkG8KpRTWVwQx3gX/aMexDym6B85zaiv2BTLpCpPt3Jg5GJKhMYjh2/o2B9zWY5xwRWMEjLoU0VKACuxy6tophfsrhFosU/moL8tViYd00v0dfWMIh0kw7dhcbBeARvNpGE4ZW3Eih0Y7dgDUlzBpxRbh4Hz0izWflmgX/jEOw4vCu4122LMe50yqH0c/BDZHk+0LElBtWdA4ud4PQcza59KnccZgi+NN0SPj09ribRw6pz7JSDRSEJ1B2xhX83oTyypPtgWkSDX1y/4ItZyHlAqRNsag== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=G08I8vxFY8p4pmLHQZKwPUoN1TqrvrDJyza060cmXIg=; b=KsPyCztUKrZwi3sc5FfTPwR3mVf6cBsHliQ9gTBSWqJpMdBfMxv1Hoj3rSWmCqUjOdMQKObzspoR5TqM53ttNfJAhd2Sm0wcw3vsZmQ6lTaSuJ+tVzsiDg0C0Uh3sx6IhXirSM7a6zmcTLOiN7E1LDF1m63hkoMqt2yqRcnrJocalr8Js6U5bc5yriUzMAn/QfHsP+Giu22iTbKe8NIXKV/1k1pJZDDGmydaApraIha4NRV2wOs4rLwqPe+PGYxPHsS6ZcuvvP+DezUjizd/WM+QhbSK5XmTpe9sWhFCtqPnobt2xz678C36DQsDNaBDP7PJfYN78rLoiuy7pMesOw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=G08I8vxFY8p4pmLHQZKwPUoN1TqrvrDJyza060cmXIg=; b=u2x7/681HO6grNyMxdmgeRh9oDx+Ovc4JXsDhon2TCZl8S55oPu+iZLCinXWbWKQPVgHx8KIemGWwTSYXPMrmbNSimDA8xxGSzUxgcDQVUZTGZfWcCU7KaCmdOIXSQtv8n9XOVtESMmcSrEe1Qn3BuZy68HqKi1WZi+luruaggU= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:49 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:49 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 05/13] integrity: add new keyring handler for mok keys Date: Tue, 14 Sep 2021 17:14:08 -0400 Message-Id: <20210914211416.34096-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:46 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b546c13d-bb10-495c-4f46-08d977c4af4c X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 2o24KZKf4CSp++ciR6mDFDafKvuI/nXAda0uy2MZd8e+LprJuK3L7OiViiieuOHVW4GElC56s+0aNF6oudh2ezFPkSI4yGcre9+b/IF1xbcZf57PYvz2YGei1WgoXohbB1J3E0lUXemNkATEovs6fO1JFvVJreCmziZitb63KTKDeSkKf8YSXnhaypg0p0klAcpp4zES6XoG9htuxnQJpQGnE4sRj0jzyTks61x2dbhcc8al9+r9hS9meNd1vLPtxUvSvCdiDVFjbxOhw5YSwFPOJD/UyB4q5vymEjEQGZF87r6TT6kGrAGYiR29KuoDEWFsYCI78CVGBEvS5bCw1YFTpwdQKpCO0FggckfAlE6rU9ADF1C5L9A7x9ofQOXPfCfUVkdegPmawxlapVkUpgsiqX7Lh7i0TT7n92YtgnBhs1vf8B9MSi48bXEEz2NUZjTTOdWcuXRbqYYSaGafG4Ry7bJeSzNuWQI2SNk/Fcx6C1nB5HULNJ247rHcaeAKACPwWsG6hLXAH0tPK6o+pLDaVCb9ZUVPMJlN+YewHaRACHZ4ujv0o+Oe+ZGLDi4zz2vBSV/lo4QOBGGLbgwcjbVHBHDYsSX/npFRH/BbvdtNfgvjkcWIU9m6N8KqO+7wBqAXaxMLJJqfsSdQq1x86Tmhh8xIfSaOetow0BmegsKRftjIwnhDivoeemQpfq5WJI0ZYMFSpg2s48v/c0AxxhK17m8S6orh/UZcY4xTa0w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: kClWp9CuxIT6IwMiX7JbHzF/WcgLcJR1I+FadzybEJ4GnGsFdLbESaX/l1wH6OSr+jAiD3Fg5S9INN49LFiiAbRr9nCepEKYovWguSnvvCt5bYKguXO1QWe2HMc53xM5s4mZCEvSLkhs+C2ii+aeA30WLwzGYfnbMt7KrYvthFjRdQj8/8OrWxejkwGJ+WeVGhirhc/wInhv2kA693NTbv3ewnhuJHJRRPnBp+TFmgmgJJd8LZm17zC0eF9RyXL3QPu/9SmLFaZeybhiS4A9GPZe63utnHZuWgAzznUgJQdTl1Y7+WeUfBTp0DZ1AazigQilwueLhb6F7CEwIjxPpZeYG05Yg8EAYJcWQjoD90PYeri5CCYFwcfNaUuFbwS3YwzLxwwW1saIg2QUyEhV6bgINZbDQclsF0LF9rjruRHlYHu8ltaYnhsPrVVZXT32Kcf00SPp3uGLSfQR3cwbL9Vsd/p3E9V8n/UGOZHZUaBLUHd6ZF0w8PLvSUQ/XtEBNWMZNtYqaHzA+nUVDD7azpX1c+Mr7wicCBRoHBEY1MdfJhz+hNCUOXDaXIeqCx34usU0HQZhg6y0T0ZglyehB9Z43MZXYBRMYUror7EzTpwEZKiItrFXP0h/QvDSaP0k6yCuxx0X5aHwQH+uEphmBRZtcZkA0AENmJxvjKQKtqTiYnFCFADvnOzzSix/ZFN2Gn3c7DzxTakRox1/rmCPyP5vln/M4b6QKrd75KowErU+wB0kvujHr0tFduNUfVELjmQGL2JaZi19FACSNnd30lJ46DzldG2BwC7WFCVodXj3r61iHPxUhxPu0nfc04fhyiyagHtqNIIZtWJaBTFzvYUX4PYDc+jXvlsOoXcxt8A/3yGZuitITR7oxs4ugRTcZiIqGuqkAYPClVDTOZxAnBlyj5dxroIQ/VNX1UMIeSiwGnY3PUejepH4qxdGrYrOVB1nPg2RaRkl+7gPFMGhTzN2jJG7Ph2+UbBG0Cn4m3jtrcM+LK0DQkRtsP5ndqrIpuuace0EskcPwty/HuYba7CdDq3qhf8GTScIVRdmVYP+VImVlsVVcMSJJTLBzgyBP+oTRiolkbB5k6xoDyKpF/vvY9di0uTZXLE72OunMtoI3tbvUviAVoIYkHr+g8lrCjKRaRqvsEWqW4K/tEmTTER0Ofyc4i60lHQeR81p3dKjwYEJjzOlVmW0Ok8KOGXZKN0JZg/fFCYWlPa6pgkACHhEfSITn3Wlx1kF62dUJGcRHUHow1NcI6w2GpK9mbidtlYgVe1a6uyaKswJ5YuExRbfTDWxXf4vkWg9bSfmYqtAE6qjyYwe7Y6taqoR4NDA X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: b546c13d-bb10-495c-4f46-08d977c4af4c X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:48.9876 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /QNAF+dUVhQP/MxUjnDjyz0iQYVNvizNspggPAPl2wwPRWfL1QPsyUMHKizhBtrcH9hUD7CIK5WLO0CcQ3GIrRjCqpn2YEVyDKReZza4+o8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 bulkscore=0 spamscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-ORIG-GUID: Pju297uP-W8eqjYgIgSJ5Tyck8VSHmp- X-Proofpoint-GUID: Pju297uP-W8eqjYgIgSJ5Tyck8VSHmp- Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg Reported-by: kernel test robot --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v6: Unmodified from v5 --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..445d413aec74 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -66,7 +66,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -75,6 +75,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index f290f78c3f30..c1bfd1cd7cc3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -94,7 +94,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -109,7 +109,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc); From patchwork Tue Sep 14 21:14:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D562BC433F5 for ; Tue, 14 Sep 2021 21:16:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C453D61213 for ; Tue, 14 Sep 2021 21:16:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234851AbhINVQq (ORCPT ); Tue, 14 Sep 2021 17:16:46 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:55190 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233561AbhINVQe (ORCPT ); Tue, 14 Sep 2021 17:16:34 -0400 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxaSa026025; Tue, 14 Sep 2021 21:14:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=VQn5A0JD8Yg+MpFvgAYxzFUIymhm/fofi/Z4INBhbdI=; b=RuhrTFG7aDF7i4p+ng/x2aTNXEgC+dBR217tKxg5Sujm0P217ikjtMpr/sPZz0F++q5N 9B8+jdZvBJleJHbLraqrVJ7+yng8W721++B1YXbWXtHvpmd42KJOLo3jyUrzzrl6qnDK d2n+K4Cch2AaOFGZakrbHLsE20JDrqtB+6sEcFhpjynDlpF+gYV3Q1ASTCtwk7NVct9p dal2QW1T3vuAcdhyJaXyYyf1Mp5h893vlPJuE2WgDin0fWW6fMVzCzwwka/6FBQt3G3C mpx9CEe5uim0yUfkPj5/uSDk5aHhWo796L66Vtwj/2NyYGmz1izguE9+0cmYK5/u3gMi VQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=VQn5A0JD8Yg+MpFvgAYxzFUIymhm/fofi/Z4INBhbdI=; b=Xgi37kerrXTpKImUgNv1cM0IRGkUUbBLbYaWSWEwRZNJVKB9lDbUEF1X+gxwl1TodGzr FLOTVndDAylTLnTHtQbSIqcEHcv2Lq/jXA5zYo8YQuApt7ePUGk1jdQu7lhRzOliDqto VEZChjqnti53q+E0Y/dG24T++IokHnkrbSTgJB5w2O0sZwnJq7cCS4z+mNGbzNA+gVb/ 77mW/rd8MPqvoOmNtwaLSV0DyMi4+jTEJKiN2jzZNHp6Z8ePLNp/udhj81UdXjwl1o3L /V7i6RQjj8DGH+fpipnHxL5kMun0kExWM0BZ7tPXfXVxdQ6zLYENbj3OyFNA1jvvISzQ BQ== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2j4sbcya-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:54 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELAPVn097320; Tue, 14 Sep 2021 21:14:53 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2100.outbound.protection.outlook.com [104.47.58.100]) by aserp3020.oracle.com with ESMTP id 3b0m96w3jt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:53 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=a/qvda3BZPW5xNA0WbZV3pGFUk4atWhx9tU64WlnITNSzA9Tgrsq06yY1JZVULG7+bhB0jeKhKBdYwHc3aphNkJ/ySD6TnQPKpQkabywhkGWRBN8nmLg62kPnYA6xQGFjYnzT9N2buYHqL5z4Dm2ess2VcM3qTSq1oFiSoS5sjNzNZ7U4uF1rQiAFNlpfGT1P3UcqmgXDE+SOpKrLSZni7JIOrFJ5VSf9NOssIGytPrheWkzykIPpt3E4c8/ecMNZRxLfUQv/N199Ny726IXJk9WgWLKog04DBBAqBmo5PXq4RIVt+AeE+YWXA2vEvbwbYXOmqRz3jlDbEPyQOj+ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VQn5A0JD8Yg+MpFvgAYxzFUIymhm/fofi/Z4INBhbdI=; b=dXk8HS6JGQBpsVIWuAE128IyKdhPIwdlWLWt7D+tqVXWwSqTiHEvXb7eVcI0zHzySRgVZnbJ7a/YfSUUX9KIojbfcxKvUHPPIZeLbQaZbjucXUABs4NOhI4pVb9YRh9IND0twCkjzltNLKjWmO9HD4/J8A0lSQuKTzlhXcSo/zwXElYW2VvdPrdQ+lhlqI7r+Xrn1IG1y46MzFO22Kf3/PI08EbFzPgWIlMgEjsanQ+x1HrrJzTFq8Z92l8nOVxF/vN4wlSu7cR/Z/tKHf83w1u4zQgm4LuW5VHH9JcCo5wwXfc1IT6mQ4XYsRBN40/UgOnlox3YSEv1JDMQkskmEw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VQn5A0JD8Yg+MpFvgAYxzFUIymhm/fofi/Z4INBhbdI=; b=AWtIGQq9iitJlAO4QTn9audYeknoiVgKGBSUxOdwZfhkO4ScFpIdW48z42HdMccI/HITtW/5RccP0UmDRaikcittWX8kUYwIy6OGzwFiSmjoKKrB8L9C/EZjh6VzCYmbxTfIqpFgEYMeglWMnXkFNurrwuEf9ynV2tElpZ0mCBU= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:51 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:51 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 06/13] KEYS: Rename get_builtin_and_secondary_restriction Date: Tue, 14 Sep 2021 17:14:09 -0400 Message-Id: <20210914211416.34096-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:49 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 6290c9b3-17b6-465e-864f-08d977c4b0f0 X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2276; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 96WDQjU0kgjYfIuWBsSkdIJawb/BQdqQ1ko4Ztrdl16UGH/HNoo5412BGyFOMuuG/x6+BJ3b10LwlZrYRYFrHljMAsv17w8ZsELbmCKFpyknzY6DvzPKBX1fC3AulK6aQVCm4tigsbJ++2oht93i3GFC0KyubxZO8NPu4fOtq8UsE1XPDv544z0qvkBi+d+iO/i4LJ+QD1OWG305OsQki2RdiMPrjkALAbWKfykKifea386MMZZ4uH5TTXuiRaiRbSXqjEGyRz/ryO6iHox1wL/Cx7ko/F/Wi92rYY8B8v3frGaTJhsgJXuzhc6nbsz9lIaiNYWje9qvvv+98C25NfZpJhp6hXxoFhnNStxgzispngGoACM6KcDQa1ZeQ+V4HG0y5GCQyahmtln6z+Rudp2Ts/8l6ku1zg/F2/03IVgWg+cuuB8bq5rfW+R5dmIQu4vMcX/a+pCunaZZN5tChhK4gDEiAPfK1QX6aSO7z9SHvhTy2GqcyVAIsVlF81IHHQVahMRqpNRGoNvT92gMlRkR1nk5egsLZOlkso+YwWFUDPys3dXj84O4o52g0OmQKdm1gQ7OsXbMV6sVoiiLHdVAjIUgESMawcQkRGMDsTny7DJBrZbMi6yg2WRRbA5pVYX2uDGuw7lA8C+SXhTqWBj8sRPj4RF+HPun2QIR7lrD3uOmIhmqR2vwC9WsVKPksJCcz1xigGhoWIuqldGc/mrAdXMzzP75FjXciiDqU8k= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ZdRMx5voW31ofaSw39at91RP/VVM2XphhVsoH+eoEemXytzD2GudAcohC+tAIXk0LUeK4szP5x++OTEkn+eV3S/EwvzxzMMkPCIlP8obuiGYXK/aKIBUDrndOJT/iDDoDUSpYLW5A/TiIB/f2QawVvuLhkDJ0PecwMGIAS7cPP3+DwCfEzkS6Q3FqPfn0jkNKtyogjsxQU+WXQ9dLJgUkAOialbhbMJa52eCjRkvvjza6yCdIFzu9dl5QqlDba1UndhYSTs5LtO7X64rg2KwX+s37qWGtklJ7/Fu5gn6P4y3yLHkF3Dc5vGP7VeokdqqIwXA5EuI5TYuFPF5GV+TGdARbU2lmkgxjSW8FnDzcStDt77h7SMsuKweoiwIbifA+1jFfGeOJ5LeHMj4aWwVmDgUryX8Wi4BZgBHWaGRKWBMbHcBs6RWbpGK0W4+G6tUGpAPS2afuA1V6Ik9tFZ2v9hmU/wqAxs1dIS+1DNNZMpQC2Ho+Y4zbOXPtKyYASuVnJBjGnBRUJdKYrniP1OMhhJQ7DXfptGwcyrTuQXcbcuoDLoi8rlK+/OHfeyfh7cK/UQ2TkcwJdOk1DSJyt4YW5Gf7A9lUqFA90mfBHAIoFPhuSEscTGFmHOqOM7ibcIsXvai7IhcbO+mnpdoBeLcVZyDFDdNWjpUjttiTFjCG5v+yz1Ct+zhLps+SqL13/LJlhsrwrghQJ+iN2Nm57cAOHZrJsdiNQ1yql2W1ywpVsX/SLz/sVq1b3bpAMZaSV3/01137pvbed4myPnwMB6wipMF6yl++620hiqaapwxQSXv8+u8q102FOVWkA5MylxhoSXxW8EzntRvXgsJNsX6B7PiqC2TgtN4wExpkJREBpITYeYRTmqs0KBpiSYuV37cRlVz0esWBAE8+iD4K7mBpg2pj7xt5PQXqG2psmzyKXEBRfFnW9qBzCqfiO/5x70NB6FExF+7J0Oxwt2aAIjOhsmUSCfU4gPSNtsRgC+sTZGz5+p4Tc1MWgvCELlht8wclb1L6oHnwJievYwxOoXW37GXMbg8g19/6lIaO6OeIyeGRl7DEZPsV0jWbILmFlsaM/5ahus2xd173MTGtaOVbP3uvduE3vJiLs30S6dDmu1Ea2Bm2oEjumsmC3fORxs47gZS/9+KU+ftd2PrtKHrrh7+1TIIboFct36qaE5KLMujuQphxsKO2sK+n0pLjetg6eZOGBYhtkVWUsUAtN0sJqGDV7KIjbQumHfKHcrbvPipzAB1X3MHEvY2Ura1h0ehGEBZpmU1FxhA+ksBrj3o18axoQyfqDxuZXgsFNaRY9zl3y8bYKF0ayYdeoJXtkfK X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6290c9b3-17b6-465e-864f-08d977c4b0f0 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:51.7674 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: c3Sr0Z8BwcvWeRqP1CgsMTOBRpMjZ5lEl96hgPXPJPF8n9bo5x3vbNEiZUdA5b++ipi/l3vHksN9s9X9CzpihCT0MhzTaSP4rxXDtRPBGa0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-ORIG-GUID: Kxs1MgWx37bsRe7LJg_CNillVMe02vjY X-Proofpoint-GUID: Kxs1MgWx37bsRe7LJg_CNillVMe02vjY Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org To improve clarity, rename get_builtin_and_secondary_restriction to get_secondary_restriction. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg --- v6: Initial version --- certs/system_keyring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 692365dee2bd..8f1f87579819 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -77,7 +77,7 @@ int restrict_link_by_builtin_and_secondary_trusted( * Allocate a struct key_restriction for the "builtin and secondary trust" * keyring. Only for use in system_trusted_keyring_init(). */ -static __init struct key_restriction *get_builtin_and_secondary_restriction(void) +static __init struct key_restriction *get_secondary_restriction(void) { struct key_restriction *restriction; @@ -117,7 +117,7 @@ static __init int system_trusted_keyring_init(void) KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE), KEY_ALLOC_NOT_IN_QUOTA, - get_builtin_and_secondary_restriction(), + get_secondary_restriction(), NULL); if (IS_ERR(secondary_trusted_keys)) panic("Can't allocate secondary trusted keyring\n"); From patchwork Tue Sep 14 21:14:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494827 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E32FC4332F for ; Tue, 14 Sep 2021 21:15:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EB67061178 for ; Tue, 14 Sep 2021 21:15:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234564AbhINVQh (ORCPT ); Tue, 14 Sep 2021 17:16:37 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:54142 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231719AbhINVQe (ORCPT ); Tue, 14 Sep 2021 17:16:34 -0400 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxRcZ007085; Tue, 14 Sep 2021 21:14:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=7cpTIjx2VS0Bbph/qWEC/ejDM2PwR3QZ7F4aTb/QKdI=; b=MNNi+PeXF1otXHYscRghKlbdz0/bZe1MwgTI/EQycV3SvU/aYSwjgVX5y8KUEzeaJxys LSCJkivJ3IUa1DXG468fmfpXUr0VWRR+AfNO1Q90y4q9FIDlXjeMRvnYEXxbzpr4DqdI BFqZPYl3Sktb3VYpIfJbP2UbGeKCNLDlHQLxH1digsJo/C/iRzLMeFKn6wjFAZgPRlKy RjCWe1WUAINz6hqNvFz+tN/DBfeBh1GzVyk9BjeRI0jCVkBJdON7LcNC/+/pIPlxz0SB NvSoYuz+UtC2lz6y5CjGEn6bF46pgD+yIRDJvB5IVVag/5S7tWF7xfBpIOEmcuv3BCMY uA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=7cpTIjx2VS0Bbph/qWEC/ejDM2PwR3QZ7F4aTb/QKdI=; b=NYaU50EeIyJVpdFkA7KHwpzytAi4HmvIVaEnHHUSHLJOtTc812Wn805o68ufE74wlODr c1kEQTXaHcOu1vU5Xn1914nMI/T7RwmocqaDUc8Z/cMFi56LjAEC43xfMznXVnOP0t3V ahoCx1TKHwZ3OY7yqzhVfMcHOlJn2yPhg8LgeNOTFuR0cCaBfPkLONnG3DphZ2VEv2kQ qmtPEHy2AFd2LM8yTnwCwrCRNH6yP+XAhFqjex3K04JPHQ3A7NsIfAhmxSyX14Sg0vvq homsDMRkWCbiSas+SNBMPXwbT1QrTZiErf2wnqOJV5Rv3tek0bPc7o4Sovn9xFxRSpOP cA== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p4f2xma-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:57 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELAPAv097292; Tue, 14 Sep 2021 21:14:56 GMT Received: from nam10-dm6-obe.outbound.protection.outlook.com (mail-dm6nam10lp2109.outbound.protection.outlook.com [104.47.58.109]) by aserp3020.oracle.com with ESMTP id 3b0m96w3kg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:56 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Hl3XKGhTHcJqjrMeAA8mgVSO9OA7dV4K64d8BAcZ7mN0qKiRpw83SdgTXWV/sGmqe/BYY0/Y/p+oX6Bd0giEOgkTTfZmik3o6b7LBX8o5cc0KWgd0w82SACoMErkIiK0uS6qdkAkV3k5HqqnMgjUziN6XF/0cu641S0ABFC0zTBRrqVNtAxLQcA2KfwOL3hGB8dVdvjVh3SteVDyJi2bZPabkEQosZKIV7PMpkIlHKSxYyDamMKMBY2V/zj15XaG5puLR4LspgGiwtcKkCzqaf4o9enNqfkDzGY0j2CpXC6zUt56laOidr9S6uLoGF7Tc5/dmgvsFu1OYqz2U8P3dw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=7cpTIjx2VS0Bbph/qWEC/ejDM2PwR3QZ7F4aTb/QKdI=; b=j2mB8X9DKCrBbHvcHwLUfb/LD4CVERQstd6jEl03gEVkFzvm6mAVs4/hWumiK3BQAUTla0p9xDXhl/MJqsnrh2pBW31zsyNL6ux1uQs+tDf1+QWHsv4bUTF1a+xXr2+yP+nWMy/8kS0SsxUqRJJ17ShWBJsZNV3cGX2wGnZ6TQ469eiSzffKkSwenPOfsAW3XoqILleuXYZt1zfzYqK/R4dvfFHHZTLu/yq/CLx59Sqx7e+2l9WOpQYIHkI92YiN6cDURmHwMqTJLcWwx7/9mRJ7x+H6Pj0GlvMMhbcBhk0QRaRaxO8xV/OxALh3y9AaVEkxt6MxTAax58pu8Qi7Jg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7cpTIjx2VS0Bbph/qWEC/ejDM2PwR3QZ7F4aTb/QKdI=; b=nha6CMY4dPYBs11+rMHhIISCnoRThFPjCUYujGrR3VZpCcPQZ57E1PMfQmUQttlHlTLVjnX5+OQSYVFosvgBaJMvLFMPjJjeSvsKC6eAL02Z6w88xNggyILSflKjeKAsvRRzNyumhj5EGG95BgrsGhX+9DY0veRj4/L/2jLJ5do= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB4908.namprd10.prod.outlook.com (2603:10b6:610:cb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:54 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:54 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 07/13] KEYS: add a reference to machine keyring Date: Tue, 14 Sep 2021 17:14:10 -0400 Message-Id: <20210914211416.34096-8-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:52 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2ff1afc7-1c46-4110-b9e6-08d977c4b28f X-MS-TrafficTypeDiagnostic: CH0PR10MB4908: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: BfyuTMCBc+AX+Tx+Jea9nfNGjKPBdB+mwEMlcraB2WwHwRBwEoRWhqYnXdl8dKh1qF1Yh8EKBd3O4SO7nMrRdz7m+G+QA1LM3JVlePVBsFsTOU25W9pMRGgkgYFdTCcmViuNymF/IvGNIh7RrfSIr2TpXxQa0BAumzGpF0orXBkGL1Z528zfV5HU+UTS8VGrRM0kapj8UsF+50un62AGthxZs1pQL1mP6K1YLp7Cu1mzz5FM4Eek9WBgLgmagOMbU5R3ouOW8Z9ZtpaH+2mYzY6DtkEjGadtJyHxZiVUJe+vrKimTyURgqCDP812Oo/K8lkamnbtfTWAbr2grf3y/4FfsCc+rJBywlce1543Z2u8u2MriVwXYYzFP4bglnVz+A7aG/lZtq19xvHcVS5v/TlaZD6ZypmcwWh4Ok/tkH4Z26unxHNFHACgMdJ/KTx7kngzxqkHfStz6nDm01aExSyAFwKAocCn9TZjhtM3RDJBsq4ty7iKgqWoHrjy5fVbtTXRB51+9QyThRxLGC9OmFKBT/5lzq1Wb9bcFtsLFzSYtD+B6Y9xMGsa5i8HoTsUHZZpqWoKUqF2dfgsZMv5gIttri1y1ZhTNbBEabB+Tr1ORb3BggnUWnKH/zsGe3aVkVo93yWofWPxDrdtW3KDKAxZnvtuuqL87pZmr6HIwCMfbRzGvE5jriq+/Juqc9yN8VNipRLtHk67bGv54VDUtH0bLQBcRYqEG5f7P209iUo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(396003)(376002)(39860400002)(136003)(346002)(6486002)(4326008)(6666004)(2906002)(44832011)(7416002)(36756003)(66556008)(2616005)(8936002)(66946007)(52116002)(921005)(956004)(478600001)(86362001)(38100700002)(107886003)(38350700002)(26005)(83380400001)(1076003)(8676002)(66476007)(7696005)(5660300002)(316002)(186003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: lxP4jbm7kEiJsuSwQ/N7mdqMrtDyxvqOp7q41/O4QRIOyWFCSo2VSri2RXakYkAB9RSFRE3Zojuus4miJg7rGCs4F/ULqj5GiDQFLgapai8XDtuVsOfgKkMqoVRyKGitNVecVgjtNYAAJYOp4m81gPzQTB1cCzOvW+sH1d1GYDWZhqLRpvrbd+dE8KU6QORd+07p+9rX3XpgEgLwbL29hKh8CivAa74NAbqkTxrLOLokhyuJ7LtqXZWbOgkInJ0eL90Nz1bfur4JMK3B+0LbdP2ps4uL2c2SBa1MV72iHlyCSkXdq3nfQNpi4YMzpdQ0RsyphuXOMJI4fIwO3cMhW6JnH2eD81HRf4GCIp6HirsHoVibSu2Bj4zNkYcBhVhg9tUqrqqGMUUKc1l8/11mksoP8L4JPhH5YOSwafZyN1X0o6qEopteBHp1a+TenOZWL+Exd1nnFx3MCgBrLTcUZcCIZxhWIKrOXJwo8VKsGPusIsdiU+EL0fsT6eO4hMNX32miHeaGPVMAPlkiqT39KQRczVN6K8pDpk5XBUm/Di3DpLoshatKP8Cp5LN9DuOugUXV94s5ELtW0s9CMhKnPVZF0hI6qSd1JkNf91sKIbMpZGe5XX/XCHl1xMyQJpUqh8DFDCbTq3GUyM6k7NdcUyMwBebgLu7vN9UDEn8ZmvQ5P4uAe53LTNksDTe+CoNGa5BQZEOf6vaRjLXKq84RfcSlX3jiMOU2SVXTOXFBemu9Eh6IcwtNVeW69RruqAPYbjS12P7wc6aSAPICbYsttYHtsE0NrLD5yVhX07RNscoRFWlh6R1UkiKITrTffQyucesg2zhsOAtrkBzAu8D/cFVrazH5jKF5G4gMF34kuu/zbKLfnIZtR22XO21KvQT+KVF+LCEGXbVNC/QN/NR2vhtxfWsGuoeR9F/4bm0TwFVZXqiWWqGuhKyxwrdZQlh8jQ0X9isqvInMVQ+YOKmrCaJV21BNul5SiHLAR+JcOea/drhjU+DE7KmL0iCfxGLP9oZdNYYEfzf9MH1T8pWjGBNm1Ylc4wh09R2RIwUC5O0KzNZ7w+u6VxyWoiag6XJhm0PxaO4Kdb1lCNW0Xc0WW1w6+IilrMTr8A0tHfOExPHVfi2OqhtqYGlyO1rGMbhzHCrRj+ndOioczsc4cdsxcoQ/2LTcICJFFYORsp1JFIDE2DcPZvJdB/1BUGdv2QvD/rX3A6F+95hA2pXyY5WmsR0s0/gOkUCIaTz4DmSwplAzGJZDTYmcJ3CFrp3l+zkH+mCBAdjpAmCpmfy8EUIrP+nPRpUu5PgRp/5CVNkP+V7ge93n5cwKFDnClWfTgEAc X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2ff1afc7-1c46-4110-b9e6-08d977c4b28f X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:54.4526 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: w6755DgvGZON3VxXHE04afGGXDC0tAiLKszGJKUQzMrr1BiwPSW4ll1WkakIceFbj2Il1VH/E+3U9mVsbbNOnG356Aqc30qRnaxE8UtdUy8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4908 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0 adultscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: yZ5bpTuo6L9zgb_CZ8CxV29SUeJaqxfQ X-Proofpoint-ORIG-GUID: yZ5bpTuo6L9zgb_CZ8CxV29SUeJaqxfQ Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Expose the .machine keyring created in integrity code by adding a reference. This makes the machine keyring accessible for keyring restrictions in the future. Signed-off-by: Eric Snowberg --- v2: Initial version v3: set_mok_trusted_keys only available when secondary is enabled v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v6: Unmodified from v5 --- certs/system_keyring.c | 9 +++++++++ include/keys/system_keyring.h | 8 ++++++++ 2 files changed, 17 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 8f1f87579819..bc7e44fc82c2 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +static struct key *machine_trusted_keys; +#endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; #endif @@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void) return restriction; } #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init set_machine_trusted_keys(struct key *keyring) +{ + machine_trusted_keys = keyring; +} +#endif /* * Create the trusted keyrings diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 6acd3cf13a18..98c9b10cdc17 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern void __init set_machine_trusted_keys(struct key *keyring); +#else +static inline void __init set_machine_trusted_keys(struct key *keyring) +{ +} +#endif + extern struct pkcs7_message *pkcs7; #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING extern int mark_hash_blacklisted(const char *hash); From patchwork Tue Sep 14 21:14:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494831 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C13FC433F5 for ; Tue, 14 Sep 2021 21:15:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 59F08610D1 for ; Tue, 14 Sep 2021 21:15:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234933AbhINVQt (ORCPT ); Tue, 14 Sep 2021 17:16:49 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:57934 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234522AbhINVQg (ORCPT ); Tue, 14 Sep 2021 17:16:36 -0400 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxNDm017542; Tue, 14 Sep 2021 21:15:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=ZT2ryMVaMnisTxnwGd/XS1k2DKC1kA3fDk1YULss4uY=; b=xHRJpMBmwSY/8HE1qZEwOydOAy/4RhMoITxHc2jibWNPKzV8C1aIkrkBHn5nzSfswN8f BW+z/TQZJYiUjjHAtqNQHgeLDKw8mxwhbTMCDr4wXK1iz+kiLZXNpNhNwWU7+RiERDdH xEJqHNQFs5EtXv0Bbolc3rWI6b7kLz5eHNNHX95iWUQ4Q0Zg9B4G+U9o3EU4MY2r9p8X 6/CLDvRiKNCztxRT1FtDMQTP6WXeJiU+kRrHDqbtGgoxoFDhNkSdS4zOPlfikQaIQvYi CdFHRsblb9p/HK1nSIwWBVNE0lkEAcfG14Hrg6N5AzZw47R5F3dRdVuYO6KuP+rCBGNa fQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=ZT2ryMVaMnisTxnwGd/XS1k2DKC1kA3fDk1YULss4uY=; b=ODif9Eb0ds+N2r1x192hPUyPBDaBjc9DPZy4ak4aywRI53qTAXW+aNBSR/ywdxNfCDrS kUqsV99Vw7KxuCw4jvjil/93CF5+eyuwlGB72DouJZIrQ410xz3oXwk8EHpupaaGGSZK ovDd9LsxZoAI1eE+bkh22TvJysotlYGeVU5NpTVACbBjJjWfSurl0c6oz1y0mzt4jb19 s50lEgdtWTOziyjhFOWYtqQN7mcZgFYOfZD6cRRDg40KPyOQAd6biFKILUc3AP0m7Y/F N/aEkwl+wGe2sCJYk796YyGrYsjgUize9XLHMNlwoQEho1VYBhmH4wQ4CKCIfywVz7r6 LA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p8taxja-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:00 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBARl178879; Tue, 14 Sep 2021 21:14:59 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2170.outbound.protection.outlook.com [104.47.58.170]) by userp3030.oracle.com with ESMTP id 3b0hjvqwgq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:14:59 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dM//vfBWS99iRuIoNdWz0LtPBqOWOq6MNUT7Panz5S5DCv3QrpI3lFd3BdcS6Ic7WlBEgu6llUaTBAfyUR2JXuwbdRtvC+d41KHI9OfvuyL5jRNpxJI3CNfKYJW/e7G/ebUy63TYj/38Pr01oNgUsDY6zhNOkQpk92w+gvSAVYku95TAj8btO4XiN0patg3MMvjnzO73xskZfQUAUeOkpGF1677dGvAWPXRu/G3SB79SyvvZKMIuWNVrH/T3KrDr2GsQShh9YKRPB+UzxeH5ImBGXISP2KIUBStf9iCo5GHWlQs5hGG0hBxVFVGPlT730GqlFpUBxiSUSx/kP9MXkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=ZT2ryMVaMnisTxnwGd/XS1k2DKC1kA3fDk1YULss4uY=; b=c94Lq/R71flcJhJC5c6EEXjt7JNWuBEIJ3VxD17vmzKWBu8CupJTzHb7Yn41hRCAzgcSf/IX30XaYyVxp7uYFOUTDdF+3VQZKostwiXKt8fplSn8TEs+HVQwmbv5OC5LjKh8Uys6L+dwwWMUOj9kSVmI3RbaMsH6Y1N9+4APaBXvpppjNc1zJN+ppo0G6kO/Y/HYxW9PyLv7bNCW8fgm8kptjfsQLCwGX459hr9WLHjkLwf19x9rNGFTzvagHkc9t88HlP9akYVcTU/k/QpnXME0DoBMl5egiEAZMdR0iKhrBY1eTQgTksFGYZXrfkjtjAt1NeJ9L9cNpiHOM80y3Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZT2ryMVaMnisTxnwGd/XS1k2DKC1kA3fDk1YULss4uY=; b=RYmoy254uqjHkPaKAH9lMsaVDTHeVV1JDoWwkjT7DXgltnskWiTbyOwgoIzsrlj7cD7yOf7dLUpeG0zWNhxnMzKx/rBnLK1bAiAAN+jd98tj1BZeMi8tdIvuYLnsqO8CGDBFdh5QtdCtiS3SSIHr5+i+zGUU/tIzvyw5kVwsJ0s= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3784.namprd10.prod.outlook.com (2603:10b6:610:3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:14:57 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:14:57 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 08/13] KEYS: Introduce link restriction for machine keys Date: Tue, 14 Sep 2021 17:14:11 -0400 Message-Id: <20210914211416.34096-9-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:54 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 163ab24a-e8ad-4ad2-c32c-08d977c4b429 X-MS-TrafficTypeDiagnostic: CH2PR10MB3784: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Sh6emwf4Kq99kYekOYqfO8LT5DdB8MGnhoMNn8BA/ANvQ+oudzB9uet6Cm23ZCy8Zg7Fn71vzmi/q4HXlWRJ89NCnj4QEGXNceDRmJZ/d3bUanc3PAPBM1FMO3wopGp3V+75svbOwp11yVEv9gTZjGqiJJryTQbXxyOSs69qtUl8Jns/myvVEJ4vR0LIlS7SB2kVp2TNsA26c/Cq29TgSKCjzzTlsYEN+pwm1JZy1qR2VqB/gAigQFnkn2zZ0rZvuv20UcCva2f8kB7xdvhuWbKz1ZZhDU7aqK5eIYYzCmGIOVj0CDOxxOWwZye+xc/JxbwJE2hpEZBLbL+E+brnbHYfVTtl4EMuaD1wXNAdfKdiIYc+8HLN2FLNFcz6rIaU/xehISXw5dpxRLlr4Zv9+z3Q+ZaWPy6hxPh6oJ0nCWTAWGikaGiJ0oquxJwFGaLQ6Skn8xdZfmncQwVgmVjHa5RBxETQKYFEBNrfFEJReusZrgwfdvNtiw800KRh5DGXUBPvwoGdmXLD0MOUoc8rQeXG2SQewXwOLToXKUOJs1JvtzyoF1H9+BKjRcsKO+dQlEktQmiJ0cG/1MOUfQamjBX/mZCf34z92Z1qKKb5YgIy5GYwoWy2OsFCNOddfjoQlQb37eo3roodH9M6vBxJuuPs5jsrULDed2fO/TxTStOS8VAoIrKuGKnQ86HwjtaZbHg48pKQ/ZOCk5aKu4hVPmg2XiKenDeZkJ+RKYKJ3R0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(396003)(39860400002)(136003)(366004)(346002)(107886003)(4326008)(2906002)(2616005)(86362001)(6486002)(956004)(44832011)(6666004)(478600001)(36756003)(7696005)(52116002)(316002)(921005)(1076003)(66476007)(66946007)(7416002)(66556008)(26005)(186003)(8676002)(38350700002)(38100700002)(8936002)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: tSrY5YzW6BFSQg4I6dHPiBXmV8ZFzH7qFEJGxG6Ef31U+APFdJmZUv1qM+8XbDzsZpD6uj43DJa9Abzh86p8t7tjKQF9DGqcDlXoW4fEHR9oNRYk1phFSqXLHkU4sTivSZOgpf/CsFBb+Bw0f96BsPLDzmRY85e7TMEKp6zBKwEjMsaV6ZeNQtZwda8WVMKYa10JbibRS3fktz9BUcoyU7suZYamu/MWQNVTIEpOZ1J54iPh0hzzeDdhD41LwMi+OxaxokNvajHu0fKXNjp5nl4Ei62FfdexemK8/ASJuiLFQtghC2EmLc7InF0TT45GukyG9n7uvv61MI3ki5dhTBrTg1aGHMEfB95D3fmW2X122wt8s4mq1FwYGjroiHw7Zy3IN7AY9+HEupvAQsaOWqnZ4BaCIdFRJmTM3CjH0BCxa8B0a3wnxgu9V/5yirHkzEbmwXpHd6bXRKxlDvyUv712SGrp5rjc7cY7GXTJoULBdaKuVKx/MuqHKCri6ZIw9RruaKjeUpHnsPIzuhyPkBH4VFJCvLkiFs87Rr5WDceOFeroxp2isJd03lYQUFpObdf5t9daW1oIvq5gihJU0q/Y1agScS12Gj0RJy33HUq7NFA04Or43kxQgyFl4DGSgfBI9u8r0JuBQ67EJKAh4nL5DRlJEVyQduh4ZHyw3f79iKoxmKT5a1FiDurqzameMMn4vWgHGIGypDHOn2OTEkLCAsG2F3U4ldX4HU07+pTRN+ov6dHHAuNxkv3XAuNgNjBl5/b5/3AkLjDyrOBM46sZD0yT+E/RStuS5gmhHYjxfgYf1ELIWut7r2kLgl6zp9Gi/sJr3WLpVpcztUv3nzYC/Rm0nw5lpopzDxio+tx0wi8NUy71nWPIpUzlFuxMVi2av2fRUUZP+j/KG8KVrqb2mDP1KkNUXWstsVTq2jUYab3vAQKoK9rYhPmVIivxHxoIys2KQDVflw7YVNxWUtAzYTx/bhbM+kPKxZAvgiYdGUYn2aHMjgh3gr2GT0PIMCI3D88p0OM3l5J2ShgLfcLkXurY9H2cP9EHT4ajVoOT5MwhIhCG1yf04dXW94hxXDIijNuBTHblo2DaVonTZIc9xURQmyC7AlSEZ5xivHKNue6JqC6sUOyIwe9pModBcgsNpqZ42vhpJKZuMSR5WeKT36ppYsSzySXGs8vet5ojIzR7deXkvzdZnqukzfArKldIufaSTG0XCT6HVWRG6/ekzwJKXru3l3cUhpsVIfXgHJ2tbVyPo6cB82JQSn4CTWjcgSR5kIUt7fWv24aJGZTMkFpnehkDwcwhXWSrWh48RdwaudMpLlO5JZsmEXT4 X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 163ab24a-e8ad-4ad2-c32c-08d977c4b429 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:57.1588 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: s9afW/9VU3U6zN2FmkZemxBFdc3Kk2c2Ho/l6KWQtABCB0FCLsiqutgKnUKwibRGzQfgQeWI4WyiWgQsZTqdsomtsBTw9IBXWgC6B+JYoiM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3784 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: FcAALjC3PLgtyUnOyQLoDVwSRj9KNxUq X-Proofpoint-ORIG-GUID: FcAALjC3PLgtyUnOyQLoDVwSRj9KNxUq Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Introduce a new link restriction that includes the trusted builtin, secondary and machine keys. The restriction is based on the key to be added being vouched for by a key in any of these three keyrings. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg --- v3: Initial version v4: moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v6: Change subject name (suggested by Mimi) Rename restrict_link_by_builtin_secondary_and_ca_trusted to restrict_link_by_builtin_secondary_and_machine (suggested by Mimi) --- certs/system_keyring.c | 23 +++++++++++++++++++++++ include/keys/system_keyring.h | 6 ++++++ 2 files changed, 29 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index bc7e44fc82c2..71a00add9805 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -99,6 +99,29 @@ void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; } + +/** + * restrict_link_by_builtin_secondary_and_machine + * + * Restrict the addition of keys into a keyring based on the key-to-be-added + * being vouched for by a key in either the built-in, the secondary, or + * the machine keyrings. + */ +int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key) +{ + if (machine_trusted_keys && type == &key_type_keyring && + dest_keyring == secondary_trusted_keys && + payload == &machine_trusted_keys->payload) + /* Allow the machine keyring to be added to the secondary */ + return 0; + + return restrict_link_by_builtin_and_secondary_trusted(dest_keyring, type, + payload, restrict_key); +} #endif /* diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 98c9b10cdc17..2419a735420f 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -39,8 +39,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #endif #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key); extern void __init set_machine_trusted_keys(struct key *keyring); #else +#define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted static inline void __init set_machine_trusted_keys(struct key *keyring) { } From patchwork Tue Sep 14 21:14:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494849 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69E43C4332F for ; Tue, 14 Sep 2021 21:16:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 559DE6121E for ; Tue, 14 Sep 2021 21:16:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234720AbhINVRa (ORCPT ); Tue, 14 Sep 2021 17:17:30 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:62928 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234608AbhINVQi (ORCPT ); Tue, 14 Sep 2021 17:16:38 -0400 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxODe017559; Tue, 14 Sep 2021 21:15:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=BrLNCus9LxI+mv1uvpxdUQb2xTGx2tIIKJFBUsy243g=; b=ip14YJ8bIr2cmOHT7Yfm3m0OVXzf/colPs1FL4dq/wdSVLkjPGCXL8OVNqBKBAj6BkYq +OPE8hcAr/cY3Fo0aSidUnHmYfGJlXWM5mgp7P0v8pmdNqNVkjzzW0euDXssBdCCk2mY RTC6r8jkXCNBQHsb8neL7Y47/LcEoC+0YW19HuBIswhgYT78sdqLtIS+T7V+IJLTSRAU W+ubsPl7IsOBEukyqV/XAF8aiTyAUwLMnhg0HFKEgyqj11S3JgpVsSA5hbcCkpGymPCl D476TirIPb8esVk0ddEote5bfQS/WYj4WHRCLSloORVP48/ByPKsK9frGUK/x9VhmLzJ kw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=BrLNCus9LxI+mv1uvpxdUQb2xTGx2tIIKJFBUsy243g=; b=yWfZ5lF3O8KDQimQklJxcC4o6a8DwkJqu25DsfrLZLc4xZ4myAJLzLrjoVApB9Tzhx5I z+eEDRSQG65gDSkh9/Nd3EcoWU7SQMNdjIzgROlbDWr/lgAaKbJQ/NCCkLlA8lY9LpBC NHPMeyZmbVk7AuI7rNdOCi6pfXt7UAz2ETdUfgjJ5FQ+DMua3Du8E4QKcOsBTQ4cYnQU 1UBEBjhhDYQfIXQ8dbxnNfoVoRSN1srZCzIAPyWgU4rCGyjMkP/jAFsNuQfEOCQ41+5I Sjk4m9obi0HnDnszsqhU6k6eFDoj+NI+GMVbnVQQJ75kihCite4NxqnnMo1RCO0KSNC+ xg== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p8taxje-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:03 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELAXHs054981; Tue, 14 Sep 2021 21:15:02 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2168.outbound.protection.outlook.com [104.47.58.168]) by aserp3030.oracle.com with ESMTP id 3b0jgdpk3w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:02 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=m1KIAuoRTAcRqr+QyUij6ztygl7iLeUFkafrJPni3MEPKd4purTEkn5AsJfaVAr0IpJW9y66BBG3ZxXPLfWmVmtYCnkOeN3NHrVBtOnrWO1MIxsdsZ5XLk/JGCa/0OkGBMr1H7rR2xtH3UDFHwduhuQp9nY/CEm+cvHKA4dH+eTQISa54xZhmiIm6f5Y7fOmSKEWRZeYCVvZzzvn3ft1SDqU8lf5cfec1pwU0SGM1AVfrLUPrFZoceA3qOE8wC0sS0BmhNGiLBDFSsD6zgc+OPd1Tsye6tH9hRUnTkVx5t07zza0pvTmJEMCRk0lfWTScOVtoY/Rnk8IJ4sACYh1mQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=BrLNCus9LxI+mv1uvpxdUQb2xTGx2tIIKJFBUsy243g=; b=hE4eQ5WjrXrzlCUUfAK9gmlQ18HC/ntFh95bOVaDyJ79vFaLiyMksjLrWr9YC/O+oCjyhtNxIv4LoxQo2xqhdTEljXB+GaemwWjtmY+Xb83oazReljSxj1jOvrh8g4PIjDHdcc+8rcc+GOE4Cs8TXe6FwQfbBdp6rbOeuPS3WkAF6POviS7pfQxwsV7w1rQxYo1PBW47lw0ycnokQYUMc7ACW+8jt4PffQwEfvN83lq+FgD5vx0UrqaBsmf54vakwWZWq3vO/bWwuZw0mG6CVwl16baZ0JU+OzjOMFl4XD8YrureDwNahjcLHFnfyOaFl8H3s8x2MlzqB7v/Srsr6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BrLNCus9LxI+mv1uvpxdUQb2xTGx2tIIKJFBUsy243g=; b=kITWmtXJxpXAiG9b8u5X4skWVXASA8hZcdkmuF26aFvEY4AHL20zz9bW/IuMgo5LY2h/gU8j2v8WSt+aTj7tLgNU7IWjbJtIrsvs4gWDpUy3ff8Zz64SkCbRiHb5HXiy1mcz2CknXcuZE6yBzqIcyvA1J7CAz5tBs/lEHR2F86U= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3784.namprd10.prod.outlook.com (2603:10b6:610:3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:15:00 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:15:00 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 09/13] KEYS: integrity: change link restriction to trust the machine keyring Date: Tue, 14 Sep 2021 17:14:12 -0400 Message-Id: <20210914211416.34096-10-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:14:57 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8460312f-6359-4946-3db0-08d977c4b5bf X-MS-TrafficTypeDiagnostic: CH2PR10MB3784: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4714; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: JU4a6yWIFMSQoj7h4m+5mgQ9loImXe1VnU02ObYD80XwbV/XP8xkyUO3PSkU7VE7vt/pBi+lRXNqVVmbtdewlJimkRKZzf3yQKQVeOgYUypEliv9rdshq7aaPxN15i6v+4Pv5SoqGHldHtAS828noP1hWumxCj0a4K/2P843tTtDkWD16umw2h3Z28acQoOWlH0rjQDAnlohhLDUf2mey2jMX/ozJ7v5Z2N10UYFHRwTgldTX8PqIWUi0bP5Vz5rTscZCEj2k00fk8GIJ5VvPD1wxm5+hK3uB3X6HXMvQ1d9maEBGtpt9sFoGrPU3DB/rrONBK7O8y6EnnRO8PX2p1KkU9TA+t9UUa0UwTpy1XVfi7w5mtmRPmjmu8zKsqIUhjtJa88RXyXR5PbVPs1S860JlKe0QtWtPGA7e5uA+zJIziUQGpAK3T9+NmXL2PCN8bKUTEwPdz/cv0Zgx/v+zDGa/AVvoZnqjKue4Pe6rmBp1iS1X8ST1uG0zcjvZTmQ8sekP9y80jB31tqOBcgiBnD22qSU5lCiXnYAP0QnkcIvsTe0asX1buLy4cRYkXZ5QCvKauzo6M/qWGRmA1LhBzmEcFAn05EUSBlNbGjSBGqwtuFxLx9YJBvL0nTJRIwypLx3OA1unWo3qHCujzL9GM0qYztgXrnwpfGtQd6++XOS+9Tn0Wt221zyaYscdOYKlssuPnFx1FudKosJ8Lh970MChSMtTxgwjBeuqavna3g= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(396003)(39860400002)(136003)(366004)(346002)(83380400001)(107886003)(4326008)(2906002)(2616005)(86362001)(6486002)(956004)(44832011)(6666004)(478600001)(36756003)(7696005)(52116002)(316002)(921005)(1076003)(66476007)(66946007)(7416002)(66556008)(26005)(186003)(8676002)(38350700002)(38100700002)(8936002)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Euok4VLUrayl9f3ZiQ5m/XbUlZO7zlj/gVsRAEQ3jM9NrjuhObjbUYGh9RsJUTTuHXv8dy1RQWtDUYbPJasjaP2CWqhmicfw4hsUGsbbIoKW4JlZUu9DxRVbUzxGfPyQm5GzN0+xkcLutKtHIEQKvtAGopARZba6d972ip75ILBKm17rcjaLtkbN8SNwit9w4EyjMayf0ouqvgbRHgNjMO0Ur4AOFjTZEeqZxwu4GXyCNNlG884YywXCzj3rW3fGLcy8GGLeNAUzPUCBftwv6FqTyM9ADzJJs5SDtpqqZw+4V/C4pP6igCkgVyBCKQOqK7iwUr3RH3xe1gmx3gGeSpWmxA836HCaK43ZyBdAHLqz1WEEpkxetV+OQHeZaSdGk3THBW40hbtG9HS27ahOwD2wSWLr7b85vlyaJyg6ljs6vY8wdFDfXDBB2mbDZQwhwIajwEaKmv8nVCoDwW0oaRq1SRkSTNrw0o2ICt0GRonR24J+/vHtkpDUflngmSqaQo63ByVuSz+xEKTerDcnqhELUki6+y+Ng6VN6hlwn1s9H+l8XKQdj/wUhdgD7NQVCwAtdBvEneZh0hYmX8eYiDXLo7UqXekY+uEcMwFUAnSVxBf2ZT6LPLRl7LnlQXmKllE8DdUV/gkO2CbLQmYCrB6Tzx//yK6+mrVOeEfzfQ+DIHWdhMoQFcJe1sQhb0rjlonQC1sI1BNo6VgQrQMiXBBmitWxbionKIRbJMcBTcpjgHIDspuGFOYRjtEuGxmZlvGbADkNRh1uOENKvF00DSdRAuT+wi5j2dBdEtN/CIgs07pQmBRWwwyGQDMmcZ8Jqm1UMtykmAaHP0re3c772Whos5CgnUPxI8eMgjB4rcoV0OZ3/JdQgBROggA5HrRFZh3xaTcSsgGsSZokhXjBPSkH+bAmiNeipA32DzdGa2nNh6U9BTDNvhrpJqy+DZCCItZRaBxFfYGqUMRjfTJJCxBs5cMAZH2eogJ+Q2NQenFMHPIHlOnJ4fNk0WuNZQKA+6DUhqk8/UXq2MYlT9fqtYZnPQR3xJM4Jq+0OYfhRo2LNZqFPP6/uMg1Br0QcovDxnmOTak5wD/rtQDp7dTYRtC+CjBq7e1iC75LX3y6+EoigkxmFR1Z4XHRMOjKk13D/+XWDi5itjVdbS2NXt8BdxwFfKcuXbcksZAnasb3r2ClykjqHiUuYxLcPVTGBsF67j7yP7rG1wXlS6BsVH+hSFFsuxhI+18O1ih6w4kXHpyFUEOsiiF6wFTi+A9CGWJzmYN9tB+qlgEteIc1A52WgXKZiVyG5ilmRCCmHk+ofDq8VylnwrGuFhqd8wSsmiyn X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8460312f-6359-4946-3db0-08d977c4b5bf X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:14:59.9455 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: lrugU1fVY/091oIXblJ+vBMp9d+Fe30kp05ZiKkmhIgWSvUZ6us6/YH0u1/6O2+a5T+WxmxWS5qB7M/kcLkEhhlXvf7vY5NznWCpW676joc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3784 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 bulkscore=0 spamscore=0 phishscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: TfYsBjLc0gSfAD9AW1P-0IQVHNbrUF6t X-Proofpoint-ORIG-GUID: TfYsBjLc0gSfAD9AW1P-0IQVHNbrUF6t Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org With the introduction of the machine keyring, the end-user may choose to trust Machine Owner Keys (MOK) within the kernel. If they have chosen to trust them, the .machine keyring will contain these keys. If not, the machine keyring will always be empty. Update the restriction check to allow the secondary trusted keyring and ima keyring to also trust machine keys. Signed-off-by: Eric Snowberg --- v4: Initial version (consolidated two previous patches) v5: Rename to machine keyring v6: Account for restriction being renamed earlier --- certs/system_keyring.c | 5 ++++- security/integrity/digsig.c | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 71a00add9805..ba732856ebd0 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -89,7 +89,10 @@ static __init struct key_restriction *get_secondary_restriction(void) if (!restriction) panic("Can't allocate secondary trusted keyring restriction\n"); - restriction->check = restrict_link_by_builtin_and_secondary_trusted; + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + restriction->check = restrict_link_by_builtin_secondary_and_machine; + else + restriction->check = restrict_link_by_builtin_and_secondary_trusted; return restriction; } diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index e7dfc55a7c55..74f73f7cc4fe 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -34,7 +34,11 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_machine +#else #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted +#endif #else #define restrict_link_to_ima restrict_link_by_builtin_trusted #endif From patchwork Tue Sep 14 21:14:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81581C433F5 for ; Tue, 14 Sep 2021 21:16:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6D4C661213 for ; Tue, 14 Sep 2021 21:16:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234833AbhINVRT (ORCPT ); Tue, 14 Sep 2021 17:17:19 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:58454 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234829AbhINVQp (ORCPT ); Tue, 14 Sep 2021 17:16:45 -0400 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxdvi018628; Tue, 14 Sep 2021 21:15:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=Yl+xa8zty0HoXEGw0xbnz8s/GfHcrrFSpEDhsVtRzwQ=; b=FAYFc1iYHHOf00WG05Vauq4BYHKOoyCba3dIXWUOZmzQ+Zw01LqY+8j4R4wqhLX8Di7B O8IVrZV0jT3kxDY/KHbLIrsOTHVh21YMTuW4ocIeibEyDOJiqnuD60rEpsK3sZkceGtS h4Dc+LorL0VMd4zdURG1g+sUco8FqlyEXpgpIeQCV8thgifk+yuI2SkP1c/Ebvc+A/2B iSi0+kSsRWjvOXtHLUPLU5RrxugahOsde2i9IW3GiZqgI1qsvi8vR+eUtdriDsI+yLN5 n3i44CMLM7+joWdaZxm1FrsWcv8uRAOT1r5OYtpzBiGNOIYiIuGEma5k7RMX0ACbOMlH yg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=Yl+xa8zty0HoXEGw0xbnz8s/GfHcrrFSpEDhsVtRzwQ=; b=nf62KymzjcS90NTmGjWeVmSSzX3H1kWXy4ZG6SWLl0EsmZN7wVRidQdJ0VahnLWW8DGE 2aYeeC1klKVt7VjKpEinckSXRpjg17PhFBOZIGGThJDoMC52pHxsXfDCxi9KxOLqRhg9 T50Tkc/KrDWrmGUhYr2az4/wJsTg5mm2hqJbzE/rbBtKMV58pg40a5hx9+Q7o5H5T7CC NUPyBC4urI4fqfLbjzBpPWGPZUlDx19qxpx6YOMVRfCDJ66Trz7JK4yoHZnzfCdhfr3E Q2WiVvPEuUk8yurirB7EA47G3pOE8iorknxfL1vr6b9yY4n8s2MUSdLeBR8fzEC96aI+ pw== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2kj5ubhm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:08 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBAXR178928; Tue, 14 Sep 2021 21:15:06 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2173.outbound.protection.outlook.com [104.47.58.173]) by userp3030.oracle.com with ESMTP id 3b0hjvqwq7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:06 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=W9vfcMB8l+C70s1U16itMgNLSiJZzYvuvV9azw3fS5/op4a2WFla+bM0hfF1NKepmJNWw5PjihkzA1Ss4tlPb62sJdGHLL3N8rFyEL3/ueiIM+6UTU2X0YEapohPfYLq6OzK19RTQAu1ZByB6MCjLRVMVMJl0NdJj8XF/6osadCDwESwXASbLgI+CCBZ3e/I8q0aysr52Vpzt7mlpdTz6G+ylyRqcg38TAGs/NRE9NlcCD7Rhsztq8B2izWjPhq9xoyG9K6nOq7S9bMZ6lrENVLlVYWQFFpaAPaMz4ZBcKSsEZf/zP+NR3Qox/qPqAPFJ8vOMQbYXRnhZiuc9IXWNg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Yl+xa8zty0HoXEGw0xbnz8s/GfHcrrFSpEDhsVtRzwQ=; b=cKISg6c8JcWKyY1+pniaAOCt3fydITr3mWwZB6lVOAXRnXeZQ9X3W2UaaGKxe44D+CY8cG1haaOr5jutqojq6KN5OzUZ6WNrU9wPBtZXF+GxUN+Od1pIEvchMkqS9gUGUH4Jx9RkDH5YuEv8xoU64Fr+qLWY06kOtr/dK3OfgjZq5QpHowQc/Zsqaqmy9ZT583f4sVjv44DRLFyok0sjtxlomQh7fjX87t45Qkz/saKuIv4s4SwVpPXbOdFi0cYr9k5LMzi1t2eGUQoqbJXjfdkyywZWp4JqPSEFBCtiU29bJLuuZcRmAC8PVjjqA3ksUN9wLuqxr07MM5rrV04JzQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Yl+xa8zty0HoXEGw0xbnz8s/GfHcrrFSpEDhsVtRzwQ=; b=WfMgsGxVLLidVySdDbhpgXeMF+glDlr1db+pT4gQLJ0qmkaUpMW4IA3Q0H9RmxoRCtWhtqL+SiK4zxQUO7P7CJMKQb6jq3U5bLL0/SDo+E9UOxZJGtNTxEYTw54l8dt58S2PGpQAbUr8iXGZ5Szjg+o8MV/IfdmS9bflnGrGb3c= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3784.namprd10.prod.outlook.com (2603:10b6:610:3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:15:03 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:15:02 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 10/13] KEYS: link secondary_trusted_keys to machine trusted keys Date: Tue, 14 Sep 2021 17:14:13 -0400 Message-Id: <20210914211416.34096-11-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:15:00 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 13850a3e-1959-41bf-51c2-08d977c4b774 X-MS-TrafficTypeDiagnostic: CH2PR10MB3784: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: UwfjzDdfRNnwCgN05SZOtmr6lgne5zoRWVhnoSK5dbwCe8KLcIaf0XaPEvWkT+xfIUmrQ2xDJ7lwr//tBEdnXq35pdWaXQfSpo5CBkpsLbW3WHUPbcwNALVfjCBeNMASsp+VGuZh9TTsUkubt+Mf12ds0wUE0xixySqfUpvLmd5Ov9WEF23phDeFpvbklbsHschRTrNqWmaXnlbrV0DkiVI2+YKOrtqnk6VnYH0LwrZvAsnOe7NC1QP2drQ4HmTWnVouUpLQLR4Gh9fU1AU/6JMFZvngANPsux5lhKtuPxVxfFn/gLC2MrYRMbaj9+jlAGGAzXhwVqqnA9YSgoulSLnAp9qJGuT1fMzcR7npgud3EcH84P+Gt9dzY/6hTV+hqoGjtWRvaDNK6k6NBmAYb7lh2y5xjRGB8irf23ijpViddsPf1bn0RTezFFzR2Cj3u2DW9HHNDCduO1Xh/oOp2DClO7HTklB1joR+H65OVpvCLZAMObm9Xd3d+Ilrf2DXVm3t3Xl2NxmOPCCDsjBqBJMP08koMnPH1RwxoJiUlfaSyPuDbtKb0VmE27SKcMQRv9NWANErqVo+Q4aIOgNEqc+oEQ2eRWxUBwBYcFjhJsXUfNPD2fURc716M1POVbIKKW2lWZ0yZ3EB3rXuXNq+bJBoy/3Uj7udRAKjIId/T1EYrtcARIakSlgohmJ0z5za9cJZztY5caKZoLN+zqM/jn+VJDEleIIc0xDw6hFxSZk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(396003)(39860400002)(136003)(366004)(346002)(107886003)(4326008)(2906002)(2616005)(86362001)(4744005)(6486002)(956004)(44832011)(6666004)(478600001)(36756003)(7696005)(52116002)(316002)(921005)(1076003)(66476007)(66946007)(7416002)(66556008)(26005)(186003)(8676002)(38350700002)(38100700002)(8936002)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: AeSCV/iIAd4WPfRVvrNFBMyw3WmyGcgl3+rh/RMBJqBm51wUuzV6mJUHMKJUXyl+zebZBufn4G+UfENxATW+dAtExY6rl65ArMrvMAslga0oU8OkpdHZzJSiKVPwcjO7hrD88cidqix8/tZLgnLTcq+ve6dyO+H4tW1AfKSanu9pqJrLLrpjrLdY6KZctnC4BJhWJ0TfYuU9L59a7oc961/qPhcl/94Jpb2zBLDDW2GUwcnXTqayKCDVNPDnFnsxJp+HTt37pxQQfbhIYspI96B7V0G3ix0+Vh1prc/Jx0dcWpQ5I9XMZbF28n5ZdkeTucnaFTmljbDEB3K2+x2CQ1Ht/wAGFhXZoDLTqFHeo0ROL0aQfyZQ00MEs9zsutI6wmW0dm3YBG727kboUGieO9FVw/A0xexD4S3sEW3ydyvoeqbYKfoMGvwpw4oS92qFBUSE443iKpf088sATue8hl8RPEvOQxOTjExnTC0yKnxToBF5p0h7AMtviX8dsGp9kABDygjt2Pt9iulsHcMPXVpDzPkXYWAMt8G3za3RnTsKM+6ErpnnwdPLG3hkRz9/Y1i5D7qLe4N2JiIZ6dsmDgLhTGAU3ajdk43uKLjizyCz39y5tl4PRaw54QmNAikG0geVFZqycag7VMhbxbP6BZ+EDu1iAbeM8ZbLn8MnV6xhCKcfk+2/HSO1VgPzP9HkynWTBMLrESG1Pg/h8W6UaYEuSWUOe7aq9idQJGymNYqJYv6/vqayOZxGnB9bNbwB+FVRZpjAxdRjth2vVKo0oI8DCttryZJ4owrqVOYvkR+jb2C6UsKBxmHJCr2zWzcYXq8OZDFiGfFJAkS7NLqN1NqoF8dHO9Wn/CiFYNQ8j/sQDJrLEmhThnbyrqCy5U3IsL2J1GhiJHWfTz75mxJsiEZLGxD7Sa77dgIf3zNdnwZPJud4yVIsEVwE/khBmbe1dJByzBbHVSeK3oejVtdIrBbIBY/cK8dzGgOSxaHf1nCZ8q/Ahybsy0NYpsmQjeoKTee/0g28i7H7r2PN6h8WtQO9673vJ2w88RnjNQCPICC/ZQUz/CorBEa0AaVhktgZduW/JWUbs/AxZPL5mp1vIWAzR62/nv0avfIDLKiJmuv0SBx/3RXwhy3sD1jYDACczjdd3FxvSqMyiJ15cJq7IvEKBjZqoKjES3kt7Cuj2vR9hvlaa3JtmFlVlcGGCsYgiCUd/uXr5naTNvkOGEopqq7QUlFFbTXzpRJQDJZvx3GYjWiEPK2BkR3eKt8asYrMhjK2Fl0tliFxPj8VfX3JZ8zl/7ZCM4rcaWejQwZqWtjYFUnucZc5REYPWYV+PHl/ X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 13850a3e-1959-41bf-51c2-08d977c4b774 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:15:02.8289 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: t1iIoGQxaKhVf97J5pwEhiN3RqHba3IVz0fFJZ5Bwn2w7zKyMtl24bEBaTlf1QKmEkkcxYyQyejsd58j+lLdxVnUMVRkj/c5gf6iRnjVd84= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3784 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-ORIG-GUID: IXNi8Ne7anXqb1-R2cSSuElNNbkESvUq X-Proofpoint-GUID: IXNi8Ne7anXqb1-R2cSSuElNNbkESvUq Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Allow the .machine keyring to be linked to the secondary_trusted_keys. After the link is created, keys contained in the .machine keyring will automatically be searched when searching secondary_trusted_keys. Signed-off-by: Eric Snowberg --- v3: Initial version v4: Unmodified from v3 v5: Rename to machine keyring v6: Unmodified from v5 --- certs/system_keyring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index ba732856ebd0..2a2dc70b126c 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void) void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; + + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0) + panic("Can't link (machine) trusted keyrings\n"); } /** From patchwork Tue Sep 14 21:14:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 958AAC43219 for ; Tue, 14 Sep 2021 21:16:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 870BA61247 for ; Tue, 14 Sep 2021 21:16:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235074AbhINVRX (ORCPT ); Tue, 14 Sep 2021 17:17:23 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:56822 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234792AbhINVQo (ORCPT ); Tue, 14 Sep 2021 17:16:44 -0400 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxeSG018644; Tue, 14 Sep 2021 21:15:09 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=KTA3VLFo7rEsvxDaO/x6l5dAYLwN6ErwXF2LEUU65y4=; b=tPqMeVYFMZcQ/KQaxx9P7mkCxAIFfOqVtcJVVcQKlTvbic1JeKTmeXNE+oOOnv8XYr6W qVbaO/W/+XbCie+wL3oMo6dU/kY/z8LwkYoNz/NdfNxQ6IKmodKntKZN+ddwk+SoFORh MO/q+EK+huso+1yEaToBqMkxmT9bC1nrnZRwiimZbBOrfpV8fmKjtBl7BqToznTXZmcd Ugbx9KqC4ZzU/9Gn65rYz80bltWOjLNoWlP6mDwHA2UfRxFwcbAq0XyJbHZwQq0jVwPZ wQD9lRi/299nEaKu2pZLoI4rNFJFD4aExLPskbNJnxIu11YBq1ttbjGNsF/GI/hcYI94 Mw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=KTA3VLFo7rEsvxDaO/x6l5dAYLwN6ErwXF2LEUU65y4=; b=oDMsCW6NDhBheKpvd6ybOICU+A6j5AQYV4z74p/4hL4Wm38JsDIVpAdWcvMg0IV8DAXh VlrJPwtEhVoH7PPyo4D+o2zNZMZEvdZ+V9QB1CeD25qpyGGDIP2+Bj7gqn9k2iQLwBeB VoF23P0UqUrB14ZcLeuXHHPDcB2Spy9z2QdbJ2qm2v53iOEA/IznYXkZwrtXF5PeD0wK 6WzMRJPSU/yikBpAFmdjc5Qn8OfYmZV1edX4/nGwOWM6cUGCBIICxLEEfG7G6Wn4sZrY qk44k2vk3bdAvyLTRvcYIpy29GTtr5cKAooGhxv30lu/n/BvpGh1Gc7BC8vqztJ3Yq26 eA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2kj5ubhs-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:09 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBAXT178928; Tue, 14 Sep 2021 21:15:07 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2173.outbound.protection.outlook.com [104.47.58.173]) by userp3030.oracle.com with ESMTP id 3b0hjvqwq7-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:07 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QnWHyw7D0ryCLbJBvXoumzqKnRs97tCRYZWjM2zeEgArquT+7HT3iC1/qxCAMmcwRTCF3LOBEt9N+c2rX91cBpaogaCDY/+nGmA00SvKB/UNHShZ2bbnbWPhTndd8xmgclKsLVR8HL8sWIdKUwcF+M8GSdKXUncP8rquBaGMWjQ34adRgTXSuIfpWvphh/VclUGrPlpY/BYdr1qxA8dVr0tx2LkPAmqlNnmkpxH08m+OXuZpOsnddboAC9Iw4+QHVbHo8cd55TnF3L8Vpvq0I5KSPA2Wvf0cbPEjFcQ5ZfZI2NL8Y1624biqJnNjalAVkFtzUz7fpsNbV4n4hGBvYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=KTA3VLFo7rEsvxDaO/x6l5dAYLwN6ErwXF2LEUU65y4=; b=fkwkhALZXeDVCEkpjiP4gZbVTLAnejfUxxrJB28x6BicmRo77k6zAAY9cvR9fq8NrIudJflGh5+jrSJfjNXtT5NjpXNb2DP/OxQl1Thup9FIcumOc4V8i0H+fSK1pO22HEP03fOiin1Zrv61Kd9hIJMALlBO+SkqzHbD/F0BXBusS3TX7t0tP19mMJPC9SGe2T4v4PyF2uZqQmylHRMH5ZkOcrwj97dNGFOVKlAbB61/R1FNHnGs1cxq3ONE0hTLgFP9ARt6mEvqLQY+096YfjwPr+tZIbOpN9KshBZfRZ/aodvD38HQkiZtIP/woVHBbWdF/wWDPQawNP0kzz9g/Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KTA3VLFo7rEsvxDaO/x6l5dAYLwN6ErwXF2LEUU65y4=; b=eCvhdIAG4me4TBIvSAwjzp2y+g0HFkSHIF8I+uLcIB0ntXMBP+1Vwh9hxOs0aDqypjbW1887cIdJmAdh1GPRflHKKGLPph52cvN5g5QV/Z7b3A8DqIx6QMeI8psWs+xhbc7jaQ6rDszpS2IHE/BbKSo+4xvp8aMpPqTdw4yb7Aw= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3784.namprd10.prod.outlook.com (2603:10b6:610:3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:15:05 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:15:05 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 11/13] integrity: store reference to machine keyring Date: Tue, 14 Sep 2021 17:14:14 -0400 Message-Id: <20210914211416.34096-12-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:15:03 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b6c20f2d-456d-49be-f778-08d977c4b926 X-MS-TrafficTypeDiagnostic: CH2PR10MB3784: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: PWDMbfpbvby5D8rABKGBQA4eON1fQh5HKl5j33jujfS3vOOjZdLRv/0nGrNgbH6fshStPISD2t6GiBPhCb72cgUIc0lDuUlXcj6d+gu4dsB6ZoCQtD4bCiJk6RsPNmjyYORq0/0mspifaTFTjCJQqpfxYyh3wHghViEj0uWWWKvVGUxQdUFiMMw5RFkRccAAjMKe2g3LPqzOozIqA/BrU/ZC+zshasYvD/BzhoA2iFj+JWRxNiUg5juEW1jPMa+YJwLABRY83CFyTq5liGPkDM6jn6EXKElbiwdxjqZ1jCMnjc6fA4w0sAJfrrCStUBMEqcRYTccaGA3Vadya1CuMW73I0BvXxDe1dmIDrE/l9VUJ05L1Zyuz0zgWS/kuWh1EENig7FDEonDVszFbQlXHXn2YowuCu0zVXig2iBEi/O9gnNRUuXasn0F6EclRC+f5xQU/tNaR36RAI2cP6zZM9rCHoLzgowZhwe814EY5p27d0CcYD79JjJ5yWKC480R5Tm7vKl85j4tIRI/WDf1AIom/lDVFsTVv+PiYAsiQUb0ShPenkxuSUXU/2da+dPBWHpII/a+Ri9wNfhLI/MJvZf7WONzDzSYildj9t7vRXCtetxbE2NoHttd0HOFjlNGbM07G8ZAizGVHnDCvm+aa9VNHpZxo2gpbYbaXBr2VlTuiauLQSvvDnuqCNM/6Ip1N4o7FsCNAEI7aFA/rp4JX+Nz/h94jES0TPkEGmfGwzs= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(396003)(39860400002)(136003)(366004)(346002)(83380400001)(107886003)(4326008)(2906002)(2616005)(86362001)(4744005)(6486002)(956004)(44832011)(6666004)(478600001)(36756003)(7696005)(52116002)(316002)(921005)(1076003)(66476007)(66946007)(7416002)(66556008)(26005)(186003)(8676002)(38350700002)(38100700002)(8936002)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: HIwaqBY7Co8jE6RmUKc5tzzmod30lLLVsk3CA8ZovVkyZyfnYUSRsLET8sqJwaSzJf/TnaR1mH92FNTJJVLVgvWtGRDHC4gxiZ1OJGQ7VdnaUJ5cU7Hyvo3pbPYQGhWqxyvDsSe5yjFCPMct0lnqR0gf7FcuLfvqrfhL4OeTGIDdboDRgdCSXHZyQHsXQslRC+aQwnYwRjI4QjAY5ZCcgvPOY6q4S1snNHWPjLRbq5j1wXjswFNzviya28Ql/j8+L8NTy6zDEX+k86iWQyuoBmgt9/oegkioilxVLdQK8ykSaWRrxlBnopgnEzBumAQNucYTOezr5vyGqbtUcf/HczR3bq2n2tfDAWMfFpeZt/8msDxEo9PMybaj4EsoB6Lh2cJjlFzZNHsSjFhPfBXtzJIF6xEJmHBcI1L5C7MBTzRcXHGE/upWW8JjOArMoQvaB/19tiMYwLh/VSfVCeo/odCId2VbH0tcCAaEFYlB5xvIGVtkmr/ry9wopGA9BvuTt1QXcdciyGjGOAOBYK8gFj2aVDbWCjboXdpKGmLjK89JH2iFzixDeYsQSMSXn47ikIu5cyI6fg6uiOtiV6ZvW6NWWl8CbjAJJS7sAI5Qa7/6hSykEjghnVkiyPdIgfzjRNAm8E1NTVUlFwj9aoHvCmfNtWKlY9ZKr5AzSrrsiJP/CpWf85tAFOo4AkxvrXx9Y51aNT2twcry1xcIn4GV0D3DpWIvaCaoioBZV4EtmVQmCcniFQ23Vh7HKuisp0ZhUucmWNd0EigQHAMqo4ebOxMGEOP8o3P9wIgVkkDD/CHRT2yMYlF6NPWNVATKI76RMx+N+8evmZOpUAPwcFkx6wQlspc5+cWljsnXPHsDjx+ZuIIoBFC0RpLyuYXLcVBr0NC0Jl8nazMsDRmx+w/Qon08ZbDM0xFX7QW0SH1+GDW0isOt5PjyNmNkd+/VfAnyE7oBnVoPbgjz+k+CH/BPSVKWdfILS+9hOPcTQlIXSOofLlQFHTDTlSYrbqTN7K89VrS8v7E+ZRfHTlKNUloilVfFJQIW+GHWXUiUtalteWbdSfh5dJsuUUrHroMlP/37JXmaBOK6lX+/zsohTnulg6fCQGEzbGZewEP9P3KbRS7bq07POf9eRef/8QpcQpULFqlDI6gOus5Wg8p+rBUL3UzqsS79QN457LWttUr0cbcUjqAWKvNFqM+2t/t/VPrIJNDW6MMpi+eWhZzgQrVCuJ1fOiTpryEk1JSKXaU1tcAoOcb4anF4310Z5B6UpZzq8zaDSMkw8c1RoiZS147nTcyQaFQKXPUdD0EVFJkAqsz8qdCXTttv1oim8Fr12Sza X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: b6c20f2d-456d-49be-f778-08d977c4b926 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:15:05.6794 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 7KxqY50X6mY8aa83MsrT+7TFDhnd4q9h9IYOKP60NWNBAhIQlfGo+h6pND/T0YLaTNizyqUgQ/Mfr8min+rbL8tWiozgw3m0npNkZs+wy34= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3784 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-ORIG-GUID: BHbq-lbGJNsTHukjbnHT35E8jWbEIlN8 X-Proofpoint-GUID: BHbq-lbGJNsTHukjbnHT35E8jWbEIlN8 Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org Store a reference to the machine keyring in system keyring code. The system keyring code needs this to complete the keyring link to to machine keyring. Signed-off-by: Eric Snowberg --- v2: Initial version v3: Unmodified from v2 v4: Removed trust_moklist check v5: Rename to machine keyring v6: Unmodified from v5 --- security/integrity/digsig.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 74f73f7cc4fe..109b58840d45 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,6 +116,8 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); + if (id == INTEGRITY_KEYRING_MACHINE) + set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); } From patchwork Tue Sep 14 21:14:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494837 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30AB3C43219 for ; Tue, 14 Sep 2021 21:15:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1D440610D1 for ; Tue, 14 Sep 2021 21:15:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235078AbhINVQz (ORCPT ); Tue, 14 Sep 2021 17:16:55 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:62266 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234885AbhINVQr (ORCPT ); Tue, 14 Sep 2021 17:16:47 -0400 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxjqP032082; Tue, 14 Sep 2021 21:15:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=gOtTkD9wTLJfVbRo4U2uC2+7hY4WwTWmc5PDwn0UAAs=; b=aELpaANRwBguyUVdmZdPXKvwvEQPGOJro25K+swA1BKlaGQqAswfxsfskEDosLHHgwWy c2zdGs+g6Z8Rp2jF6+rZLIJH/GYOmAFp3GLc5Q7eZyWwXGCdELJU0q4qTIpoyLAhXPO3 aoGtTkoW+JmTwkE5IZ2SKqPo+LMDCXqQKGarlXRNDMPWaPSxdHfCrxIFIlvyzE9F9J8l nNf4EhUCC5rtMJ0flON+y7YXZCMCcoVvtsEPqIfCR2yTjS7o58cwc8phwISYaCYOrwne E/rDHvnBCopMhkyLXlnoB58TGxAtWkloF1ddPcwueJ8Feyb8R3bw1Tel3aga0dwulc8i Pg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=gOtTkD9wTLJfVbRo4U2uC2+7hY4WwTWmc5PDwn0UAAs=; b=0Z97l14TuriSPRIY7TP9c5shkm91v2DrI7GEfUtaA36E+UeFJVGvVoM4qiH66DHlMupj 1T4Atadh68EtMJ46OX0NcmzAZ4QJYuA8Wk4rIgC+6fel8g+FtfpAqfAAJ4ROXc3mOFKk 4rAGe78OsTzouF6J25st5FrmhyDpQLhD9nN/qb+6+Jntb2WDjiLSE5e9r+XVBarhurE7 Rc5qXOSEBrbd3/9m8D7xHRzJLdXyPNqYGrNFEjoO5jjIQhRfh39EwEyng6pXXvrXbSIS Y0uvVyY4YKjylDwfyghIew2qjGBxHcs0859brMwLRuwGHrYp71wrpuVDE+GyY2RPxvQJ 5Q== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p3mk1d9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:12 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELB9pK178830; Tue, 14 Sep 2021 21:15:10 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2177.outbound.protection.outlook.com [104.47.58.177]) by userp3030.oracle.com with ESMTP id 3b0hjvqwuv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:10 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=g7KS8wRFTYjb+GXqhQhCsAnMs/Cd4vRUrAHCXQrczZEq2QynJ3BScw0zSxF8bjBKMuNPXKjq8SdSJpmzpixpgSMwmGR+CDDbPiN5LgNK4WCPe9jocSLKTzq1Dt/AL/ypTIj6FfpM0d0IIvxoa7EaxNmsqNlWLTez1/M6gntf9kBsKtzmxtvJcxT4C10FFZ9C/MLQ3DXBiw6RUE5kBntNzTlazTh07e8sVsunzaOgGpGVBQZjiDhIR6gxpb90xxD6PL4jO3+vxRvHKUyDxMdRsavvD0W2pOSMT4DUoa2YV7a7VGmsGuDjTS/WS6S8NL3UIz3egzp09lnWpNI6OJb51w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=gOtTkD9wTLJfVbRo4U2uC2+7hY4WwTWmc5PDwn0UAAs=; b=huIsIXiywOZjEnNbM7oXZpeTm+sFgPyISfMc0Yvhp2J3JRWx+qiRT+qaXhzUpNj4H27Fnhr0Jhv0Ag1c1+Fs32tl0bmfaxRaS3eFoXGMKj12DWCKExseo+37V2FKjoIamwdU4fYnMvSGhkltdrQ3m1/nakx+18u+2BhXYw9T5A73eMk7ZGUkSr678zF52DwjRnMEuE/yV6C5+joqFvLSlATEIgf11wD2Hbzu2Em7//SQc01UNlGeyU9SuH9ZA2jaWTmCyeZ50uvoMUQansGygjAlq3Isw/uh8tknMgew5YY0/XfBbczqBotZHtNyRy1Y5lyqvhdjt3FEgD3ad7sFQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gOtTkD9wTLJfVbRo4U2uC2+7hY4WwTWmc5PDwn0UAAs=; b=G/j+F9xGKe6qzGx6nzSuRiDoS7kc8K0AzEXGVwm/jyYBCyDg8JhECkI1t9raWSAOeMJ+iNeqdTVqZOzchYBGe+qvR9YO4Vv89eDjsE5hk+oDTetkecvOtAQp1/B62cSVutjr0LU3S+1qmC4WOhqa5n4PetGx96MnNcs0NOyyYko= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB3784.namprd10.prod.outlook.com (2603:10b6:610:3::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14; Tue, 14 Sep 2021 21:15:08 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:15:08 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 12/13] integrity: Trust MOK keys if MokListTrustedRT found Date: Tue, 14 Sep 2021 17:14:15 -0400 Message-Id: <20210914211416.34096-13-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:15:05 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 112e6b4b-f532-4655-4233-08d977c4bad1 X-MS-TrafficTypeDiagnostic: CH2PR10MB3784: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8882; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: znj+MLRu7LGETSB2+KPT+Ug5rvWwWxi91hFSpXUOzBFLm+VhZYnhTcxMka9Y5HUWwgSpPoeY8fXTqqfQnyXGAGlZeAFPQlSEx+JD4x1iblzMUCvLHCt452xeZPm8IzW5xAo2ZAVVNMfrDG+LXYs/VGNBY3fnOA0xqc2rFDygKWD+FII+JfJ2TmjKbdIY/yHao8yoY8lpP4o3aFkmuoPgeDojDmknMSpe0kmY56atnkZkwXZuR0AbhLrM+PUmIHnsI11ZChvly4VpAU8Wyg4+/enCMx68jl7vgaELW6U1pP6zh5wfuJh974pkI0yPLy129zrjlOVlUIidmlMEKLeJsYeGA35pc9pDq8Tq3/8k5L015YUo9eqKNrKYWtTRne/+EBatxxeulWAUz+GFZdcXY4ssDUOOoBaw8d/VNJAqESwc9/1HamGb32TX/mhihyhfW/4cs+Ufa2yE/Sk5zleRP94J3EKHPDghm49V17NofWlULJQilB7J06sb2eBlDAej3n+vdq/UqC9DHJWNk7rr4jClG8/D51ps2nXcRpWEEImWKH3EQK6r5sDwSx5k47fc21yhF9+fMTu+u/ZVxAHoPyg+0AR2OvFmWDaxPOFNvKzL0preH6mVU8KltO0RkSVGN6crHgbEKu1ef+38SGXQ+vPQBpMkgfRJc8+mpS6BdrPuSTZZork0f9dMjBvDNLX1qU1ge5TFPnIkhuXt1M0qAe0XEjtQLkIZwKsoxxsnglg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(376002)(396003)(39860400002)(136003)(366004)(346002)(83380400001)(107886003)(4326008)(2906002)(2616005)(86362001)(6486002)(956004)(44832011)(6666004)(478600001)(36756003)(7696005)(52116002)(316002)(921005)(1076003)(66476007)(66946007)(7416002)(66556008)(26005)(186003)(8676002)(38350700002)(38100700002)(8936002)(5660300002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: dP485k7DY14CE1zFJYvCGduJDh2bGNeTrOlSxhZ812VIBgoBUgYZQUqy+ihWnD2YP7EPoLrJ4W1TBYGWZOvYsuyORYtFMgB+JIPb6LfzutGWjosx5X6XRgGF0SBDDkHpIJXDxdS3ftOpNl0sPrLdOpl+HCgAm+Yiy9YpPwTqtkwSEj7agjeeCR9E0OTfIr6SasZ50k/1Vdg/3DlHkuP7EYag5Ecv6Ze40YuT109W/QeAnN5PCghgWBRJ1EgW4l8QY1KHL3rVL/92Q/nUYF2uJPxHEs6+VyjCKqar4ZR3mVlBQYwvHPCksHRS/4ixslAgKU2+omDiQXhXA63S3MKSBGUqXUOAgeNfr2Pj6EB4H2y7gqhnq/BRAJ32hhtlxvvCeQBPEvUTkosDLy3lQIiHU2IXE8FeG0kn6qG/OAk40xIaJjOTnQCQERxbB/SBSKm+gBJ63m5SDJlq2Xcc5Njtgua7TaTg7aA8liWaWeKOYbvy1e9tJNyxXFnKiGnP5wmxaGejZVtQMikauSnJ7iWFTZZNtftOwba/qMa0FoiGOfBClG8m5Xevc3ejbAa2IrI8GTa+VECqlM4/O4xiwj5Py67e0nutoKE8oCD9xhxKZKsqODjpW9+REYMG5K3X5RNRaStTqvDtJ9pMczg677gaHe7KglweIWrEtG/6oQDKikG5/IcMFJjR2wgUQdHSrxkbGOMWOhHIE2HQrmbc0DPxMoF8LZOn+kztukeDOjoMX6pcLXBXUw+iikdj7GrJdOn6Vzr2lDPeNrdBqwFbxOOR7C3PQoajdCsp2A3koFevDxcAJmFZITZ22dn04XPbKYnu22y8G8HhV1Nr1fikICZth3cOvZD+IkoPauMud42Bblu5AWwcRq6UDu0xYIiJoRXkNFVlmsuM1gWg7hi3KJfBnjSiluPHIydgGrSlJtUf/ccX+wEkjUXtJjYY9cDeMDT+mThJtAMfwFoZVhjqIR+Lxrj00x9cypOrmfWIuN5kWi7DhqcASxn2GBfuhHysKY/vsGSS6kXp1UcIH/utj5cMeLYRUXP5dzw4Mc6nte6A/JuIqHHPnjEcEIV+wt30nphK6a3xo586MQDz/t/zs65p/bSSb4LoOP+HnYX6ysfQSPZO0BG46lvKGmIePBIkTOUfvRihuc3WrtqxR5lQZORtb0AXOwUC4k+15fAuukob3uCeKYmvWg2L2Eexg8oj7IO7JOUGt49E/sju/bX+fjVphGcLisGjeIfxZTJ8e6NAQ4JrPNWjlvtRrxKaQvsYs3e1QG0aGYyaQA1DH8Yoa7uiQBp/FMC+6tsws7FJL/fKE5zIGjNX70uUIIz1N5+eMsmb X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 112e6b4b-f532-4655-4233-08d977c4bad1 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:15:08.3457 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: IEODi7/RCbP8Kjwxhm73jBEhxpGQ6UW9DFpF954ylBRRocyjxST7cJyWnspk3yvHjEPmqfpGX0i/Bi9WNsEr7I0ambMGrhI9OAS/xptlhpY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3784 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: gPyJioanZBi6gbqlBlVfkNjt_SoC73Ff X-Proofpoint-ORIG-GUID: gPyJioanZBi6gbqlBlVfkNjt_SoC73Ff Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org A new Machine Owner Key (MOK) variable called MokListTrustedRT has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themself that they wish to trust MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the MOK keys should not be trusted within the kernel. MOK variables are mirrored from Boot Services to Runtime Services. When shim sees the new MokTML BS variable, it will create a new variable (before Exit Boot Services is called) called MokListTrustedRT without EFI_VARIABLE_NON_VOLATILE set. Following Exit Boot Services, UEFI variables can only be set and created with SetVariable if both EFI_VARIABLE_RUNTIME_ACCESS & EFI_VARIABLE_NON_VOLATILE are set. Therefore, this can not be defeated by simply creating a MokListTrustedRT variable from Linux, the existence of EFI_VARIABLE_NON_VOLATILE will cause uefi_check_trust_machine_keys to return false. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed mok_keyring_trust_setup function v4: Unmodified from v2 v5: Rename to machine keyring v6: Unmodified from v5 --- .../platform_certs/machine_keyring.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index ea2ac2f9f2b5..68b8f2d449dc 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -5,6 +5,7 @@ * Copyright (c) 2021, Oracle and/or its affiliates. */ +#include #include "../integrity.h" static __init int machine_keyring_init(void) @@ -40,3 +41,29 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t if (rc) pr_info("Error adding keys to machine keyring %s\n", source); } + +/* + * Try to load the MokListTrustedRT UEFI variable to see if we should trust + * the mok keys within the kernel. It is not an error if this variable + * does not exist. If it does not exist, mok keys should not be trusted + * within the machine keyring. + */ +static __init bool uefi_check_trust_mok_keys(void) +{ + efi_status_t status; + unsigned int mtrust = 0; + unsigned long size = sizeof(mtrust); + efi_guid_t guid = EFI_SHIM_LOCK_GUID; + u32 attr; + + status = efi.get_variable(L"MokListTrustedRT", &guid, &attr, &size, &mtrust); + + /* + * The EFI_VARIABLE_NON_VOLATILE check is to verify MokListTrustedRT + * was set thru shim mirrioring and not by a user from the host os. + * According to the UEFI spec, once EBS is performed, SetVariable() + * will succeed only when both EFI_VARIABLE_RUNTIME_ACCESS & + * EFI_VARIABLE_NON_VOLATILE are set. + */ + return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE))); +} From patchwork Tue Sep 14 21:14:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12494839 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MSGID_FROM_MTA_HEADER,SPF_HELO_NONE, SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D835EC433FE for ; Tue, 14 Sep 2021 21:15:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BE72561214 for ; Tue, 14 Sep 2021 21:15:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235117AbhINVQ6 (ORCPT ); Tue, 14 Sep 2021 17:16:58 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:4474 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234989AbhINVQv (ORCPT ); Tue, 14 Sep 2021 17:16:51 -0400 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 18EKxjqR032082; Tue, 14 Sep 2021 21:15:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=IzlyzUN0VKQWEn2KJDwO+ww1xVfp+yJZPwUWf8ijzFM=; b=pKQSS3FEUr4HAh1gWPqC618Bq5UD8yDCMVVzsvpWLes8RhF9I1L3eSp5DZApKXcUaHS9 x3Cy9wmxVNIn3Awrl7okHgLRpbvMfL3ofS6/uIUpWUsO5xkmjt40EuHsVk6bqMES9fAO khOXRlRxXZOgyCQIzgQ8WYA5DGxRmh0CpSzJX2LeioeKa34EOq5cj1gEZBhhX8dw8GeM toEk6nu61iYW2n46fTmRWPJ3++jyfQCVPsYkPUv+s6TbGApudEqp5YZPJzbwCluIUojt qhlqJJLcM6KcgfhVe39aq8pgeKFa1k6wH8HvTIH/dXhmDOXsFgdK2fHtNEBaYNYobHv9 eg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2020-01-29; bh=IzlyzUN0VKQWEn2KJDwO+ww1xVfp+yJZPwUWf8ijzFM=; b=KyraUoNlDNlqeotg2S+Iq9uhj6t4nMq4hPpd1djEH7Z+D5WvZNMsdkJIW/wuN4uY3+UW rgCIHLGTl/s5UFUOKjs7nibuy1+StoawhneNHBgDBpsm2+0vlJ7QxfsN5QzoyayDNXtB C5mYpnzjvdH6T+Es6wzlzY85QCVaS7VcPno2UR87V5CZPEK5QOrE1905rEGdootw96vI 9gc3EFdLLf2JUptOarX7ZbQjxCaG3zxR7LeUd22ShrzOlnP0SCtOpoRib0goo1HTWwDo 0QFGbB4ATFNL2ZV2U1o3fWly9D0IFBMJMDN9G47hLZyKUPGRDA2idQB91H4heKsikGum 5A== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3b2p3mk1df-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:14 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.0.42/8.16.0.42) with SMTP id 18ELBADK178849; Tue, 14 Sep 2021 21:15:13 GMT Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2174.outbound.protection.outlook.com [104.47.58.174]) by userp3030.oracle.com with ESMTP id 3b0hjvqwx7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 14 Sep 2021 21:15:13 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WV4YfIw6xH8lFeqEOwxRFqK5zul8/LaveFAV6+NBetv+1Qz2RIfcp/3csZ+BFCoK2Dkxvl8gPkjkoJT0VVJTkLgkdUu3Gt0QfvPu1iqX243RjOg52q4mqr31RygApzETzB9gmaJJAS8x5DYtDXCA1DaX8sWQ10PDGT/BtzGe+EloYrwEZb8opOiFx3oH06jzTHuLegX/CZMSCJP7VEGGQ0F38pzS0TbDhOWoAaBMPv6kbb2TFKFP+jJM2N7cnz+GvaROBLWDfZY+OpEZU9lxJw/OBAD4mCOHgDxjqBQL6IySjPvRhuWsbclBZ1NjF7z2pQjbsFXWMlVqhJLyPKYV6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=IzlyzUN0VKQWEn2KJDwO+ww1xVfp+yJZPwUWf8ijzFM=; b=VZ7/PYny+iwZ7YeIZ7rrPzpLu+T/Uw1aQWXMM7sj6JEa1OQo0pYvpQDDJ5Mk5AiCsxVhAvlX9DzpmP4zhBlpeKwYHZUt1KCb0lcVWiFe5uyr2XRiGH5Cw0/uLfiMrvveVQqqAen+qf3/Qd1aGgPobscMnqILy2ydhUiSUN0/SnIUYxf5plzi5XJ2e0K8YTFpuH4uY+fN0EKjNGWCilBjinpizrTQcivHSYyKBsK+K8VeSUAXQYlzwWCT9hJscWaFplaaTIr2k2YqpjzkixCI5YDJRgQjgQPaQB0DCqdJvURA3KM9XwOthQO3lJyMEydkSyJieo2f4ZqzDrQRktZBpA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IzlyzUN0VKQWEn2KJDwO+ww1xVfp+yJZPwUWf8ijzFM=; b=srQ/Lg+gTabE8geFZSde6mT4hDq2sTq1ivDx6ediOTXFizrW134/V3cIrWlQ4tgEo4rHFiULo2nFhussXXMU2cAOi8/K3Qok7FEvdRoD4gkrY7LBSKyRug8LmBaFCw3LsXyLwUktTqokuxx7OB1j8WZ9c6TvrqllaBPGQfp/Anc= Authentication-Results: vger.kernel.org; dkim=none (message not signed) header.d=none;vger.kernel.org; dmarc=none action=none header.from=oracle.com; Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5036.namprd10.prod.outlook.com (2603:10b6:610:dd::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4500.16; Tue, 14 Sep 2021 21:15:11 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::340c:c4d9:1efa:5bc7%8]) with mapi id 15.20.4500.019; Tue, 14 Sep 2021 21:15:11 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, scott.branden@broadcom.com, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v6 13/13] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Date: Tue, 14 Sep 2021 17:14:16 -0400 Message-Id: <20210914211416.34096-14-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20210914211416.34096-1-eric.snowberg@oracle.com> References: <20210914211416.34096-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from localhost.us.oracle.com (148.87.23.5) by SN7PR04CA0165.namprd04.prod.outlook.com (2603:10b6:806:125::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4523.14 via Frontend Transport; Tue, 14 Sep 2021 21:15:08 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8f57700b-8929-4748-14c6-08d977c4bc76 X-MS-TrafficTypeDiagnostic: CH0PR10MB5036: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ogtXgSg9hsJa3+jBiE+p30QQ79L8I4C2fcR4wERQ3ujOhGBlcbG3DbIc4pN0/qvasShLMQv1eP3ZyzKAyh3gusEGyYezrvCNI4OuqbMvi1I5HUyRtYZ9BO76KHsPWY7EFNrS6d6MwUZkXJgx8jTNhRCEmQdzC4+P3AQ63eygBaqMIRQSIRxoQoRFGbBSwhz/MI5Auuy1FAVHFA89Ajk3FmrBHiJHPWM51xbPtaS2eGxWrzQtMnaUDMb0Ep9J/Ndz6GQ+H7tAEjL0O2UABQKCLJDU2hje3Nq6RD5dGC0W8ZMRbejGr4sU5gEY7YuNDIJpI6Rn85C20+TYQxad8a7jqHp4XDQSGK3PI76W2aAuQiWtPEjPjzyh2C6ihlKfi5V5ZlfWIJXlcmLBAmGkhTOm/5hvXMmG0aD9+ieTikT6m2FFT7fvi/m7q4sq/JzNfWHHDIG85K9uZqExg2XpdKIVoCcr3tLqma/Mhi7UHuTpI+WRTu+2EbuBYyE/p7rGk5kf9VNF0vUGjCGgGAcQD1edyCxlACt5GPzS0Dd4vsHofSZD+eR+PvpuF6X625opBTECHeolyDCo9lTgaIK1mRf6uy4dalHJlmKhlgcfbwNiaKQbjdn9sXmCmTaiPVZbXeckjmcaSfNZZLeyxTUCuHkOaWyDwvXsY6Iiybe+WJIP/7gwZAwBYxzB93eJp6qL7dNqbxefhFO5MOqzF8sRoF78L63aMR3AAPoM2KuMZpTbfEA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(136003)(39860400002)(366004)(396003)(376002)(346002)(4326008)(2906002)(38100700002)(107886003)(1076003)(66946007)(7696005)(316002)(26005)(956004)(36756003)(44832011)(7416002)(38350700002)(186003)(8936002)(83380400001)(8676002)(66556008)(66476007)(52116002)(6666004)(478600001)(6486002)(5660300002)(921005)(86362001)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: GwJjTB8EHo5L61MUKNmzY6CXcQDP6Z2QkF7MS4ZuiCfUWZDFffno+xHEJCJ2UY5qexfswd2BhyUF+vb02B32X1EKHKoA2MU+Kd01tylgSjGMmFLbv/tU7xiReuvQUlxtLFMRLRs4qF9uOILJvGqTjBFwwadTV/fQA4UlDsNdt5BCtyXvZ490eJ1rbu69mjRtjM57ym7iKqWIoT+vJaoJhobALwfDkASu9TAQcFP86dEfnjiR2RiQK4mTVkMQI2MqBqPV2R75tZqzBKBKVpF0zj3VCkuETrSUN7Lm9MFwlRl9O3YJMEW8yaf3Od/uXViSad2Y6H48cKV6UxXpoEo/gSv23SWsivsxC6xSzpoLS41np09InIWka5n/y3x5Xjq5fXTG7bu47wjJI+gH4wRN8geYvURZOex1u2D/r/ABPoGpfqltjvc54nG0Jj8WRPpx/TPcH7HYHX37j/wQOolWUjhiEl3bApmUTyDr0mcxxFG2c4yU3pXz19DW7XTdFnbvr5YdUy4HdYjlYca+/uLe7hyZhqmwH0/n8+nNwX90o1TOnBQrQ17N78PGkXBai2SyFxHD3o2WO0bLfeQy9OuWXwtfZoko6BljFk4uZsrTm6k1m5EPFzC7vgktKnPEnqNhffDhvXbu0jwrlnUHOWoVZi7yqIgLCYpdpqxm074LeDhL/Qqm2jXzSaU3eey/hkophr18kPbogfSuJTAHRqa7aNhKG45iy5te5xt7tgO4+Oe2z2+2IEhpTSLWQkjODYoDQz0UyW+RmNYEbgJ9gyDPuFuDHVYpZCFQFCvzAWQs96iaGSlGZ48ZXrM3SzG1L5AJN6b0Q8w32anoZ+R2SZ3JeAZMO+jQ3rSnIviRDzHhLPSqXWQKd+cBZE5HdWRc7Ih9S3+6BB83gu235RV9Vi847GGsXXEzJ3Ebr9gIqov/2xUsZ/cWOWfF4oionUnAeBAwtJRgJX7nY1nhVXPTSAHKzjvPlHGqak66IdX1XjQC+OOCcOtR19DRYBpEq7auUZyDCYnIRTnAMgUQ8v5wLT/u8V3GxPp0VccEPncn0a9AW49/CeefQ4bpCQn/6dzuf3ZegRsGQth4UMAB/tQfHTF5fhTtYC3g21kfSVTl9usTnls/N6ujaJpWcgWPzcNdvWsSVBp8/r8TLkkaU2efooNWvafuTEs047oaeySvv5bLtGVGNEW+pTCLzh3BQldGQlzmuSNbgQwnx9BWVUazh+r4GxhZXe3eifek+RsL5bijrSmu7a8UGwQZ+vM4JZkGWUIBf0JeOQo6Z1H4UnrMzDvEQfymL4RiH3DfI6o8abXFsRwGiZv1i/VVU9PCrgZsMl9p X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8f57700b-8929-4748-14c6-08d977c4bc76 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Sep 2021 21:15:11.0787 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: KTbq3SYesvWwD0JFpUUf3Ih2tHLS7AOrk8n4d814xMRO9W0u0x2jIcmSWAolrq4Nn7vBNuhxFoS2iq344ov3vSUfa2KTEfW9HvQltxDe3iE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5036 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10107 signatures=668682 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 adultscore=0 phishscore=0 mlxlogscore=999 suspectscore=0 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109030001 definitions=main-2109140123 X-Proofpoint-GUID: mxss-Hrd7icsoAFFQCOAAKKTZz_8gDRu X-Proofpoint-ORIG-GUID: mxss-Hrd7icsoAFFQCOAAKKTZz_8gDRu Precedence: bulk List-ID: X-Mailing-List: keyrings@vger.kernel.org With the introduction of uefi_check_trust_mok_keys, it signifies the end- user wants to trust the machine keyring as trusted keys. If they have chosen to trust the machine keyring, load the qualifying keys into it during boot, then link it to the secondary keyring . If the user has not chosen to trust the machine keyring, it will be empty and not linked to the secondary keyring. Signed-off-by: Eric Snowberg --- v4: Initial version v5: Rename to machine keyring v6: Unmodified from v5 --- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 5 +++++ .../integrity/platform_certs/keyring_handler.c | 2 +- .../integrity/platform_certs/machine_keyring.c | 16 ++++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 109b58840d45..1de09c7b5f93 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,7 +116,7 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); - if (id == INTEGRITY_KEYRING_MACHINE) + if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 730771eececd..2e214c761158 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source, #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +bool __init trust_moklist(void); #else static inline void __init add_to_machine_keyring(const char *source, const void *data, size_t len) { } +static inline bool __init trust_moklist(void) +{ + return false; +} #endif diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 445d413aec74..d78dd66fb048 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -82,7 +82,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) { if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) return add_to_machine_keyring; else return add_to_platform_keyring; diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index 68b8f2d449dc..7b413dacade8 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -8,6 +8,8 @@ #include #include "../integrity.h" +bool trust_mok; + static __init int machine_keyring_init(void) { int rc; @@ -67,3 +69,17 @@ static __init bool uefi_check_trust_mok_keys(void) */ return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE))); } + +bool __init trust_moklist(void) +{ + static bool initialized; + + if (!initialized) { + initialized = true; + + if (uefi_check_trust_mok_keys()) + trust_mok = true; + } + + return trust_mok; +}