From patchwork Tue Nov 16 00:15:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620819 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6323C433FE for ; Tue, 16 Nov 2021 00:19:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C984161407 for ; Tue, 16 Nov 2021 00:19:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242957AbhKPAWK (ORCPT ); Mon, 15 Nov 2021 19:22:10 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:54660 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349366AbhKPAUB (ORCPT ); Mon, 15 Nov 2021 19:20:01 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNMBN9009038; Tue, 16 Nov 2021 00:16:17 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=oYyarWa6/nH/R8iLXn2oxuDsNUALil26yTxNiVmVmeE=; b=Tp0S6KY9k1Ac+1No2tByc6VyJpDLm45QtNzjfMfZvy0Kb2ibN5eh6qrAw70+WEPas9Px 8rltZuSJol0azOXVHE/4Ctd3BuWx/gQbNgpdX+XTe4eDXRsDXrrDpOPA+ZJAd6Hp1MGb 5RBGxGRfA/FefnOzigvjxsLEEIIM4+uJ3EsSzkoR65BkD5kknjk9HPnKYIo+n67OmidO eSAydbJHYbQzGIwtqmjS/0SBNn28WEeDg+OZi2q1T/CrBa2gCl4xTpynQRBsKw7oRmk8 vx1xnuZ/BjXfbujYKo+rUb86ZJ05b3ghJIgqlERao/3skIz1LcIkGMnCzjXD6i2h11Ud lQ== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv7xb32-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:17 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B1JM046349; Tue, 16 Nov 2021 00:16:16 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2107.outbound.protection.outlook.com [104.47.70.107]) by userp3020.oracle.com with ESMTP id 3caq4ru948-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:15 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Za7od5oms9dsRPH/6cb+0caOYaHNeB6ZoLyq7SRF1FNbIVU9mxdqXBnX6ju0fWwK607gJRd5T11dR+oEbQWzM9qCeA4kEGaRWC1rjQX97r2/tteV1XxH89CUMcYXzuVt6clVB284B+ylyBLvDNSVrsI+tH0PYJ6wjGbDu0tkv31LUOIRrr79KM3yh46V3tE+QIc/mrw3ZvmWfs+4+TdYrgsNLRAGxI7UATFHP6MG75056095XP+t5HepVOXAaJCCp4rlBMNoLsQVQCCBj5Ds582vSuCnCcodxntX9T7pkD2F5yqKZN39QStgaU7vA/qQThRwppGyvi29idhzHOeoBw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=oYyarWa6/nH/R8iLXn2oxuDsNUALil26yTxNiVmVmeE=; b=GiBRHUN4DvIiSMJJznubfd/d6RxVzhAFfDviRTa3G2MAzXSCm4MbEFBxPS+wkZ7sYrXM03zpZ9wk05qQ8eQgmYk4kjQh61suvOZP0wYT1JUwIgm9tfkSkCy2rBtkKHcSJWQ9x6wGbN/EIRKMDZb4J/ZsNOoilf3hKa+MQ2pkg8CDMcZYyhDDFzyWEFpEZ6ooiZ7Ygn2alSd3xPVJBI7YTVhiTRPmtV8KRRDyQS48iV4SmKl3lz+DHZHNz1DpmO/bCCD/D9zlsvA33tz8YDSxSXszc5rG7IMY9mfIwqY/AL5etrqbfylQNLgvZjRmTxaRrOGwYYn2jsLlorA9jTQaFQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oYyarWa6/nH/R8iLXn2oxuDsNUALil26yTxNiVmVmeE=; b=u07rReEbwC74xoLy4DgzeYuLOnNGIOz7IvDlGFxTOf+XaK69KFB3sPZBbCGNssM23YnOz9no6TLTdV1sGNHnG+BH136TPz3xXWTahvltITy11L/qgoSAgqRqZ1E/Ad8uO3ty+tQeNwHwFEsZg3m6aESEEdtbHdTE7WAk3+dtk6I= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4358.namprd10.prod.outlook.com (2603:10b6:610:a8::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.15; Tue, 16 Nov 2021 00:16:13 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:13 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 01/17] integrity: Introduce a Linux keyring called machine Date: Mon, 15 Nov 2021 19:15:29 -0500 Message-Id: <20211116001545.2639333-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:10 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 5c4b7502-818c-427e-dfe8-08d9a8964c77 X-MS-TrafficTypeDiagnostic: CH2PR10MB4358: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: nFZk/Ym/KZ4GNfXViXjnDQUJuDH/L3pXoc4Mlq+7uIPAtAwjzPs9R5umnNIEwMVUIN6Ll+Mqkgx8xD7rwtKJ0YP5TOVI81crtpF1a6EL/GzeSZEO0CmQvTe1gyyuljgf8cgg5069gK0+AAMLdmiKpD9ibEuQyFSfhvzI87EkJZuvXFWfUuPL/B/C6JCBA3nmlMteE0Z1cIRVboLBsZG1nHCUVGkzNyCjkNHFcXjFJn/vV1JRf0acQj8F4TOg0ydEnAK9gDxLMtIhwmkwFR7/IdTUMnQMUMypngiiu5O8FhA9hmaWhxYrHWgqY3QXjRZLdRVmnkE5q8TMeuIVBYxyXPeJholGPdIq0mLCaeUtukLZp7hEEgVcVmtnBjIK82voTSQWmdWrSEAK1mUHHMG3VAcO/N+/s2zGMS/X2vgVIjdSUHZdgq0mrd3VY3Hm2EMbmff1LiqgB11Nk8ZbN1qf3n9iDBeGzVbHxV7QPyNjMn1cBDVGIjYpUAzqP6jGDf+e5+hpItrW8YoyyW4+4TMsW62Sb1gr/b3tvG9WvudDrAWA+FqP/ICOnkIioCYpR4DL1g4yuCioNovzdcRbO8V1PgL0vm5WB1cHHKNtlMapaf0eXmlrVzphsSYjfOqHdbnUA+PTPKpm5qkCX3hqwGfpkG9gfaZYvj4gi4XZ7+MHowz0SEjvNzT9axaMdDa2UFu4cgNrMACsKVl7hEgDylwtVjQQE6HQ3g1Vbp2107dNkh4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(38350700002)(186003)(86362001)(66556008)(38100700002)(8676002)(26005)(316002)(4326008)(8936002)(83380400001)(52116002)(508600001)(6486002)(7696005)(5660300002)(921005)(107886003)(1076003)(44832011)(6666004)(956004)(2616005)(36756003)(2906002)(66946007)(66476007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 4A8xS9EO0Smk/dhjrI+VF/ocLpClpTv19I7nHQdfBove+gU64vDTeIncDGxaYRZDKCf3BoYhNZgZWOQGMp4yeSuIPClfLiA8k/K1xJlGjtt65FP6WuQ7SFUGlu50vqhS0xgB18WjRv59ExiNh9WViLjxHIeNsIQt0cYYXJDe8u9WPRhQdrvsL1tIGQ95oIeYWshWD4dV55cQMi0jlLSjD1yXqoz5Eo/3/WR/vJj6IxOhJHUhGJhFK3eJMXw7DFa/QXtXvrFCDT2+LHqjDchTQdlvafMO8+/6rO8TtFVEXUhjmuIvLsfJ/euNoTf6jVpXooGEJyw8KaX/7uNXKRuY5zkJJUuYl8pJPDQSdohRMqw/QnaFvUrxrT9zGTaLezq2T2xzU6F6RFeeq+2EKHJZKNAleQ+kF4TB5hgN2UOsQwULpy6CeLhmblj5umvl1cAv8ZYDOFsygJOqttdkqNjZK1QR/oebHF02iNUarAi/JmbkaonGl61y7xD6mAbIgzdZJvRGkSqhPPl1TeL6oJk0euhV0bd1FqaILiqJyhh/7bs/fi69sAbmLlVikvOHGUqOi9CECwOtL0WZTPZOcswKvJBMIdvBYEtpFAD4xeiOj1mQWtZ+h2zTCrfPL8fW2eeTwSk0vBDtlULziF+G2eb7OlGkZ3q6MNmGuhh8UaKR7EPub9AuOPn/25P1v8v0BVJjpCETXNUctJocuHv2AhOqp/IDw34GSpaeiKV8t8V/78QuhNkPGqgcQkQCPT7dKP5khq1ozCB77T2p1oynq7XHkH401osXCPMkO1JFvESarEvQSoQd5EGc+1LK5vS1Wmlxcaimm2fA7HUvj3imJDkTEBpto0O2d6iJNa19l2TqqMObsEiy3cgCVKq2LU5trIz9QzPlz+FKVqyhbYFnr6t4r4oRDwQ5hXLnSGT7GO+Et5V5+cdykcOy+HFuNct7PV2myz7CAcGUaBdU8/L/E1OqMgYiidayHErQ8KEmmJbhwBab9otK8s7srF4DGnDUMOkhxzM7cwg4EbOsFo1aZtEtPsZr+CFGsfkGG0+M7aApQg8/p59+GLHsSKWqWpuUx8HRxo06W6W9bny36bZM51gYlBAJSKUTTlikwX62FaElNf0BBwVm/h8yGtZ2QBtcalPdGFACDjiys26q/5tAn+Bse+mwGFtUnk94LyxLHpX/mnDXt7x5IbWbibBvdvadGSVRq1ZcvSi1oNQx0jlRgco8R/P9zzZtS0tQNpdASP7rBowynpc5D5scJcbj3MZACLNYqz+zVWeW7Zn7vMVDSktjO/wb5nvmPOjxEAXvr2Tv3nbvAY/JqyZm8HBslIo7k8aE0o/1qydhaG0SvfROtnqJgJqMXlUO4DuS+k0PbwknUw+Lwe8lBoz2MvdI792gLogDM8etoQK96d3H3xvvdzFl58I/Pw4Yvir+cEe4XbMV8RsY/+WtCIOBYXcUJat1C3vz5Xmz2LiMfwcrAh/g5ZPJWpT8WFgqOWRcBntZQYD+lHWQ3mbYDgQEWPJF7DETSYmNWCMJLEqt0/sO71qDRlq6smDrc6H5vXtu08oi519sbSKFhV/toRdEO2W/f0jnFW1y3abt6+9tFitYjOjSK+ODj1H8Eh3gcIJwQkUVmmP/HgCHng6D/Y4aRoa7gnhJV2sI7mjz3SDjl5ubAeiWChSz9g== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5c4b7502-818c-427e-dfe8-08d9a8964c77 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:13.3669 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: U4vc0aLihjtEE+GFHx4LA0zc+dZDJNh176DtA/5EOfMKFA0GPZbO0MhF5pMRsr30XEv3wxt32MaHSYqz4qpnhPYbxy+f68hxBHH9haBM5ng= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4358 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: JEmXPLiRzZLPt5eAtusF_EZTotdZH7Fk X-Proofpoint-ORIG-GUID: JEmXPLiRzZLPt5eAtusF_EZTotdZH7Fk Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Many UEFI Linux distributions boot using shim. The UEFI shim provides what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure Boot DB and MOK keys to validate the next step in the boot chain. The MOK facility can be used to import user generated keys. These keys can be used to sign an end-users development kernel build. When Linux boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux .platform keyring. Define a new Linux keyring called machine. This keyring shall contain just MOK CA keys and not the remaining keys in the platform keyring. This new machine keyring will be used in follow on patches. Unlike keys in the platform keyring, keys contained in the machine keyring will be trusted within the kernel if the end-user has chosen to do so. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v1: Initial version v2: Removed destory keyring code v3: Unmodified from v2 v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" v5: Rename to machine keyring v6: Depend on EFI in kconfig (suggested by Mimi) Test to see if ".platform" keyring is configured in add_to_machine_keyring (suggested by Mimi) v7: Depend on LOAD_UEFI_KEYS instead EFI for mokvar code --- security/integrity/Kconfig | 12 ++++++ security/integrity/Makefile | 1 + security/integrity/digsig.c | 1 + security/integrity/integrity.h | 12 +++++- .../platform_certs/machine_keyring.c | 42 +++++++++++++++++++ 5 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 security/integrity/platform_certs/machine_keyring.c diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 71f0177e8716..12879dec251d 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -62,6 +62,18 @@ config INTEGRITY_PLATFORM_KEYRING provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. +config INTEGRITY_MACHINE_KEYRING + bool "Provide a keyring to which CA Machine Owner Keys may be added" + depends on SECONDARY_TRUSTED_KEYRING + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on LOAD_UEFI_KEYS + help + If set, provide a keyring to which CA Machine Owner Keys (MOK) may + be added. This keyring shall contain just CA MOK keys. Unlike keys + in the platform keyring, keys contained in the .machine keyring will + be trusted within the kernel. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 7ee39d66cf16..d0ffe37dc1d6 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o +integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_uefi.o \ platform_certs/keyring_handler.o diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 3b06a01bd0fd..8c315be8ad99 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif ".platform", + ".machine", }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 547425c20e11..730771eececd 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_PLATFORM 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_MACHINE 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, { } #endif + +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +#else +static inline void __init add_to_machine_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c new file mode 100644 index 000000000000..ea2ac2f9f2b5 --- /dev/null +++ b/security/integrity/platform_certs/machine_keyring.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Machine keyring routines. + * + * Copyright (c) 2021, Oracle and/or its affiliates. + */ + +#include "../integrity.h" + +static __init int machine_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE); + if (rc) + return rc; + + pr_notice("Machine keyring initialized\n"); + return 0; +} +device_initcall(machine_keyring_init); + +void __init add_to_machine_keyring(const char *source, const void *data, size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm); + + /* + * Some MOKList keys may not pass the machine keyring restrictions. + * If the restriction check does not pass and the platform keyring + * is configured, try to add it into that keyring instead. + */ + if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, + data, len, perm); + + if (rc) + pr_info("Error adding keys to machine keyring %s\n", source); +} From patchwork Tue Nov 16 00:15:30 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620823 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B22BC28CF4 for ; Tue, 16 Nov 2021 00:19:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 40D6061A6C for ; Tue, 16 Nov 2021 00:19:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237475AbhKPAWM (ORCPT ); Mon, 15 Nov 2021 19:22:12 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:54658 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349330AbhKPAUB (ORCPT ); Mon, 15 Nov 2021 19:20:01 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNIDI3009034; Tue, 16 Nov 2021 00:16:19 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=Fet5i3la/BK4/vZ12MuOCx+XE0c4VFKhrHPBinrioSQ=; b=Xvu1JbRD+QdKcEUUUK36Vvxsipum2Jd8NKUHWIhDaKJleNU/9mbCbTQ9qFFgHL8hHw9K V1VYFzvINYQfckyQrZ7as3lMQGmCpOZXBbc24cColkeJ/QS0+VjTiz8IAyWGeF+CHSox a0XVM1SiPwpXilmK/Qtumd3seDS3Nqc5lMurnBJv4RVLI5VkiOa1YA+mysgy3QHbzlsC TLSm78bpLMr5fJ/tmvaif1Lmed/O10V4ukKD+FSA6KGiGFKlz+mKDIKwiKBA3g6lcBPD Yy0VrwgmgfnfOuO6cMwSqFhcJeT2OT181DZ+8fl7/BYS+nj2VCcET44jTwlUbh4TO1UQ qw== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv7xb35-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:19 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AMWm072890; Tue, 16 Nov 2021 00:16:18 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2108.outbound.protection.outlook.com [104.47.70.108]) by aserp3030.oracle.com with ESMTP id 3ca3df6j08-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:18 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=b9p7eJHxwa4+jrtB6eosBfClkMYWrzxop8MEcoSBhApHrl+VGz836pHd+j7wuZGlbRdahOtzxrWwh0+MiSce5xYHIpTuzZG9XHc6fVXjzEjYK6SJF0PqzyMw8m/7zpTGE/ZXtIwLWUMj3+pY0OARKHEFkfySOEPxSthc0GLEK62Gosrw9H/hcfos+JrAj9gODT3YFgzPRRsNimVzq5tooL1Gn6Y2kKd+SSLDykwGNjZX6luaUBCkwG+GeKAnrjf+Uq9l6akGAydY7HvWZFMNEvk8Vdv29kKca5FHI8Y5e3w3iqfHnHMlRc1Pi03ZpqluOSNLZrDSJ8sw0zdTBAuUUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Fet5i3la/BK4/vZ12MuOCx+XE0c4VFKhrHPBinrioSQ=; b=TiYb0pNALExsfN764GH8P/IhKj635XM9P4d5Tn62jisoOtMXsXNM+IHLQfPL1ybZ/K/nk8SAf6+rKNAI3o+a2Ms3ID2v6n3zm/kKeT0hfIBxjgCPxGcpuZfqtDjMm7SB5CTa+yNxDEBWQKt95lGk/MsO8F6yiTsYjIK5XkBuQ/Rc3+BvqJxiKjz/+/jaAvZZhyI1XsttA1cEwBjU1bZXOt7jP2P1lyL+L/sNUVTKAJiQFIl9+blrYTbBKst0E+DR5JsRsGLg5iYUGPNEP/sy497gWA+XLxlLIHhJUjqD6Adscwu9Bu5c22O8CtouAX2IRkFFW2Ui0/BJEdQ/lWKrZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Fet5i3la/BK4/vZ12MuOCx+XE0c4VFKhrHPBinrioSQ=; b=YOgjf824j0GswmGnOmqhcrUED7JEb832Arj82hdW/zsa4mRjFZdY4nyrAOCfDz0p2kp0Q8u3ggp/r/FD+To7PCnXgH2TOqF+q2E2Ux7RLBZ5C6WxU0UNvqLaSJV/voQLK+0SY3lt7Tl7+mXJWw/efZlae1/orThzSyZnqlt4ymg= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4358.namprd10.prod.outlook.com (2603:10b6:610:a8::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.15; Tue, 16 Nov 2021 00:16:16 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:16 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init Date: Mon, 15 Nov 2021 19:15:30 -0500 Message-Id: <20211116001545.2639333-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:13 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 48d081df-dc0b-46ed-0a3d-08d9a8964e20 X-MS-TrafficTypeDiagnostic: CH2PR10MB4358: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:3968; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 52G/HxY0Ps7uB1wUQKhLwHu28yRkDxV0jwBXbMhQlH25OufbDpdrTI8M5JWIlqr/EZBSNrAY/8PW3LCgbHf6DSfZ2iwqh4i+xgymTh10s+1/XoDbdcp12Uz8I/EvW6qYQ1jBmhLaGAltQoZhwXGdVw1JecSHZn+Tzut8HwzlWGPw+9tO3j0Xp5YmTlfvsEKKd1XS6duilhloo12K0LcxTgW6Gc/7/X3L2W6K/t3WrfODa+p9wMPv8TfRxxSn2fyPDaHYtodr+286o7lrDw2kKUbsDQQSCm/eOXVE2Vc46kGqE5t/jsXjHvqy4IEcV7V32Jo0mbr9wXdOK1p9Bqr5nvpKbDLJg5K/eNjQ1btrPMLYW9mgoatJ3NuStvs8vc44J0UCGW8kyWL1m+pQ/ykgZHmUQ+DqLn2oE+dFZeXqUv7bK5nIVBnsur2+gxRxFVJTnIOP6B5fVxvjEcVd9aTROsNmDHsEmTWPJhrtKNBTtRftULDBdWQLb6KHnxFBpyt8pH+REBSqf7CQYjtEw+aqF2V5yWM0pZcscoZ4pgz+VpfNbA87uih5fW5OujBRe6/Lf/iyeZFvMJNlXhAtTeJQT8lcgKGLirOdUjsWi1CA3O8X4sIVSpaSBkkPdX4Ypi95kacUth0Of55oNh6L22F3zvhvUNu94AmOQI1oYuyFWtHIUWiTY3W03rUJqTL9/+cu8y9pWVz4JtI2BSpb/dsG/lccvBRJZy57KPGaJeKxRSM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(38350700002)(186003)(86362001)(66556008)(38100700002)(8676002)(26005)(316002)(15650500001)(4326008)(8936002)(83380400001)(52116002)(508600001)(6486002)(7696005)(5660300002)(921005)(107886003)(1076003)(44832011)(6666004)(956004)(2616005)(36756003)(2906002)(66946007)(66476007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Pg1TGehGfSqUPpgBxQlBbztWKFmPrW/hJjkI4RdmzKu7KViOyYCKwgCG/CVIWrrPfQqv+iPnMg0o9FW+4C9i5/YQev4dIEaO5rzo64dC9cIPev15J1LEphatuWgxMjXWeOGv+NmvE1EO6AJUyXioIRMqpsHxx5W9HowOqhCeRUOGoZ0ZMMqjv/lodBwHYtdpJw59MRvef/qyMvlEF5VAocwvSVM16nhPwHp1GbIqzeXsfcl9VlPhgORlI9ydkunWftphewk+9bzLUxu8MWIeqr7Z9vtZkxvkYU0TuDrCWt/Bdu2UJ70h3ugzDHh6ExR1HDXIG1xWvW6gRiXKgOsiA0W6USJp8hmz6Pa9d5sKVakd43k1mkwXI/LRo249S17coL72NapcB/bMa1pJMdQ8wQDsz1XSj5CJNIl1OIzFEDoOjxroFoS76wnfaW3sQsgdqCZDN28yULvWnsCq4zIzsOpdCsxfsYwlCCRpKPDPff2csOGHPdVd8wJjmOilGpVJfy5HHkQoT60P22a+L2NiFqclHpd97CmBwVsl2YGZGG7+M3Z4PLEA/UC0ZGeqZxHre33DW0pJY+lwKApRHGpqogQHtHhAJyh6a3oGBYUEwTy5xPYBwrKHSWIMfd05EmowIxeOWBEyabCsATG3hsxwBCCXtvwK62JNzj5qo9P/IL3syEMGtrY1V0fBXk6f3Si7H5iSaVm7hkplxoDR6RUNJnz0tHpNLjEWgkH8SvR7mAVrKJSjyF6jLGoimQnvigO6BSszodfohBCUz2tzMgM2vp/gKFFT/7Opi+AAb3MlF158zCSQ6LOmgtc10oZvc1mOF4X25RcY8nm3pGEhiJ7Ujk1Vao+k9e/aHuJaD6DekBzbATiQ3X63hgTNKnnmvhHKRFU2KteKyxUm8PF6QRcYnXg6X12UvxsTRYSxoRJhm8eWyU2GZ/6qd+UBZL28TUA0ZZYPMgkUZl9p0GJbn2m12ucdKkHVZxdz4WT1Qy7Hm/cvrWd/wMLuXkx/+D/Tys+lMFUQt7MF6ztYU1NiucL3LFPNTrWJr5ifkTZV76Yp+0/iarXbz7RiY+MltUumo8xqeT1VhTRq4iMBt1Vqh6Z9XLv1gik9Ahl2HCASbBxxN/Us7OD4NjZ/+GgCkxZK4hU4kiiDq3QmLemex3YDWVo7nD1muWuGKWfA483ZoRZotUWinyZFUkcWCciqMgPwnSLrnOuGDVsz4SeJrOQ6AVXwTy46St57Vxehi+AtmGfv41422wQGtC0/JkBGd5hc45qnePEJLrYhQ6aVASpsuoOs1pojxrwiD+rJnT+U4R2H8c5ErT+gTleAd/l5VvgRSwQrFLR31Cs3tPpgEq8kxQDdbHv2z2KNtPMrJO5S1s/t28An3GIfYbk9XbfV/ZBzJUH22UC1c2rkAEPZzszY5DYdrGAn3ef8vgF38hpzrvUAxuzoRGLnLnOyW6jNZFQ5XhpBWh0d4gdUUdCPzBfuEJVUGH5JxgRDUEmTDP4n1vls4RFkpSNlIaqN0XOVACAe1x7QnfjqSOJ9gx18x4IR+F6QQcP1AXdCegzV1Lv96MIilIutqSbzPwjs4VDHm5ZtpYiKx2qEv8+Dopq2TImVb2nd/gytPyNni9QFqVrndKARw2tszbn24qiRrrTl83qN8brCL/PVk+jkWXpoXGP78bGQsQ== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 48d081df-dc0b-46ed-0a3d-08d9a8964e20 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:16.3290 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 1sRJuEU3UlMJkpLGlnqOcXytDk/R3mrvGknCP/LA43ojym2XhQHHi4TiD9Z9WVp85y+M4RzntmYhLHpRo1UtwsuZyyevFXjhFc83Nnr8Zdk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4358 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 spamscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: x8qLlAD1AHl-JO-xonlvqtW0YqtQfWzi X-Proofpoint-ORIG-GUID: x8qLlAD1AHl-JO-xonlvqtW0YqtQfWzi Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The machine keyring is setup during init. No additional keys should be allowed to be added afterwards. Leave the permission as read only. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v2: Initial version v4: Unmodified from v2 v5: Rename to machine keyring v6: Add additional comment (suggested by Jarkko) v7: Unmodified from v6 --- security/integrity/digsig.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 8c315be8ad99..910fe29a5037 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -140,7 +140,13 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + + /* + * No additional keys shall be allowed to load into the machine + * keyring following init + */ + if (id != INTEGRITY_KEYRING_MACHINE) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction); From patchwork Tue Nov 16 00:15:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620847 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13904C43217 for ; Tue, 16 Nov 2021 00:19:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0011D614C8 for ; Tue, 16 Nov 2021 00:19:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348112AbhKPAW1 (ORCPT ); Mon, 15 Nov 2021 19:22:27 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:57876 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353536AbhKPATx (ORCPT ); Mon, 15 Nov 2021 19:19:53 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFN9cVw029754; Tue, 16 Nov 2021 00:16:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=60O6rnQkrlw0sUUcObFEFRo6UsPfAax+n5OYP2BTs4s=; b=RJJCtEpHFWiYyRu4VP7kQyMSjzaIklh8aPTePj2wLtVioIWZ5Um5JLNrDhsa5RiGEWwX QtTl+G5g5k9GcF6NeGwvV0L1q18nixXnSKTuf9jL8Ru7N101VTeUT47Nc3yk3O8uTxJL pBZAxcJvTyXysJmefoa3MNHASwDLr+JMmptHRWq+uxYASTge9Xsr12T5VTgD4OWWgq0i Sp/npDwWVVrY5a5OwHN2h9pFQ5okgfWYb8P7iZatwKIKUUwPX9Ferh5xY/Hb3E5JiZgZ Gzj8Ve+xhMBxIBh099CocxKBZxse3P4yMjt+cj0Th/j80EF7QhuTINNutBZCIWE0crYY 3A== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3p8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:22 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AMOx072901; Tue, 16 Nov 2021 00:16:21 GMT Received: from nam10-bn7-obe.outbound.protection.outlook.com (mail-bn7nam10lp2104.outbound.protection.outlook.com [104.47.70.104]) by aserp3030.oracle.com with ESMTP id 3ca3df6j1g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:21 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NNlT7XCdjbgq9MX223nraZkpfTjco8tGduyfJzm1bTKPeyYVcbnubW+xUWL0SJPRgiD+mvXwSLwPu5s1jFRBaLCrjRXPYk9fHMUd9/mmC1k9FFHlAiv1YjX2S5Pjx8IIp/blFYwRYrvaigSNDevzH7c3Djlua4/vDojwk0jSSBqSyoM4jBKS+zze0YaiFTMxgwtig7BYFbrKwodKOPqyNjk92eKeY7opWMLVkTXC40k8/cu9fYOdGOBXnvWU2ssF5DIl8iJxEMAGv2upqRzkzdpuL1e5QblG+TnALU77juHGHYuTSy/KQ53kZz2ziZBL/Iea9ObzBaCtJZzULR6kwg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=60O6rnQkrlw0sUUcObFEFRo6UsPfAax+n5OYP2BTs4s=; b=EIfDoV+Xkz4LxZdMsFPy76KF5Y48QmHcNeSz3hlKrSvQnPWh61ZB2Dca7vvm28dpa0IhiqQnr7VrqCuq/t3uo2PKdJIUiyY2qKokzEUGOxYtuRYk6m/y6uS1YKwSjDg6KtWIguIOp0VllRLqKwkzNWFkJNy3RQgoQY2H/20qR9l3jT8Y0ooMl22CcKdOV/R/GuUo3to3tcAtXiflYSJ69bHkiWjsn/hmxmhQo0fiYbY1C3nUh8+I5QZRXT7EF1Xu5n9JhiRhfsBPVeYCWCA/fSFLte4/Dr4QeHMCCEQoqQnAGnBoyLgVlCZhPS4clUYx8bqNTUyAbUaThqz7mxkXRw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=60O6rnQkrlw0sUUcObFEFRo6UsPfAax+n5OYP2BTs4s=; b=glW15V7XnmLvnziud0sZUfEdpzfdbCCRaJzcvC+uqiqmfm4pcR8CeUqzVdcIjWHz+zsfQFANJxxmsajawnx/+ap031wmvqQZZ9y+Pg0U7z1xt9NNRkVGccYnBgwd9L0Fzmxt6yogI8aFlCyxPAkaZEnIksw4OcjmANiIXNMrIxg= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH2PR10MB4358.namprd10.prod.outlook.com (2603:10b6:610:a8::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.15; Tue, 16 Nov 2021 00:16:19 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:19 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature Date: Mon, 15 Nov 2021 19:15:31 -0500 Message-Id: <20211116001545.2639333-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:16 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 84b92552-311c-404d-7fd5-08d9a8964fdb X-MS-TrafficTypeDiagnostic: CH2PR10MB4358: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2733; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: qd+ol6pC+wheqbb9Qir9OGgxQFa+4Ovq4/i5HLd7kYP7orFNNC8Nx5C1ocJWxkEoYDlquif57cFjUZUbx8aYJja/f7ehHqD4EUxAmuKrZ2aI3QucKczQ2D0QjKLnEwpQDQOFkSH0XGfRYpOslXtmI/vxOO1b/xTyA56i6wuODyAWbIgE2ECp+s72ejozMMkaX3T3XMBrbWGO1JEsppc4j3wNa4N9Mmqa7p+1n+YX/pnSjDnUdDAMFszK1rKnKMv2NqaRTr5v/WecXc3K5ykLpyuEJQFtWr5wsB+exlMdWuBLG/DnLiVswOUhjModbAH3QAL90O0+u5DxXUhFuSFyB6/hHyw5tTs3Ttoa+QH7R6sa1Lvj5wDK/VpsyiNQHR2e9wata1ffOoIfExjB8OiSAgcl3zPD8G+NoWZtzqM6gR/CqxYKE97JXoQq6KfPEwLy8fQ1Gnr/vIN1e4churqN+rIZOOB660fSKMBQ4FCgEaejHhGEt/H0q82dVfyPyUuOdBNii2+xDz0nMoG6TwbWz0Pp7B4ZVN7B3s1pGoqnZMvZtQPlPRERsYHGqvtBNpI+9ejI97IDR0eX5byd57+B+xdHQE1wiNIkVq6xM8CZI9x1Ut7MY70k4xBF2YLkhZSlibP5zJrDcDDDyD/Zayf1IWj0t6yM5jFJrVl8GxspSU1zbI+L1960bC+yhhglCwvuK3Nk0Lp34kIoNsN9EhjeLenDSx+v7D9LfQYXWs9dCRM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(38350700002)(186003)(86362001)(66556008)(38100700002)(8676002)(26005)(316002)(4326008)(8936002)(83380400001)(52116002)(508600001)(6486002)(7696005)(5660300002)(921005)(107886003)(1076003)(44832011)(6666004)(956004)(2616005)(36756003)(2906002)(66946007)(66476007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: EYId2ypom6+PrlTqtfVqvlfU0+exsRxk2N1g3EQXwdPop0FM/k1AQLDwetJZ+DkX0ohC6bbg7gi3h4+Ra4kEegIUbji9wKslJUpkKMuicTjzZ9HVZ+Bbks9IYpcE/m8/Ze3ty4vhABimY+IT7XlmrhlRS7uEYz7e5Z5nPyB/+FLL33AusV5hlEylLF7vd725dBDTCot99cps/Kg+xlkwIINp0B+CEH8fX+nTuaVzhkzVKcI3bZUYGhmA+sJLiLWeaI8ld17Ff6NU43RYovWSleFkMhLK//vBs3k5bgygDmsV4QprVmIn0YDSAlYs7QnHsZGL+kHNS81WsiYbdLfItP/qXAd18Ki/Fk/OGZ2B2klUAvxBhuGD/wIbL4VT654TfrUefverl4lQzItTTWa08QhZb8TvKCeTCufQl0Bb9MQtQn83HvkRdx8BzVGl/J+VeRNO4GdB6RTNhAJffxI3sFb//NNgNNpDloeZlJj/HnmBTZNRe9T1aPPUMXsQVPX1V1484O4TP+J6EMI/yTMZ99wNY4xgq+FSksScSwH04UNEzHbHdos5JVybp4QtkgwkLkqEjDL8RPCT6G8YjWKAknG5QMrjejFqLMaWc1qJmz3DlgRTJ+bxrtWgyhzQ8ej/1qbeoNaFlBzqtv5bsrFg4LI1OfpyDMC1aCb71h0U64GTWrUOckPWcoOHhIhIdDXCTUEZtC72lvM+nSX7UDxnHojW2HVlrUFandcj/Nnyi6s4i6Hl3tnxiHl+FRr7sinZdOiYSTnFzF3109MDSA/dxNjgVjlmJ4yWIuQCg6uRYd6rlRDuelkHr/AsRBJ6/ldu1u1i6CUkNd8UJXgqGsGhl59MpJ3WtkPBSJRwHt8o2VfxoPzKytV/bvCJo88qCpV9GJ+m/PQ3vw9puUEUAXD4TOfLJEqKZpS9BzEcYaMBG+kA4CzCevS/Q/+8kcARNEPLBEfErnGVMfniyGxguPSbq3hJdm3JFHxGBygZFIkQqvVTwUe5Zc4MN4SpYLVRo4cxB+UBs8Dr1EU5JiEEcyU8SVRMxRlrZhyBNZwx4RZG9pvwZ4CeZZdCaV2lGgFgQnmP1qnU2Dufx2hBFEsdKCGbQuD24XfXxGtEyXIAWFObv5vghw8LLbBUSDekQDSXktfVixl8mxUlRSga5uvhk9KxWsua0RfMF6Xj2LK4gmnOJHFzpT5Yh+IM/Cw//fRjZY93lx5PaNv0FquRQT6/45rZ79JkCGKEqYkddmsIV7vvJ4/pFUaCiX0wGEY3VnHz1Gy18Q3eT8OV6Ro56NKU05Bo+muT/6z2SBDW2GvooUwInwQeiYz0ya3dfjylXtEB8RogSTk6Jm/HlDSIXD4vEy0MXXR5kjOeuFGGPHNuKfPJZBSvFdjMrBXiz+hYza9pUJvaxE6U+Bft1HoZMbFru+dMAU2Zk+vwDgt8tV1Wpnbzs3iJh7kZTSRFjlUq/lbz/wzwAYpAqBdyHiZ2bFMYaqk+bTLwphzdvQ+4afpkKdTSQlRh80d5uyPErsX7U+ZFhP2mY6QVTUc3nb8ATugFYkvbTdfGz3DQZmB5m/fWJABc4UfS3BF4c1LhHTXu74nqI7ws87WClIaFX0H9IcvE717nl/fuwgR9/e7D9CIJI80N9fb4J/fcCkLCvb3uYX3z7xIPV+C6q36/qRJpf88ECYFbzg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 84b92552-311c-404d-7fd5-08d9a8964fdb X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:19.0829 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: HhZQFNpQyM6tZTP/670EJZTGT0upEy9zLPvC+IqSqzt3g0WaL7yAUfLBgfSP4tIjBSGT9fHGJnYjxUbIP6U1QIVKHugpWTPh0wb06NvotIE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4358 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 spamscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: fKrzdRgOC6FpbAt52txBX19_V_eR8QHd X-Proofpoint-GUID: fKrzdRgOC6FpbAt52txBX19_V_eR8QHd Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The kernel test robot reports undefined reference to public_key_verify_signature when CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined. Create a static version in this case and return -EINVAL. Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v7: Initial version --- include/crypto/public_key.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index f603325c0c30..a9b2e600b7cc 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -80,7 +80,16 @@ extern int create_signature(struct kernel_pkey_params *, const void *, void *); extern int verify_signature(const struct key *, const struct public_key_signature *); +#if IS_REACHABLE(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) int public_key_verify_signature(const struct public_key *pkey, const struct public_key_signature *sig); +#else +static inline +int public_key_verify_signature(const struct public_key *pkey, + const struct public_key_signature *sig) +{ + return -EINVAL; +} +#endif #endif /* _LINUX_PUBLIC_KEY_H */ From patchwork Tue Nov 16 00:15:32 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620815 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3C0AC43219 for ; Tue, 16 Nov 2021 00:19:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DD157619E3 for ; Tue, 16 Nov 2021 00:19:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242472AbhKPAWF (ORCPT ); Mon, 15 Nov 2021 19:22:05 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:58734 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353558AbhKPATy (ORCPT ); Mon, 15 Nov 2021 19:19:54 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNHFKB029766; Tue, 16 Nov 2021 00:16:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=r6jlFALx4QhkrsFTEgTPRs14tJPwa3/B8j4XEJAgbtk=; b=gvVWCfDBN15ofXQhew1VC3HVlI19M0krvqGhpFkHte5tiu9Vv5Qi2lKkxKgGmsm+77ov I4JcqgCJec1qNpSn6ODOwz1GTJlCvI4QERVm0cJyNVsCopRf7I4jnQ5km9XBeZG1N3yq UiAwD6x7C260k9u0Vx6p37HBNenmnExIZiOZ2QHdbhM0gng//VWGjsxl5ZEnkK2NdEYl 8LLJZiApoSOmgI2xkeP30za8TlFpqcYzjS4OmIVXrzIxHptco4NCwmMwjApvNzi9qNbX 6HM6BX3dRVyT3SlHHSPgvvqXhA/uLSvoI+/0sAWc8IXjdKS8RMwQVAhgTk/Ox7KkrmSM QQ== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3pm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:25 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B1JQ046349; Tue, 16 Nov 2021 00:16:24 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2170.outbound.protection.outlook.com [104.47.73.170]) by userp3020.oracle.com with ESMTP id 3caq4ru981-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:24 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=K6xvYTtAl84BDJr86ISEpLoPbcBkPJA8gnosrOayCPRQZiX396wBjH+W2V0TKiJecUS7FtuIqQIY1qezvx3q3iakaoZrQ4YSLtAuHOaKg9lwxtPgbwJMxtDzpUk3sms/11DZZ8OXC4nzWaL3xRsjBDToSGffwCPhUvZQpLTYYzhcszDVrb+g+UKA0VKC/y3c8hrwc1aMSsOUDJS57767oRF6YhmcaKwqwIM9UrvgPuD+9d034/+1PmNrXzUnSXNPHPtv9ohjSYTZJ7o6rOqAXaL0+jg6G6CbGUPqSL9vyFeeLA6pXhSPk4anFUCCX6ThLAfs2WWPzJCBJpil2GDWKg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=r6jlFALx4QhkrsFTEgTPRs14tJPwa3/B8j4XEJAgbtk=; b=O+TmjrqwJt0EW1fp/S/yLIQhkLmjXBR6j9r2fccqm57XoUCTpl2tt4biR5KY0/OkG42CVTmRHan5c5mKlMwlOu/38beQMT5GJa1acXDA4epbjCGDaClL9FloQEURYZguhANwA/NgcqlLXQdErBHGRWKwDF7wowg5yvZTDWxwWQu7DkkGf4caHtsjj0YU7TabtNnhS4PsXxjausGMp7MestZzFtV06+go/4dcZJZRx80WRzELqykMqYzlEMUhUqtE53T9GC3fa0K0EO6ZTtnCOkS/C87bfzglKNyMql/uF2QzR8IOv70y9YKp7eW+QLFVEx4fbsiNg6m2rUssY+KD2g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=r6jlFALx4QhkrsFTEgTPRs14tJPwa3/B8j4XEJAgbtk=; b=fgnF1AxRbkTf7IRyUTfzWNWtti4v3gOYcDduAaAyy6Jc4iE1iXjkmFivnpWM2qaUDqz6FVugPpOUQDX5uGmUcoQPtRrgsffsaw5qm4fMR/MjUZ1gbgq7a+c0z7f6VbouHw1mbZ4zhsQzu7+dr6K36ct1Y3FJguKcRf7lQnjvcwA= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:22 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:21 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 04/17] X.509: Parse Basic Constraints for CA Date: Mon, 15 Nov 2021 19:15:32 -0500 Message-Id: <20211116001545.2639333-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:19 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b1c58018-814f-4df1-7292-08d9a8965176 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5797; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: GxDaA+B9ADRVDxxlWatpFXf7lFbcoyLMnCjSLXFLx5/Kfgbaz8juMtj8QC82EYQu6tMLgRZw2mZlmRNZSfn6rCwf1k09P69MAwfSkJSWa+B6K2lJdZusMGKxp4Hltb1/PuZHNKXhNFJ/qnlrKQLjLYtYQWh7sxV6lLuoxaAONscctncB9OqZGDEb9pDEkNhNr6frLq41m1tLG8T5R9bfuo7l9uqzXcNicW7oUvP44MXg0MZ4xKPCeVR56rvqlJ/6NTURSBFwScn50OZ3hVxrWEu1GYPL68H/JS4CsLYCkoRqztd8qPhg9r0VQMoyp4TcUBqVYxdxnxxpJu7hkT45TziPdRxnQ8xt/Hrq6CcaMbzqSejbZXeJrI2RqZdBs5Nk9sOl/7B/em5LlUXob+NegUg+pxFEKJQ9NJ0bF2u5gJ3ec/GFVSy+981Lv/TiaTVuG4IP28GkHYfJ4ND9bRo+QHwxv8WSoD3ot7rTdQxiYN8HLXFUzvb+jzQjHryPXvpZr/uJa17CtummS6XBAUc2MEfIjq2TsAj2B50Xaj21TTSMVb5MoYh9fd2fgS7soe9HNb6GDgtALPPLkA0pgch+QRmkdvTqndGJnv1Kwzcf7K8f1i5n6pC9+FesjGPsTizbLFbso7N1MsJSntuJlQREZ3SrBJ5+2KnpT0xFmfMpcYYsp/1k0ecvDzmZS5PmM5WpvNSvC7M6tF0Ru/gSLvUKyFVMPq1jkoRBpHDhThF1uWc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: KC7C6i0VSRAnK3yQpP+pcA6L1dGJnc9LfunLIYMLpE2J+PDfbzhRD91RnUgE83BAZhPPEABpHSOdn+bsgerIev+GW250dSGzkqxElUl7IbnYw2kAvXfgNDmG9nJI3OQRTzUZQAZIH9XqiSMHNOtNiG9yorsholirQoky9tASWTzFbyxFhjsv4rQbGIGOpzCkm4PO9j6msOve5sguWHzCqGSZCwnI8I052+O/UifEC+NFhqn3BDoQIjuzOAoze45ALUMNBVSHTzWrsiVyTZXP5o/uDuGF51rKgV9o51sU/8BhbEL35Zwgy+qW2D0aZ6FA8YOjQrRr936Xp18rb13mAB5QvinqY5ZhPCzOgrIdR7MWWReX0AdGtVrkwiNvvLYA4HP3FQhkZsAjk8LJPSDVy7BlKIatX3nBnN6irm5EhfMvbzVHC6Ct/4qtI7PxNCBddJTAJlTVJO4Vk9B2bk960USg+dGB4IvlOQSMbX0DdV3CJZh3jvPvnwI7LXCqwZsU4KBkRhQo766Mv080Jjtw4qzbFWsvQesYFfF/AYCMrwlr4zC3N5w/TneX52jgJuIguKfWZ6JjBlgdiRUTbkdZlGuDyAm9/LjRNB/QJXbO+qzAcORdne6/foytAgdOJoJytGwuj63gbVOsj0/ymcyiSMXmlPtPkZgKgr2YyuNqztkxhTPH9YHgm5+YM7lzWaAKSb8d4R53A4NfxX/6JMCOi1nGt+ZD3bXqiqiXyLT6eJmDIzvvWxFIh2Yr8ZLSpmIRgfz+xiymDMXAl2QBkl4WFVs8Bb+xQSDSoEM2XQvy5ZmPPsNSwH+gCLA4q3+LH94u8F/OxO5iH1b/vv8f8nhzdiXGQGKOgQCivzQKc9qOyVoZLMwucatU/F2HDZq6Vy7WxeXNG9bqiasn3vB3I9dvghA1sLi0VYJi1fdSTFCw3fhxT6tsnqLVmsLdkpuytzGxwk2sYdOz9AeFBJyatUd4AwwVDfExFEBb7V7Tgw3r8wIPJ5ByUKpFvyVG6C4bpcr4FawASUcqmJbX4C2hGBcnUe363rrIFXdnXAlbe+xnLP40tMAsMFFzJCgDdHk2TJaRpGa7ppAC3UWDtmAjQ1rvxxBlq1uLL+Q92jj7v6k3cCU2wL2FjU8kmnOiX1Q86EteRQlJ1OGfeiwS3a550S9sNMDUQd3yZVHk/rWZJZVPVeD+iVP6vAp0DwwbVnQyycxanPPABBukteWHf273GgVBnaKaEkmxP6NU22XzPZNfdIaykZvsGujX2HLna9mDIs71jauoTnP1GgHIltAVf9wjBYsKc7zVYluDq0f4F3RDppd2t+tnV2NGerbZZzSpA87EHblBaPTToE9B6l3d1x+pNTrzzkWesEE8vKggWUAz3Aj5kp8dFQAvZOKTqMxAsav/M4YDUhfoULIdY2GKu0IbVNRJJ6fYKTeNwx0Rz3/KbWABiHW91ppJqCk/YfiMlL4lxJS7Ahmky+yLxhJOJuziVhLUu1QxXo/tzELwq7ufiuYnF14FVo/z8EApO4VaXwv1630OlGAEludJ0nPcrFGWidkFHVrOsgjMhaZw+YnqRnJ2I31qq83t7hsoYcbxUhk1cYJ8O6/WQ63+e7ihhy4sLLC8tAZocfUKbHmJMfwHcEaTnDTlvAUgeC8gNLtv+fMLFZWM0XB/9x1+e13O5VVJuw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: b1c58018-814f-4df1-7292-08d9a8965176 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:21.7382 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: l4X7KaHW/Q97KceZpGeJVS9r5AwsjwsA/gndnbsdCz8YIP29boR7Wtg5BnMfr+MBNZ6FVFyBRgLBradNyzhBSDWIsTW2zdGwgUD6oE61C6M= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: wD_EilYT-t42tzV921DGM39TcuOdGA2o X-Proofpoint-GUID: wD_EilYT-t42tzV921DGM39TcuOdGA2o Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Parse the X.509 Basic Constraints. The basic constraints extension identifies whether the subject of the certificate is a CA. BasicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLenConstraint INTEGER (0..MAX) OPTIONAL } If the CA is true, store it in a new public_key field call key_is_ca. This will be used in a follow on patch that requires knowing if the public key is a CA. Signed-off-by: Eric Snowberg --- v7: Initial version --- crypto/asymmetric_keys/x509_cert_parser.c | 9 +++++++++ include/crypto/public_key.h | 1 + 2 files changed, 10 insertions(+) diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c index 6d003096b5bc..f4299b8a4926 100644 --- a/crypto/asymmetric_keys/x509_cert_parser.c +++ b/crypto/asymmetric_keys/x509_cert_parser.c @@ -571,6 +571,15 @@ int x509_process_extension(void *context, size_t hdrlen, return 0; } + if (ctx->last_oid == OID_basicConstraints) { + if (v[0] != (ASN1_CONS_BIT | ASN1_SEQ)) + return -EBADMSG; + if (v[1] != vlen - 2) + return -EBADMSG; + if (v[1] != 0 && v[2] == ASN1_BOOL && v[3] == 1) + ctx->cert->pub->key_is_ca = true; + } + return 0; } diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index a9b2e600b7cc..61c66be80995 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -28,6 +28,7 @@ struct public_key { bool key_is_private; const char *id_type; const char *pkey_algo; + bool key_is_ca; }; extern void public_key_free(struct public_key *key); From patchwork Tue Nov 16 00:15:33 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620813 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 832CDC4332F for ; Tue, 16 Nov 2021 00:19:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7184B614C8 for ; Tue, 16 Nov 2021 00:19:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347334AbhKPAWE (ORCPT ); Mon, 15 Nov 2021 19:22:04 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:56148 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353441AbhKPATx (ORCPT ); Mon, 15 Nov 2021 19:19:53 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNNR8h007673; Tue, 16 Nov 2021 00:16:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=ZGxaux3O2h/UxHDxxRko9/8hYIcYj2uByWULJeccau8=; b=VKtnBwsetRNWK2k0+wb8ACHMaLFxTrqw5zOf0VY0gfMtCNJE2+7cjkU6vgnxGOgjgRzq EWbgFpsixVEI97vHLB883dbWnywhnfJD3eEUfWFirukiy0juAiVBWD/n3rkM/6z++if0 ZN57ZbWficKxvtVq/uYMH/YqU0udKyr9O1Y/OsBSE1+uKijLhdI4NK8F64Y+0Hs3emwM KfQnLe6X6mOJLunYt3lMlyiuTbDm1gnMx+oMuZS2TyIxDrX5kyfmrk6oUKqxvku5yjWn TewM47hQ0yJax51I7gjJO37NZq4sToW4np/gBDt9iOH2tGX0X09UfNsJF0hCPp+l+VON /g== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv5618t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:28 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B0Za046215; Tue, 16 Nov 2021 00:16:27 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2174.outbound.protection.outlook.com [104.47.73.174]) by userp3020.oracle.com with ESMTP id 3caq4ru99e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:27 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hP1r6FAfTPMULYfWCUFNL2TVV08vy4kQ49K6OsttmEszAS/axqpmutE5AypKBiU6p5YWBRs+f60moXxmMU8FO5djehlZ5jBQrU5nMPAof+kw6AxP29CWA4lNEaW62jHPkKxRnKcmNwqwDNPmmgYNuXyIwA8utNiL/2q7rAbi5RBxJgmODniSYww6gSBolXAQ+ck6t/FGdnyqx80kz2M1acXejGPSXnw4Nb2FO0CkNZocVEW31rdHhrDVBYt9AEhLH7FP1AAAgoOSufoz3kyipsabRzCRr8wltO0iuceubWpa0K7h3V4Bt3aF4FoJV/Yu0K1pdCAifh8yVA9LIu8fcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZGxaux3O2h/UxHDxxRko9/8hYIcYj2uByWULJeccau8=; b=Yut9clokJcZElBtsuE/sDDzICyZ0ywU5c3GZlA7CQuPPAi1Av1A7mPT+6iK4PMm1wLfiA3gJQP4imjL5HPs73EgA5X20qIe7fbcrQTuJH3MuStLywvvZuGwH+Dq5IG9Ctf+RRuU0D6HksTScjVejcaTPgUBtOD/dxbjXTkf60AslwCrWPSM8Dj0reEYRbt80CDDWxrH30NYnIG5tGXEBc79+UqAeUjS8MrZ4vuZR2uKw6/258Bn091tN3l4d5pBjCdDUonWSrgCKYSDjXF6ighEY2exjCT40mh/PfRhSs3+aWZlbUxFS0QgFVfu2mE2VZxmv7BTYafCuhF4sERm8jw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZGxaux3O2h/UxHDxxRko9/8hYIcYj2uByWULJeccau8=; b=ajmb4aGNWNWsElo98e6hkGBsx0o9RBgESYCzMWrlKSQ7UmcR1RlxGBVxtm20/gr7P4LqBMed2Ab0Cv+kcq0HzfULPVoMTWn3QhTGNrXzHpuPM8SAC6wgWanh2jY+D0aZoeBM5/eK9qw/5VZCPwWuP/GXpuI06KbTW30jcTusams= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:25 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:25 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 05/17] KEYS: CA link restriction Date: Mon, 15 Nov 2021 19:15:33 -0500 Message-Id: <20211116001545.2639333-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:21 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: ee514baf-4fb3-42e8-5d4a-08d9a896533e X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:10000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: bMMXPqd9W/fhDGukWsjRsO2lmkW5wDyaRBlkPDhEbzbURpeq9BBdE9LuPPQ1gPp6Tr4ACMsSeFAr0ZatkJL/Cvsu04lcCA8Gs5w4cvRpXAeVCWf1720Lthc/h59R6zNWO9mOoHLw6Wg8lncOKJ9A+1qu71OX59q7zUwfH7LFTpXoO1gbKRaG/AeKqt9VTblOwjYqXQ0dxhZ4v25QKVbdQ/eqANeQfdUKRw4IVfsgvBStEANd9k3JWzNTJMKK8/CrvuleaBLC6gDS1F2mwsm13VhWFqy6rSE/fTsayvZXq1koA1pZlP/5zOqxvx5x/1l0ldjW0PKABMBkkz0YmiRP/DThl6e5wO0yiqPkfkvCmS2zF4fAYa/dLeAfNCqnBW91CUeKzvIET4wIp6w/VlAm2HI0LQ0V/k/2vpetufK7A7g/UCoMnoGOjM95K7QIJT7EnKShfn/O5RcolAtayOh31l/TwDo2DTlMfbCvhdlnd8cb+8l9/+Grf+hW2Rw57ytGkXzRK06LAnbr93TCPprz+5ZET9A4JEbwUzlT97BIeiE91N1zorpfI+zN63Hvx4TIfzq3gKB8sO8jUFncmrGsB7Rh1S1ZvnJLDAqzBSQB8EY0U5bqgXhRbGXg+fF340LB1QBTgYrPpNPeqM8XFZKftSxTcGSeg1nGg8bXqPMKCtM9z3YTjB4001rwJzpCZRMj1ob4B6JPtkDReVw4k13fGQxoU7uEVw531q1Iyzc7URQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: OsfTyvmBcxWXgNuZ+aYYrE7aI+geRfXJ5GopTEjmxpz6eu+vUrcSSYwZ+NCUYHkFKPt0gPo4Nl1NYF6n4B6IxYGzaqivpHo+unEaR6R3zHb5tYg2vtdryVWtAxwtWi4HIrnmo5UrcDBLoxlvzZ/5SN9AMzMORT8nfnWTgnAu56LyH4Vo0/wpl3ZXw1BeoJaJNR82Hs5iVYd8Z7xPDgoFltLzFNvOIASNxSjrOHBBFtMx4y8BHe9lri0eFuEcjDwFCGASQPB3vfDsmb+9qE4EVIb9ATvZqY4NhUeUqHzky6nQFYOX5rDZKQSlRMxR9rFb4Mx87qAdtwZKkwldV2SP/6ZSKizUzkOskgZ6VuTcL22OscXobjnpce9YjoLcR6XnqkRQhy4YRANGu1LCAqacAgR8E8CDqTn0wybENuEGFfoO9EfL53czErspGPjuyUDg+Qd91f5AZauycPOCUSkV97Fbr2H7uygLoYdniwKt+Wc5AaT8JPOtGtEALgUn/vn1OLUDyRdgP/LRU4B4TMeO/QYICvi+TcipoHgVAiCg92W8nZo8YEt8LZIvQVrZNNFkGwCagdmGrZM1tE7ZG9Rv4A0I8jpAlNrhsd/5btIiLO+nrpOmY8QAXqc60u7rpyrTDj3JnKTfAie3w/1HSvcmJS6LciJleetbvaEl5vG7ZKNmPOGK4TCC/VhYwUz0MzaB3yRKGpANAxw4m580ERgWyrSk6JeVFuvLOT887dIIkC/HPGtNFDwwxbgFpNPGwjQKsZJ7dA/iA3IRgHL8w1bf/OJdx5NCuFjFXRNKWYq4+RTzYPwGrWXAOF5v66TTg1V/yxiOviOvjU5toTj1k92x1t8MJseek1LoCyucsMMEBauekNvSMNzXl1nxAKqGeBPxT3HoYvDMzAuIKw8SvdZd6s1Bc87WDJdZnjqlN94So4dxSRyTbAhbaIp7SJO6j8Q0cJ6W7tz+LMlg1BGoGudr5QPY9HFdQRDi8DAtW5pYPuWCoYdl2juieJ4qebSiMkFBRajSwupVW6+/Mggic2BOMjI+142efdiNEqhgXzYlBoEnb1WBieHkZE0+CyipvdMis6yIest4HZDD13fVn9sGNZtJD39rm/uQE6ESTA4fA8gRxTAWZPsyvGQe+W8syPyQyDcjHTEhRi0onpkmcFV35gzTien6BGjHuWbulRoKm0PTOQlo9dwfx8jqCyl/dnNEfL22b+5vyCk4mpmc4ZmRMQBFpoGJYibzKXvies8I4GgxshPmVbPUn4PC6aJ3j38fRa3cEMqHh1zWdq2l+7pX78OpaqsUp4qR5S6PpMEWdEyBQdL+XQbscjqDc07wVvaJuIb5wIxkkcyiagEj447HMyZxTcX5xaqVWMjQx5oJpcr3UKj9HhqQH8eywbXJP9reiCwsffdkI8BLyxXIR+z5elEPKqZMxveHxXB32XUOaKVyPRGqaHFak4QRIB3NgskKAbh+i2AF9rALrRt167uGqcJ9RY4EG+wFCvK+Dh0klO7mymmZ87dr5dQKj3AD2uuIZ05HtzjvvK0gl7KsXknyXW+oWfUqTGD7GYHmWVzoaNC2bA+ljFIMDis47P1o4a1B8Y7RtSmye4ByTglPG4extSA64fOu0Xjtnsx/QMKz/hVeoJcPwDTZlj1LtdPvTdZS+pwtC8LGoCFcmXmGs2dl6g== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: ee514baf-4fb3-42e8-5d4a-08d9a896533e X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:24.8327 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: GKw5eTNujBLQpPq0/pc4X4XK1gUsdoSRXnbJbQHM0iV3pSnlUzObt8ltSnnzjL3LDptIYkgkVhkmiqG2HR6xmABWXLdybsmRj9EeIPfBrBw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: EcQ6973E1rIge62BLoJYw7ZPQD83W54i X-Proofpoint-GUID: EcQ6973E1rIge62BLoJYw7ZPQD83W54i Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Add a new link restriction. Restrict the addition of keys in a keyring based on the key to be added being a CA. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed secondary keyring references v3: Removed restrict_link_by_system_trusted_or_ca Simplify restrict_link_by_ca - only see if the key is a CA Did not add __init in front of restrict_link_by_ca in case restriction could be resued in the future v6: Unmodified from v3 v7: Check for CA restruction in public key --- crypto/asymmetric_keys/restrict.c | 43 +++++++++++++++++++++++++++++++ include/crypto/public_key.h | 5 ++++ 2 files changed, 48 insertions(+) diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c index 84cefe3b3585..a891c598a2aa 100644 --- a/crypto/asymmetric_keys/restrict.c +++ b/crypto/asymmetric_keys/restrict.c @@ -108,6 +108,49 @@ int restrict_link_by_signature(struct key *dest_keyring, return ret; } +/** + * restrict_link_by_ca - Restrict additions to a ring of CA keys + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @trust_keyring: Unused. + * + * Check if the new certificate is a CA. If it is a CA, then mark the new + * certificate as being ok to link. + * + * Returns 0 if the new certificate was accepted, -ENOKEY if the + * certificate is not a CA. -ENOPKG if the signature uses unsupported + * crypto, or some other error if there is a matching certificate but + * the signature check cannot be performed. + */ +int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring) +{ + const struct public_key_signature *sig; + const struct public_key *pkey; + + if (type != &key_type_asymmetric) + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; + if (!sig) + return -ENOPKG; + + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + + pkey = payload->data[asym_crypto]; + if (!pkey) + return -ENOPKG; + + if (!pkey->key_is_ca) + return -ENOKEY; + + return public_key_verify_signature(pkey, sig); +} + static bool match_either_id(const struct asymmetric_key_ids *pair, const struct asymmetric_key_id *single) { diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h index 61c66be80995..1e4fff6b7820 100644 --- a/include/crypto/public_key.h +++ b/include/crypto/public_key.h @@ -72,6 +72,11 @@ extern int restrict_link_by_key_or_keyring_chain(struct key *trust_keyring, const union key_payload *payload, struct key *trusted); +extern int restrict_link_by_ca(struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *trust_keyring); + extern int query_asymmetric_key(const struct kernel_pkey_params *, struct kernel_pkey_query *); From patchwork Tue Nov 16 00:15:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620821 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF391C28D15 for ; Tue, 16 Nov 2021 00:19:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DCE2761A3A for ; Tue, 16 Nov 2021 00:19:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346963AbhKPAWL (ORCPT ); Mon, 15 Nov 2021 19:22:11 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:54540 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347963AbhKPAUB (ORCPT ); Mon, 15 Nov 2021 19:20:01 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNXeJS013778; Tue, 16 Nov 2021 00:16:32 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=ZK9b/FSbm04oyCavKF6mYnKOuXnw+pCxppnHqU+VGLY=; b=rGFV8Daj8sqW0ANfo0gEM9TJtefSK2XqC7CLSa5qGo9P6h5bG5Tl5Xqgf4YhP9L/NeHt Fxk2tkViU3DMwk6v52S7hd1t83hCpzI+F0VGVFURhW2q9LwjMQvhwMdq5bqNGcUeEvl1 MXJWdsk9m6gevNMsKwuQ5zC80BUkfAqPFVRn9WLmPjidNDgEGwrb/SlM+oFySlyeXTwZ JQ7DzfomgevK/HwzrXMsJGUKO8GRfytZEXIuOVvIARcr30lgeTH9MXEZ6MvBOJuU3KI+ N/qCoH2lahlV6/MdQyw0xNEYmflp5nwTBUciWDnM8EpuvrunPq0vf3q8c1qSt3803TdI lA== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbfjxpbef-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:31 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B0XH046194; Tue, 16 Nov 2021 00:16:30 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2171.outbound.protection.outlook.com [104.47.73.171]) by userp3020.oracle.com with ESMTP id 3caq4ru9ar-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:30 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FCTcbTftM20JgUw3zQpT29lGh+6wBgqlmOyRIN+LQuL3zpGUGwu+WyXyZLv4fWnRZy5xys8fd/7EWbGFpWVqbzBESsBdRj9krQd//A2eXNM5SbFeCMqfWgW2g42b0DINFrwJlHGYr5i7N6Iwo1jBdcLhG+OT0LhZJBnQL8nZkjQRcaDITzdbzrKXhRUGpV42YYzOUOlDZg+TgKPZvr6ZBMF5GUKVgdfkVzX2C2JaS+vGyoJy9o2a4ZICOjPuJm1ZoM3+9xFw6kpT6tyD2ypuVxMEIl0kt1hJx24ZJrZXY6IMwBS25BSGAboln75RG2Aw2SygDZm8VS+e83RYxOg97A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZK9b/FSbm04oyCavKF6mYnKOuXnw+pCxppnHqU+VGLY=; b=eVzjc/iXOLHHDD0J0gKJiaKmG3QBNKMnRc0s97VrctEpEnReznOkpp+3ICIy0FFGv0Wudn5h2Q4NEMEsoLpLVFceTHxTj18jB174KIArUyKtIjpQhiM+bUllShAFx8iBWx/jRP5xBhRjZwsLOez9HSCjiAyKFnkSVEMjWS9oZ2eVdf5zN9sGo8hgoIA+TcGw0IYfZgDsDoqTtyHU8WdBfeoGmYWsHkCMoWmV31okNL0mXo55iD0BoNuQTV5mwQtHES+5UXvqYsJNLAmfBG/R/AohvRnW9o3a8y8hzq0UvwBGh/tF9gTjxK3g3INbYCpSsi3n0Z56F0Cz1p6T5PuzqQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZK9b/FSbm04oyCavKF6mYnKOuXnw+pCxppnHqU+VGLY=; b=WXxhY8qgcC7XkYPCDNmh4DN0LW/76/1JqPySjAxNBDFYJADXLTnV01eitxSd1H7AvrIlba4zBgjcOE8mF9pSbhmLELJ2mKU4djoat9zhrHLVSD+FgqOYUdriAfJy/H1XLnTEksIpV/FIHemx07elfDkTsJNBY+UhxP0nN+paygM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:27 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:27 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 06/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Date: Mon, 15 Nov 2021 19:15:34 -0500 Message-Id: <20211116001545.2639333-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:25 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 048d7d6b-27b6-4240-43b2-08d9a89654e9 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4502; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: TFWQNFgz1d/vNMXA79J/OjCXEAvbkPNSLP4hdE2yYSW8/8abSiGVb/03pI7g8jfHWGlytIXHPXk35KazcQyTMhKTRZG7y2oHQ2mcY21stlmz75a8EX0nKHHpVZiutl7yuTrgr3abp65TtI98qid0tqW/iptAZtOPcm/eb4JLFz8/eCb87AyjD4XFrY8cK9H4C4rhaP2kfJlqVX7qH3/4LLvyI5l9dSFN75JJ+lJxv51pNr5U+Ngn5Zv5WsgVf7tBBXG+JmSWMStvtUqLGsFICu8POrJtbJzWhbIp7Eikasaqiku3npxqXijRxlIU5Dx5zrIx4YVrhw7bQzUaOuAwWqcNP2BGxuRwydWhViRGswk96osqBMJdviPCW35KuIe2LYPkLlVCOOBr7LOVdTb2dX0D1a3Yha0oAxevOVtHqMI7h+wDktxeoanseB1KkSK71G0/VDIoSbdq9yOwbVmbnA+hVlj6PBVBKN+plTOKTa1DXglfL3Pc5kitaRoWMrYWLjj5wvfChb1bmEjW5JkcQJPFbwATe4K877mc0Nk2CEsl2o6owkX1jMFBA2Y6wBuku8txEnlZprLI1cIXPylAljyogl6IeYoHCuTW115ZBIy1x4O1dLCDofDiF4tQcsMozIvWcx9mZJEZAfV/cYeqBoqNQEasuwoshcBH3kGmMxPvMmzFNcMthLX/svS44NYnUdAgBkJAE6BXb6bCUF0bPZgPl/XHrk4hlMHxwQVRKPQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: GSqzdgQvNyaGxm2cK1JMM5os5gbw9MO3ySgriem+T0QEuq5+5UVL7V+LOYA61/wOHFOhbIA6LJi9dps9Ay0bH02luV5r+tQ87rWQ9EHrcVLVhfgS9L9xoVVWG7MscSiNOPQi+y+5D8BEePZiV0wH9XY6umL6uO37cBB8gBpgPsrCaz13G30LICyvkQLq9pRyjDUi2uyjRku1RFaLkYYPRQayk5XGW4AzYpJ71xDsE1EcdKwK/MscMUQD+WToPNFSvKiuALavvGMGUz7V+6CUcC1V4YV4a6yR99Vo7OYEe9MysBSpHs2Ti0V1laXIl/TYxFFzHZyLPdSjeBQ0W6mobgaYKHI19WTsnJNv81yDsxrnpKhMuK7IxIAwjojvFZUPUqzMUY8U3K8pOqs8en+TLhdsbGJk0vAMCTm115GcrF/n0eSzHMkSPRHEoJhn4H9KUKuvZZyutiZHORzmdonuAQqMBBkDVnmFxVQwM6MW6kjSer5aqor7qKjBsSbKBfc0Oh87kToSx+ytESGFB6LM/DmoMXXE4s/fPQBNJkmw1A3SYsgyuoz77yGjNhjXp7jUZkL/fUQ1w8YE+niYRA8qfOgZV4Dh7KZiVwdUAtmWYZfglDX3KnJt6c3jEvxVCwcvjtVUimJvJYkuTrBeuuELcW+9yhAQnW9sMhpYmjX0IJeE7Ij1OiybxnJ4MClDn0McOB0OsnbsAz8ChSASUzTTGuyUi/yAe/TRs+sPGKA5d7tfpKdMbDe5+Ex+DqnHQe5ibyRdElTmaVC+tUg0kRQh3b1G9PpHylyrtJprC4UhNGqjA+l0m3tL/B4ktAz68ulV8Zx8onWnqmoIXPLNxLHn27Ou93hiIH+HcwGLm90gVPTFrPNkTaCuZsHjja9fnF9m3F6iNTxy55X/GQAbilmX+/MMvXNZke4oOqyDYIYw4bIodonBieBgqJr7BrxJFaIY5OSVbU04j+BqnFY+s4El/U/Jn2H1ntTkOsMosHIcUNJUYRakzpeVH23j0pydJ39SeiZ2siV5JeoKAgTHhMmiYzmao83ByBw0N0uEkLtAa0lP+5TGpohq2038vCYjLBSo0mrbylD/mrSbcg2mSXKjfg6XeGBMevu0M52z90BcDtkDHMrGpDGzxDHGWoXox3AOQJonHnOy7VjPk1wqsICRBiVmufOwO+ksi5FwY2LyBiNwiorZXWIgOAu0jd7exgq0yHxIWqw+qFTsiJXAzVpma+ijyd8FZ68M9Msdapr+ebQMJNbVL2qHInr1eG+pDYbv3A77ENUEwGBj0bXTwE9SEtk3nPwERjIOXUsz37gXMq42yATm1WhklSl85q0bXbpkRvvmGurQY89XwS2ebQsihZzeUTfTh+qvO7niCHtum+dedX3aJCqtHD3bcLLzmCaChNqb/BnEh15Bok0MZqiJ5o2MY9Ggxv/QqzZNE/DXbTQ0Dr14J0gKLnS2/rJxbsbR4LO/CirowzOwR7Qog9IEAGuIRFJhq8Pk6t6mh31dtyluvEm/LfBYdEX36yU8VTs4XcFrZZ+i9UiQF3Hyv+bDWX5j3vxI77GRvfVZbCrUw+BZUQzvnQLstfwZX/mnyV7b4io8Q2u0a6+xx0cNssZArWFdb+fC3kp1Dwmf5mwUgwb7TbOqPOvQ9zgcCDx+StZgFwHCf/f1pkHAi8Tcsfq5yg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 048d7d6b-27b6-4240-43b2-08d9a89654e9 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:27.6304 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: v5Q2bRnoWpHDtEvKyZp8pDia7TpZSMIg9FrMxZF9+SC+FAOfqA6LCd9xQcZ1SrNno+SAZgDeZTCLn1Tj3USxCXwIwocze08p8KgXpRhF4aE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: IUIAz4gGrj5yIyfnK-YsNQ_5y2REHYT0 X-Proofpoint-GUID: IUIAz4gGrj5yIyfnK-YsNQ_5y2REHYT0 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to restrict_link_by_ca. This will only allow CA keys into the machine keyring. Signed-off-by: Eric Snowberg Reported-by: kernel test robot --- v1: Initial version v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok keyring gets created even when it isn't enabled v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca v4: removed unnecessary restriction->check set v5: Rename to machine keyring v6: split line over 80 char (suggested by Mimi) v7: Unmodified from v6 --- security/integrity/digsig.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 910fe29a5037..e7dfc55a7c55 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id) goto out; } - if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING)) + if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) && + id != INTEGRITY_KEYRING_MACHINE) return 0; restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL); if (!restriction) return -ENOMEM; - restriction->check = restrict_link_to_ima; + if (id == INTEGRITY_KEYRING_MACHINE) + restriction->check = restrict_link_by_ca; + else + restriction->check = restrict_link_to_ima; /* * No additional keys shall be allowed to load into the machine From patchwork Tue Nov 16 00:15:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620827 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECB90C4321E for ; Tue, 16 Nov 2021 00:19:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D4022614C8 for ; Tue, 16 Nov 2021 00:19:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344031AbhKPAWN (ORCPT ); Mon, 15 Nov 2021 19:22:13 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:54662 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351676AbhKPAUB (ORCPT ); Mon, 15 Nov 2021 19:20:01 -0500 Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNIfKo009064; Tue, 16 Nov 2021 00:16:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=P6HRZJmVz2XtBtaggcCQYwe9zcoLCReB3FUgmsAhduE=; b=UoixeSISNUuhxJ8FXpQ2K38WCsw/0QgvKrf2QPqluSn7rSZh46s1otE6UcJvOI/Ii2lQ Z9PMLhQwORj/jR7YyuEl34KCvkjiR/SFYwW0LCEzCmkMZKCbljOr9LAD1Q2oQBoAqYZk K+ZP6FqjjSpUNhrO71wFhKJ7Z7/pmN1mTJa13alDpAvhmMqiIk1IWJ3FFJN3pRLWW0HW 7SLexx0KV1SVpWRbNqdZ89kqmC1A2bR7saJKi+R1/zYdd9qWIGLm7NNDN4WECwnvQoWc JhnwWBj0lRK/td8rtrz5yyKoGLz1lvgniX3shIIeATyqjV/iMuPGWVusikHZ0eyvk4Ud Gw== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv7xb3e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:34 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AxXY046155; Tue, 16 Nov 2021 00:16:32 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2171.outbound.protection.outlook.com [104.47.73.171]) by userp3020.oracle.com with ESMTP id 3caq4ru9c4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:32 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=h+LnAJ3Yg/qW7RHB/Wmf3+AbkjDRMyst5SdwRLx1dLKcIfKpvpyhpEfrx4Q3qdDzIU0Q3OBTNYVcgObEtXvQPnwmi8BVQD7yStXqDHG369rIVHCJxvQp3mY9UwYJiuzZMKSSYUHzagX2iE/pZIqrI6etdEpXBJ6BXRKy3xHDxqJ1fcqgGwX8GAFRfFw//pCmgzoQASrRyTcVMrSuZwR4mipueHBTQyLA+tG25V02DHovEhJAlMJ9yr/oAvmBM3TWgutb8wu1Q+KbsuK84uwx2VHvuOffa4dZxyD7iFvP90K8hx5v313lgMGu+X3wfyeR6xfl9ucj8bC6OO8PSRa7yA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=P6HRZJmVz2XtBtaggcCQYwe9zcoLCReB3FUgmsAhduE=; b=iXeDbkD+Z71x/oXNyFUPCJ0gdsfMZA3e73bLYI0eLDfOZCoTwk8os0PUHMHxbbglt8ctnTxOsf81lugKYJU7/XaiqVgwV4+ebQaLbXNz/byq05P156l/XxnI5IXSW9s5+XZIK9vfg8+SYnIFigSVutLVTxuOe8kmBCvLcKZ0ybKM2ioMELtKH5kMwO29bui7oHfNTr4xlQLJN4CQrM/dcl5GH1ykIsSzsKw4y1zPWq8hNgXQJ0ZmkimmZD1Co380pyjxDoQpUH4IrNmdwcfHBk5u4izAh825LEUoNudd5Z+K4ZEYUiTm329xDrp01NNj5kRF0DxYvjetzmokWtWwqw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=P6HRZJmVz2XtBtaggcCQYwe9zcoLCReB3FUgmsAhduE=; b=gi6amRPkQcUOvywZ8/f7lVzUaTRRX4QTaeEagjSNyg/ll3G7y8WmBzadLKxhJ1ZAKv6pKp6Ikj8uXP/XqFmYVCFutChjtvt5+5uflhdtlH70UwuZSi88/Qc5yEIZoHiscSUeCEpcYC7f2R5jyc86Z735gRsXch3etZ/E8jzdusM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:30 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:30 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 07/17] integrity: Fix warning about missing prototypes Date: Mon, 15 Nov 2021 19:15:35 -0500 Message-Id: <20211116001545.2639333-8-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:27 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: de5a1494-57e6-4c71-8e7f-08d9a8965693 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:104; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: CQ1SNUHGvGh0u8yMq92VHoRO0k0dyuHw0XCWbBQavoPNoHOyZUjToIS/Mxxm8A/ueVWVo9wJ7qWm/7RUDetpUTbzpqV9lSTp2PrHMuZd8sXh+4iuaoh+CbExdnN9VUzOZq8okSGHDjjGaB0q49Q8L36t+FPjyU1qgROR0Q1m/Mei3klNl9UgfGjr3XfbJi7gsSutygBIHDXBF93yZNANBKzeNbKUyLC7Rf2JKhAqLvTyNqcegpgGKB5zZ8XqWWIy0wXgCSdbL2cDh6Xm6c+H+/kxDJ62IcjwqPzjIb8jVbO1r+bkzTJLEqtJRYZmno3msmsK2VJZVd2vMU7tOW9EH/8xlkqXHlDXRjHNNMmBPEfHtbvdXaIxFd1zVjx6TwmROyaR1wztkaPZs1ZVK9w8Sik+0TxkG3aVC0gpkFUHdcSbjQZkPXq39BmP/iwb3hvw4raV7CWqzSzz3e5Pszf63K9cw9ZP9ZgNuW34vCPYSe9vs6BAKG36jJWzMczQwUC+uclLCADTH+deFsnYjqYYRqaPvCUZtQAu40KFXEHgRxYrBTEv7ijR89RaLC8MfBv9+Kex79tdbCaGmHr8U7get7UOph4r1aFmJa2HfHoX5ypAF+i/oPQWPIDlbp02SOfyuOIXI0Pm9GcmOg5/xRPZ1UJsuZjRXFzTJKNuFd8w5HGgwKAXeOXWJXLJF1WKwNJQZ/NMar/JkeOrAYr81O1yUFKEbJN4sNg2pOOT4PSDucA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Rd0Utxx7FmGCvEB+7HyB+hNZS9RMR83hWkFJBqFhb3y0By3W/ViavU1NlQA+RV8upa+QW68/bUooR9erk4BJZRICZF19c1sjopis9U6gWFQtWtWNLi8ekRnGXq09h06cl5eYSH4UNB/adI5z+sI73GFzKe15VbWkLU3r3mmRpoOJgsOEHN10T4YGbNgyz+uXZ2Ku8fi6z3CTuPF1ePOERatBlk0ny+dPN8nw8OgyCMo0ilg5qPd41CzjucnpcP9IsDze7gN22d8o//T2AQqwxjKofEC2kQC1PszGud+V+fXmzsI4/pVd4CVVFh0VbM7Af/Ur/nin8OxO/+r1ou1ESObwKY1R0D/Pj5nqOMxo/cVwyjdczm62ddzPOkIAHKfpDWjjzzbC+Bp99jubkIg5mDw4s8iZM1+Nmn51Iemz6AklC5dpdFsUcwnseLmqPhQ+YriZOWGNnYBMYF/pIi1FBmAT3xt0gOBuRmcWffQPFoyJwSmSfbR96Xjhqv2SrL+O/japG/lI3J75mNSPSEaj0tzwFTlQp18Ec8b1QPiB3Fn3hi8cKP2S2clk4U0SXnwHmbxD/Hw4TtlrMaKQWRVJGQ5QMaxrNQrjeVvth9eJt8/6VP72RiptUW7GU9CT2Er2T2QfcmhpLtNdWbZNT0+BcfxeLYkdj3XCoH3Op7QvMRrFzrezr+Kwjv9NZHMb+snC/1XeBuHhYCKlmTZMFd2PKAGWESQ3LwhBONXOKDk3AWSvI84eY5f9N6cliZNOKeA4kLcup2Hcf/JGATaNO1TMuMrMLJfBc6Y3Jm3XkBT9XwReW3zZY3yPkl2sddimN+XciRQPKHTtjPSokAKtiP7xZAyLheT/CwZBUqnS8exC0lv8k4OxKnT8dWVdZb1wF2D4taaXHxAHPsNRJmA5IfDbc6n3CG6aa11p6VUA37lprG9Q0oMOqLqElxO5JpaHB9Q0DBGDUHFui+VmiXJrqPV2++7dIB7y/40BkWRFpifHWOhQVysA7eBDIdyvXzOrz98YP2gX2ZHbVF2xps0iHN1xQvA0TCLbMJraxzWY73w2sycJXUMSsWvdBChwKIsMT3kvJCeVoLNQoRd1mtsxk1jGpTceMQJh+g9zC9b1I+4W8Rq/0gd8S/Wygb+ZOCuqo3etbtMs+IK44fHhrWexqOnM9rzNeJew/2X+xrU+cHnaqNu1eW2o8XCR1Zl8lmlfZILCvOBrvUvr2VFL6yl9q8d2M0MA5CbAJEgQ8NdJom0EUoT/HDAdSWj+Z/L9Lvm6iJwP2t2pW83uoGfGUnSpigcNuUHAF7PSehB0Cv6pDyvcaa+1k+bBxrSNz6g8//kaxpZutqpzu6n/JTG/g2TsX3UR5VGr/I4QsEztAkkSbEr/a4oopU9Rj5IzqgcWUwgo7vY+EmsIsD+aJDdwbquiiE1m+JhJ9820z5VKcX8YsYenJK0COXGF9P+FywUvQzLx0njeM+7L8WQl99ZKs47QT1Z5wiDhiSKjXZBxan7l9UVmgpiKVcQii/4H6yEpmCzyuwz9nvmFN2E/Mflh1/Iigo59Euk48ZaLWK8acGqmHgekIwZLnystXNr3/0hPs2bNRXmIprKXkYQhYCT3QwApaie2N0mXMUgielQG4mjw4H/OePWiH2GMYa/Lk1ApwUdyuSvazqcbZ1FluEKz4qn+3ppuOA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: de5a1494-57e6-4c71-8e7f-08d9a8965693 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:30.3744 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: q9UsvDJPoXnVnjb2m/LsSSqXlMRW/pDQY3z/V5ktROeHDzHUioT6WKoedyHiu80VK1wfVpsEv/EwXJVqlwfx1fZSlC/XevHuHJDm5jO+F6M= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: DL-y-yc_duGGT_-9F4J_sBscxdWXugOt X-Proofpoint-ORIG-GUID: DL-y-yc_duGGT_-9F4J_sBscxdWXugOt Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org make W=1 generates the following warning in keyring_handler.c security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~ security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~~ Add the missing prototypes by including keyring_handler.h. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v7: Initial version --- security/integrity/platform_certs/keyring_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..e9791be98fd9 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -9,6 +9,7 @@ #include #include #include "../integrity.h" +#include "keyring_handler.h" static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; static efi_guid_t efi_cert_x509_sha256_guid __initdata = From patchwork Tue Nov 16 00:15:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A5D3C28CF4 for ; Tue, 16 Nov 2021 00:19:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 619FF611C7 for ; Tue, 16 Nov 2021 00:19:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241250AbhKPAW0 (ORCPT ); Mon, 15 Nov 2021 19:22:26 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:62122 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236400AbhKPAT4 (ORCPT ); Mon, 15 Nov 2021 19:19:56 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNPK5g001710; Tue, 16 Nov 2021 00:16:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=Zbs+nv7qDOFsSHUeKjH51kBTLYFB9i5N+yzVK77AZlM=; b=fOidVO+/s+eodNM4TLTDaOK3RL7YKq7e9fLCWOFeJSD4ncHJXx2iWn9Da61NYeA7bImK bnHneZjbLg+OEdM5/LK4mBJD78BzPkz6fIcmXrr+LzcaWyzbkMBbfAJoCwVHkc2zggsb ytJJZtbbFswwkNRGrY9+Zw4Jpu6BLeyO2i4pT8PtJoJ3leI5Kz/p9DkoPGXu5zMQC0JE js7AgAEPgTwyYQ2/QN/fBOzzLtnAxfx5NCjkhinF9mQyc9RVzms/DU5+nF9y5tNIz/8C 6hpNSHzo/uT2qxUAJkXkL94g0eJkauJfyxPvwMd+GXKnRQLvLuPNhjoq2J2DkXHTf8+L 5g== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbh3dww7n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:37 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AAOv136124; Tue, 16 Nov 2021 00:16:35 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2169.outbound.protection.outlook.com [104.47.73.169]) by userp3030.oracle.com with ESMTP id 3ca2fvcgmq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:35 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oFEBc6Kg9EPKNusqHcyrW6W4Vd9ACgRwGUuZZ3+VAniXmBSQg7pNxRJEcdAmdpWBeJRaWwFp7N+bLuu33LILJYErh5ThzE2einBIuZ9EFntnUjww6lrzxc63xEBVF4hDIzv0IZbbE4oCeA5uzH/nyrVLbRt6UMR53/0WUqYJvp9ZGaqFa9y89oqWFG8kts+WiRZuXMEzZHRPkwVbTiga5UtHwNtMnEp6B8pfNDTC8KnEiHNHxJcTS9bjvkfhZGC3nlfk5zI/9cVItDwgEt5k7k62BHXQqJYUXhUsLw5ymDU4cY3G3cQBKDVLa2FlV7VguREENC2GfNJsDoE+qVdN/g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Zbs+nv7qDOFsSHUeKjH51kBTLYFB9i5N+yzVK77AZlM=; b=maJkjfAZtPfOhy1+F5X58N/6+BgE254mk8wFwBnU9cWJIV60QPD2aUGVe/bpZNrTWKOGVjWsiwZ7dRCV65WU8VfCxbDWGkrkNVX+sXm9/o0WbIuYkEAofFoLvHi9LsdwoChz5TYwWEd7gW9c+/fMbw+6zFgdKrgcYi/Gax6Fn/nKq6d26rioPHjNk/slCWQ7K5vsXxka5AcrZyyLxhXkDSfrD40lgY2/Vpmvlayzw+dbrfipfV2jqOcOhbvsSkntd9rGPG4VxW3SQ9xL3ukll9vhiB7N7BjRK6xcV1X+hqVRnCn4UrbytD6EQr8EwJAIewE0jPdGt3ripf389PR3YA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Zbs+nv7qDOFsSHUeKjH51kBTLYFB9i5N+yzVK77AZlM=; b=mAiiBjL71QzkkChtXzPQzz95u5RGRqo9vgHChsSng7Ob5F3xyBsYdZl3nXyLPXqmy9w4LzJRxcwMVLZbhz7LlMHuINeHA3tjgmGaVuR4wmSFZ5RpbZr+1mpZnjnyUPnPPRMFPEwnQN+2Njhp+pBdU9a1Ttgrz2MTszzCbaeQ2U8= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:33 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:33 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 08/17] integrity: add new keyring handler for mok keys Date: Mon, 15 Nov 2021 19:15:36 -0500 Message-Id: <20211116001545.2639333-9-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:30 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: e0a77727-23a9-4805-2d76-08d9a896583c X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: /IzgfYp24+zeUKoer8vSgcygIt8c6V+G5wyDjBf1k1LL0An+6CM6TQ1e0FJlA8d4WCw5VNhTi8ultqYYEOD2ISdoY6T+sleetQzIbYw0i+mjwZc+54e6ImwQfL62Bio9Dfw5h7kKkZu99bxiQUa9jARBgsEm7xy8zg9ZoVtYfMWUtPds1GxiTQ/J7wUaxJJcgH6a/cl+AMVJ4HUYwXHTawqzaZC81khWGAm/S4SieNJl6rSq9eY2iX6/wyOCl5MCCqhvUN/zdDxEVhCwrqu1Px4UQcoIYC8H2Clwg4lmwnSa9tgj4YB5fWZ30tanuDwnbkGPUQ65yQggzcuskJ1Mwc/1kUzOI6m0Xpy42Cw/nv0c4kkmSahdSXmbldR+uF4sFdnaTMI9Kf6OHTMNAtNsTjYxHq7SDqhnYqpbjm7Es/iSXdn0wFwO0E94QWZtUYIsjpHHf9NT4TRsq5Gib6a72E+0Z+HxXzCveYTJ9GUtq0ZVxpFC25YVh75Rnh4W1rV/gYEcEdB35+B9rxw7svgPqcdErjFedwAFb6+N1PxqWQ7GeiKqKrG+6vdVXUgfdNNL73rbU412mmwm0MhCbvrptD/ZKdLeWvYbn8g+65HyPtmb2VTyiPDHRjM/OMhdC0xjVnHudCGZ23sU6omJoV9dFWLW+j9WO9T6inqe/PW0cFnb57AOqVzUyWBBSEoIC9XpA6O4WKdxbDVV2xUSGvRl5fArKrS0aYZizWmvBlLYkDY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: v3uTK+XEPuCt7S18Z4utnHUENAZy5VMijkBGhzyGiVwiFqbBto6s6iT7dkSyWCqe4isP5SwoGFRyUmFxHHdsKp9wZn8qnxiHh0/fW2Linb59dczbF5WOcwmv5tDv0lIzi4DcgG+9APBQ+mZJF0foYA8+7fAsqvyK4Q7lRlu8dn4c2YoTz7UdKrfjvlLb5pbNaci6bz+PtPIDQdhIzqXfG4wODlcZ7SMDMHmNEhFCJka2uhVhs/kxw4O6ZqLNBIzkvTXCib0uTQMByRNRFenLOTvRB2qj8ny+alfF1aj+55TzvyMnGV3ex6EPm4ZEiSw7Kksrp4wPkQ/QtqX1y20rDCdyEB0k34ZU6/vFmPfetk74RuIm24UO1dIJ5iZLDSI8U6emqyQuTR+5BemfLxLr8z0D1Z6qkqxOQIt8BpyqvrSRV765FXn6A+1ysdYajHR+mi8GQh4k0K5/xsu8bNR0lhn5PIbOBoPCIcOehvoonZp3Q0SGAxX7SeauvWQZh5Kp0b8+qpDm+UBVHGWEt9M8/J8JyGAxP8wfXQ74S/62WGU293colsmbIFdlRiH85BilnDTP8DEQa7rVb+Qgu6FF35tcyiWuFiDnqRx/9x8UqHfJPUa6MV1aPFgTKA6cVL47C79I7v9gz4q5EsL/7pvY9eivlaaSC9364wm3UnFOtn9PveoBPauoaFgjyiml1ZVG6G8sMbAt2Lo1jjWo/wQLXeWS9vcnIvpqCV8H7xvgzTW5xsj3vYvtOQvWnJ/6hEb9rRlXuU2yHOvst5b3PZu+UX6+z09BZZBTEBZwkqlnhVGMomIkksNUEcaHDZgOQOMg6QK6tRK7RJ/u+6U4X901fPWjpSX9+8gVaP1KZ13J9Vr1+HyhDZ08TM+dGfeeT1VxnnOuevWzSDcUMMj9XHHHL4e5pCONZr5y7c30pMmZ+ZjY3AD2nvTvALKSgeurPCC5UjwUDC8TwDtGrPJ8y6Q/l0ccOcR90F4oiYJOvZgLCCXSg08r+saH8F5c0++0zzlQXH35QhECxlZcUyjI8y+uVee0vSRz+MOYRwwejx55DeRGMhBxDRWhI1iPw1/i2DHP0rHHfOh8DH5AsFQ+D7oUtwRwEc12QCOHjh8eE77b5SuiO63JelpSEV6HrKhQH3XrlBB9b1fsXwzpKiVxjGS+kTQLP79XZrXV/g8f0hMQwPrJmFnAA98xtCkfkzSVcNFcrO3Z42INzvYAkXV3rx+ei0fIU0zokuI2cnfDJeGZDjyN9LHPpIUu+9Zb5uw/jaakTGru/iTsnOslNvSaJjv4nMja1dDEWMgxpEergBRQncCiMosPeZcPLUDz8Fsuqpl91xfnhWXKkC3cGbeeVtj4qHl1rwdksHQs3uesnbzQqwS7UHn/mYShZ33FY0cwsWor+/gwlKTodrHUWE00PHBkE0HqXi0xCksSR0Wsy+nWo7NBOmBlwyiE+ESTNEA1MfLRCcUFOUTIz2FyZQ0vZbaVorua8AImyWTXEBencNPjh1ESMOaapTA8rZhKhG+i1ETKq7XNnGsuiSuHUVdZ1tEN7TpoByO6H+9nhce98WDOwyL3rYMQ3eSv0ZpVq8DpncUmmM/j9gk/XOQsi+Rd2djn8RewC0sMpQBAtokzP+OFaTtwDR1CuYKbhmzXr8RKi93FZndDR+bp5w0AIYA+Rlwvtg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: e0a77727-23a9-4805-2d76-08d9a896583c X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:33.0556 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hx6zNvXlvCbaYHttQv7BWdVyd4qJCEucwwllC6yBIUHb+fB+JdFhGdFUlxj0psA/gQuc90fjerV1wSOz/ZXUcIRLI7wG+S7LBrixHC04NOA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: 8KO65oPvbHQPjPI5OicIuXU15Ezvv-bc X-Proofpoint-ORIG-GUID: 8KO65oPvbHQPjPI5OicIuXU15Ezvv-bc Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v7: Unmodified from v5 --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index e9791be98fd9..4872850d081f 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -67,7 +67,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -76,6 +76,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index f290f78c3f30..c1bfd1cd7cc3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -94,7 +94,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -109,7 +109,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc); From patchwork Tue Nov 16 00:15:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E4E0C4167B for ; Tue, 16 Nov 2021 00:19:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 536C4611C7 for ; Tue, 16 Nov 2021 00:19:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347932AbhKPAWY (ORCPT ); Mon, 15 Nov 2021 19:22:24 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:63642 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245206AbhKPAT5 (ORCPT ); Mon, 15 Nov 2021 19:19:57 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNPK5j001710; Tue, 16 Nov 2021 00:16:40 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=WKr+L3SiHiLLrIGBrmdwA95NgNMVutskYKzwxhu1iUQ=; b=hU3qLNoAgzX6TuWMIZHr+P/nZm+FzYJyCfCNRyfCXuMuROqeOJClOZYMBpUPlOuQf5Fi Xo0TJejMSHzDF3aDx1GGbUaEXo5o2tcJpdvSzWojF9ZHCOm5zSjFEKEVB10pVvyTQCE0 jYX67ezbagXeLemhdp6qyK2ISVZp0Hwjnf6Vgvy9RUpf+EecckxW4ff09vbh1W4wuqzW e2Qy8CaMZEsdfkjR7AofFeG0651urVhGXGXwEitLiKU2Ae0kR0iSFqCLj7zv79ioCDWY iyXREY/ijTT8dkj1fFO7b1KGjIbxLUpuEuaFsTbKooJN5fYbGfLsQ/PYDDtjPXqzEhmY fA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbh3dww7v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:40 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0ABPV136170; Tue, 16 Nov 2021 00:16:38 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2172.outbound.protection.outlook.com [104.47.73.172]) by userp3030.oracle.com with ESMTP id 3ca2fvcgnt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:38 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jdV6ABhZbL75rFMUglfrtnYRbhjZc9vVgXbfyTkpACs2/KNLsBsfh0kMCrXwKC3i0lf4Sa4o8m0P6ixTHxDyG1bNIzvbVj+ttkeaHKaH3Nzxsn1B3cNjnZeXVcTWNK4h8E8RKQK5FWcNfdkkxcNk7IWP0xOrGG+cSomi86vSRY/n6j2ALY6woDscZK3NEwJvxE0M+COIQlwi4vkE8JN9aQRlUftnvi3ocjduTdl6t+H79ict/P9/zBa9hkiftPXvb2votSrn4g4TQCSl5fqXslCqP6Qeg3ZmkjqoPsUebgdr6TiSoMoNPFFgcNjzz8lKNahvWfoOabGbSfbmsAa3gA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WKr+L3SiHiLLrIGBrmdwA95NgNMVutskYKzwxhu1iUQ=; b=aU6krOf5jWFTPbMiuoZYIHT8bswMBI3bkARWfiDz7KjANDV8DCbXazt7tGQUIJ/uzHpCkyP+dr2rjc8cvP+RnyJfJpo9U2k7rEuWTltwdbJM8UIuYgXZwTVC/iJ74IIQ9tWqXeFVvtOKCinsxAEGbNQe42L7XMR3910kTKCUwbgBHt8XhB2W/93VvKX8qszmww3wruuYXq3z4zzVRqmYf48NhId2uxxpOgRi42rNjl8aN096Sf4GtPMfBV55IxZurLT/2+xOKzNH/T3cf5haX791C8dn56C2SyYvuEiPuH5EfjC9lhUFugytstvKEk+N04ITMfbF2Cg4n51TEc+NRg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WKr+L3SiHiLLrIGBrmdwA95NgNMVutskYKzwxhu1iUQ=; b=JMx715oEwE/2EQdVUot0R0XRU+V9CpvZUlg2p3HdD1/zmREnaDyJ6/rBaYy6skvqXFKrlKOUg82/XKbgFPGKkYKBluSuIAHU/tBJa/LRHsjS9MtSqDD3KQHSEXZb0l7zcNvs1dWOyfMKEdq8g3Riid1JNOLOryK37UfgM9IHTm4= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:35 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:35 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 09/17] KEYS: Rename get_builtin_and_secondary_restriction Date: Mon, 15 Nov 2021 19:15:37 -0500 Message-Id: <20211116001545.2639333-10-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:33 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: f2876c05-0526-4e0b-8b03-08d9a89659d4 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2657; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Gj9sjxWSSdm1U5lmmzJ2CQDePaUAkpHyjx5QEqBiB3Pex8T/ilZIBU/EVv2CQ8xX0tEFuZIGvZsDIyKeqoueix+B6bBlM//+P93zh21OEAH6InWTWwTMZl65FxdiPiX4jS9Yc6oOuqSSF5ZDUGg3Mng3u/Tcknp6I/Z+mXs8FLP33EblEmAggJXoB0EfM0tZ0L5iEp2zxaNq9dc549zUDRHnVd1x2NaSTZr+bFCi+lg98KZwHo2TAEDvueq+hEdUxPI7Di/e/n9k3ovZpbyB70YSqZne5niirl1HT6alNukc+iQuzn9yFA8icoJUYZ4j5bATmYjZIIp6onbpcTEeuN1SiABp1fCJwgTNJauzzSkJ8+w8yuqBxOEYscnBPdw3Cv+CW9d9zPEjwGotEVujL0KI2Ha8NAi+0uaShslMz0sSAG2BBaWyqKHvL2DLih+gD+1FLfn7vqLGUvshGNT/SD2kIvJUyOKziKceamM7bLA5tBPecn8DFf/68I1Is0iiO9vGRIGIxnUhf5bF50v4fOqLVBYZE16+xHTUmTvE8opfYtUNq0X6q2EKPgFogVLyyG4dXa1kNM2M0h/F36oo7333UXF6JntJV056W3utadVERWpL6MuudG8ulQ3kc44ynYzWDx7PNfKrhWVZw6HeEIK5m4dLhgaP3t0t/avXbUkqjxmUBhotwxDCjy/goDD3NhdbstcgcWr8+vtaERTmMVU/9+QQYYE0IYslN7mKv5E= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: khKLEIA3KrCh2LyGmeT9kL932nOqSlp/mGm0TEtkUrSkYR1tSiEDvK9dWNiYDLeZ4O1j5NfJXn0ckcK+cu65E1AKRw8suQJ4NfYJArDzNEuQqT7Mak5VqSyAq5HoEpxzEskG0p0VCZEdBudodoToCLhZ514LjqntobqY54jm2e6AR5jEXy9VupRL2oKGw4GYbseo8ScX0hXhjUmJPhMSmhYUfie9Azh9odVaRHxvjsbZ5Br1Bge6iOSUOwHnKo4ger5ruD8wH3+q6+IVEEldkfZguEo5An/l8QkEGZpsrwOhqXkxxi+g2pBmLzBbERaN2POZGYGa7q36KrnnHVB2UV+2KxmvuXW+vg7kYxiArElWeGZ+F6gWdavUUx6xnmw2vi/wa5m8EOJKEwSfO4ZTft//HqD+Ruiox+n4cgnTMFVJS2bwFS+2dozOff2VslGLWKRfdr0gclUaJHrWyFll1sx9hz+JfkaUadVV3avn3c7mjYisKYy59PpWQ+01WPsj0rAOCZMBskgda9WYyN4xQFpAeurScggU+VK+w1EPzbyItXBFKx8mbHhAcXbl5Mho9V6FdDpfi4Hj6IwzArM9EW1Q2rf/AlB8eq9lEPanBMbbjM6zI0eZKVb8xBXcfZGS7eONysTwQ4jUR0cWhM5mbKS2U0VPlysmQbvPCpY7k/hyFe/I0YgqeV2mrH0KZnZHlqNG6TiNEi5UBclKDmRmO75JVCgjlYMHr2lw/DsNtXfzUGWyY1rXUVRNDTHLArNekHnWcmTZIecMQ7nju7nGCraZ6ZFmq4vOH2C84P+kZKymkRO7ktD/fySmK9LGWZKhuHux1fyGLJQ2L9IiqqFXkIJyxfLVyDCI+IrYYDTPmABbWAvYFOqTcJpjCHCospkDoOc7q1Ix0iTmF6a6CFNK4Sh1mWdiB5agfgdNc4c59kZY8AU8LM2+a0ZtR7yT7J8d7804D3kliFvJm/jyE2l22bZq2zmfbasCmLtseTFhrpliMQBlq2QdBKQtHIbo14UMoLzoxFjzu0jiDBQQJliyLonseWoEujFjg1zdDV6QATsE+E1SEsp8AXTuc+sMnzp6V12MEvhPf53jrhaKufgpOnucXXqQ1pa3FcxKhyC4uGiZLvGdvwQQLnWs7/LElOLLciPaqLqp0eC5eAbzrWKLNdQPCqXSojCVVjkCU2sAh0qlDCCusyN/xfNwJvtQmTMMYAH79KN/Itfibo2Z/nxdkuWzBKIhiLhwmaT3Ayo2adkAte4ZxI1q+iQUYyx8wNWJeu8dhaIH8uGz2tN6oMUj8JrJQhSU09K3Ckq7pd9hE5gxRYBzrDM6eHSjH47cX3zwS7DdktznhIDkqbzlbf+U/FBjpUgX0FfX4+m4XvrHruvAPc7fms31ri3+UptFyxmdvREqaE39RSiXfbp5Ss4Wm6fH1NgH5Fn591PzTbM0/8Hu5usunnJ9CELE9ebKBAXdRwJWtU9MncljqLAH2Cnm3qIdrxwF28TREKrmt+3aVEMCdcDV23Xn2Lax5ibDoSH2uCOs6QvngC92oC43L3YQeK5aVCDDsaEsUibueeDY1lVC32/I6Qq6+j5L2jRYx75ph4a/oQUY9jy+NjghcVRT7r8l9kpiGR7sykDc4LfYQRJqFPMlSGniLNQT+OYEKKuP+rfW0Du21+fsUSQmQ4yXdw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: f2876c05-0526-4e0b-8b03-08d9a89659d4 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:35.7856 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: YezBITHUXYRv7WtUu+7ozJbW3a650lBuardSHI5ivTgjH0lH70yfR1hdOwuajg9XzT/s9MWmPS+MmRc4mrxvSc4yDs+O3vLNUw3/VXX53+g= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: -GqJGGjQYdYiNMLIBKbsOndNyVEdkuGg X-Proofpoint-ORIG-GUID: -GqJGGjQYdYiNMLIBKbsOndNyVEdkuGg Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org To improve clarity, rename get_builtin_and_secondary_restriction to get_secondary_restriction. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v6: Initial version v7: Unmodified from v7 --- certs/system_keyring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 692365dee2bd..8f1f87579819 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -77,7 +77,7 @@ int restrict_link_by_builtin_and_secondary_trusted( * Allocate a struct key_restriction for the "builtin and secondary trust" * keyring. Only for use in system_trusted_keyring_init(). */ -static __init struct key_restriction *get_builtin_and_secondary_restriction(void) +static __init struct key_restriction *get_secondary_restriction(void) { struct key_restriction *restriction; @@ -117,7 +117,7 @@ static __init int system_trusted_keyring_init(void) KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH | KEY_USR_WRITE), KEY_ALLOC_NOT_IN_QUOTA, - get_builtin_and_secondary_restriction(), + get_secondary_restriction(), NULL); if (IS_ERR(secondary_trusted_keys)) panic("Can't allocate secondary trusted keyring\n"); From patchwork Tue Nov 16 00:15:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620837 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82887C433FE for ; Tue, 16 Nov 2021 00:19:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 64B93614C8 for ; Tue, 16 Nov 2021 00:19:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242840AbhKPAWT (ORCPT ); Mon, 15 Nov 2021 19:22:19 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:65476 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352142AbhKPAT7 (ORCPT ); Mon, 15 Nov 2021 19:19:59 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNITT0029761; Tue, 16 Nov 2021 00:16:42 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=HYVB/EkkAgybGxUM/55xpHO2D86RkkBq9cobL+8bo14=; b=YoNNSQlFs83Qx4BgLc2787wXK5/nZh3GAfdUd+VlGZgNRIqLi7DQnQ8Gn35TyAnXCFmM mamCVFNjfSSXfKQxAkMZUub4gb2eLW1lPg47XIOhEHf1Nq9CH9eU85gAqzv5HSRQZtJx XjZ8+8tDBUkM57agrgoxduKj1jR6B61bLZiBgZHc+y6qlXvTcbQP4VB49PeoxTDNJ1Dw v4QN1zC7RFcdyPQAmg2PFhi769N2FNNdGhAAZ/fM/qY/8WLJEB6NzYbUGT7SCs7WcCMC HoUnO/3Zg/qBeafJ5hVVP+nyqYv4d20BoXrJIshTYki/buX3I2XfTR6OI+ygLCU6eaz8 Tw== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3qw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:42 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B0uH046198; Tue, 16 Nov 2021 00:16:41 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2168.outbound.protection.outlook.com [104.47.73.168]) by userp3020.oracle.com with ESMTP id 3caq4ru9gw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:40 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ONcHstwjrGZwSiEw/wdCsPLVefsNtsq4CT4+alVhWtBfOuHAI3T40IcNVvYoR8StOrPFja2XrWQBZRpWu33C7d9/3oT+rhnFPivyPzMQip2kjkkmtxsmTEoLVBF2qHHjK73TqeIT3q24e+YW/RgzIRTcCBPusKujQuJPJ8cv+oyutE31JG7lB9uPi6Zwf+l8p+jQOYkPICtNlXCpuXR0QrattaZFU4/AdJS4iQ6cTsvt/wAVzC8SCY4OkF74kSRcVLCuBdxUV711hhWHDvHDwAudqviOUit7IST4tdzvctHJqnP7SihjrI/gl2tfyKCxP787VaXJL4pcSFSMlModiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HYVB/EkkAgybGxUM/55xpHO2D86RkkBq9cobL+8bo14=; b=IrihphKWIt/eOJoCa5isvJcuwaMXNNaSCM95cDYPyxoqmcaEtG62EYgYwcim8jAr59Jx8/qY8iCHNxaOHqt84mOMUagNXYgVJY0+uBofhrmCrfHNbhbkMStLgHNxRr5IaXsAvd687o0cvz5u/VLFP8qP7zXmL1hNg9W7rSVvm/ZpiqD7Ty8nTPQg6GgZfG/Kmcm8e6ONgBKMdBGphVbPHl0IF2QHAcvaMcEP+OAsMsYZtq0mqTk4hK/wMG3wMQZLt2Qi4jP3v56ST5DRMMUpkwwXp8uuSNIma+Nl36P4SYCZDJZjO/4gLu1sfWGhnzoUs0nzSfI0q0OHq+xQcv440w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HYVB/EkkAgybGxUM/55xpHO2D86RkkBq9cobL+8bo14=; b=laFw6l7v+PofEpfBBOWjd5NPntayu8PwJa5qnfoHLavLm18ctvm7kjazRxOxiK0OYXlzEsJMoWhMcyIYWThbDO6hWQ9Ha64uVkcQmF3m13GHIcqKKdyz/190w85IWkYi4viFwpHlLRkdjlEF5A8U73rCXKEfdqGFB8RrhROz7IA= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:38 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:38 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 10/17] KEYS: add a reference to machine keyring Date: Mon, 15 Nov 2021 19:15:38 -0500 Message-Id: <20211116001545.2639333-11-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:35 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: de3fdd3b-f61a-4871-a12e-08d9a8965b6a X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: h1FOSC0P2ulYATH70bEIVQbCfQsR2qQViZvpsEn1V04QWbML2uPJUjwkjaa+dxXKTCizj29qcKYKATh8kSPbD/YNaHXWPA6s4CBL1t5/I4Mjv+NwFzba+q9ZMuMnk3QqeOk6BzCR012Gy4GbX6UZTl/A3OrHYpVyQ5Dr24Ki2mhgukAWl9QwdHUJJXLcsy0MgcNpzm5EWGH2+qLi2t9Jpz4WHK1agUlfbmW9Wbha35eUdaOfFqY1wWTd4qgywyjK6Sd3mRWKeidphSLXrPbBng8ERP0zb1yLpoTpVe73lOYS8vrRs1D1JCKBlXoRJHQhk832qpLD4wSPrmhkC/TO6uvmNbB/6qOAQtVB4526lZ/D4PAHfopafL8ldtpk+Lvt88FQfZxCP9F196O2HdVWbQIS/NVIJXq9tU4G/e6PonObVDxad51f6hp6Tk0SdxWUrNPiItkSG15P479XTrUx9dlunSiw5JHwcIK8UIxmYCf5XBhWClizO9XakfyxRpO0e9kceODf5w4G9aE8AD/WU5AAC72tuAEuPajXUtQq8/dB7Dq7CFvAYQqgeH6NBgLfKGU+2R0YDkP9dCMYgvoqm0J/v1ajF2YWBcLuzfTu45Eoj1mzejw9DwkITId7fee2ce7nMZXONjC0zU+QwoI5MxlrL49jCu/od8OP2oIP7aA0RthL5Wg/Wb3p7Q+sPEu1ceRUxwZe9A//Gnqm0/Ul1ByYLZoqCJBg89k943S6+AQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: QCqvUn0uR9K0b2Fl4jIf3HViwCuRC7vnMXZH2w7iwB+SewNaIHgXn+DBM0JtlNH/8iPZMAHxfui8/zIAZb0xCuemu58ufgNYL8CoSnD9SsgQAPJUzi8Ys8NeqaGo2D7up05GkvQTT9ZxVglhcUfEsDRwFnIGQo6fphCxPiYUUP+23z23TQgObCJ9LgBK1QLBVdFOAxlCem6ts/NssgH0KMiqvXW6XDQZmbf2a7Q2qbPVzzo64ij+ywqvtIuJahTfCdIr/umv00DiRAO+SFXqdg2AewnqHkmiG/5LPlAk612oeUT4BGrjqkeolsVfR2t5x+vHOq7m+L4rWSU93lwcpJWjmNbi0CqVal5DQgHsIEdr6J/piKQEmBA/vYZscC6fvzeRYavBGcRCK+B72MiLkKDH8O6VbkPeYMAf8o2D06WdDXOhvAYpoG12sCS1VnW42vGhuTD7PJS0Q81RlO1pYTQ9SE/DF93yjs6VZO+2GOn2JikG4Qsw3wNFlPpO8ew6nuY0Dn2n8cP3yCWjdTc9yF7U3Z+rZZ/dFstPBrj2T4Ym4aQ3JqybxQODfPbPnWVCbFgNPmIxe9yVtqcroVPnmoeF2X+seRAkNAVVC5fgndNnjyxBm1MCXZ2m9gCSTxdHveAhvFeXcxQh+K758hDVYcrJpU6D4+8cIquMCqogsNUtkacAPCk04cS513rWfIWfphgi8Ei9qwnAK7vxa047tcAMYliE82Tl6ZJ1mKwRXW6RWNi8dKkfLYc43BXX2P7g8Ok1e63MxMRXaWAOQBnJrm2fsno2vkJ1tdv+LyCd1RjI/IrsWvh9V0rjmbIKqtCWdYfly8X5TX8u2W6xVFY1P7LfvoHooERP0Ebu065FtUONw7oUq1cC9UOPdsE+D89b6bhycr8R1WIOPRRRCbiBIvQaWKhFEuLi42bushZ1B0wQ48973kfctxQMnNV0MjK+rLn+8ga+ZO0Yyp4bdNQBWRiPtCcpDIWpZmmWzZm2Tg2zdu0OCpw45Ip2TrwBk5JI6tPAgcOgge8Eh/F2CSlIq3g9f1piECVTYLx7jKCOKbATZ422EuYZF6GSbfryXokTI+Rh0oqKJhf+/fvM+FLTDolEz338xuwx10mA16hrOM7KXAYIQ6AkxMmbWzxjrp0pfRCGgDstwsVnN0VexDVWZdFSga+vr+EpK0j5NWvtwsfDAE6VZwbAp9Tw0M0k3sBJQDRDYU5YIMLZglthI9hHNaAQ8nBBTkQ5LjORONfIYwUKRXqDY/8Husm2PnBk5FzbY8kySN7pnDUX4xRpY3ZWI5PMdOoRkyJ49AX4n0vMdMlAx13IooqxH6sbCeF2fLVj3d5VFTvBwuczOJ+IW0xMyMjZOB48NPnGV48aNTv27TF2naZ12W5dMXLXsfWvKRzyTOv7aTsQTjKZFSnKFagNwQ8S+LRbO10q7bb+u82uRV8+mOC3lYBGXq708ftE8ZEL6yjkDdjuA0hAIGa2Q/vlaw1CPNw0xsefxnNYYE/CHLpXJsllKbiRqu9DczXx7f6xjUElE4KQPWtXh3NiDHge2U8/9OJeTg7jv3ymClBCJRO7DM2QdWhDBD+YtrFSKLtCJZHu9vwKkH2ZgyIGu9Yqsmx/llJyCc1DvET/tA+fryqWVJyPB2Jf5PCgBebO1iwWJOtTuKkKUd+5Zh9PCJKDWg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: de3fdd3b-f61a-4871-a12e-08d9a8965b6a X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:38.4440 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ytz49Zk6MTMraiPbmiSnLl9dndNVEphuxSITmLCgiAQ/O+0FxXmrxmueeDp5YcCpFCL6bu4ujwuLLiydQonEkJ1c39DaNjGpUWttdtRbZ4k= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: 99r2Qnuo7JQ3W6rqeR2tjnI5QMCAqnHA X-Proofpoint-GUID: 99r2Qnuo7JQ3W6rqeR2tjnI5QMCAqnHA Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Expose the .machine keyring created in integrity code by adding a reference. This makes the machine keyring accessible for keyring restrictions in the future. Signed-off-by: Eric Snowberg --- v2: Initial version v3: set_mok_trusted_keys only available when secondary is enabled v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v7: Unmodified from v5 --- certs/system_keyring.c | 9 +++++++++ include/keys/system_keyring.h | 8 ++++++++ 2 files changed, 17 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 8f1f87579819..bc7e44fc82c2 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +static struct key *machine_trusted_keys; +#endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; #endif @@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void) return restriction; } #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init set_machine_trusted_keys(struct key *keyring) +{ + machine_trusted_keys = keyring; +} +#endif /* * Create the trusted keyrings diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 6acd3cf13a18..98c9b10cdc17 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern void __init set_machine_trusted_keys(struct key *keyring); +#else +static inline void __init set_machine_trusted_keys(struct key *keyring) +{ +} +#endif + extern struct pkcs7_message *pkcs7; #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING extern int mark_hash_blacklisted(const char *hash); From patchwork Tue Nov 16 00:15:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620839 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B39ABC43217 for ; Tue, 16 Nov 2021 00:19:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 96E5B61131 for ; Tue, 16 Nov 2021 00:19:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347887AbhKPAWV (ORCPT ); Mon, 15 Nov 2021 19:22:21 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:2590 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352850AbhKPAT7 (ORCPT ); Mon, 15 Nov 2021 19:19:59 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNITT3029761; Tue, 16 Nov 2021 00:16:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=VZh1SqSllrJuN4tkZKx6ulcpLx3kJowSmVgBS2Q0Aa4=; b=dpRJ0VLcxJwjH8W9Pc7DQOipTuQUxeJ8RhU1eoQZvGc1qXtjTkNG+sdjPVyOVpYuw7Cz na0TIXyIlWyZfFBm4gk5eQjGzUoGdJBIPHGG2/9/qSBbhuAGGqCkXdnJze5RiriuC3Gg dJUm2KvOY14cywsYeUAjIkiKvMdQvZI0TwyUB3fWvEsorhnxJVHfpjHfIG5W7c1ng8k6 3FLQLQdjWqEv3FY2v5nmA3KwPj+ilWhI6SUzpiCIrfh05VMjZZCO2UPUyZi4Sqze9wKT 1wSPwKtgDzMITkHe8cOI/RTS2Yn4fZWDZzsLD1iou6nM2HoFSrHHvKYvhKY6tnfhwaDO JQ== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3r7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:44 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AbpA176543; Tue, 16 Nov 2021 00:16:43 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2172.outbound.protection.outlook.com [104.47.73.172]) by aserp3020.oracle.com with ESMTP id 3ca564n42t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:43 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ea4I9XfRceT4f4NXJimiyuCZgv5dSkjCbvJjvwzmVA1OwgcE3jLTYs2rF0cu7ZPEjZzgmcDpYTpbDRbgTU3CA9ldA0B5JcWUn4UxS3pJ+lBte90INuJD+JxQm8A/MuF1FcuSuqGGzJXDtzE4OXzYK7cf2LR64uvCS4hKBHygcak7UOWy6R5X5Ntw0OfXzknkST1yy1ODjaYbAf+Rxd3+C9I2di6095zi+kmHNtL9qWzY0lGZxbzkt52ozNsfS22BCcU8Oh1zvBMCBCsPuyvSYG4pKSV2If61RAcp085oFtKjWHwDUxO4CkE16sI4ZuN9n9ACEllHu9ocnBitnFsadQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VZh1SqSllrJuN4tkZKx6ulcpLx3kJowSmVgBS2Q0Aa4=; b=DhF6Bvw5dIykw+kBybCzgfNEkSaiF+wZENMcTwvCD+tJhnFjz7zDOteAQ7Xjc67d/D24dasRNw7biXBLBZBjtw8xBzk0jJPSG5EJ+m+PgxEqxvd59EUugiO5+uYkJ9ccxl7uuBSfkOPy7VA/4RPjMU0tuKjsGVm2UXpPPX/RnsdmjwCxFzFx+lh1eCic9dJkRrj+IMh3JFTh+eQxb7419TNrbyh6em/1HM+O0jgbbqSyVSy9JIV+IFvB+LqEz7ilT8bYdjD1ARFRJEpUpbVe+WIp/BD1zlh02tPcoO762HqWaufZuoByzW03Sosrf/qaN+floFZtJhVbco1Uqt66lQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VZh1SqSllrJuN4tkZKx6ulcpLx3kJowSmVgBS2Q0Aa4=; b=suHDEmgFXGoBVFsHuiYRi+Thj7hRAyZKyQBr7jroEuNBYIsL0mGBUWQmitI4x4RvmgEYD+J1zhqGV8d3aBA8yT4/w+/MGLen2xrpTKhpmoGy8CgJgeM89Epusn3zKhfaQrgc8MIkpuF0/7hZsJi9mzjXUDWCdYQAnWGobJLYbSI= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:41 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:41 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 11/17] KEYS: Introduce link restriction for machine keys Date: Mon, 15 Nov 2021 19:15:39 -0500 Message-Id: <20211116001545.2639333-12-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:38 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 427e04d4-65cf-43be-ee81-08d9a8965d01 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: XWd7QpITOf7flXsS4rMLAmiUw18QdfasrEm+dU45Z8svIyXeFB3VR7dNKs9tjQ4odX7MQLD1e2K7kIlQIe3+2nnkJRX4obaWRXicDyNPsrJUEvpTBIDue4HDr3q3LDvY29IKnqbq1mPHpccgKn4rKFvd+1zFk5+i2hd3045/i3UXmdSkOHPnKErd+NDdDP7AJoh3bNv5h/LLKSBoqVLy0NzB2sGrJ1AtmOnYY8qWDm1F2Z+Gb+8qEhtYKgiLw8MQc4QUqXUYqFyyMc9RMLxzF+eCenxk4S9SDWlOKy3QIp13onhiONmmUIkYPpk5de9NPqPk1tJrrDCro6sEH1v9Qth9oOXdX0qAYq///2L/aGMFVFui7rY6FoQOdntJJ4NcDfdeWpKKyXiiQ5rCBzem9yHokLE36QeG2JZ1af6Easnf6cEZNUDem5r4mxqxYyK1mBJFy8E63SH1lO2f/nENwAhbBpmgOPIoqSwzZYutg82AB7ITUA7hmmnupQc1CPgRqtRsgIyre1mMNApG4hgl7kAcU9yjg3DPca3K2XbioNU1HXML64qeVU2y8RQ3rdSyfytOtc8ppokuNUsDpyg4E7T3OpaeNoHTlyBHQyd640ImGmwh31PlTIGlVoM5QKIf5bY7tL4vl5V0NpBEBu6lnQOR7W5tWPXt/Il2FtDe6cJzoK40m9LA/msqChMyeh38dd8pCd4blp6qVFxwZ812qAvMIdO5whpsHTYGrnJNRwk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: XAho4umKk11vw0seWxeQXCShvdaWF+Hec2RivlolhzLt3pvwDCF5HxYH3OLRaLdKDPEHxP3FJwCO/YUkLDleWzN259ntJjM9D4ecX59iAvndtmd9sEd0JzShRhOK7nZE5RGLcDbO185du5WZssHrwZ8MuVDOqSr0d+soVqKxyPGBVglLoFVsZqCPQUyEEQzEkuFEjFkOGNGC7Oi7ixdqpq9ZmeQXyLNCGYSjbe94DcR+c+eCnGgSpCM/a/mYQdW0K1sTM/JcgSEmSxhBcXGC7ZNYRFobFsEdzX1gvl87gTMm5ZBrGXxxvogfoUtMrEFbYz7QZ0jscJCgbzHJG8j4/13R1Jge0ZbBXgf6Jq65zAh/yDvqIvO17nD29hQ/TU71dyFB3IZdMsBiy5DqB7n2OlOd3fTTasQXQN06d44KDOLB5qbYF4I0boSk8nXc/pGyC3ILCUJ9VGcIgJERpxjUJGat+08fw0m8D1LYcprybvJ57uKEz6Z4P5iy7OH02GaJ/w4beQkkRx6WOYYDU15E70czFB4f1BoEolbpL3uLqLgYhv0zCXUbMhh/Yi8rK4pEZTh37Qw3We5aswQ8gG+kKzRGrrcjUbQmk23r4SPR9JB+rjoCZHVzHEZSawNIjDebZT3OECrBKh5Mh9K2M9SL50GLDES9kaOPcj9MtVtNqzHH2yig/6A6y1TdHXnIepAn3CItehkTr5O6XlNqfIiK1SQIejcB/qzFAO8+wTylLB/BAp9cD8nUMrroGpqfV7uzeh2cvTuwQcCScPJ6yOIWXMHcphzX60q1frZ5BGoL79FlYC+VeezFc9jzJwZ9uHacOUR2qYc8dtYONoqL4jsjtxbqPLJkHIBrUrlztDqwVF6YdvDlQIMJF/iTxC9nIqj4H5iWuFMcw0RVXZz9bMmQtB8i2QP0dk1GqHfEI3gjO9rwVKApGgXIf9DL4qZ+pkagx0umbuSAoH17MVDMJwWh6j/LGMdBVtu4DGj8q7+Ud5OoYHqMW89Gzq2/23Q255WTTvOuy2q+7KfyvYLAIjUcIOocNUPUjmAAEqWTkJ1BNfIWcLjM3EYubPkFSq2neC8/KdNIbbySJetRX7X+kWvmuqH11fScKDwg661uMPxHHbJuW5T5SbTrIt+oeq+RKExryT8JmIhvv53bP7IMLXSprQNECI9QeUYoGk2G4+IIUnp2d3rx+uwdDxFWKbZ4nRHZdNERgcZiIEru2+n6BnW/1cmtu/JPTEPOSIN6ETTOSk4bm8z1JkT8vTiigJVFZNV2g123ZmthIBbetvamuTeMiKaMgC6ITBU4wRIWp04XM4w4Pqwmtx2apmS7B/sXyjfniCQOcO9+soy3Fm9obRyYI3bSoMaFtoSe/dLVbFWhKIlaekZx8otir0e1ic50hQp40IYLHxzyyClKGV2xex4Qv8Z4addeI+LyqED3hJpIs3owS8AgrpdYcjBinU1rpa91W3vPlaV1+Lw9bLJuHEstfqNwPu/h2UM/LLuZUouWWBFGNrOlfZ+tTH++G80WJxLIYyKlbSl/jaDx9UWlpkvs99PwDN6A3uc3D7iPxMRAHzfRpuGCrtQkHgF+buPhsHL9F09ZyaYgd4iRzjlKL6buHzbAHpBrUAOoryuhjo1yARSifk1/2njiq6z61sxlKXlswRN7kvy78sGvb8drZOMYGg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 427e04d4-65cf-43be-ee81-08d9a8965d01 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:41.1053 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: RWp16Uq2FFdUMNfUnrzuh0cbAntE+ruZcslAYPUqQKYKxytWU+9AOBWCTyqSxz+mM+BphR4ayilK2TzQKO6idieH8D/zUmOE/xa97Qnx9CI= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0 mlxscore=0 spamscore=0 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: KyM8pv8S0FuJDq9gVlmBG9w55SLvqrbX X-Proofpoint-GUID: KyM8pv8S0FuJDq9gVlmBG9w55SLvqrbX Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Introduce a new link restriction that includes the trusted builtin, secondary and machine keys. The restriction is based on the key to be added being vouched for by a key in any of these three keyrings. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg --- v3: Initial version v4: moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v6: Change subject name (suggested by Mimi) Rename restrict_link_by_builtin_secondary_and_ca_trusted to restrict_link_by_builtin_secondary_and_machine (suggested by Mimi) v7: Unmodified from v6 --- certs/system_keyring.c | 23 +++++++++++++++++++++++ include/keys/system_keyring.h | 6 ++++++ 2 files changed, 29 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index bc7e44fc82c2..71a00add9805 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -99,6 +99,29 @@ void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; } + +/** + * restrict_link_by_builtin_secondary_and_machine + * + * Restrict the addition of keys into a keyring based on the key-to-be-added + * being vouched for by a key in either the built-in, the secondary, or + * the machine keyrings. + */ +int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key) +{ + if (machine_trusted_keys && type == &key_type_keyring && + dest_keyring == secondary_trusted_keys && + payload == &machine_trusted_keys->payload) + /* Allow the machine keyring to be added to the secondary */ + return 0; + + return restrict_link_by_builtin_and_secondary_trusted(dest_keyring, type, + payload, restrict_key); +} #endif /* diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 98c9b10cdc17..2419a735420f 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -39,8 +39,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #endif #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key); extern void __init set_machine_trusted_keys(struct key *keyring); #else +#define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted static inline void __init set_machine_trusted_keys(struct key *keyring) { } From patchwork Tue Nov 16 00:15:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620817 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B6C0C4167B for ; Tue, 16 Nov 2021 00:19:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1740B619F6 for ; Tue, 16 Nov 2021 00:19:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347464AbhKPAWJ (ORCPT ); Mon, 15 Nov 2021 19:22:09 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:5892 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352635AbhKPAUB (ORCPT ); Mon, 15 Nov 2021 19:20:01 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNNR8x007673; Tue, 16 Nov 2021 00:16:48 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=DpFCJng1SZ7t9XjR+uU6XhXYX+8jCkgECtnfcJNwenQ=; b=RX9JgbnqdfGAi4crKxQvxVbp/PoptXQA9l4onc40eUC1WlmUyGzxu5sv3Mjl8DygIb/6 2A0MTAYZGEHXrdl9s9WN6ufcwDZXXQ21G430yr7KP3dc2AJ5RH5OGHpmeN2dL7/OPNKn CofQ1P7I2jw0gDjYBraX3A3QPRxkLGinKcsXtbebmqLOF3olNJ37TscWr0++iJqyIH99 tAAeiAVWF1FlhImyg3HebccfIkG27GSwdMN974oBgu2yawAGa+92MeFRgnqr/luuciEA OriMa0qB4gkhO+BJiKevsORGe5RSCosMkNnYt8lK/SljRgHIFuYOiELxwQCRz4iTWpPV 0Q== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv561aj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:47 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AApH136120; Tue, 16 Nov 2021 00:16:46 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2176.outbound.protection.outlook.com [104.47.73.176]) by userp3030.oracle.com with ESMTP id 3ca2fvcgu6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:46 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Gcnk5ar0S4fIVj0tiC//bgAyCczRvkaWY4uffIQ/MBevqxqeqV1dnCOoR2dTSRNQgqk4mMdxbNTcVFxkEczLwFcvO6jy3latYisk8cF3o84upGodTVcsQfS4qSmpGIpi+Vp25YiXDZAAhf+V7ZJyXgY0wjv58nq/2uKtdFfNRw/OwKjkb+FnU4UL4VezRFHQWZtXRHdOwh/LxyiC0BpZ12Vkm9yJNW/CeGW3xh0DOsXOq6QzXOTmDnO/Xb+9AW+nxVpfg6TCKXhmYMeLrk7yNRBz8itIVqTHEzywxLcJXUZDBTqNSo81Z5GuR4DUwsw0NHrqNIHMRMmgPeRmP+vfeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DpFCJng1SZ7t9XjR+uU6XhXYX+8jCkgECtnfcJNwenQ=; b=O0l+fgf9g21PAtMZ3StJTKuqO33DYrxNt58CGKTjlUOmXruky94DMR2J58+tZ0Z30JQUK+V80MHwHkZaEiCJmZgToVGsCZk77YEGFz2vzdZCf2Jg9CP6e9v1eFOti4enf1FKSXyNWmlBc2d1Wv0LHyPtGZRrVZ5tdeM20jawiajTSF3w/PUa5AQ+heWXZTJGdMXYy/QONTAxvi3VO97yiXDu56HqBVcsydh4y49U+nhCdugzC6I+T5PWoiXMePEXmvq0PYelvKgECLM7Y8AMRfuI4I6E2Go2e7K4oUbH0tGfY4qjxnI17yL9nZhm8xK3qpY1GH1kmQ9iFTOpSw4a8Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DpFCJng1SZ7t9XjR+uU6XhXYX+8jCkgECtnfcJNwenQ=; b=L+E3JCiTgkjopB/cIiI+jn0JOa482I58esoRGBb0ejlBvfnBXspUjZsypM7MWmGczzr35ACIhxuItRiEA8X7DovIUh7kYUxrPtcQjKP6mtZQxmacokmVENkGS2jeJzdkjJiFdg+Ghe1UbqLq4vRrFSUH9IE8Hf6rtqpwlfNGwW8= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:43 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:43 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 12/17] KEYS: integrity: change link restriction to trust the machine keyring Date: Mon, 15 Nov 2021 19:15:40 -0500 Message-Id: <20211116001545.2639333-13-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:41 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c3843636-d09b-4169-58dd-08d9a8965e96 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5236; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 63+F7UcJy4sFof9qocF3sMSgFZ2A/7spsYllmwOnpR2C2pNab511FwsKgnrMwSooxIou6DvLSlhbCCdVDm7YNsfam8mU5iV3zGkgJom7EOFGreGUPXGBvSclRqFN1/kSEDAmyDw42ANFvMIoPy1QhV0dSDtbDuZv3kET6B6ixip1eSIXE1vL8R5Y+H5tvjE4RLs4gy078lu3VTozz484W6qRcAhadNUTYySf5QG1GdZ2YmSD1ddgswcu3xRVaXkAgV7mpy325ZwyWf//0+0StS6HnoD4kvYcwepAGCgdgtNN5K8jeO/y4THMEi37mHCF3KuIN9NvJzQiUQ9mNfiCOtLgLKgtuy3+rDSWsJW6TybvrlLTrERd1daiibwZurnrJ+CTdYKL8VEKZhgq6nJ1CSZdTscn16M2+GDmav+yPveD1kiL7rvJzxiF5vrrAX4HSjeKmBJFeYZw2dGIh0Lvzc95u6Xbt5lOEsMDIuh3TQcgPg3ROxE+EQnhtp97O0x1oBdrQng1j1Kesl4u1fnrJNtv+dYz7Unq9hOPZ7kIuF9vej6C6ieQgKN1+J9FXE7w5g/meS5JFIs6oQBopQme8fW29A8GDTui075hMuEHyLBuH9bhWDxzcj3PLb5f8a66eX5HUmVLl9jOiu/4j8gk6nbRQjpHsSjNqoPTxq92GKS/Mq1FE8Uvyah4TznVcx2DJMnieC3podF6BC7jpV5ThYrk5IIe5l2UybwGO28egKs= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: E4yhO7rEzPGq7WfKkdixUMVGbA99ZNP07LJmqs1R5JyQMG9BdboSukJ5M5GQQcaz0Atlb9nyFKBQoa1tvIwabHJ+ucMKGEe3oeCeHnNZTNwgvznO1VJKVNlyzyTEkEEbLziioyJ1z66UB+kc8EqcUyotILLXjwSSL7zsdR/rMJEiAob5JcVllgIBlSW27y/6URWgzviRLLogaDQj+yYLWoKtxYIGOii00CivA/GS1q04GTz4vuqVJB7FWmbKI0q4yCidPdl7nG5k8qrLbmCvVFMxJporsTBu9Gi6R9traV/4CJtIWrBxNx24yLbKF4BlNF7MJ5fVxk4PSEWO7LU9myZ5wWEZT8dq2cRPyzwAHkcDvCOgNRAnz6z0NoVG3nONgoQ3JILVZbvV7MsTnxHD2zyzb6+iC8bo5yyM4+btY63dYUO3M1tNXk/V8om9Mum6xFNBvdmy+Gr3q1XQuoWIhUIykHfhr3MAfIz1+WmVYcl2f38DOD8SyKwY+wIMmmEyZhzpSxQuwnD+l73zpLWiXWP6JSibNilE0uYcJKHUuJtw9Nxa0D9ZOruwkXx9RTfetksN21BsQzVkhSHIXHFN3dgNCd6DvT4Qx+MfDclln+ELYAbWQmEaEYu0Vxy2LMEsgFjqLvmdCgEtkti1lzDRwdhBe82Ucdz4JSLD2tQjUIPoQGeG5sqFqthHvTHyz8oy3JlTggqgp9+UzOz/7kx2tRJGurmcHBB/VcLOfLTGsUZpXLuWc/TDQGFyugWCXfke/92PUpeVdNxPwjG5HHqyapOc+zYZxKv/vrQgkFEZvJhn3XEZUUi2mrR2g6ezBj9cLhdHYsFsMsi1+g6t0ms0PaG0hXgws3KZpWnq6G+lREIvpIMtHf6Gq5o0Cq0kgdKaYPojZjStU9TtqYXstoGZ6iPk5aH6P5C8ZddxTPlmsG2gHI1VmLjBCYVGS4xBydE5ytaXPPPBvJasIESsfOio7yvk6xPQ7TfxMA6MxWtocwa3u4SHeHCR82y9rq3kf3jyRVeuXKiXnBp3DHK3qs4vOqq2wZ9Sf/pPFDEz58tRt5di9xKyCaCVEDQYHetW+b0vNZKH7mTUqIHtscQ4fBMi3QPI3XAJf1TyjmZm6ccN8fXArnD6iHwOKJBKzyE8d6BVstT123Wto6k9nF8wRUddwVMA6FnO4VhqxEeIDITHoYBAZ0+ArY9XMc8xbMLBqpS1/JY7n0Fz8YmvpSHszYmsUJu2tP/irIZ4CWQvWoql6VZUvHtWk4emuRs5vlhqiZRqdFU31iYjWSi9ifkxk/9OyCxes8Qw2EmqUzQIxI5Rfx4+VsTowsFOgpXrwQsKBec2u/d9v1Q6cbl1FljV8q1TGps3R8l0vZHTzjfXhhXdpiaSeeLVyTBlibs0XTrVbPqtes1opVS7EPfmfKoLaOkxC60ju1KX144jh8Jv7QRqNMCE6l9/OokAi+P7Y4nxZcUV5RqGcwy6dstG3QlKn4iCR0eGCRbx2n+XZdjAcWDqgRjirPSXjsxCsnnZJe8+Bb2CDybCBkp7o0aU9MBg6nJz5/F11YHfcycC95jpCx0DYY7WGT7Jmswm+jC+qlGo4nX1PqM+gqEKrH3PXvGLNC5OiIaX6ptdcNJJdzegoptqWIhkrNTS/ADz7FZEVBOa9Til1/bTBzX6BlgF/TaM54dqlg== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: c3843636-d09b-4169-58dd-08d9a8965e96 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:43.7457 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: uDvdWQT1WTEVdSkvaEc0zEa7dysYHWI6vBlzYlioxo19mxQXptkOl4loQSuN8DhRH86qAQx46oWH+ycchQVcdTrELnTCb2O967Z3l12oRc0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: y38LPB-CWhK8OmHNpSkzKah73e7ynMiu X-Proofpoint-GUID: y38LPB-CWhK8OmHNpSkzKah73e7ynMiu Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org With the introduction of the machine keyring, the end-user may choose to trust Machine Owner Keys (MOK) within the kernel. If they have chosen to trust them, the .machine keyring will contain these keys. If not, the machine keyring will always be empty. Update the restriction check to allow the secondary trusted keyring and ima keyring to also trust machine keys. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar --- v4: Initial version (consolidated two previous patches) v5: Rename to machine keyring v6: Account for restriction being renamed earlier v7: Unmodified from v6 --- certs/system_keyring.c | 5 ++++- security/integrity/digsig.c | 4 ++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 71a00add9805..ba732856ebd0 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -89,7 +89,10 @@ static __init struct key_restriction *get_secondary_restriction(void) if (!restriction) panic("Can't allocate secondary trusted keyring restriction\n"); - restriction->check = restrict_link_by_builtin_and_secondary_trusted; + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + restriction->check = restrict_link_by_builtin_secondary_and_machine; + else + restriction->check = restrict_link_by_builtin_and_secondary_trusted; return restriction; } diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index e7dfc55a7c55..74f73f7cc4fe 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -34,7 +34,11 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_machine +#else #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted +#endif #else #define restrict_link_to_ima restrict_link_by_builtin_trusted #endif From patchwork Tue Nov 16 00:15:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19C53C4167E for ; Tue, 16 Nov 2021 00:19:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E93B061407 for ; Tue, 16 Nov 2021 00:19:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344102AbhKPAWP (ORCPT ); Mon, 15 Nov 2021 19:22:15 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:11264 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240885AbhKPAUF (ORCPT ); Mon, 15 Nov 2021 19:20:05 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNHFKV029766; Tue, 16 Nov 2021 00:16:50 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=RDur2duLYJopEx/61zZX94qtsNXff+nIwq2N6kSXinQ=; b=Gey/P7bUlLhVLHDyzXVSw5D5+f+fQtGmjUM5GHJVWvfHWphqcDK6Kxg1Wd78kz99NEmp 8f1Zsr3AVuNq9Qmfci2alalig35bnDyUF+YLmP0c44LPmL+Exitmos1SebpOuloEQqjb rtNsH9kifUHk9GUzl1nQJqUUldKIH8IYtbmgw7Sy/qpn9w3EOGKn6CqLYeHaG7lB6D6y 612Te3pcJFYNUu/2OQNtpkl2gtsE/nM/S86z/3ohu0FrWgs1u6z1f6n63a1nz/xipt4t dUmhDxo38RPsdn2ySpwPnPZ9rL5f9Eb5BUk/YufuLw27sGQoaNbo2hSDsAzavd9NQh30 mQ== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3s4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:50 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AA85136051; Tue, 16 Nov 2021 00:16:49 GMT Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2171.outbound.protection.outlook.com [104.47.57.171]) by userp3030.oracle.com with ESMTP id 3ca2fvcgwm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:49 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZPJx7rBR84NbuGTDzdI82QEDP2wq6YZZH5DNSN6YpWCVWzNqEgd2+7XqVIDr8VlCqUvjtbr6giIeAPS3WRAy8cOsZ6OL5/C27GTEWnBvZg/2+YoKtlHttVzFT+5TiMDswPD9ACuokN80WK+6e9uNPOIfld+U4Y30AUHb41feXtn3mxnLjGNswdMAt2wJC5a/rrSmKilg1PL086fNBPDnCPVWiP0VP75QYvsOcv/SJLKcyE+lzRN3w8Zqjyp+6lIaTwOcEKaJYxpJ11rhClLaNd5OZXSBIchBAVMb27lNEcqb/lVVG4A5Rmo26E/pEdsfPqL9M8iKNCBuYCHfNWNNmw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RDur2duLYJopEx/61zZX94qtsNXff+nIwq2N6kSXinQ=; b=iYgrXx6no+TrHS33ZCjpLfYTF15NQ0E9LcK4PiMJ07QFBC3HtnvqpwBsSpB6nCkKQHJZwrQxqqs77CsHd32fns6INNlaKPRGV10T3zbzd6aeKqjp4gSXVBB/OsVLV4kjrASkXOera8O8A92eW/M6N4Y5CaKsQR+wd5pixiZNjxqi6NA1ejWz48OHQxCaGOY/SxH2XyOwfRVEQcc8rbtsiI7kZ4g9ugQNsRb/C1HCV6TJ79Ybby1Rc9hI1jEQuN15c/4amD1EtPUN3FbA1Pq2+OKT+vXDUAyU+HDjrxjDS7/pGpDH0eBXr5tQnR+jwIEyo+4CHoFc0gdbxpHQMMWZqA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RDur2duLYJopEx/61zZX94qtsNXff+nIwq2N6kSXinQ=; b=KobQjhYzgT5yW/UR6y3l+Cbf7twXWW3ovanCx0HkHumQWMCyjdn5u1ABPevUIc/ncuVT38xI8O/ZsaUL6IcgLOZdZ9SyQNDGCCA2V5PDSknBFia5/kOtXM0WDb8c/x6i3vCiJW/+UCCshxkGWOmwv3ktg8eC63Cf7aVOG1hBt4c= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:46 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:46 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 13/17] KEYS: link secondary_trusted_keys to machine trusted keys Date: Mon, 15 Nov 2021 19:15:41 -0500 Message-Id: <20211116001545.2639333-14-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:43 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2513e2c4-2161-4214-8ca0-08d9a8966035 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: TVbdQDsVdvfvtv9Olski+tlZJuMwoYGDU/8wJiTyskNNqAoXJQAamh3vLAhM6pR2GCKbb30rzf9CZlkSr5QB8BsxfciwUQpV6Vk3KKQ7HWdTzJSUlBYyYX79v490IGZJlF/NoiH1tO+ayI0665RmkJs+utre2t787rBisDeUNGW7rLz51M03gYIHlVZew/P1F5GHrHdKs85krYI0LYv1RZeZiO9bO1h/rRX5Umq/Vg2PClQ8UFIOp7kjDOwtFV9R+jcBUW1IHIU9QKuveUYKLgaZC1L+jCLycsoJwDp6C/t9b2AjJML9ea9aXGWi5tkzRGtWUCYcPAp/bSRZENYaIn8GRjEpI2bHdmMherp6A5MgJxTsblGETvBTwUm9aIjtmy03dehQW1+hTrEXxRdN1sXtjHXKBiN/kMJ5iurgi+N79IX1M5z/HToDH9VIScreJ3Cm88yJllvV302Qu3otmfuqvKxhRVQza6Ssv3V8ldPreI0PeXUm3wGXicfe0StRBq+ODUHvmCWRKYsw7QaaHAe2I/fKOnKEzkCK22RQxS1YY9XcOtkTze+vvy1btwmOG3OU/toYBwzRgjuCYdVQCVJCsDhrgVZPKcMMbzAKtrJ1W9YM0GK5TcxnZ7jMrxOlw4AHUy6nmBcUriNu3ED8LlJ6eIkfBDAMllcSvGzlWlZNFc3If93Y6EFQgCar/EZet0K7AvBsEbZuvgBEOmOlFM6Md9gzNQU9InY9uQ+F7g4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(4744005)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(4326008)(921005)(8936002)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: rSqIWFIS6I0i25WYGYhf7R65UQwZlS5ZHX9Hwvk96WoLo8HB9BkWFN3QdZrrE+dSodHdLKa1dbk5BrPBXmVi76GSIyyII1afcjvEujHVJvJYHswl2SvXhUhRJjFiJax1mpFz9rxaFdNVqSEpB69aJ8ARbIcacKleUoLsZ8ReuHGxznkMbZeXWZdLcpkg3z8p2N1FWhXrZEjAiaabHkMuTkjaNSAvu2sh7s9fcgS1vXqnw1ktEYR2J5weY98JAy1/jlVnlMIGzpagEL4pph454EA0yC6FsFLg6bINZ1VqzqNkParQK06SOwCPDw6rtMfJ48uwgYEdih8HFNWFOdu16oRCiQJTQG3Qqx5PKfbu4d87uixxL9/jJQj28gBI9tcOxCt9rb0Oe5PWz/g14bzkNyvlG0M00YkisB5zMex3cLhP5vUbYLT4R33tjx8y//M3CT6Rc74X0cfoGuYxiQ+Zw+eZYE7NU190rF71qMPwdlhxBxRgfOvdSYOwDkgr+dU9p4LsPkiL+uFluSWSQj4OdgU9gmWBdgi7YsaYNN2Y11vRRIHfkAmAX7aQgM4rh27/bj849ZnZKm5CR6B1a3pTdvMmRccatmOs4rCUARLrke4N4tTKpZpYGAqwYoQvq9eolNengg1oydgg2ILKfLSA42Zh/YRav5eRmUH1Hj35KaDXwnPhJyQuOO4M4KJ0xCTCOoiFTfTB0jiIb5+Q7KiFFvu1O/eAsA3szl9C0ccDnqOxyIlht+7JVUGCTx7MMUdos0LwL39pW4w3DuKVnHg18SGLJtVome9BZ0yxoobCh6C4TNos8Tzo03Kwhk8IJYWHmRJrdknZQ0KqLKkAi9rr+ePULDqGiIWVqxDoAD8vnBxxW+jsy84lWRG3XOfFUfI5edanGqyRxOeC9vMPAmq+NA1lJHtCzzrrGNIw/j7oeqsQ9ipYNGAUYMgIqDNUZr/vU4SBSXw7bPJrfk+ZDFfKI8impG6k1UynI7xMn5I8SVqlwMuZLiMSWuO3+uz0FpxcMsVSlqE2DDuCQIqWPjTPqHgPEb5PKeBTzdXEPJ4lZ6iCOXLBnwDX8JIPBLmWMmrU6NkPLX/eM3FR2ognCS6ehcMIHy6m4Bje9JKDSFR3+OQKbHCg3cP8ldnAko72MTPmrpeZAPlEmLUfP3tschfvcP083OMncxW4jzseiRPeA6kPs5AVDOBZ2IAFQSRpApejdQtuu6/N4WXXDLvSD7F8ngqsEX36F2cGyUzxsT9bx7S3zQUHj3NGor1mAIUwIkQcGNj4TqZjvrXxV36WUM6ToGYs3aqmf0gpdVQURfmhgGkhH8/gVqIYJCUmqPEWosrYbsZYcIivnOldvvWpG8PbWt1dw3djWfbbLpt76E8Diz2dXZtKGL1M0ggy95ldHVRnjAuRMVimeGIbN0YKFSZLOwyBvQ8p50m4NZ2KzYGO/+OLPTUOMUYVoVc25Qo0NWmBMB2P+Mz2eqyqkNHOjBwrFpebYBbrIzOKXKrcFBCqueQhfxVwKIKFb2MJzgpnRLPzNJ6EHvE4QRRXEA3PEvRjrZtQGGt1DB9whjnZQvPln59ADukCqyEUsUvzEDO298/5lX4rF/sJvnqtQDWSsai4OVZrmVOaVWpZUAS7FSHei1oWVse6mMPTY6ToN2ivd0CJaxOapwShnXf2qzvbCZwqxw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2513e2c4-2161-4214-8ca0-08d9a8966035 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:46.7296 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: fgUE38seeKAZnji4MvMQQWcZOimbux7H8/oR4j7MTjrvZCiptZZB4JNI+7W1tcMUkCOdAz7Kbzwed21VQt7dF3EUMd6e9YUu4HxW4GRMCB4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: SpvDiyZrPM71qvNvaWvqdoSnOo82sqP6 X-Proofpoint-GUID: SpvDiyZrPM71qvNvaWvqdoSnOo82sqP6 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Allow the .machine keyring to be linked to the secondary_trusted_keys. After the link is created, keys contained in the .machine keyring will automatically be searched when searching secondary_trusted_keys. Signed-off-by: Eric Snowberg --- v3: Initial version v4: Unmodified from v3 v5: Rename to machine keyring v7: Unmodified from v5 --- certs/system_keyring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index ba732856ebd0..2a2dc70b126c 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void) void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; + + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0) + panic("Can't link (machine) trusted keyrings\n"); } /** From patchwork Tue Nov 16 00:15:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620833 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0776C28D17 for ; Tue, 16 Nov 2021 00:19:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AAD0A61407 for ; Tue, 16 Nov 2021 00:19:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347734AbhKPAWR (ORCPT ); Mon, 15 Nov 2021 19:22:17 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:14926 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345988AbhKPAUI (ORCPT ); Mon, 15 Nov 2021 19:20:08 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNHFKX029766; Tue, 16 Nov 2021 00:16:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=OeoeTOF1SZCnCC1c8qpZDdoyUVGX9pjbHGVQCxC5Kqk=; b=XePAmDHY6wkMjNauyKLDqIuDx7VGPIrOrUuNTbp1jc9HdXH7Xkr2SbV6IVWkpI2QyvRh 8TKD/4uilKsl2eOa8pG/T6iLNCTHRppBquA2Y75SQTe+sgWvaLP8futUgdIiRVnYjJgi a9+aSWj5l50umFVoxMwrlSlT9sVp3AaNNKhc3NVj1unkV3SV+d/F2fKs3XanfQgaBpwJ Ax5HKv1VAU6lokNdbvDzt/l0G2bTsgu7dx0FpiQWxEy6GPv4woEMJ7VQFB7uunQdcPeh lelyeKhZcDPUnMiZ3tIfD2MnUCrAKJbPERdHmRAA51RyNEBzeq00GOjmP47K06SAn2R8 nQ== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhmnp3se-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:52 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0AAre136099; Tue, 16 Nov 2021 00:16:51 GMT Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2170.outbound.protection.outlook.com [104.47.57.170]) by userp3030.oracle.com with ESMTP id 3ca2fvcgy9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:51 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jOwAJzj89fCVpbSL3h4NWmMl4D183yuOqyyxu27C1Zx2yAn/8zAmXGskLX4r/4xuYjXx8AREkLPdlTn5BPhRADY9feXoXh+M7wsm8qH7nBVqU6ios/srPxJbaT40D/l63u6NukdOHWz2FHfKs/MXfW7xqqKktSxcNAS0a0cdoCiciLiQmgFj2l4sF1bzVD5ZkFCjfOwK+sC5g5DLt/2pLhZd8q7S58TMct9IBTDIyZ8iR/KWQJGt0to4uE3fgRiU1mlAFQi/wUOuboBFQHotAYJZA3Rq1NrxFdwvytxahRo0NgMZtNH2LdNo2BXcQ7ZuHpDRegHW/9iF0NNmEnF4jQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OeoeTOF1SZCnCC1c8qpZDdoyUVGX9pjbHGVQCxC5Kqk=; b=akhLIqDpO8UdixqsvKkf9NdJ40zYi+n3EdgcJFTYFyyVWZPwgjoxMZxiVUp086KAKYgKS2lfXRR6zMhv3C2NldQesd0ZIF7K4BwzTtKyI1Ocdu4r1ZuFf2l2CxCfv0+upFWdR6ZOWUvdO6myE1ky8q55CV1zSOdRktbVUZeXcKXEGj2wnAjqPdEs+HYCjVbUGo4W1j7xEpBIdvLRUNx+i6WiSgvCg0SNej1cwuBlp4Qm2LGHvPbhpenNU1DK8s/N1FXFLn055ct58S52YyE9/DcQ3FIr5sI1SrsrlI/9QKA7eNed/AAo+NpT4mtQ+aLyl3V70ikNq2LX438Qp+Cu0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OeoeTOF1SZCnCC1c8qpZDdoyUVGX9pjbHGVQCxC5Kqk=; b=iBcIFSdzAHx8boLeNVwr5XnhtjhC/ES5622rB5/DoZnjQpaPltP+dYp6J4t8MQmYDSXHqhRQ+Y4uboVpt5+r3dymHVp9sM9Za5XhpPmgPlBvm7Nwymdn4sPwSsL85qwhK28Y8mumRzYOtdb4jzIspW/fQ6LvYER7vdkPTETzvBM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:49 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:49 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 14/17] integrity: store reference to machine keyring Date: Mon, 15 Nov 2021 19:15:42 -0500 Message-Id: <20211116001545.2639333-15-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:46 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 978c6326-1a33-4a6d-59c6-08d9a89661f4 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: PQ656LwZXC6SF9YP7fxvqexv+l+CL4dGVtylPkHTSxccNUVnS1XFp/pdZwYY3TGm+TpoyXK3Vtm81V8Mi+fBzKlwypwsFMdlCWfoqkqhvsgI7n+jAxU9ScjMtT0YV4sXWZWDdysERVRyy8TjAI+txmLMsifSwN94jcAsIF6bArwr5sct929vqulKDsae99pDF65h8VHf0Bt6UYHdVvc1BIXxhVKdfV/0y6xjegHY8MJ3k/SudLVnsbQMSBOluZftl+Fcrhouiz2gdd+D+FtEwXgDDzrxLxWaY9KUS75U4ND9POQyOaTdCZjDVa9PDQPlz6UVgp9tvCv2K92IjMH8qp/J28SJ/aQP2Bi0v3Z/F/Rcu5Yil6pSUwZqEIJ5Q83Er/chi5jjuYskKqqTzzgI9gquYQJqD8tdUFM98BzEudGAD7csbmF2oITkH4yO7jVIqf5jcBrpu8Dy9UxbZ67sFkZkgj5KxUhMzhrZ6lQmQm8m8lDLuQUJHS1DN4OSgtFMcLLYm22587em1BZMSwO+l5oTPBWafrSpomuLl9vpKfkPT0HSdGKVZb130bsH9Nd9JlQyI/W5a+8jke4wNDowYGccknB5hIp98FGBohTjY5JUzX4rhDlJBP7i6/rok1bGYFS+jhEFovNEmhPJbsWPxP7J/t90Qa0H1GHog8JObHHH4Ggd+ZUz7LKMzQ+Mg2AVNsRbjWhv3UewcbeDW4CLZNI+lckYyFydGyLU0BeWinM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(4744005)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: HL/kihU9Dz/ps3iZ617AV+LAQ4udPay1mYhm8REdionQkMdsXNzWenrWIegDGYColgjZpOxhhSOOb24A1fjtK18+G22r8tAn3jaI2nLZLhVd3mH5qzwsiWaUSL5KEvT9tOnM4Uv/7XMLTChmWBcTxZv2yr+t/ggx7bcbEl05MUzCh5M5zRvZGqgDP+215rZQyTwAPzAgsExz+JXdq+H6/WDVt//4xotBQX/CB/1Hdo2//6qIzdiYeRHD5Qtbc1AMKTApyTkwt0mia9tc3kl9Zuu7Tlya1obOZCMWvtC+yEMTzY3TSrA95v7tp/lb8Qp3Qo1L7KJJ4BvJO87WT2bfnz8Z407lHElPM2nnMR2cDuXL9XLaua/qtmHmX6QFt1JawWdduflC5QKsUK8d78d9EabJoT8qIRJEzcbvoBhWeqE+8+YSXxP1Mle9GS007YaKYe9dyUQmT7H1dofcm7SrvjFSJF2ev4AKddANqPwI3zWvkz03xmBPikh1yjYqt3kn+KvEU2gwESj9bwVpOUMbs+VjqJ9LzX5sWSQ1a2yUf2fC7/ESD1oPc5c6139pTjg5vKTE+gJFBfFscIbX8aUOgtSAnZpY0XGNVG4PwqDWKM0m8xtOb74y79fLxWAGGaGziLzX3FRY1fWaNmlT6hxA/I7gpkSxBpLOaPtGnegmoxr8MiGdcN4e8YT/F5mxNnNarsYcty017R3IIjDbUktufATrbLKN5R9r3+ar3Eddt1LwEeuU5js6/g6us1PGmHLBlUyBUxvi/KTrvuTQ08Qmw9XrvimNji/iVNOkmvlhlTXEYgPC5kih3NPCzLCZ38A/eQKiP+1LHgAoyE4mooouVVjsyeDKHpLSJBW14Id9cUTDd/MMxTu79WFvHcjnDK5Xgp/P3U0ZNORJT3D5eUq7aP+KNQ91mlFh2Y4Fi712CznXBzmM6NGfDZqKKUp7dYWMg8iDdPjEs2YkN6h68eAtKlhxFJbGKbUHxLatT0l8HUZvxZbAY5BxuYEJ+h6X9r8JN9DNdjSOVOE7Wr9pabKmcJtBuNcHd3tkpO0oxctCvYXmim9b/6GIEfBuigN92wGvwuCm+Cdfcb8mwH4pJdir5/fgHf2lYYOvUw/ge47GkrzIHgL0H0cAvj8c2t/4lGJOtZKOzjVNIWAWQpemkeI1G/LRsWfYQj58J0grheajAYIrqbLLGY/g6mtRAXBsbheE7YInLhG2GoWA9lbeJhN/O588BRJQnx/0WLMYc3GZ5hRuUKBVs90t1NmDCInI4IFtOmSx019wULJS9xo+WLmfv4UyrJSzBIoQUkaQwCdqPChvSJKCNFgaCKI7U7UZtvHlurfOmcgqigVda9OZ+VJ6+eNY0PS2c+ru1mzMDdtn9/bKW0u3gQ5oDEYIv7xzKwFYOGQHnvz3icVGanJA2dXWUPlGdga8rk+QrnDj6IlsL2krmD09Mg7an37hsJz3K9c8NAXHSlsc/yVscRTswg+ODrP8CWFje/n8Jts87nYMMDQmjpwaRjX349Ar1TsojlJx93gorBj5qqXDMw1TOsbP6sfThocLM8V3o61A1ub4UAYhYSOR2duzlCjUxNK9Ru7TPA8i1frbCGn21wv0Ylt/Y758Kd+yEp9qTzyEIMo6hjX9altQSQ5uJZMuqmeCkzctkliOOQslvXhhLefARFaLuA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 978c6326-1a33-4a6d-59c6-08d9a89661f4 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:49.4029 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: s7vYpqNc+wyfFEMA2Eckz4GheeA6fPq8VdV5ONkEnQEE4/6PlUT87YT2KWM8FuHDwOSFlJfLcEEZn+ljQb0P12o4ngsV9DxkPcRzr3fSHOg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 adultscore=0 mlxlogscore=999 malwarescore=0 mlxscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: qEVf_Cf4JcmPX6MHI25OdA03U_Zpygfh X-Proofpoint-GUID: qEVf_Cf4JcmPX6MHI25OdA03U_Zpygfh Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Store a reference to the machine keyring in system keyring code. The system keyring code needs this to complete the keyring link to to machine keyring. Signed-off-by: Eric Snowberg --- v2: Initial version v3: Unmodified from v2 v4: Removed trust_moklist check v5: Rename to machine keyring v7: Unmodified from v5 --- security/integrity/digsig.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 74f73f7cc4fe..109b58840d45 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,6 +116,8 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); + if (id == INTEGRITY_KEYRING_MACHINE) + set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); } From patchwork Tue Nov 16 00:15:43 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620831 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85FCAC28D15 for ; Tue, 16 Nov 2021 00:19:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6D65E61407 for ; Tue, 16 Nov 2021 00:19:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347085AbhKPAWQ (ORCPT ); Mon, 15 Nov 2021 19:22:16 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:20458 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349509AbhKPAUJ (ORCPT ); Mon, 15 Nov 2021 19:20:09 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNPSkn007675; Tue, 16 Nov 2021 00:16:56 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=U7OOz5N2hC5TSXo+gtgewDyrpOY65vzFXYN5kYtI1aE=; b=BCOcgD73y2kufsUi+4XmoDAkvZc40JkQhIz1jKrqQYNz/lG2xXIGEPggEKjKrdqMS3wy lrLxZkGQeXp8OZqqbe8ogObGnxqmH1PBVeinFRikRI+TJvu8k6f6auzFawEBz/O0JgbA y5g5hMZ5fU7k/KOmnzhb9KcV9ojkL974VfdZf+YEX0pqStKPORwlawi8cWgRYysOiTCZ BzsQEwKpBpIvYyOb1IXaFGBsfq5G20YfxgkE8UE2EHP3jWLSvkWxyQb53JR5lXzphNYQ vNsw+pwmoOEBtQqMA2pmLuyILKlco7AusBKM8YfMyP+PZuNznuBYd6GZ9W9U1PcgnxLp Eg== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbhv561bm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:56 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B1Ys046368; Tue, 16 Nov 2021 00:16:55 GMT Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2172.outbound.protection.outlook.com [104.47.57.172]) by userp3020.oracle.com with ESMTP id 3caq4ru9t0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:54 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iJauXUx7eDr4cg5ecVzpcBWXZfpzUNg5ghaKb9GGBPn/mLK74QJv+RSmWDskuAOjGO7HuaP6yiqlzcS7LPMuxO47TKpoCccjUayu1CjXInrbRyWA6rtjgO9Qjk/77sNbvyV9OA/MovQBi8FEdvxh8KYGIE4aKtCe1Gzp6utvuj7LIFbK+VY+cOGT0o+qNGMuUdIEn7Eya0tipC9HWfu9z4PylIocGYkuEjnE1shDKq5Asg+F7NpYjS4wVrMoXps7LVNxkZe+lXb6qqWm3n/zOq9cyNm50Q6uqpvpD3oCzP9sb+KB6r0HLtn3PWfvxK5ZCqujpMNSM00OJ+Nyh6sagw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=U7OOz5N2hC5TSXo+gtgewDyrpOY65vzFXYN5kYtI1aE=; b=T+7TZIFGppx+JVJ9vJpqmgyWcUJ/MtQUNUDG/KnEHOF8XDY6GyDLF0Vct/4xIwlP/ybW/bwAYXa6GSP9FbKcaDbj9vFFdhFXGGe1szlvIUQEfJj4ZpY+EWiFwsCqUQm5dN4MSau6lYp3OP9Q1JeJDlHyj6uglIWBgppAFo0WzeEn+Su/amfL0WWdGB4haOQp5t0GF2WFTwB3+LAScVapa3O/SKjZfzlN4E6rgiTrtjYgjO1y5it6aCFltdKoYt53yuHgqZMp5RpL2230jIBR8bvsLykwGM23aQ2AD/nzgOPQDesF3UQCvLTtBjFv6BoYDYBXpKvc/9saenmelkqn/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=U7OOz5N2hC5TSXo+gtgewDyrpOY65vzFXYN5kYtI1aE=; b=cZAex+YSY1DDwXOQEVPDSq1/txxWSH9JARuhhHjf8/QLTLoBdJ3MTlWX88k9/a0M/tu5BFk+oIrkuQ6ajLA/TjpqA4BhVE/EqKvL8Lc7AzFxSHk34i6V6L6qbWNvKso0PX7WlMBIH1vIXDUHOomdw02YRnar3lbwyp91OGAb+Wk= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:52 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:52 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 15/17] efi/mokvar: move up init order Date: Mon, 15 Nov 2021 19:15:43 -0500 Message-Id: <20211116001545.2639333-16-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:49 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 8a0f5eb7-8ede-4b81-feb5-08d9a896638e X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1227; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: d6Ai79a1QTM9gAPP687k11UXc6dJhJOcVRWV/Za27woUxzPHRplFLcX2x9TWC0IqQhFr1A76NfPdHt/CLPpbCBqPfs4jNsqOKFI9VT5dvTiveNoADmlljAeJI+tssalS+tutNCQihqFbvL7Z2kC5F69U7Ti6o68ankqnfUidSd6iQ30VjqIrbawtsuHYcsaQeC8MNWUMd0dM5a4mBI3J/pvgMbcT7IPuuikVoDA2rtB37yT+RP7xvbzhz+NSp3v7FHwTkBG2FChhe+GWfbkauynpfsDObd7nVA/OS2u/bmzFVydr+wljTwWMyyQM8t+Mjn+SVRe3LlnJr/GWaZFYWWv7c7LCke+v74Jdc3+sING9xGPiRDibhxx4OP01VCq3hlsf2yqATGMEzL+DJ9YDyLNJj9bi2UE5Eu6d/X747t1DqzKmBqk+mNk8cPcTaG398sSif31evKWf+6nUwv/OX/YriH7vQYD1SvBnoXEmptvdqxy51SIfd8uhb6GzyUSSJpC4DLQ7tXdhlUvwabGSalY6Cd9Tuq1y6jvbqnBHT7wn6+twqmZaJJczlj7LFFNz7RmMoyvzGMZWI0xyZ9VkGRvdeh22Dq/lemf4P1D1pmrUbrEPqOZU5oV2NyEr93UcYQwMeoqnaaTWtLRO8zvArkbO6NY99UTTpVLYj5n5Jm/eakdQtaxQtC03EdtzS7utvAkkdfvamHStdeXboej76Ibrppt535qINAZ05+Pc9hc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(4744005)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: A0ZI9O7W0djkEaNEeCy8Is7qnorryRi4cOcyBbKZZsRqkIJoZy60REeGX+rLvcAKKQbvmirDNl9PJEI3PgpMlPwaDztEOgNtjrJGHtJdU1VGnLDfaOuv62veMF811w1YfIttIZMRjdnui32glq1gBz6oeseeL1pXbvhFavOQ54YA0Vj2IWMmHYc27Q09uKbEzcFQ5VYW4vnHIexbdsoMGefNiAQsF28dxXTosATGXzMYlLU3TVOZfF8ywfisgAz3cJMHiVb4nQxVI2p8fYDfYHxtbQlelEN++pqBV0DmyhyTyeHQo6LhCJi4WPo4AzvIZO7DoE4okz4WB3q0iuIPt+k6kqru9ENXiv5ceMc15eyYWf72/l8KUWjk8YvCr7ySzfbuIhA8NLU5qRtIns+FOIDw8nOczbZXzf2hgLg+blbNPsxmpxPGbw9KcHKR3ScXw4ZMI1B6r5Syvx8+eNqbkDZSes9gk3tWsTNBLMGPLK6eU97xX+7PXCx0XkU0cj4qO09vrRy1h0/wvt2cMYwAC2sXb8O0u28cxLPlzA9+lbbgWFvrAS1mC5z7uClHMoyzZ5IK33qXjNvs3rmxykoH92Y+VE7ZRoEKptYT1lJwDMLMwmwV+udYrXXCFMPN7pH9Z85EfbYnXXPNwmt09fMZBp8RlRB5+YD6N2VJZvBynD2+idaXDdcqvDmY1wiLHaJumxIJVOOvWLo71xbl/SCcINzVWVkZveb0b+OyuUuye0M0dWCczxagEnKSwKHmbmDA+3/qkg0ljJcoELRqu7NFvp1wiYJUh3vm96VK+hOHn3Vw6dIhr/v5jX+l5mbC5sH+RT4no8XmEhq2w5BZWNyZmR6ubhz3CGOZg8cWQY0ZxFsj3F5WUk2ixx7cxXllxwR/zwaKxGo30B2WVXfSVQ4WqgpNhrTKAS/SuxtQFiXHBaC+qPjk09U+GkXCU4I+OrfhEGhPAXBZ2MHzTberMeaSME4Di7oxK58JTjTnuSWzUFdIWjEa5SHyDPF7uHvizQCA8wFpTr2LMVAPJ9wiHRboo2r6NTa9pxMT3J/CCoFx7dPT2dKWL81GaWS3b8b8Kh4Ax6wlSWV+2dNtevnWvKHF3Que5yxpYoTCRMd065OnU3wVNCAog1viQIaRtxT2Iuefs3Zc6XQNkJtWSkjTrf6oqRYBJGfdgdzmxbQZA3nlNpRdjBC+7LaHcXd3W6FCbn3TlQzVxh3VqS2r8fGzkyhfE4uljhuQilsrWahhGFbS5obcC1i7v4bYwmSLT71mwDVjUMOn0Rl+zGtKyDGB9fvxLb5D18+5i3yKSADfVOsECuavUFFz31obL/uYbabBOU+7NBaMAu5udjRWSVktLkNGmHf8ouh9lZvJKpV9H5SF1eJMl+UJCZocwlU/NzVf9XVGRa+ZR3QDyk9dX8h5cOAExnGAp0wtoor8s/Y1LbqnScBa4lscBnWuXbr0WQLKTqraX6eNajW61C8waMnBb3Vuw1ErKoQQ16PttLBMaG8Ten/pnbK+CJDwbwmr6jatnTVkrj8vjAgVSwl1FR2uLL76DaiyvIwYMSnjDazzlOseeBt+9aAsSKCA8kVrotiyE6j3du/ArWgUoAlvKQCpgzMC6H66Z2OVwzoYXOS2yOnyLWbuCwqm6ryr4isn2OSXXVI88qVMOntVp+jxNWYLSsijaw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8a0f5eb7-8ede-4b81-feb5-08d9a896638e X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:52.1738 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: PtjDKi62WnFxEsTGUwl3naNbJgPPek2HV2l3KY9/fHIsGAwqeBdRuFrFTKcxawnM8FoFwgZPAQ/0IW8pICp9kNka28J5gaWuwdqPW8t79eg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: X2ivz6U1tWHqo3LpZa69OM55fcTQpXhz X-Proofpoint-GUID: X2ivz6U1tWHqo3LpZa69OM55fcTQpXhz Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Move up the init order so it can be used by the new machine keyring. Signed-off-by: Eric Snowberg --- v7: Initial version --- drivers/firmware/efi/mokvar-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 38722d2009e2..5ed0602c2f75 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -359,4 +359,4 @@ static int __init efi_mokvar_sysfs_init(void) } return err; } -device_initcall(efi_mokvar_sysfs_init); +fs_initcall(efi_mokvar_sysfs_init); From patchwork Tue Nov 16 00:15:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620835 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D734C4167B for ; Tue, 16 Nov 2021 00:19:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 008C0614C8 for ; Tue, 16 Nov 2021 00:19:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347795AbhKPAWS (ORCPT ); Mon, 15 Nov 2021 19:22:18 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:25566 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348497AbhKPAUN (ORCPT ); Mon, 15 Nov 2021 19:20:13 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNNmcB001717; Tue, 16 Nov 2021 00:16:58 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=/5NuIxD+XV2XONuyuvz8PErITGHCkY5jI0gcJLNHf6M=; b=jVULcMMpwg4uxqm9OWcKHDiwY6TvXFM8g9nXVEMSi1IX5vylHqRlD2DNG88Jul9c/l9D XQIsZpbdCxX1VWyYobFnpnpblSfkWqrvaE8Q/Ak80P8yH3tT20hIqu8ySycH7YMu9Pbe 2TRKKfAcJJvvQHoBNDrqnPnQw/S2W7ahSVJ6wmf0Ee3RBAP8a8o6aYCBbCbb0xflwhtg ftJoEQc0yogNY25pPSXgq51CWZFMO3rbbwFob/+8gDuwuC3stu405IOEr4FSd5t6D3QV guisZFvtmrLE2ONxYjat024aGEkSlAQi2RmTNMIZ8vJeZl/Tzefzfk9ERLpIrzWh8C38 Iw== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbh3dwwa6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:57 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0ANmh073035; Tue, 16 Nov 2021 00:16:57 GMT Received: from nam11-dm6-obe.outbound.protection.outlook.com (mail-dm6nam11lp2168.outbound.protection.outlook.com [104.47.57.168]) by aserp3030.oracle.com with ESMTP id 3ca3df6jkv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:16:56 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iDDiOW7jujNKM3zXsF+KoxDZAW/sFZ2C14k8faQfKLgoglE6mQ2w+x1/5P6AWtRiNG11Y2ezyxzgiMJAbdPCoHu1ae14G3oRrcXc/XMOHh9Y7PMk3TO4xSd3i4zmlEzxakx86iKdKbc3hyPdGnt2qt7nQLJi55kw6/Dm3/yhefOsM+X6ww7bRyVyKKy/BbvC7wdKHrxTHqXglH0FRAnvgK7VREiWoMx0C0D25Yt+olV7XZ4Rw2v3ichL1/De4hiQul936eeqGWix04LjYXXy0DqRl2xzESOe3HPOe+3YFMfYoQyZ0UTdHn8ohcf+qg5tp67C7ieSbut5o/EeWIC1rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/5NuIxD+XV2XONuyuvz8PErITGHCkY5jI0gcJLNHf6M=; b=ZLbkREfqhw09xrTSomgN4sWXeE5f/rUCsVb+509BJu2g2/4uAGteNYTFUV6yGnCKUwzsKLbaKn/xRMRccYh6yrWrZ8qmI/L6Au8knezbqZfpKB8fZvm8M4zRlgd+6Z5BFT08gByPSYP6zRtXjYiIe6jeXpqTqau8FAmSIKy5qPtwU3AGn+RaquOhfrMSIIDcYgRoaiK33fEQL4/WZFjFDMWa+OJJ9ynuBnqNSYWXPf1kHWhUHKN3bEnmTKmT7p2q12cBmRQVJGXp1aumi1Yqe6k2BUcth8PGyR55JLQP23a1eCnZbwc3hbQLzDJgRywcY7loroxxJnvUOm6tPI/Ihg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/5NuIxD+XV2XONuyuvz8PErITGHCkY5jI0gcJLNHf6M=; b=qKo+qIARWMYx9np0pf1iSUCpvrZ54Q39fLsZpU5P52W05nbCVBe9SkxQPnzjaSf/eQPSnDNeRQI/x/6n7cscK88gZM0n6cBNnxujbg+HfpTd1zfozQSk1MH5WN2sO2bTOrTIZvNFNwJWbqDxM0NNYOz8ZuOEm/09bHJsi/djuWc= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:54 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:54 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 16/17] integrity: Trust MOK keys if MokListTrustedRT found Date: Mon, 15 Nov 2021 19:15:44 -0500 Message-Id: <20211116001545.2639333-17-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:52 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c4ecc319-8ccb-4cb7-b0db-08d9a8966531 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 0UDaMCZDDzEwQPi8S3bnAt+T2gZhmUaGwrnYp9VOmT9WgU/SXY7cKGCNynv0CqvJSyhCJtmF9AOwVLgolRbdoNrh1Z+nqT68MYtKeeQjZ8lY6fpkQI2AtPiZpRSBJwNBcinNQIqaKw7xU2hz2FaF4pJZRt8xbWDh+V3gnpFngshurZjHeC5kKCYxB2582A+hwCj6jgF/mv+Cpzpx4RNKT3yicP8S0zJ0lJDKQNlci0YCR+adDy6nwZNHoh5H+57nWfT+mi47TWM9VH8OLTIoAZykw7qd8C/meqN4dd8pYCE7lyTFcf6wS+wr6N/yYoTDWgM1+K3ePKeeAYRY51uWGebXf/sw0GVBtfuZ8lTTRCFEs022NDJqBxgXjOTBiM6HDmJY4b5AvdA1CVohLrQKMy9duJNWPJCoExKXUdVAc/lD/VIJqgo7fEbJYl7lEueXFXj20jnhp5/MJLLs/ep+vxTHG+PKa45cKvBRtsJbJKUyC7JIwmUFA+1n752v3Tb5xTA+r16tMvyHRwsqEVBhtIa5JxM20GrLZZLD5MFVwr0RB1gc3wwBCdQX8iyADwBF7cZvFA9xpnGVKrcVvCjF1FxvWHv7Mew2AnBkEMMuqRaQ4l/5tYabIXpVcFCvNXZEieJgRdCJYto7du7wnt7G0a6OyZYK7Ci+2tuLKvrXNVao5bILFkeT1q/6iRxfKhm4dSVfXvfQmfZM6xy9n5kpJlsVOnDGtgUOFklmlCpUKjU= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: laa0elK2JdrLgk0ac6X5zOJVMo6/fbM+ytNh8ZeR8kBu3yut7YBtrPeRQny/LRXjFNrw66IgRl9y7wAC2AYTUhTZAgUPI0JlpfJ2UMZZ/XUuFf34EGhMpsOTkSFSGOIsELNI0+qhAXjNF7clath8c48OVwAMBQERj59QngduPFcU7WWUt/ZdAwdrXORB4G+nK/2zkgeRqrVvQ/xihBN8TBAKKOJxZkULrjt++omLzHl+8m99lm4Xh+LAFP/prpiRz7co9tHEwRmznoQx7kSSXkzTAKOXrgdSDFRbQK9bQ4r4Q+M2k1WzxgLhibxwfE62IHmu8htfhXgwktSNE9JKKkjt4dsZZ/jI+SU0BaW2HOGd15Pkd2DwLjbxvtj1R1+epo6Gp9XodgABRJf/ZgOQpq1UJ85ksjqadUgI3UTtZusH35iWt8TylJ36PCRWVruezZ5RPchby54qpQtmY5dPaLnRJesLWdVr6+ASJTEApZHL7Zzece6oKJHDWDlURGaJH9BFXIW8tqDofYGAgHsK4UK66kMO7lz8O6DP/VgZRNj/zHyfODlJJvhINBXbCHlW05xA/UUTpJUUHMiiPG5Aw+jrTciEXyWeZFQcPqbFZvs6kRZh2kMegjYZVQKJcyQBnJrzMmCATcYgah2aOHXBNBS1bO8Z40GGk2klaSw7qZkdR2DlvEe5WWBhyT5YvBYw3NHjdwsp4zfHt0WWlpAuGOKzxYHXLgXLAmrAVNLRRn+eK1xG88v2u8v10Zt7sTI+juBp+VqGDTNgvP8uCoWcloRntHIhkUpNhMJJoMOCg+9gc1iKm8oA3WuqYd9m8BQcjZshh8ndOMNml0ZauBcBphBYHTz92O2c8c2lzTwSwfBtVlT4mc4WeOcc160DVM8UWJkP7RiItg54o8ty5iaXIkSJNsyfpRqCAz+DacxD+gbUUeQAQ6I81moMqn6PIgMHc/ypgYkBSW8EJhMIzbuJqHseiPYaZycHZnWOu65Qfkaj9Nzs5ZVOufepEr2/8bETNN+aC3hkMgpoQvpnFQ+DLVCvmTZbCaLTdwArSWUYuKEMDR3KrD8G4bXdcjQXue0tW6jSxh+3az5aT2e9XYRc1B9JHb6+WfZq3QzlMRswGzQG6pf6tZLj57ZcIXmrWrAXm6N/DzizpzZ8QRpt5+IOWsDN5AtnOW5ayzMtklN3imrlPZrAB+H/ZQhj5wL0HWnmSobfEZlykRFq/ISEswxUlKzame1amTc7/bF/fyEOjYwTtHwf75qU4TPh/vjeEv5jpSKuAVma4qF6y4CAevDrPvio/7e0laKcE0f/JSptOZ9cedzEKrvbRHWHaBE9ZxlCyI/E+8G1ym+9kuV3YPdJ63Mzg2o1naLxG+dVURgbDkcaIFoyn2uq0toANiO0Ygark152Cej+Qk354NJRCxezt/GBCevUHZlibLeO/elJJOCQmuu6cAMLZHRdBzpup7lmC6jniGAqLNG9Ue6nM4kzr9AzkGJyQepWdZtJ3Sqv0V3uOFphTRXS571fiKwYyZY+QGPxjM7qAJovLf63u/y4esa05rptPtUv39US/3MHkTA5C+91SC/oLucWyUmnc44mwAMOKPKXWviRd1oaQoXNL6ILyMtE6zJbMCXW/4fKR2LohkIUsGRXksbdxwIzN10iVYUB1cTfnHwpvdYv2rds+Q== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: c4ecc319-8ccb-4cb7-b0db-08d9a8966531 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:54.8271 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Hkt+X6qJH6MlCxmT5qY682GwTyHbAScB5tF5uTtbVuMrMKzTjrvp93p4U6CoVw/aZjJecxSGbtZIPvbww85uEGtmpLTzJbwz3DQbqYQUfsc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 bulkscore=0 spamscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 suspectscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-GUID: IoonEpr3HJebwqOnGpdM5nrbISFuL8t_ X-Proofpoint-ORIG-GUID: IoonEpr3HJebwqOnGpdM5nrbISFuL8t_ Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org A new Machine Owner Key (MOK) variable called MokListTrustedRT has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themselves that they wish to trust MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the MOK keys should not be trusted within the kernel. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed mok_keyring_trust_setup function v4: Unmodified from v2 v5: Rename to machine keyring v6: Unmodified from v5 v7: Use mokvar table instead of EFI var (suggested by Peter Jones) --- .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index ea2ac2f9f2b5..09fd8f20c756 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -5,6 +5,7 @@ * Copyright (c) 2021, Oracle and/or its affiliates. */ +#include #include "../integrity.h" static __init int machine_keyring_init(void) @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t if (rc) pr_info("Error adding keys to machine keyring %s\n", source); } + +/* + * Try to load the MokListTrustedRT MOK variable to see if we should trust + * the MOK keys within the kernel. It is not an error if this variable + * does not exist. If it does not exist, MOK keys should not be trusted + * within the machine keyring. + */ +static __init bool uefi_check_trust_mok_keys(void) +{ + struct efi_mokvar_table_entry *mokvar_entry; + + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT"); + + if (mokvar_entry) + return true; + + return false; +} From patchwork Tue Nov 16 00:15:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12620841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63CB1C43219 for ; Tue, 16 Nov 2021 00:19:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4BDFB61131 for ; Tue, 16 Nov 2021 00:19:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347926AbhKPAWV (ORCPT ); Mon, 15 Nov 2021 19:22:21 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:18108 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349721AbhKPAUR (ORCPT ); Mon, 15 Nov 2021 19:20:17 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 1AFNUB3O013790; Tue, 16 Nov 2021 00:17:02 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=2372HCIvuNXObcgcFNIhrtpicwfVjtqo4xDCb5yI4rc=; b=acNuIRO6pFz+1haQgDtG/DVh13NUucvXq2tLxOa1L6KJfowGU0HUM9OeOn4QBhsxKfPF 8I8QFc6/FphPF79d4wDFDF4M7OlAMowD4bB6ZrqJwHuwY3U0I1Qxd8IHNnhzYhyltuJ5 2mWL7tPHEz/QJpeGcxNMJje7M4Gz+FdVqh04t5gZ+0OwR90RDACbPPL+IWNlf4E6Tx5r PqO8hi4GRiXizga5e20s7FAt/DNwZ+z+s2sWazV8ywNOgvzP7ihNbljzV00qbs6v1X+p ouwcSW+3CYJTpGauNqIRzfZ2KO3uNWnyeLX5l9l4hzDGWSKX8H7GhbkI/OM/Q6D3LXo5 ew== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3cbfjxpbfg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:17:01 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 1AG0B0nC046183; Tue, 16 Nov 2021 00:17:00 GMT Received: from nam04-mw2-obe.outbound.protection.outlook.com (mail-mw2nam08lp2175.outbound.protection.outlook.com [104.47.73.175]) by userp3020.oracle.com with ESMTP id 3caq4ru9we-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 16 Nov 2021 00:17:00 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=G+f1zTzhyQSO0Nbv6zgN3NGI8/K0Y6ErSUZ2NNmqJo5v4OhNJX27RB9yexvMRIQtcO20PzIhbc13SaPIAcrFpm5H9MBMQJYxDRFJxioys75NA+3nnDHOuf4ImHfCDX4QTN182piLhJHufAVrITa4QQHjDlQ7ewDY03XSe/cipfuTRL58071ULYGtkof9g76Tc1hsHb//Q6PbH9dgM6KDpvZeBN+km0XO44jneNKYpXaI15RuYG2rdEsr/UXQZkFwhUxs3ECFH22TKvqQH/H9qvixKvuwdYVlJV3nIuhImsMdBEohW+ooik+wqECcU8RuThcs/jJOXzLeW7dt/Mdw2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2372HCIvuNXObcgcFNIhrtpicwfVjtqo4xDCb5yI4rc=; b=Hs7XDA3YLsUHZ6yRdlcTx+VvCEuf6zOpuok5V7rrpodXtGGVBZdggh/YRFR5YFOkj2pmhBzMmpW4uIfk2kvBkfwhb0Tmzo1i/QODWnmXgTm9J2SYeyfjI0YX+pWlI0vxjWpHOJh8hZstBww9yvRJOFjgmp4l0Lo/A/2zo+sz0867owE/LjoDSnwiKtZQYnDSGc/0WHL38VeITUw+46qX4TfHcvksEZLywdx+muJoCNCv/LPYNfYxB5mOnznWh1j7cL6MNaWzRAQGA2fP9b/VX5GBmWEolDjEolXB+MocZ82EtsXjqUWxzVwFtw4NDTA+tVsrlRHM/y3lepoV8HGE5w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2372HCIvuNXObcgcFNIhrtpicwfVjtqo4xDCb5yI4rc=; b=ztUjJJ/MdDX1H2STkqeIuXsaiCsqyaXNhcW6Vzoh0JP9d/P9B609nMJml0ZUjahOB3KFrY0bus3qAAMyHiIw6bjluwD9dco2aGjFEIfdBrIf5N/CIgmNKaU6Kp9PSrtqJfu0D7JueVPJbUcNzikFLjQqkZfdNG+Y81dgw2MzsXI= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5276.namprd10.prod.outlook.com (2603:10b6:610:c4::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.20; Tue, 16 Nov 2021 00:16:57 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::65b8:d8e7:e373:4896%9]) with mapi id 15.20.4690.027; Tue, 16 Nov 2021 00:16:57 +0000 From: Eric Snowberg To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org, zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au, davem@davemloft.net, jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com Cc: eric.snowberg@oracle.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com, linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v7 17/17] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Date: Mon, 15 Nov 2021 19:15:45 -0500 Message-Id: <20211116001545.2639333-18-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com> References: <20211116001545.2639333-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 Received: from ca-dev113.us.oracle.com (148.87.23.5) by SN1PR12CA0048.namprd12.prod.outlook.com (2603:10b6:802:20::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.26 via Frontend Transport; Tue, 16 Nov 2021 00:16:55 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 0db1ff32-ac5f-42ae-fe3f-08d9a89666c8 X-MS-TrafficTypeDiagnostic: CH0PR10MB5276: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: A4F3jnRSClHT4X6JCndAC3hfEHG6lsDDk3RFy8H/j90+C3KqM0J1wPVpl5Wj9pas95/lgzMA28hGOYef7Af0oL/33JepQpZWp0qhB9SRFGKarolIH+6MWTN7tFA8aG0LUdNmuumB2RT5foNfPZP0gUHU56OW4/XYBfpiS4mnHnLEE+P7hYwWvWCvYFu47w/KDI/59xDdVVSyruM7p2Y/fNXbIQfEJwdFskst158C/eDRV6Kc5zBRpN2f+5DhudD2VJpcbiWG+hoZb6UJX5qkNGieoat3zcOrMP3PbxXp1fUPOhDrbYHxHKHIWZZpNKoKbgIriDn5AmBUiOEN4ezWNA2sVPy9BKb35oH0ctzoRbEu2dLm5TnoUgQ5LXCGbd6hapfl0RDC4ZLf4Y2iOyn9J5TufRmiVbzffWhoScrc5fRqi2cpuuumjNAnZUFfTcK4fOq9GrhZfNf6NCLSNPBnC0hkTNEim2tcUH2YWBFdjfa+Um4NRKMdm+E0HXT0HLfTeBPC0zSDvQWqQiIM87KXfWTLQMRLsFhsIxlRsE7056e2wtmlEyfhboRMmTgxK9AtO0lCD32ca1lRH6WJL4N+GA4ieOcOAZTOGFHGCmSKbffjy+F3b/gZcCajWBp2eOKwx/L/sBcSM9i6KTn/pRimBU1wqh6zcdgzSQ+enH0I6gvmelf0XdDkOnFzbbdAwiAK8IuvwUEAoWyY9nMbWrpUj1801fWHNKExbDzLPZXWEmw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(6486002)(316002)(66946007)(508600001)(7696005)(66556008)(66476007)(52116002)(186003)(2906002)(26005)(1076003)(44832011)(36756003)(38350700002)(38100700002)(6666004)(4326008)(921005)(8936002)(83380400001)(5660300002)(8676002)(7416002)(86362001)(956004)(107886003)(2616005);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: oqNYZiulgj/GyelJTvnO7nsdnuLNdaZA1CSCAQXY+E4sJnUIwGe1+bBObwHAW4KTI7xTtISBF6O23zSAoc5w6c3Rj1J++MdnNeyK9Dqrb4Rx2VS3AIgiyP+VjGrM4N2V0bA4/74abbRvqxknLT6d5zVtZDb3ZZsViI3KBjhXltHCG6yS1JOwbkDC5Ju9DS9prv7kZH8b3byW6P4tRWmeM5MUOLDOm34u4SqBj2VzphOKc6D3q0gCsT680/gdIxPjzMtxrqZkSldFH3fT4+SrLayS3Z0cYumnC7pGgFkQJP1utuirZDB7eYnM8cH+3PtCtXAIGHQ4ykN16ZMFBuOtXwlgmxgwrSpJ79E+RvPSGK8CjDP4pl+NXozvGhx7tzggjfzA/2boq0pJilYoDyEZTdg14x/ifJU7rKF/3iC9GAq6LqYKaebJ3Uquv96fN8kDCT17rkNz5YfUJem2F9xBMHqCOLd7bQx41H6N7h6qEzTUAcvtPyDgWjNwzmQ/6NjHm+jmbKHRWBuR59b+rHt2vyNOTXBHmwSzFvlaE7mBmkOjtl2PMlGRnT1eZijf9uMsVjFpd//JZRfwUUPKydH2uBSsS3r0fZ7bbfANV4W5wNJwEeWe88U+1QyrvecWTNoOOlmk6Wa2UTDFwePNlyJpPtqZitPQkas+3xn969BmZnrQkjnA2a+q//nisr8Q140w8W2xRaWbKhMiRKL7d48HLXOEYP/T2AhsrTs9kY7mxaJcRWlTDL9c5xCtUW5Msc9DIksiy2chCJskEGdCPXcu1tDcF82kZtDOVedKdqfQWoi8KYhwzUp3qSr5SrPru460EueATaHI7FRUuSL9beGxNabAplovEwOGe0dAbFOTRlvsGPQVnmm/dqj+Wqb0uXCtFpPPxIFm7gMTNO4tBMAg5C7HQpswQ6DLJ5iW8s/WaWf4AY425Bpjl13BUl89eQBAkEOhy6O6LbOxZuQ+/+DbTnB+hAdnAomq9y/jOVuiNExDZU9b65700h6rIR3rvOMLBr0EcQORpcogKSNrP2Zse4+luAVwCpTekry1sMJ7Dv2xmU40k29TSAeDa4F87uUyS5wrrClHr1jX0qJICF15z+CXS8U5uXImufj4sL6ZrayEUF87PI9FlYnFIObnXoqVHFQlZLq3IQFY6XQa4r9dmpRCWIoF0XoLDCesGiHAFOrBxwxaUVaBm0GzarW28ladPhjH00ZE6M/F2yIAqInUaJqJWyZcDq9dI8mYv9sJ5IrvkUg49M4kLLNTTjgK9y/mXFYcNP/loOqu2VPlGx0IM0jhOVOc8uxnckhcZgNU/nb6w7Yio5qOXBdiSu/ICoVKIKATMCpc+UiuFOG1+nGQ1LeSszaCo0CZv2yvCYbpNsubxqB5I1t15rK/8y5XmwMB6ojAwW/mn1i2YUmeDIu8b4aqQT+LOT+xF+Xv87t3lBIYly+kbGJxsbqXbEpws1g8xmUCoztaXvyNH1qaGn494b3opVHL4in9rfOOWJlzIw+Qyl+cAOtcOi6KiWBvhXDpfqEmM1iBVYDLPvlTnE62VvhEmT6sbZpTWcDqHtFVNAvN8IQRk9htRf6JbOqplCx7fdvuyh1TdCmAwS09bLR5epgsM3iHQIlXM7GXtxs2ioupfHULMuvbYatzcixwQPlNQsuIwS2RSa3F4GSMZ/cgXA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0db1ff32-ac5f-42ae-fe3f-08d9a89666c8 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:57.5651 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: PyX9RvALxKjJnbX+COOzi/h8uv+sVRGhkUMEZlE4G0b1zL1vl9Yqe7tY6nRoNx93rcj9+WurgaQKIgyTO1V8iqblrwtDV5ZyZyOlPJ1brbc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000 definitions=main-2111150124 X-Proofpoint-ORIG-GUID: hmaFrdIDUiFAfj5rZniORGhqb41OM539 X-Proofpoint-GUID: hmaFrdIDUiFAfj5rZniORGhqb41OM539 Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org With the introduction of uefi_check_trust_mok_keys, it signifies the end- user wants to trust the machine keyring as trusted keys. If they have chosen to trust the machine keyring, load the qualifying keys into it during boot, then link it to the secondary keyring . If the user has not chosen to trust the machine keyring, it will be empty and not linked to the secondary keyring. Signed-off-by: Eric Snowberg --- v4: Initial version v5: Rename to machine keyring v6: Unmodified from v5 v7: Made trust_mok static --- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 5 +++++ .../integrity/platform_certs/keyring_handler.c | 2 +- .../integrity/platform_certs/machine_keyring.c | 16 ++++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 109b58840d45..1de09c7b5f93 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -116,7 +116,7 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); - if (id == INTEGRITY_KEYRING_MACHINE) + if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 730771eececd..2e214c761158 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source, #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +bool __init trust_moklist(void); #else static inline void __init add_to_machine_keyring(const char *source, const void *data, size_t len) { } +static inline bool __init trust_moklist(void) +{ + return false; +} #endif diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 4872850d081f..1db4d3b4356d 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) { if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) return add_to_machine_keyring; else return add_to_platform_keyring; diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index 09fd8f20c756..7aaed7950b6e 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -8,6 +8,8 @@ #include #include "../integrity.h" +static bool trust_mok; + static __init int machine_keyring_init(void) { int rc; @@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void) return false; } + +bool __init trust_moklist(void) +{ + static bool initialized; + + if (!initialized) { + initialized = true; + + if (uefi_check_trust_mok_keys()) + trust_mok = true; + } + + return trust_mok; +}