From patchwork Wed Jan 26 02:58:27 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724511 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AA57C636D5 for ; Wed, 26 Jan 2022 03:00:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236789AbiAZDAO (ORCPT ); Tue, 25 Jan 2022 22:00:14 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:43288 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236737AbiAZDAK (ORCPT ); Tue, 25 Jan 2022 22:00:10 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMn8v7007704; Wed, 26 Jan 2022 02:59:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=ySThEHNMp2v6MxARykWra1hpqPfHpaDkvQhWD7hNwfs=; b=HSuGnSqmg40lwvLx0UMEcQY1x8hq4C89wX3RNSjBTz9Tn1FgC1YR9h+OrJ6n28ihyTKh pcP3E3/WMA14C196kYTbcTVrGOtwP7oGWLhBfLrQUFXlz5yZIqhxua0hrNToiJOLbCfm aRezL46DT1Hb6OaXLLhLQ2MsxUlPnMpyl+OUOHr+H7ryryrnR3eGNAKgbG5u1/qIkpfk 3uBy6E8nO+qGxDYtJ0G7AQrIDfdk0c/m8na3Md76jRCmBr9f5O61uLGNVgTnzTtqUxMS 0Yfk6zk0PRGs2eAoKgOh5sS4t+5kP81wNcx4iHuyfq0jwSD9fgZXAtjZG8P+rU6TL3VW Cw== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsy9s4x6b-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:34 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oS7e068311; Wed, 26 Jan 2022 02:59:33 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2045.outbound.protection.outlook.com [104.47.66.45]) by userp3020.oracle.com with ESMTP id 3drbcq7v4f-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:32 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kTtGTLQQVrGuPkfSYfg2iHvPcaKghJzv2Poba65MTp5Ks9SDQq9bcnhykVSphO0Gks6aXGp/9tUt+2GGzJo/TYOghhJVADa3Djk6XggtpAXkPT5EoIE8y6PD02EM2bgD7IxV88UnuxJz2FQ0JBIXZNqzJCL/OfpRC69XWSOjAZygpytmh2xuqxRR0wwYqDiWyFvtpu4iTuhoR4p/MP/2oAjlKMN4FrgIyRx3cgTpuiK6mEVoY17yx8e9Nt4ipl6Jo8/1zcqGsmb/sVTJINcOPgD4KglvRDWwanwvYLecCVuyYUNe4JXHjo29C70lN3TZwOkNNXiLGRAmzOhWnmYu3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ySThEHNMp2v6MxARykWra1hpqPfHpaDkvQhWD7hNwfs=; b=ZEoeHKeYntpMjvtSHcA4kvtP35Lv4igomDAq1gYS+LQ38rORYo/jc6aFGF9Pio3cz4T4WwJHIcxJnDSWyfB445KSBqfHmQ0hrHGpCeBX+CZTgeV8TLnB8nXgllATYmL7ZUl/5+QXlzt+Kynj3/2wHdrSTmbNtBFQ5Mc7TYK1oYqflYxpYA1OwG6rD9kPrpGygCfyHKVOex20dH0ebnI6fGt2wwGgtow4pTiX4flQT6e0UOu6/AxU8xtQnaX3zYQDCE0RHNtDTZDPNc1JwEDupD5vO/Gvs/6TloFuTbiqP2DpMRgTBQd67hA3tvhjwWgZyIeRLQMeOlY99jkdL2sEEw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ySThEHNMp2v6MxARykWra1hpqPfHpaDkvQhWD7hNwfs=; b=Zl9qqmHOHtBhzSUH4h6F4IX+lzOCjGrYEtDo2LH2H/IqaBOnzbDVObcB/ucRTTDRKv9R0J/XWg6YABzhtIgQ9NvPgQLlrocEjy6KpMhRMeu7d1hJmVyvf8rTrgWNPnHla6x4p9UwGH3HeghntiF3U1fFdOOaOLFQjmV/FIyR3yU= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:31 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:30 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 1/8] integrity: Fix warning about missing prototypes Date: Tue, 25 Jan 2022 21:58:27 -0500 Message-Id: <20220126025834.255493-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 08cd10c9-d6aa-4a58-13bb-08d9e077dfa9 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:115; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: +V+mS8Tj5nkXyYzXIyPnUN/Y8vYv6oGTI98iyHkSQSyej4vUbOfcmnaspLhS8nFy+kYNF4FiQ4wf1OJhrFeQLthLDoBNsU6W1Fhq7af+j6r6LtO+ryojcpgVnfRVsy2okEUbmQqhIYeQRIZAsXFr45MCJpRryRk/ZwyNSpNyzrEL+iFTH4xWe88XM55HYE10+u9Fh1yc7sArfYfjEpnCylj0hzu5Ez6SkOt6QlCbYrY/QlLiPj+vpbKr9wAdXsqzkM0NsCnG7cK7Lz8vcOVQ46c0lsfP478XqwosgdzFxKZmb6DQ2ylRqPMZowIFUwrdAiJy6D8IqYLH+1ZH7TdUxnvS8cgA6NlBEvHdsbWNvCo+Gx3Ols35lhsatY00EqXoiPm0tDpnQxPo9ymtAlru4jb1gTW+hmkG3jox1TaxTfvgDHHahVpeU+duyGCcj49tAHkxBsJBpY3YwIvcpcg1+fOILpCPbedVdCHZo8UvSMLzNAShECw8MBeGsPT0mOmCplKErNp7Qu6hydlW8AMlGlPQlEnLNhteERwQBemvZhkf10p6iQII4PoS8bPv6IuLX/OfG8QoC2I/tWSIaH33pQKMZ6k0ZaWPTUcwJEb6A0k9/IZdH7IfVQoTQHe31XT/jauVk6QXzIdf6vHlcJKB19tfu0A0e9NOh7Fo6gFiEH82uKsTs68BTVPpATk8wQPEs0zSaQLJzZsxiTkKrvJjNA== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: IU1WcfUI26qjaHjShCOIlKTbks1uUHQZwLyCRp/daHQyDKIkGOhgeEWy7//haPT7cuSSreB/ACHoFuYoQVuFsphpoEuQt2MeRMBoe1psWgxaSm0neVhZ9FINXOahRGNzCBqgaQQVLQSW20sJm5boVQ2OncPM26+UrUQeIK5daGmD3ilfngm1XaBlDCDqhz3E6dom1EaUuEwZSoGqavHaYZXtXNJI5Dy7NxkgT6eezSmMKY/A16UHn//b3wrY3B1W34EVG1XjllPZkKQTUNqfoXGUvThRS7sOIDv/8mDY9NVKLaZQ+5iEukVh3QZJ9WXI8gNVa64VJJYwxPopO7rwaQbDqyPP0m/5YpgI6PqYLWbhiuBB1Nu/DE6+vbR8RYxfgZe2xWPYQZZyNAHNOZ3zQFyqDM1q6pt3Xy4VXINJ1r2eFz3+Cff4HaSfs4b7kdrt2GViLx49Ln/VAlef4NlOW4+0IPyxXOMbSqYe0WPoQs3zIxoxTv2u4IeZb3vW+G6M2LSIp7lr+azAHykV52MKS6YtmhF6buYDU7tPP2Gqh0NjqYDeGaRVvdH+Pp76OqVKd7DzJgCJABhFmWAnxIhZhQIrEgcBegZvtM2KFaLJHA/gyVX1Lu7F/FbbtsDvOVNggxaKZ4SxKV/3N/WGT8w2EXUME/ToUkdVM+ol5Ny2DmlU7Wtw9NiA1berg3voRT4B45m0ebilnkfpXCG4QUwesB/31ISj3n8JTxS8yYldtqClwN893AH78gbvliYkBb2ueLNHsRz7Je+pNkYMPWYk552bL8sSLvYVUpSxW4R3YJadx351Yd50uOEZlU70l7ctpzO8HRDzUB5iWxsk5sJQ3YEUL/E4YXerCj4ag7m913GtboSwGF1aW34WXqeMDJsZIv4KLe8HkStpD72JYPlgrOhbOEpS8UcUib+1tugsRMJjOGsXGp1rtoFI+b9ck8gyumfX/aocxmT9ZnqMgNk88B2g3V4T3GsYNp5ojpahlx8F+9Vbo2dUtB5SBi1Vi3W0xSKB5TAJl+WUsJgp5IPrWnOv1VuM/vmpv8nvUkMCJD7zlARkKpusVUzUv3RLlHiHpDnx2RRDmA6T2tYb+X6L9Dj1NASpPaVYICrYNEJNIcgf/9mQvm6m7OglzS5FwMbdm5lzaA46sh7lSfeE5LNVFyMjlw7ynmKRMbwFXAEs9EmmJqb1lk/19Ds0mSEVaV4mVveU11nfLnz4iX8jzQvUfiIbp31WW621SBWBtf9y54+4xhIjh+9+LrDD1EiTVzDts3ym50FNFO2J36700iB/BSXYfRcWNdczVwAo+Pe7m4uUUGi0J7wxTtWyWi3CiruegnEu+O2UNtts5SIXx/JKkHchJcbZYlkD3/CBZQnjt34tIzZflCrLXLwGl9yQfgH2ANej8bQfA6ixFulNMeFmqXxpUhIq53Nw0tEY+2sdhB8RgJ7m6ZS4dU4M4XJ+Qt0p7kgtcwlXvU+aYz5T//TfwPKE7LfznxrtCQVi6wUBBlp1EH69un7B+P4gch+w78Em6pKE452Jdfr3WxuXoOEx/Ix7pyOAckSgoNjErmb5HdCJJu8Pe98VcG0H2aZGWu9oSh+tLs6QSubWL2Ch223faYDl2h5gPWmFM5tkzNfc0qBL4MjczM3u1fUvWsV7Js3Yg8jBXJ7qtz84MvuwrivylRjJBswaUerUyMPcn/FLJks= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 08cd10c9-d6aa-4a58-13bb-08d9e077dfa9 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:30.9327 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: mXNqFCYYy0+y7xgRuhp019KeHM2MlsaGN/z6HpX2hNxtcCwvMC1HFCnmOnR0gxiRtrehVZLczdpglEYhc58z9P4FdXZjkBb3THAlO8J9eck= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: 9-1jgdk0ZwmpPJlMv9N7xxvqOWdiKQrs X-Proofpoint-ORIG-GUID: 9-1jgdk0ZwmpPJlMv9N7xxvqOWdiKQrs Precedence: bulk List-ID: make W=1 generates the following warning in keyring_handler.c security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~ security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~~ Add the missing prototypes by including keyring_handler.h. Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar --- v7: Initial version v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Unmodified from v8 v10: Added Jarkko's Reviewed-by and Mimi's Tested-by --- security/integrity/platform_certs/keyring_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..e9791be98fd9 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -9,6 +9,7 @@ #include #include #include "../integrity.h" +#include "keyring_handler.h" static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; static efi_guid_t efi_cert_x509_sha256_guid __initdata = From patchwork Wed Jan 26 02:58:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724508 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 388CBC3525A for ; Wed, 26 Jan 2022 03:00:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236748AbiAZDAL (ORCPT ); Tue, 25 Jan 2022 22:00:11 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:40208 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236717AbiAZDAJ (ORCPT ); Tue, 25 Jan 2022 22:00:09 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMn8pm007700; Wed, 26 Jan 2022 02:59:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=ebbL/MQRvBkDiQdk+IkVjNxl5ng6KXIUAY9HyAMVJPA=; b=djsqk6PEBF3tdhJJvLmTuwFROiA/+nlSSfS7WKom4f+5990KV4kp7yX6n50c/ufEIgDl 7xS1ZjXQdB7t9JSNBsn+iqPrHzAaFHrF8S0FiZt8Q0ZmouSA2MNvkPHek4xDhSaoygnJ B4oJfx1qEKAdbDfEdgnFiTPdrKxCL91zNxks7UtNjmJEvHTGOwqDm8PsmTDwxJMT8Ex8 3PGA6cA3+kjM33crL1EQSGKtFRqu6IInxkg4pDgyc0KS9i4FZ23s2J3rP4t9FX8Y6Oa5 HU+aTvhuabSq2lbZMPxbcjRct5lks4sqIymPH9fLqaDJLVRx6LjgGz2moFa0QDDrG7aO zA== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsy9s4x6d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:36 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oSlx068380; Wed, 26 Jan 2022 02:59:35 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2046.outbound.protection.outlook.com [104.47.66.46]) by userp3020.oracle.com with ESMTP id 3drbcq7v5n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:35 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=h+s22/4f+y3+wnmO1h91ayLc/6kqDDCqr8B8YO1j0DbC5oYBeI0Z2BfjNQLabCfBFnNMuV3Rpr99V1PsOv+03Ro+hyxEsYnB7BugqtG+27tdkotDdwwU1K1SXtuRo1AAsd2l8HCBbL00vpRfwQEBpZhuqRzSrjU79HSDkYJ3EHnyImLHPR+vDC3zVL38Cb79vLmYXd0BXL3xFASLjP8oC0sPdyPfjyKziMhmWDjnl6/A0DYMVhv02BrY6knw6dCy1Zt0ig7rwWtaUijLqK7kebN/HXHzeGjVk1nt3seIX24PCT6X+NjlBtyxbxXwWdof/aaZ8PY61iHjZyvaPgpNlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ebbL/MQRvBkDiQdk+IkVjNxl5ng6KXIUAY9HyAMVJPA=; b=d4Y6aMZfu3G3QxoEveJb6+iOYgBoQ04kNv9GwyTsIn7THk179m9ZnSd26lBlANtdLmseinFa89bygeQy/Og3eW/JvQKkVvqAG6Zg9Ng7Aqo3ysV9OmYVogbsn74RN7/rvDnGHKdYzA/1IE/R+D0hxg1kVyvO1+c20+mYtX12m4Jr+YOti3dyEVOR/c74qi/nrDb+Pp54pF89NHz/rSmA/GHXpaVLcYVJ8m7ej3RIo6A9CNAOu+75FZTx62mAeU7EVq7CjWgIgZgOWuv8W1V1MlJ6WzKwyiory1D1m9znbxFlvoJsW/2AGe3LCwv6ZnCCqplQTJLV9qEyf5YJDzdYfA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ebbL/MQRvBkDiQdk+IkVjNxl5ng6KXIUAY9HyAMVJPA=; b=SK6qxf40maVRCMoy+xDbiWnwpCOgukomyP5G3dxgtrKRn8Wo3WRkvJBDpxfgqY4ymh1tWn9P0NvO1ObQtPugPqeY3VDyQsVGkL090XinLEDK8ZI17gr2S9ogtLNi/eXqbY3lcl/GexpaDFrULIvcmSTkm1JaCf25zEjVJlw9uFg= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:33 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:33 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 2/8] integrity: Introduce a Linux keyring called machine Date: Tue, 25 Jan 2022 21:58:28 -0500 Message-Id: <20220126025834.255493-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: c79d61c9-f8dc-41c2-ac35-08d9e077e0e8 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: xgeqS6gqZXjARd4pV671NAS3ydmTa0tptnzQzXiCeNqfxNHBGnE0Bz3cr4hqbBRwSmMMjqt1rhtKL87n2MLxZhgAlcDOWzEI150pLUX65mZz9zS8gnCEWNQX68Xxma53H4FTzO8DTvNYkFfbRim/S0qhnkzh0MdjIUN+3IrW6iU8TjQawUnX5gGZOPsFaiifA9c2DEAKrZdrthT7IZZfMY0oQr8lG1SU9vbhFxr+glCePLVWezMfN1ziAFfL9C93PnZp65MwT1tCcY/KLl++LUwsZB/UDxQsknrU+ESZdvwmnXleIcuf9xaoVu1eKN554j+Ubr3T4toTq9//HpyBZOAL2NZT4+CmvokxG0XwXwHGi/Zm4cIK0wr9L5HUStEgl8fIixoSN4a6erwZDCX1xocu96JKpe7KxS2yUHZcFnvkuKDYEv6G6Q1XvVkfK4Ff1GlbK5fCZbHIA1q7UlXlpWxhTTt4HPbMG9h+l5yzkjrfGOv1ZhWUAf9LlHB+hUs8GnO/TK1s2FdGsNKGB29yR1V3jLKghjXhzAj4CI8VgCIikjN5AWf58slUgOP/tiIKL+hhju48Q9xBfb5dDHRWfRFEGheOUVikUkhVKwlX8fO+cTwm5yyDGdkVVkTFR0isX/Lb1WWZzThKO7xx2CdybFNstdp/Y4FR8oon/MZNoUgnUlR6VH+KFDm9k2RGs+AEdt2+pAhqxnCalfIq38KEPw== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: YycTbv8GI6lgWhrOCMf/f1rz4PEZv5XvF+O9DClaM4giBXGrW/SLi8qdGjT3H4HJbdyfgasHOFB7ezfHIXpml1CZXM27eUezfeJ+NjTFPkxLHPXO40piaIlHb2isxCCIZOjnS1ZehvLif9P2JXSg9GWOER3nRDaLeC0I/cIWWn5ySnqjMSDCjeu1xsxehAl1SA++WzcnZrKmPVxTNY9vhmGfa8fS023bxW15YO+uJKzjsTKVdk9MDHj8sa84hYJA6aKsV4oLjkuAvnld5RckLhI8naZkMiO032V4D6PnPfd/PyDFWNQmqr7TFmiPeZPOZ2Ur3NICT+4pqK5DglvwCgBaCiiGj0NODZmCmooBdPzVTXTqo35Y6/3bxyw65R/A00Prq/Bhh2kU5myfGooVHuloDIC62jVoqR4E5MYw4Wbt1rtingKsqYtwPGY9mti8WlhLTij64rjsu+rfXEYpJ7QgOOlYCnDtSez5ws8Anax33HkmuM7z3iIoYLh+wapyq/bsfQocOr5D7eJ4yI6RvhTyapZN+5huViLQVjYtbr3IEsHiP9D2jyhp6HZBjfblRbO9NT+4OjqmW2zCF6e4lmeUleRCtz0d4McQmM0sKIQzcz7EM9+3bhnCVAkmuUYaDmq7WdJPaj6PxfZ/qJ8lKNshp4xq7uhWO5Uvj2a1Fv1TkQ71tXwkVfB9hiUGH+1dSsLTQojMRmI7HjiFJDNB9FauhqlfffmlS6WKYfLlBsMyoboxZh86yxCQFV/mjsVnjKGJU8R6hpSI565KREQoHsurTyRHOUOdYwT3L27BO6NPd/o9+o2Yk0T4Eahd3ADdoo5HwoLWlRD19xkvY8VMvmSEcvKMCbpbmEaY16UR+96lLLQ/XJDJ8wxBdMZKJbHKeD8/SniSEpefGFacWrcm3DQxm0lxEwXyfWLTzpDwgLgnsNTSbSMYF3VLw7IdAYl/RgLpcZ/ERa3+2Ev0VxmIDk2vfVU5Yl37iJhA5ithLSc9H8BhClwd+IdNKorf1PformrXHhjg8kpLDrPT7DfjJrZVltfzVDde0cNxgxdI9onEpUFLgGjJmrnlXfrcw+Q0sGz1ySBa4m+Z6u5PIz1PK5Jzzga1sTtGcinMfl7QwJGP7Hkfa0q9Io7g+cZO3nUidHRitjOKxs8Aa9nqePklyhcaqLBMd2DYjja+RpMlpZAiU69+z2sCcW+YttdZqbNt5YQQRhAmxfPGw/HSetbvc/JSrw/ZCM4ilr3ONPOaWyDBiRW3GzJSX0Sp7uhEicUu4H5LQNsfKXESep+GtvpE23FFr/eD9ZL3uYjDzrOp1sZ0XCUIS+gz24XONsn7ByhuzEUPbC1iLnpRqtPUB699SVgpstCvhL+AFvtyXm4SOKWe9B3UGzqfgA/CoCWflhLionLh7lEpgH5FN21p+O9e5aSd//w6l2Dl9PbL15bA/65ih7rOuQsVeYrX4KmvdrbrCDW8AhIaQEn5kDfbYL2HITYlzNWxerufkgh6mJ8DVNUwGH1IQ0HQf8QYi6y80ly9jl67LvUU0iyIhUF5OJxuKRHvtYRo3s3aYGvS1nOW68SUP2+AcP+BqW7Mt+u0hYbjPtVAsF9FJTMFarR/qHa4s2izUNsWnvH7Ekiy9EdP/XuSr+XC9vQ9PoJ3Y0kFcngo08/8ryo7r901t21XsIw/AmrB5z1XPBvh2wRtdV/DRL0= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: c79d61c9-f8dc-41c2-ac35-08d9e077e0e8 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:33.0273 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: q/7Xi11hUEXuuE4AbF1coOc6ql14jqe+5UDU/vtqb5fYfqzsYcRE4cw7R9JdY2q54Jl8s93pG9dsLDfSxbPvGz5zQSB1x2nMa7V6sa08UuM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: YTdw-_twPxQyHVVBBMZKhmjPPkiaMele X-Proofpoint-ORIG-GUID: YTdw-_twPxQyHVVBBMZKhmjPPkiaMele Precedence: bulk List-ID: Many UEFI Linux distributions boot using shim. The UEFI shim provides what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure Boot DB and MOK keys to validate the next step in the boot chain. The MOK facility can be used to import user generated keys. These keys can be used to sign an end-users development kernel build. When Linux boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux .platform keyring. Define a new Linux keyring called machine. This keyring shall contain just MOK keys and not the remaining keys in the platform keyring. This new machine keyring will be used in follow on patches. Unlike keys in the platform keyring, keys contained in the machine keyring will be trusted within the kernel if the end-user has chosen to do so. Signed-off-by: Eric Snowberg Tested-by: Jarkko Sakkinen Tested-by: Mimi Zohar --- v1: Initial version v2: Removed destory keyring code v3: Unmodified from v2 v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" v5: Rename to machine keyring v6: Depend on EFI in kconfig (suggested by Mimi) Test to see if ".platform" keyring is configured in add_to_machine_keyring (suggested by Mimi) v7: Depend on LOAD_UEFI_KEYS instead EFI for mokvar code v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Removed Reviewed-by. Prevent IMA from being able to use the machine keyring since the CA restrictions v10: Added Jarkko and Mimi's Tested-by, removed CA references. --- security/integrity/Kconfig | 13 ++++++ security/integrity/Makefile | 1 + security/integrity/digsig.c | 13 +++++- security/integrity/integrity.h | 12 +++++- .../platform_certs/machine_keyring.c | 42 +++++++++++++++++++ 5 files changed, 78 insertions(+), 3 deletions(-) create mode 100644 security/integrity/platform_certs/machine_keyring.c diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 71f0177e8716..de02964dd421 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -62,6 +62,19 @@ config INTEGRITY_PLATFORM_KEYRING provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. +config INTEGRITY_MACHINE_KEYRING + bool "Provide a keyring to which Machine Owner Keys may be added" + depends on SECONDARY_TRUSTED_KEYRING + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on LOAD_UEFI_KEYS + depends on !IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY + help + If set, provide a keyring to which Machine Owner Keys (MOK) may + be added. This keyring shall contain just MOK keys. Unlike keys + in the platform keyring, keys contained in the .machine keyring will + be trusted within the kernel. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 7ee39d66cf16..d0ffe37dc1d6 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o +integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_uefi.o \ platform_certs/keyring_handler.o diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 3b06a01bd0fd..2b7fa85613c0 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif ".platform", + ".machine", }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY @@ -126,7 +127,8 @@ int __init integrity_init_keyring(const unsigned int id) perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH; - if (id == INTEGRITY_KEYRING_PLATFORM) { + if (id == INTEGRITY_KEYRING_PLATFORM || + id == INTEGRITY_KEYRING_MACHINE) { restriction = NULL; goto out; } @@ -139,7 +141,14 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + + /* + * MOK keys can only be added through a read-only runtime services + * UEFI variable during boot. No additional keys shall be allowed to + * load into the machine keyring following init from userspace. + */ + if (id != INTEGRITY_KEYRING_MACHINE) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 547425c20e11..730771eececd 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_PLATFORM 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_MACHINE 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, { } #endif + +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +#else +static inline void __init add_to_machine_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c new file mode 100644 index 000000000000..ea2ac2f9f2b5 --- /dev/null +++ b/security/integrity/platform_certs/machine_keyring.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Machine keyring routines. + * + * Copyright (c) 2021, Oracle and/or its affiliates. + */ + +#include "../integrity.h" + +static __init int machine_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE); + if (rc) + return rc; + + pr_notice("Machine keyring initialized\n"); + return 0; +} +device_initcall(machine_keyring_init); + +void __init add_to_machine_keyring(const char *source, const void *data, size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm); + + /* + * Some MOKList keys may not pass the machine keyring restrictions. + * If the restriction check does not pass and the platform keyring + * is configured, try to add it into that keyring instead. + */ + if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, + data, len, perm); + + if (rc) + pr_info("Error adding keys to machine keyring %s\n", source); +} From patchwork Wed Jan 26 02:58:29 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724510 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CF14C63686 for ; Wed, 26 Jan 2022 03:00:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236774AbiAZDAO (ORCPT ); Tue, 25 Jan 2022 22:00:14 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:42602 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236735AbiAZDAK (ORCPT ); Tue, 25 Jan 2022 22:00:10 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMn0am006704; Wed, 26 Jan 2022 02:59:37 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=VW0/x/eiTqQqHzXyIRnGefAfqYKGGo1jFIfenhKIN14=; b=GVg4cbsnbilnyOZI371hSmILTH9MyLjS5LPl3GR+y4UVT/n5319hLAPFiKrX3EvY+jzA y79XQpKVbk3r62hACKQwGYSdqfNHLLkdfwcpY451VnGpSGNLkmVbejwx4KHYd48K9mwD NOZ2SoEPBl7hT+R7Uk7BZ3p2pqlduE748g+w65725EwFtvzd04LcIiKKnlu9TNVgm6gx ZoA++qyNBar8eiO65DvBpKFqD9iFezSiFwp67C2JPJkCipeoxq32dnYPPVhKRZJ1WyAo gff3b5flWHWjthjRCz0djuJGj7W/5yT/20JWYLsTKa9sPYLFJPNNWPSVGQBhLnPFfvmv Bw== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsvmjdgra-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:37 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oSm0068380; Wed, 26 Jan 2022 02:59:36 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2046.outbound.protection.outlook.com [104.47.66.46]) by userp3020.oracle.com with ESMTP id 3drbcq7v5n-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:36 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Ccrtp8GPDDBMHzc4LZ9FLciQpj/QI9E8w2lIHxBKvtOYHIyNxxqdVRBEbxvvfAK8vf9r1WYv+Gq9TX30MMrRVCXBAAEWLfdDLicUkD78AMglhZxqLElStoUA2dArKYDpUqqJy7dO7FLWc1J8t/pFT1lbkGy0ltxpp5xv+1WASydsBmjoq+nW5g427IzlQJSMaAVYM4IKfdWJ8H8m4v9VgGU/pwxAL2skpTWCyuZue9PNB1200EOYURlUz8U1JLAFOXi0REwTNTL5r3gCDctMC2tmAKfq5hl3cZhGUonyjoeXgvGfTkjQ/re+dIREnxWMs2X4lshzSHNSD9lILNcK0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=VW0/x/eiTqQqHzXyIRnGefAfqYKGGo1jFIfenhKIN14=; b=Awy2vBD9Qd1ktY+2LmX9tlsf+Zi3lfkWgvfgxtVc4tLvr1Slf1E+1oyksMPH9WGHa8iBR2TCriBMw/xvvgfOZyukE+h5auxHBFLhNY/uRpVMwsLkPMse28Cwyre1A6eMbuEHb0YfF8edL3Vep93g7bElBC0UYmLtklmd0WmXQxfYpXFMbr+sWrPgodqWAuhA5SD2CqUf5HC8DSWVjH5WFwjhDOqTIcHKv75YrGTjvii2qPivMyTKmZVSEGlsxnh+ay7nj1qfj2iNhpm0tRWL1JCgyoIRsuOpfmGZUvTyewCB0Sv4Itk81kn5yjFUVgLy2P8+5tclcAVPSLSTn+yrUA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VW0/x/eiTqQqHzXyIRnGefAfqYKGGo1jFIfenhKIN14=; b=DwdWgABZGXU6lrPFWF1CkvpD4zinnQBn5tJijb42eoaYQWBYO5gf7qOisBKYP9E7EVVJbrgdNE0O6dBzn0WOxA+NG8trmcDVLdEnDNOqQ3vrtFSP9F3PrTiOvJpqlMK9Gp62ZCNJHDhMGrKgCdchUcujCi/FNdFPeLRMmZ/ueco= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:35 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:35 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 3/8] integrity: add new keyring handler for mok keys Date: Tue, 25 Jan 2022 21:58:29 -0500 Message-Id: <20220126025834.255493-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 59aca902-8176-4507-222d-08d9e077e221 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 5NS5Nm1FwSxM4SqTFHXhpCm6FfffALQt7y2MK6Ye5JQGmX2k7rcYpffnS/tXwdOAnxu5zgNUwLGZNg+l/3rTyi3esLK+xK8OyxZh5Jr6u8zL2qXOyyyYj3tB0cI7jFe8PKtaoJ2VM2W6LtxNB5IPQkMD9qhZ927PFo02+PvZMiFEj9mPdH9NazN8b8S7bM53FY9YG30SgpKmwKE9RPfbe3IW6uEm6m1C9aeKkwOUkNxRc9ColJtDOuUGALly13Gn5ooqlyifHT9yq6A/NqN2866zLNsP/Y0A6VoW2qRjvRTtloZGpO/j8IeW1aIBq/J94ua+rD1ukdRQelJFN7k8k0hPmTJnSkGzVHYqUYMkDt+nswDvDVoWsDFicH6KVdaEMtyZRL6rqYlb42DYMxJCGuTcbWQ22Nfe2p/QE7xW4RoXK4pdSy5uHYZBz6OU5Ky/5UxhUwNGw9ab8EfQ4ob2BJJxd7O/NZfYyduth8MQaAW71dlqfYW2aodamCSQz9WYaIcoO9ZzwSyK+vQPDGyiDy7bW5yQQF0FXN96lCag2rvhViVYIEIGN19lnicdDRc7j9+jLoXLxupgb+sJQpXyM/jJ4VlSQ/CwzR9y4trShvouudIgOja7Uk18oI1VcJNSFK1W2vjxlebMtArqbRzTnaRZlDl00D0ZTy/RXPCoGQu+2ZWdGjqi637q7hIvDi3AhzWXaqLAPza4IWOYY/EXWw== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gFiMObFiyxHkONZYau6pHgkOtB8JWoc1nfgvS3d6iQBkgDh6rOwpKXLwhh+WNeDDFTEMaWU6i7X5o3xpfRLNVf5faH+Rw0Bn4FAkKWymQb9XBfI52mmv+4TjFgndAcfHoF3ocLEWScFc/Sfze/CmA0w/k7pmQGM0bKln3NscDpepn0P9hzh84JpUqcsiN9Y9Va01IptEg+MQ3CRRSri8v9gS3bmZ5emIoR+w45IuyVuPNXdfOTVfgXMbhqKlhMSvSmSpB0JI1/hZrnYRpUiFNFbYevN+EXslY84B/g75+5YcSTOwghOCdMTcrygVMm9NDo204XN3QPFGk3M+hVOrDCREQe58HnqFhcxyQOyPuC2PA4KxVhQTp/qUisLVTgj2Aj8Y/vBJew3e+4yeB9E4I/Wqzi92ItGQoZne7wzaewQIUqEml9aGvim0JBd1gEvUqMt1DR2gpwOqMpWJfqi7SPnp6+4hwUYG7anV6S1qfh2+wDHHTWMVxmR/Wn1PS2UVggdh6ZcQjUDN1g7Zt8m996C1g68uQ1/Mlt5kaME032WnvoPGQFRi+sIqcBnj3JKCJSk7dxv1gGf32L9QulsxJZGwpv0IbkveLngJHckTDmJb3fieyzDftEUmbigOzOxkfGDy9znFMSHctXSWmIooGTraMELJYqhqmtsLnlgf1R6ugPcbPem+zHJnxjtndMWT6F4VV/US4K2v1mfVW7si4+lGMAvb1+MnXoFL0XEDTaDANyaLtoFaaYbdbULZucxqFpqNipaGm605kpFwDYor7SNCJq7FtUFBkmq14aaLZiNslGIWyO9sRTsKUiFq9hL98PEqNKXPqfl4RXfW0kWRZKm3krn8SD6qbBSDD7nU6mDRtEr3Yx141k2c4B8rlQV2QK40/iKJ/IyrNb4yKIuJZz7jJdp7NgyQGT/gfZmGX/Lad1M0q/EAMvaNaK/ymQZdEE+BKSrU5tPiDyk8c/cHokuiNey435D3q6DOU4osdPmFYX0o0BS8+ubKPQTpryAGQcOHu+tDQe/Gu45vpaLrQo46BebodhNbd4apH+4vhlK2RAh8tUUMil23SBWhUJ6AP3l6GNVYIGp3nME0l0GMeDy/ScEEGofjy3ntGwXaQ5FoPya4OCqPOg3GMvZ7t9441DII/KJps2w7wHdzusoHf/Bk4ApnQOXNcNt18xOknj1eg0vvINlfUFLjT8IiiltPABEOJkJyrbUoqrkHmNxQ5aB9/Jn2S7v16MftPIjVdgW3Ik3hqx9COJSq4/hWzsEvDI7N3CmViKVNsSO3jvLDOpif4yOEIOiqYW9icA0is5niw1VYhT4F+/RR3/PZtw01YPx2hKhlaw1s2o/UMzaHmX1gkZ9PbDP9pfzfZp678JhlzsDV9V85L+dAiVmgT28N+9Xq2rsMxM0cCyOf358o6gaBq3aJ/uLfj2si58Pr1BhD9Rr4EEZEcO2vlzldN5NYOfZ/0xdkQLmfme+4UYlZgkCgAM9HnkYsPPSnetWS9SBbeTUukvg4Ytoc7QpONGiBI6gAwkojC+CWwpmgtU1zGHqHvEyW5vblW9rEVbFAhCnY6/oetRiGPRbS6XXPHSA+ReV6ibP5KOAYWCIuxlcmN6ZVVrzwsMCP/f2/GOv20WC/0RQpvNlS8vYqvceJbOhBfvWM9JnyNAwscV2m14ppmYLck22jpqIjNgLN2lwTgxg= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 59aca902-8176-4507-222d-08d9e077e221 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:35.1063 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: /+6JcME8qd4YcF/UPzkn4/MtfYj/4Vl8h1xgWnHiYHRl6/K/0xlkj83W5W0ne+bG8sM9inZ0QAbfl+9Zo2ea8vCltYGjWFoXWGu8dKcC1IY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: XYrVKOwCoLo7or6S5qeX5fYXpk6d8lt3 X-Proofpoint-ORIG-GUID: XYrVKOwCoLo7or6S5qeX5fYXpk6d8lt3 Precedence: bulk List-ID: Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v7: Unmodified from v5 v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Unmodified from v8 v10: Added Jarkko's Reviewed-by and Mimi's Tested-by --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index e9791be98fd9..4872850d081f 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -67,7 +67,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -76,6 +76,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index 08b6d12f99b4..5f45c3c07dbd 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -95,7 +95,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -110,7 +110,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc); From patchwork Wed Jan 26 02:58:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724509 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76150C5DF62 for ; Wed, 26 Jan 2022 03:00:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236758AbiAZDAM (ORCPT ); Tue, 25 Jan 2022 22:00:12 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:18628 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236736AbiAZDAK (ORCPT ); Tue, 25 Jan 2022 22:00:10 -0500 Received: from pps.filterd (m0246627.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMnMlh001973; Wed, 26 Jan 2022 02:59:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=buHYZo1Lk47XcLfgsnK+nEMTcS2B+qK7iLPY5yNlI+4=; b=EqOh5rh3nuw5eHXflvKGTAyp4KW1X67ZKaNHXbTE1IHBLlV/PNwAgLZuR4hNw1vGyfHU ZVCxhuGoi31cj1Kpvax+7B23TlBYsawOWTAvx29XLszxETZJ8UcTznzjpnNph/3NFnFw rOlefrnulHgk4k0MJ5lDXQ0BBSH20OKujgt0evZUwe2jaJCHXqxfgVmL9MwqSRU9OqSJ CRoX50+07hhEA5vm5QpKFy21c9dN5MYutfrqnHVGRNoSa0yq36Q0gVuX4FA1phOAx1jr H6XYkv066TAuZfrNnCve6pFrWHBtlYcPc1JMr2ZDJLvH9YfXz2tki6W16oC9dyqCk0gq 5A== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3dswh9n9cy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:40 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2pIZc181301; Wed, 26 Jan 2022 02:59:39 GMT Received: from nam12-mw2-obe.outbound.protection.outlook.com (mail-mw2nam12lp2044.outbound.protection.outlook.com [104.47.66.44]) by aserp3030.oracle.com with ESMTP id 3dr7yh0ss9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:39 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=PVuNYbwIQ4je68hQjBxlXgEhF0/X6hgqfyu3QA+InXUBMn4a+bzelxGzAcBpMSS/NuqkEmRN0qonj09oPXpcCNAb6i4yW1fqa/RdpP11Yy2Vlkvzj8h9qVtjqLzqEDdfM9SkofSKqvstiIf/Z04i4RRAXxEogGNenhL8PhCQtwrDVDA4di7hRQrvTsO4OWCpKV2OIPu175TrbA0U16ph19ium1avHNtmtORBzDL9lyKHBUxTHrESKzNHE7C2MMKBZIrfRksW6lHW3ccZ8b2KtduDP+FkCWdL3rxmd9jveuIKFo3FjGstaFpsCYGuWg/olkWvaNvxzCWs3mF8HeYSOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=buHYZo1Lk47XcLfgsnK+nEMTcS2B+qK7iLPY5yNlI+4=; b=lD2Y/Y2LaNgyCCEEqgXhK4tdXqP31+ZUQyTFGiZgamjUq9fJWHnbBXYsLlmBA0XaKIVT8DnSupRe4BLaGK7owpQ6pcqFS5JwuQxXM7cQxwsTqAStEQS6bdpWG+Os+TknMQuiumO4QzYCZ4RVrzo4hIx463Q9u0nEDsfR+sQ4Xm+YvUOELAotbnrfoMxps4/tmpXHApW7C6L00FLBQme35Wz7T35+jRXk146xjztQR9fvJuneogZkkbM4692lH3R4Lkm47MMvG/kbIX45324blyIul61M0y7d9sNG89di9iN56GgJbyrW6Z83vfMMwqRrmDpPK8xWOpxnY/XornB1Kw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=buHYZo1Lk47XcLfgsnK+nEMTcS2B+qK7iLPY5yNlI+4=; b=R82v7VI4Pfx/ejfc0mVwo2bqkIRRwx2JBssU60wSqJoTAb4zaTdvPq0J0BR9R/i6AV6NgqLMg2ItOaWDNvk1HYc69+36U504bJVtk9iQN9ixNsE6E7un4m8YCNU5AEKVMmWQ0Oa9waOJlzvBx+N32V8rib/rBrkJPbzp89PcfpM= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:37 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:37 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 4/8] KEYS: store reference to machine keyring Date: Tue, 25 Jan 2022 21:58:30 -0500 Message-Id: <20220126025834.255493-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: bf80a2ae-a437-4d83-1800-08d9e077e363 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: pZF38vvwph6M30hGYIxXdBmv18y1q1a4Ch5dxSGDlnVnVnkJQtGbR7363l9hstCduGk7Z51eHgCI7EJzHpbw0fGJbOeDk5mSBI0WCfSuwrGgCQHwV1bfMrrVw1vYnma1G/EPGVBzfJwVQWmxgNof2Jy+Wa20g+pCi0DIaskTbuDj+XpkjxIEPz4uy0aFXXiURoFoCX0rvCu/Es90B2sFdpM4aun9VcpbptSSosKNzD+qBIglwn4kglS5PIgB/bB71ZZ9LFkbczNS0NF/isO7NZfqvlWo18ifjdDL9MVGtutN8GANKk2q2mVyChz0JKob2Wnhgts+J3RtcGO7Moup2s+dn/FUVdXcaJjJrK4NujHWItHEmOdlpRrC8AtsUR87pBgmCpxxezeUKAyJRUK6stnxiIbdf/QGYv/JZlIKdGqHvnFvUDqzI59BjM3qX641C2uABB5kpqB5/s2i6gHmI+Q6qYBu+kGwTGQmxTXB4Cbnm/4sDhmx7WXCE9VFYLZQX8Vl9Bnt/k2mxFMaCFY9eWIBJXsMa+9B7EFsy4WrPIp8z5JhYzdswBuN+68/VExFkL3sxeek1EPPufBU4rc+jku3R0TTu161ezxrCCzQkw2DmSaUl5APqu0OX2r+cVNmbHo2Nx/tnknlUQ0lHAk58bd4dJI+Ad6kdexnbpiYfk+MoHPB675qdwlKQAjwj8ZpmNvNa7YDZ9GT9Iub5FrM7w== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: nQPKPO5KnvvIeBMp1G+DnhH2bCrjrTAp+KexMm+bZbY2agiwpzd7DItIfI+QAz5KpOieR77/IB6YNwRsxh12Ff2bbY66wj1K5q1atkws7juR1t/uwW46bm3x7smCmk4ncSHOmKS2fLZfsZrcNQHzWgRyuDAwsu+mHUCaQuPmO3LjnNYQ0FeQzlQdPyET0dHzhuUHxQo6HiEDd39AZCe33HSUcA01rtcIIgF84mObERdd8wQ4+AVXs48AoGgT9OCfJDIEJis3rVodTq7uKyrcVOUzUPzl2icZN/9durSaI9+AUebYMKknBj6Kn1qjYhZh9KDjSUImGlZ3sJL9RltCQu+t0DccseT7RQqNTAYQZJvgfYZAb5G8jLQG177i3MAdGsmTkwkBMsZtCVP1oJvIGRKx1tA3f9aaW0cb0ukyXa7VTQxexnBfcfBCl/f/LFZZLUtXoF+9cShoo0IPUXMzn58GTGYW5wt2WV63VSkIlecQXlkLZQLowwEK/f4IOESE+SMdjbazH58MevysfgxmkmPsPEVVGVqeVK7rxupSjNwdPZsp3ycKBTCp92dk7MbP/w3tcAEaWo8XO/G+zXarLYPp7m0SS0qtkf0SZ4ypTLI/qb23c3UF9hz0zieVqBAfnQX1Y1avKrEH3wvb75NPjgaErpLcob6bCLJarrx4n3w/4gpWuHOVlBT/lIWAunS6A3cJx+e8AFJPVcxJCz10hQwZ48m8bADGMAEy/J+/6kbFtFyh4BIADk1kJkT02pD2BLhzb4lnZy1rPR5G7HXZHmWbbCh2xRe9JPqmiMDCnFcdlYiSn3WpxWHZoudj2njZipqmyKYy8VIyiMfs7FG5wUis6dGAG9kHL6u/0pLq+aoh3qdF91K28NWaeC4CelKpapkmA+L9lg7YjhRiTt0mgv23gqB8Ac1bbBGUtOTCsUpLooUQ5x8x0hoU/IkuU8vQmQglTT4uLPJ4kdllhdjC2E7/sdH97McsAnITqbJjBzIWmKo9eCN83PJRIP7Ko5u1Zp2iG0wOqhWDmxxVvTeniQ15NEZFErw/RPKiWcJbet9uRBabN2ZqppmMOFwLZ6FO0J3rfbqiS2/ctYpNUM0/cs+8ftB0wEErQOkUpw4B0PYT+EAnCcBEdsa9exnGtzY7hubJxCPoNdufvZgwluFypWDPcQnabJtTOZ0Bl6c3FpokWGXTvyukZbfQ2n48CDqChTRK4ke8lFOkTEHLhE+8Sr+OAwRFxXtpjdnRWMRmodyI4TwLr93eRT8Sia7iUZcvIfSRbhMsNVMHVGrM2qMdr3QBOUzTm4yYTjuddcEUcbGXlo1YAxz0OU7fF4CDUL1UhUMQh1xBO5P/EXILJF9MlD/T+j4V0779xllbsp1nhZtmhYCz9IRc+L9xSwiZqO3dyJ1vBpc9aTDHXVxZ/u6Mm9pt/KXj0y6rt0zohvs0MMnPbGzW1I6uuiJsgIRe3Loy2imVi3hcfxrEVTHg1xCo9Jrtqc5S8a9f0bSL63kCjvYpNfQtid0zPcl1mQIwjztRNSt2Ba5rAzrowvRLY20t8hR3+Rv6Fjr5TDmYFlTX7/HwGrwVA9wTsIMWqqTEMovLJUMPOQ+IyXiRpiVQMT6L2JNbCoFKZOB+mKpDYER/3HIPZHjLLA3EdrwwCKDuStc2D/6S77YEUJbVoIFlwsPxM/o10vvF8ZIP420bzGZuHo8= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: bf80a2ae-a437-4d83-1800-08d9e077e363 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:37.1694 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3fQ9OTyPDb7IYtxA1RKUfOlD/QaQ++DrthgfojfK0w4rTHaH+tx/ZbpJC1CzpoYpU9qg3H+4wxLKALygSH4yHFOVW5HrET+adMffa24aLh0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 bulkscore=0 suspectscore=0 malwarescore=0 adultscore=0 mlxlogscore=999 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-ORIG-GUID: 4b2HZbqVaLU-S80c8y82mpmeqmMbq7Yl X-Proofpoint-GUID: 4b2HZbqVaLU-S80c8y82mpmeqmMbq7Yl Precedence: bulk List-ID: Expose the .machine keyring created in integrity code by adding a reference. Store a reference to the machine keyring in system keyring code. The system keyring code needs this to complete the keyring link to the machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar --- v2: Initial version v3: Unmodified from v2 v4: Removed trust_moklist check v5: Rename to machine keyring v8: Unmodified from v5 v9: Combine with "add reference to machine keyring" patch v10: Added Jarkko's Reviewed-by and Mimi's Tested-by --- certs/system_keyring.c | 9 +++++++++ include/keys/system_keyring.h | 8 ++++++++ security/integrity/digsig.c | 2 ++ 3 files changed, 19 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 692365dee2bd..08ea542c8096 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +static struct key *machine_trusted_keys; +#endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; #endif @@ -91,6 +94,12 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void return restriction; } #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init set_machine_trusted_keys(struct key *keyring) +{ + machine_trusted_keys = keyring; +} +#endif /* * Create the trusted keyrings diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 6acd3cf13a18..98c9b10cdc17 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern void __init set_machine_trusted_keys(struct key *keyring); +#else +static inline void __init set_machine_trusted_keys(struct key *keyring) +{ +} +#endif + extern struct pkcs7_message *pkcs7; #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING extern int mark_hash_blacklisted(const char *hash); diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 2b7fa85613c0..7b719aa76188 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -112,6 +112,8 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); + if (id == INTEGRITY_KEYRING_MACHINE) + set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); } From patchwork Wed Jan 26 02:58:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724505 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3DD8FC636C8 for ; Wed, 26 Jan 2022 03:00:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236731AbiAZDAJ (ORCPT ); Tue, 25 Jan 2022 22:00:09 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:38998 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236714AbiAZDAI (ORCPT ); Tue, 25 Jan 2022 22:00:08 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMmudT004068; Wed, 26 Jan 2022 02:59:43 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=hsRlw5cUEmCQAxmM3T7lF0RRf8E+tm9TgS/qrdHKXHg=; b=GtmGtZvNeHJ/3eeJJt9a4wT/3PIcMKuguwq7WhhMknQvbykerEG2Ip4mFhIpylFFXQp5 1YugunXkAoLmG1eWKk3MSCLRU/BBZ8Od4vNWGJfOkQV0cTDb0ramnNX6JsdiB4t1SgCR ut0EyKH7zW4k6iI9pZOT626DEwH0kQ9M+z5+63melvOAxGTLKLVb8ADSmZt1X6yy6uhX E3lmK8nb6FZ21M4CChWCsjfioNplv5xutIBszf/z0yOWP6GSYX3Qg8G5vJLAiaaVRo+Y pt9EqAgFV31VUhdUHERR4AMcfCcorwHrDpAIPfDFkZVe9YNCYn3MZj2SNnatT0WxuTNt 7A== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsxaad0xy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:42 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oxIC079584; Wed, 26 Jan 2022 02:59:41 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2041.outbound.protection.outlook.com [104.47.74.41]) by userp3030.oracle.com with ESMTP id 3dr720979h-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:41 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=I5O1SS1SLgQ1yOaX81Knvv4neAIY717vJ8MWvg7/9O6x7qM3o+1uW+6KNsymy4c/XptduHz7Oi6hDGI/ljT9Au3In7jUOnGf6QdTzMVFYN6t5nc58Fzi7XlHbWPVYbuGFfRk94dZyn+tuRde7WdyL0AJdcjcbSULsBIwtcZhcIPqzpi5Tp7A/8byPytJreUgZymQJcE/hu0tf/JJ63zfWH64MY9ec5DhwKygT5q8KaXN3Z8NET7me5wrHXF3ycxqP2Y4O+hg0KYkr8s79h6xYq7l6OLJb8QWPhtgZSvipNZSDyfKYphXPvoyWi/t1UJ+FqaBY0Bd6vsWrHDjPh9Wgw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hsRlw5cUEmCQAxmM3T7lF0RRf8E+tm9TgS/qrdHKXHg=; b=HLhJ53l3n8ZOYjIHg5+g0g540eRKY5s8IdsRrR8ucOMYEDv+pt9GEcfZjVocViFk4PkbfJ1ukxUpWQneqBpLd4BmTleWajo4P4BNMq6pTHi7ZiWq5nXzmtoGwEPIVpPZLUcrn66eSZ4rq22kG5eG3GlkqpiDbFkXMc7/xrrZthq6GMvoPs0ZbyGFuBYfUyNWJzwLDmVPTUSkUDCkGEt5W2mLQ7jZGgbFkNG+Lkxb0axRgLc/FJiV8m7J03wbEcMxdIbA5DRILMjwPewVfwllhw6tq4furEmZGHPkuUQod2fmIUntI5CL06FghcWfCWl46pNGp9WmElbJgeJlgREw2w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hsRlw5cUEmCQAxmM3T7lF0RRf8E+tm9TgS/qrdHKXHg=; b=B8Y0qbhpZCyCY0paCa1cHO7ke7Ovoc1ZDaMt/7h8IHx0RIgv5NRmzZvWXKQHW5xkiZoUmHw2uC9yW4oLqSagCh6G9hW2oFbYPPyV6Lc5+Q+6BF7Xj+C/R+5BI8TD1UTGd8sX5h6iNKc5Z3JQEks+/jO9rJhpHRCL7BP21sAeeU8= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:39 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:39 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 5/8] KEYS: Introduce link restriction for machine keys Date: Tue, 25 Jan 2022 21:58:31 -0500 Message-Id: <20220126025834.255493-6-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 39d77bdc-4d37-46ab-d1e8-08d9e077e496 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: LQtA6gDIXthsDnE28XKg1E116mnFRKVEN0PewcnjuHKMBfrTRrQ2CYOrNbjfZgfzC8QaPHKZkBMUlPynfExcLZwOKfxSTcMwUEJkh5ts4OikaCxuRpo2w7NLmO0w3ssobDDq6D8pNLxM3kiSKzZp3OARlRgYqgcgoIvZ4cfDIswTEh78LrMw58t6Q6oGtHHNfubr6f9Dvx7P8KIjV8S8UuPBekSCHFR/TovdwuA4oGvh3EktvLYDyIGAHNADfz93zmcH0QSe8WnYHAByLgudxW2uODd6PZnZfUGXMeL8Tsd47668igT7c4f9RkPD4O/yWAWcldhlbZ5x9gudUHxO08Dde774PJSqgEvke4YpWc+ZGDj3D5+IG/ZBkqP8iJmc6/sxpKD/Uo1qJ5GKkIVAek/1J2N48+mIxdUBk9LNloJb7RmW28tbgbe5qUkgsao2bFiknLHeHfgi8CSAitgOpetg/HZnHVeA61bvxs4kSEVAZ8Rx/+5NT2G2t3dcrtu1Nq9agwvhw99N0JqvLOLEcLxCriJ2tluZfYKugub7r4kbKZZKEtptQgVdGh0c8PYhBfprkhLeW6WDBJbEx1hOUuAAfF27/N0hD+2XFHFiPs3VwckyL6gNNWevLrRCaYZcQVQRU6bZHW/kytm+EGlQbp6TQdr3TUNddXlbT60HvI7r7iaSAfMnJGEJWkSOnQXK979pWQbosJ5jaP8oYL93mQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 35tARddnRdCo4qFJen5sUMvkOoXv8PUPdKPRQ3rHvqfhKh8tb7y3tjzaAlQDEE9wtal311uIjlkRqBI4sH2H8ty4ZwXHAT13Dil4/SCRvnKsRvpHH6jrWskMpKil36DBl842YfwDfF/h78C0+kJxq2Jt32/81AY1zhfDvsTJ1eCBM81oKCfrjXH9GRnLXgaLcKwPAGH03VDZFtUPg3GU6TE4S23YdJJFjWfUKU/mM5MdaqjFlI/9wcBmY/BhiLj0KJwe8XbmOAvvZJB0jdo5GQg0EKMWwFdztSKQuuhoiwmiUVoFgwkXGkhODDnDu6VTVlQlcxYwfz1I85WcIXsQbPu9eKQWGO7cG2bPwVMBh481Yi8TeX4jC+4YZLISTuOAq7BDpAhPv4wC4S2C7pittWKTAilUlY9PwOhTqLmCWAMcxR5EAxTiyw7zyTnG95ookOejADfUnKlS95ccGGeYSXlFpgLFEqvekxeHVx90NFAbglhnsKTE+bYC/5UCmUrqaMfksJPRpWPNp6MbASc2O/ie0byByrrIiawGoLs2v+DmOpo2ieEjgsOSiP8ppnatMhl5siFR7DMMj4m7BZYTfrYXOWPEtLRmwWMm1x188QTm7gItHKHrPtLkDBToy/Ly2tqBpp4LLy9ZT4LoowjIIG4PsLL94T4wGBsuSNhaC4Bzciu1sLb2PNs0vPXM1yBHrmHYZuSdSw2D6qMpYYRjbXOrnJLoFS8cVCMf6/f5Qj1DzElSSBa4f9uPiUstCMrq8o6cGocyZww55I+5H152QsT+g2z8gVjuLx4z5uY8VujiL4Pc1VJGEyDsOZw6LAXuJRo8Q/jxyt88gSU16kxcX/UekZRhSbJgcKQlse4+fVIg+o8W0Bgm14sOzXQ0x+Exd1RtjPFEC6juNN/CGsORb+rqJPcxpE6aUVvPsbIYRjjvwZiObUjRAhIC1E7yL+hLwjlCUhqvsR1/ZCg2TJuHSiT7ina9fiNSZgmupoCuzj8dK7jFbT/yiQJq0Tc5F/8Br2ZTex261DeJNF2zGE2384hsw6e8S/vHJlFb5EHL1o6GL2giWtiFK/MrtmqapLCK/WrSpE7vKE2RH1GsE0UVgcPadsw46ts4DvwtkYolOw3MpxqtR5Lmo1pK5Bs73ZeG070882d83Sln9EnY+78SbBzulJZyRYLeTdGhUacBF8lLEDE3F1AaLuaiFFiuz5WhDG2RtkyNlWtEFtn2aMeJZmR7Jss8vvtVZoMgcmHglIy/CVkVQfPn8R2+sPDoapSmDq6RtKqaveO4U4743JHCHKHrArO9GIcWLHYMVxbRl5XaHrA5FjW35JquZphmiGh3+be3hGN/xatFSTO7PBm1cB0oD3zT4iH+c0QcIk8PAXZ1AsMgFc9gAUOZ/YoAG8Ey/RCgbz5FLzKwur64CjYYVv8dQ5UbkVOwR0Q6yFWLvrMxp7TCucvQtROG/m41O/7Xy6z5hI6wZowxUejL9RRZrQu/N0y7IqBTMUHW++DDSLy+sO7uLppDy2f/OQ3Xmhdj2Xnkhi+jTRMqpyPijWxJZqeaxqegUZBVC5KvaJYb5CbtRkYyqQwKEzYdVqzCNNgptV8ska1P0f2F4gYvxrtoW6Xy6iuIc3rCtC+ufRqzMfpOSfF2EQ5Nqnc0yBi1YzhQANHbq4v4pHVBqN89zCT859iTQKG8nFwN9+p9gbLGSao= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 39d77bdc-4d37-46ab-d1e8-08d9e077e496 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:39.1860 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: csKMGBhyv0xMdFuSNx3Q0pLXbqWi9tCAN6ZdrIXC/e161KJEb78p7Q/j1FzMCoNeewv2USDDU2kG/byzkvMS27HqnZPN9/E9iSbRCbHgC40= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999 adultscore=0 spamscore=0 bulkscore=0 mlxscore=0 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: gIU-MvK34u7jZQs0F6IjOpblIhxxai41 X-Proofpoint-ORIG-GUID: gIU-MvK34u7jZQs0F6IjOpblIhxxai41 Precedence: bulk List-ID: Introduce a new link restriction that includes the trusted builtin, secondary and machine keys. The restriction is based on the key to be added being vouched for by a key in any of these three keyrings. With the introduction of the machine keyring, the end-user may choose to trust Machine Owner Keys (MOK) within the kernel. If they have chosen to trust them, the .machine keyring will contain these keys. If not, the machine keyring will always be empty. Update the restriction check to allow the secondary trusted keyring to also trust machine keys. Allow the .machine keyring to be linked to the secondary_trusted_keys. After the link is created, keys contained in the .machine keyring will automatically be searched when searching secondary_trusted_keys. Suggested-by: Mimi Zohar Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen Tested-by: Mimi Zohar --- v3: Initial version v4: moved code under CONFIG_INTEGRITY_MOK_KEYRING v5: Rename to machine keyring v6: Change subject name (suggested by Mimi) Rename restrict_link_by_builtin_secondary_and_ca_trusted to restrict_link_by_builtin_secondary_and_machine (suggested by Mimi) v7: Unmodified from v6 v8: Add missing parameter definitions (suggested by Mimi) v9: Combine with "change link restriction to trust the machine keyring" patch v10: Add Jarkko's Reviewed-by and Mimi's Tested-by, also removed ima reference above. --- certs/system_keyring.c | 35 ++++++++++++++++++++++++++++++++++- include/keys/system_keyring.h | 6 ++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 08ea542c8096..05b66ce9d1c9 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -89,7 +89,10 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void if (!restriction) panic("Can't allocate secondary trusted keyring restriction\n"); - restriction->check = restrict_link_by_builtin_and_secondary_trusted; + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + restriction->check = restrict_link_by_builtin_secondary_and_machine; + else + restriction->check = restrict_link_by_builtin_and_secondary_trusted; return restriction; } @@ -98,6 +101,36 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void void __init set_machine_trusted_keys(struct key *keyring) { machine_trusted_keys = keyring; + + if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0) + panic("Can't link (machine) trusted keyrings\n"); +} + +/** + * restrict_link_by_builtin_secondary_and_machine - Restrict keyring addition. + * @dest_keyring: Keyring being linked to. + * @type: The type of key being added. + * @payload: The payload of the new key. + * @restrict_key: A ring of keys that can be used to vouch for the new cert. + * + * Restrict the addition of keys into a keyring based on the key-to-be-added + * being vouched for by a key in either the built-in, the secondary, or + * the machine keyrings. + */ +int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key) +{ + if (machine_trusted_keys && type == &key_type_keyring && + dest_keyring == secondary_trusted_keys && + payload == &machine_trusted_keys->payload) + /* Allow the machine keyring to be added to the secondary */ + return 0; + + return restrict_link_by_builtin_and_secondary_trusted(dest_keyring, type, + payload, restrict_key); } #endif diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 98c9b10cdc17..2419a735420f 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -39,8 +39,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #endif #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern int restrict_link_by_builtin_secondary_and_machine( + struct key *dest_keyring, + const struct key_type *type, + const union key_payload *payload, + struct key *restrict_key); extern void __init set_machine_trusted_keys(struct key *keyring); #else +#define restrict_link_by_builtin_secondary_and_machine restrict_link_by_builtin_trusted static inline void __init set_machine_trusted_keys(struct key *keyring) { } From patchwork Wed Jan 26 02:58:32 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724504 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CBE5C63684 for ; Wed, 26 Jan 2022 03:00:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236703AbiAZDAF (ORCPT ); Tue, 25 Jan 2022 22:00:05 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:31056 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236678AbiAZDAE (ORCPT ); Tue, 25 Jan 2022 22:00:04 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMmuYU004077; Wed, 26 Jan 2022 02:59:44 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=WlMV3zJ+rcIZiUVrqyeKB9w02g4pno5zMkV7P4j/tso=; b=Lf2WRvVptJiA6OkxUc1sizVetG/RVabUCSVqXUkopo3HDsdZlO2a65a79nbRh591HQvJ RqGvIQ3Que4c8drM5sol5in7M+JMgHuc0dbXeQxocYPQs7GbEg4BD4wiUPnq05J5ipur pU0GyZt2z3XJiTmJTNoaYs/42EcI1tpl7/YoULhkMANnkkr1OCt5NKYgeSW1Fj6Dr4Vc IR394o1jOmOetT1rKh09QFpo2SE4liID4PvHGvT2HTgAwTHQ0jOJDWeOpyf9iGyDT/20 BbcDGNpz6c4nqIoj1tehza+scjE0HPMGQJHIlTcDV0r1fLMnFPDN8MoOayta19cEcave xA== Received: from userp3030.oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsxaad0y0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:43 +0000 Received: from pps.filterd (userp3030.oracle.com [127.0.0.1]) by userp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oxIE079584; Wed, 26 Jan 2022 02:59:42 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2041.outbound.protection.outlook.com [104.47.74.41]) by userp3030.oracle.com with ESMTP id 3dr720979h-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:42 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TmZR0e0Cl9JAsxjhBHYAlkRScAjZ+6EjyHJcLaasrfkvpO5ueqGfCrbYAaKBgvMDnSC1r5ryys3qXy3W+7o/OA67YAY5UqxfP2c5t4QCtfs4+eRod7hkG4zT7RiyMDh8pWzDcJF4KMLoyxndo4ElPlCoFRVRijYIgF9svyVKTOq4xQz99RzpLQhndF5FPQKyzj8izNOKKQQXSelgMNk5tbm1rOfyhyKPnb4Y6GBCqL7wxd1BVdwHEKpbeogr0DMjr9VwuS2e4b5vV2DyJULtS0Ejj1W30PTj7otMfJC2TOOFjLVqgONkzhLgMZgeWhpbqDujHumrFpck9MEOw0czgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=WlMV3zJ+rcIZiUVrqyeKB9w02g4pno5zMkV7P4j/tso=; b=nLVxZvCexDOzWEFc041GuL2OItIaCJMHJl760qNdsyTmlTPyMxN7xAnB9aYt19KSv6612aGdtG9T2V7BtB7oomRSw516CZSqUyX8Rrjxfg4D+azag1MJd27lfu5ye8PjhcBWbHBmY4f/0bPsz3PI7hy3T03cea8o282AU2bxnnPTNGWKaRSwchn6qoBrfC8+lRBNMGzDkuh+/ZuMZGx1wX+oxWAb2PSgG0kTxDgCk5+fEUQJ+XQyfOmELrdkZyBejVItYA/9xqt1EaY5PlQcbocz4mPCN6Z0qIcFBoj/WBE+9D75qe0DtgsOVxfSBVZ57/UtNFNDvLyXhtR8wu0Ylw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=WlMV3zJ+rcIZiUVrqyeKB9w02g4pno5zMkV7P4j/tso=; b=LD16EUnYaIhdnFzmHQNw2Rrxy7n6g7Ay2PCm2kjf56+SfYkpIBjTiEREcWYD0k6gDRZJsHE1B1Lr3db3uL9B20BFBR40dh+le4lJDwoXAhpVXgSgkesgKHNPXoj9E0m3bW+/Jbu2OyOQg0xWH0jDb7AVHNlEjpZWrw2SnWNgPlo= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:41 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:41 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 6/8] efi/mokvar: move up init order Date: Tue, 25 Jan 2022 21:58:32 -0500 Message-Id: <20220126025834.255493-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b85217f2-6306-415e-2ed3-08d9e077e5d4 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1443; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 6qSjIM1vFo1aogTBdTWigjsS2x+4ZSI3OPp0wiDyU3UVCxUMWua4J24VyFmFcLkG1Sn5DygeJ4fELMxrcjVPVfMWl5dM2qPT3b1n2NUmWtxDp7p9QrSox4yfCiz7usrmnFojxwFwYVFYfK8iLglF/4yWJBXBTSgFAvXCtVxGPr+ksr4IzHG6IhFQyGedSlktcU0RZXQaMUlI1sRXuPcGp6+pe4NANm6DEBZcIH/JKVwFAmmeP+jVH747n6zzVQlDo9sg4dnBENgoTfj54ROO14qA/LJArhmqT4Y5upUcfvfGd7MW2tL7frp6kPswhoD1t/lOBWH73gnq0lu7a6u+1SD1skhEOCgpvZ6qrxgLQAXXbwwJRMt1LizDsQcbZg0KMfj1p1QN+xHpjuJNldEf1DboollIlfkBxg9INNFpSN92IIqU0euXAaWLH5Ua5ky52FaihRwbDmJhZvrX5pX6S67uR7XJwfr1QhvmMLoYFeqJ6eCTGvf0XnxUYkHedOXEn4lUFDtEo5BEBkaGxqsWhVDhKIoIy5azhOdCztp5s4ec4WvcD8wNAccSnnTgM6fJ9oxuKO+F0T2F/dSDN1ZTaP0lAiK6NLxsTdebKXF+bRwzyYu8FvZDQ6FnTRYSwoBu50m6Lu9d5VnLMFL0uUUF9L0b1pDEYSZ2xEE2cfDj6i5i5AdWNW/TcBiSXTvg7818qdECKubtpVufrKNBtUQpEQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(4744005)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: QzPFloz1B9tK9u22xj3u9sdk2fO5JIPS6Dxyo2O+vnOFs2S5gCAxLOJD7OtMf0OOLp73BADhX2sr1kl/WcIHVQQDF5netmIftBFGTQ4nssGqAYe/pGIjpfVKJSSd5X9PmYNAxjYYfm4Zj1w/u0dORR48ZK9oHIYDEdkEKJKLBbzbpu5eEh82++zMvms7qpBHTuFx6oF1TRI98JoYRd6Sfu47JucC7yGDnOoewO8R4c65ngZm8iVpnt8lr4jrGdxBrZjUTwXF+v0+loiICq4crNbci738d7LxBw2KP+AluPPxHrtsWBXDOIiIDuuF1GJrmV1h5Wp6hutLAvADo73K3YZzyxr374tCqacDa59cQnLiXWoelP8ZGkaYCI+pXRUPu+54kh8fDUp7KtvmY36VYa3T1Ju76+4ASyQVpGl6fYn0WxzG1+ie/XMghinSFvXMi/KZ1OuZgTGmjF42IenAgz/jOQijMAr/0BdTqbTuyoeKxxsGwFxyKBSTB2+sF0nOFj02ApTpIvxgZoiYigUHyumMcrsQvidXV/WIfsizm8qGuE7DSFsSJn9h9tkCzHGqf1J9VrHYpqX7qRLgB7RmpuVV17uTGuxte3AVf0MIsDf4zxNFrVa4DWRoOZbuEQyxjNcGOJsDQkUulmq630VmfBiyPo6qCVf8Y90qqpj80UBkZz5XMCKoIyn8qp8nAaxx4F5gKlt0fQETOWupMDRjl3bfQNwTkiHzAdCPxKTgR9pJAXt96PGE88c93/YzTPPXF80kYhge6rgMPMtoMRlDnxAOlBdgk8FXFTisbVvKMNfIWryODITf3wAA3ThGgA2wPLPVVZCh18qpZDvV6Jjd7HoX50TwUiDPl5/XeSmgtkWXruAy5HRc4zu9DP0ohSaPo3bQ48dYvwgMSSobQmk2LusHHUglTULNsVU/bnNvK1u6XiwiUEARuaBegw+DQK/xfjH+RZHzVe3ySJW/wh8llrtGOSHK+f8gD/bMQfopXfixNsQNbnf5a1R42HvE6OAc0TESwGVvjUChp8aW3Xwcyi1hZll80EMIjAxusQpUBzoclUZSEPYB9Vjd+1IaY6/sRNQmGs61d6UcY3ONM+4xWAqGI06NsLkAth8/Y2ikdlLsxj9eWfmj2egEci5vvdLEXFoUT3kRRlq4apqQGACOeb0ToFxn4IXQqW/Qr0JD3NzCmdW45Sm/T4+utfNg117XU7q2taAbBbb815lwcUyzYJc2ostloRC6cOL2K2TXCwluYW48IfztXOsvIqyo/p67nCm9DaPMZ6Q7pMacBpRecFnpcydKBRBIeSvDpZ535e7todmWBhEb3i99bDrcEmK8PmmeoM+3jlpOQWQwLxX2p6FNuvUykivIJTlZEXXs9wku11cX49VkqLy7KqK/jthI09aLQfit4dJZaSrVNStzbduEhJUacBh60ngxb/G3kDS5af8WNNhrnsaFwKGwsqwIF+GKzhc5Jhmba+WPUVoCV6lFgOWuW9BelU/oEGNajCgRqH3NDXZqEAmbVbVhWqdUs/sYckPEjgUOyCfgkrLqWd8kH1TlyjDK1h+4OuR2SXfdrVOM/kk+P/mt6F6f+hJ6FcMB16JQhL7HmT5+dB/8lU7i9Q1XphQemNEEaL22Mg03E454DKZF63p5OydMn6EoKjYUNQLfdEz3X3aiAdsy4JRsGf6z4xZtzveJ2tyLalg= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: b85217f2-6306-415e-2ed3-08d9e077e5d4 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:41.3141 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: trEWD0f49yivHGwg6dSiNBMxcYzC+QbVVjxSRsGjb/YYMJWeJH6GRldUNcsvgc5sKvkAyx8DESTRcLISyZT3PkyQYjuk5kjUOwxdc14pMUg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxlogscore=999 adultscore=0 spamscore=0 bulkscore=0 mlxscore=0 phishscore=0 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: L5gdP7hmtuxs1fG59HA-iUFB7oIrGkot X-Proofpoint-ORIG-GUID: L5gdP7hmtuxs1fG59HA-iUFB7oIrGkot Precedence: bulk List-ID: Move up the init order so it can be used by the new machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen --- v7: Initial version v9: Unmodified from v7 v10: Added Jarkko's Reviewed-by --- drivers/firmware/efi/mokvar-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 38722d2009e2..5ed0602c2f75 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -359,4 +359,4 @@ static int __init efi_mokvar_sysfs_init(void) } return err; } -device_initcall(efi_mokvar_sysfs_init); +fs_initcall(efi_mokvar_sysfs_init); From patchwork Wed Jan 26 02:58:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724512 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F215C3525A for ; Wed, 26 Jan 2022 03:00:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236813AbiAZDAQ (ORCPT ); Tue, 25 Jan 2022 22:00:16 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:43614 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236741AbiAZDAK (ORCPT ); Tue, 25 Jan 2022 22:00:10 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMmudU004068; Wed, 26 Jan 2022 02:59:47 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=H+8l6AxwN9VVcjTjbSVhZ0qL7eAFSgSLcKDCpWgNk7k=; b=mosQpZs2VMLzmtKpUO0PZXv6Ko2ihYhjmSd68bfrF+s4cL3PpUw3KVy9ZnTatXjrX2nl +3ivxOFV9cdBV0f8XegUjwSg2S/olnRXkQEOAy/mDgOxiGOz2JsY3Fa/7LFM2qUZBRyf 7kjKquSpe/QF5UWhZ0DQqVpdw20+tcsnkkCB/2TriSHHVDid0z93OdJe0bsnjHR3MZkQ 3UbEVYWsXg7i5wmjH3faW2zbd+0pJxpAsKH+Nh7Gdgxo5G+XP8PZkmwFxJ0T0LXRvBhc rcLnz9PP4YgFuZJgBLvzyK4P2+jac0i4FjJrwYC3SsHP30BirahRkhNja3GkOZ+l90Op FA== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsxaad0y2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:46 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oSsx068412; Wed, 26 Jan 2022 02:59:45 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2042.outbound.protection.outlook.com [104.47.74.42]) by userp3020.oracle.com with ESMTP id 3drbcq7v9f-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:45 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EeYz412b95kenbbYhabDsg7g91gH/2vDBYngahcLpEwx48PeSGucJ+EwHxZm48FkOEP9LaH7g7+AgkQFP9WUFKRLEa0WAOdPANbLkSJGx+L2GCQJlvx3LNrWfn3bXDM0fjq8UaNG3LBj08LnUibI5g2HaYpQEbM79SkMxc6CDSJ/Z/IFH6IEsyJoHZHRKQUBNsYF2jcw+8S64yiX5j8BtfNxTnn+RC6BnZSPexZXfrta7RkWka2hhzI+UsMvCXlq3c8SISK+izJaMRvXCYYaMQpoQG2FISFddhwHqu6UairSnSLGBgBzMDwdwS9yz3ZVo+gqVTRTCzaSStnLNHXEDg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=H+8l6AxwN9VVcjTjbSVhZ0qL7eAFSgSLcKDCpWgNk7k=; b=hIi/DtB3FT5S/zDANw7YqjEgwsmWyIjJOAt6pOwz4QwTpmgBRi109gvyUwhm7q1/3ZIpIKcyK44Z8IdA4QMk1ePfuuWdVOPRTjnR4yoP0vlLPXnBxVRVy7jgeB0l/Jjx8NoDCEsk97abesVs+HEQh8AUcdAzFdl/361i2ye9oPnnPnKUAqSlbkPgEfeImnve3iUQIA+7eG5jyKxl5OeDjhH7Jvnmvs6GQJuJX7KHzqel9LrVn4kkHM6IFn4iu7rq8DLyj0nGiBP1W7CSNYbTeuRq14ROych/cBg2++0bQ4ZVt73bi9gzWsWfJcX49/JoZz77IePYgu64BXlHZj+RGw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=H+8l6AxwN9VVcjTjbSVhZ0qL7eAFSgSLcKDCpWgNk7k=; b=navtGca7Re8kRbHw6PxiPZ5FTohM6cRSHZKk/T2AgadpxpE9jYnVDh7n/ZjL1QfPa51SExv2xrM1dFy8QJAUDXgzhKLhnwT7JUUwYgL7RKy5m6NWZFoSwEZ+4jVV/XVcX1lt3XdnYBSdiv5GP91092teXjgmEtP3wMuuRBgUQjw= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:43 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:43 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 7/8] integrity: Trust MOK keys if MokListTrustedRT found Date: Tue, 25 Jan 2022 21:58:33 -0500 Message-Id: <20220126025834.255493-8-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: a13ff737-526d-42db-80dd-08d9e077e715 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:8273; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: RpACXYjqad4Kp7fJniDBEE6j0FiWdfzJbsrY65jQTjLZTmv0DJ1EnmsgDO+rp5OeYgiW+JFy3rBOhbmLRnH6kAJkFHunTWP5wePZ9xzsSClrgsrJQZM4zUWLU79qyQzQfTzlI5kcSpjcV4vHS7+TEGPDtjbiGzHIcIve0kuyHFIA5J95beIJv4WRw6Z+faWhQ+WmNS9WPz3EHC0iYJF8NxrEf+kPjJ+zdA7s53DxjRVNMweybUBjj3wZ/zafLSmEwnEt7QcYfSkQtt1V2Z+x7qZyo2lJoLvQXVlyqiZrPvfmvxOrCYvG7MxfEF8VyMq63yU2h4eFRUdcy+6+vj8TBajp4XZKyjYsPyEvRyhDONUCMVqaaI7Q/tcPgOLlMyhFBKecHA9Wp6mOCor/nnxg63MpU0PC5zDelY1c6oekbNdRuDRke4Kr9BPaOwS8BuH4C3I2AbRNclg6c3X52F6oLWPPBEAWbmflJN8sIMrdT0DfSfb/PV/US8bHD2KRLvEm7NyvTwl+g3fPxWmzeI1Q3YiJVpA19tgGoIxfiumLcguCLlyzPYE8VKA5ouHFQCF/vNFZmzO93HRHDw6AcEbdJiLKUQ/1a6KYwsz6bJFyzYjlEsZAOfH6W90uvwpBYgagFglo7SmXskOMHCn49UHCdS1UFNtuuedpPLqU6iwxLqOodX2U0LUZYTaw1KJwzTLjOynbsSthpuE9pnJAOHb1Ew== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 8TGbSMnHPPJfAgqpCNctSRHkemqXhBkCjxvbSrH57+wzU2y4fthxoHukXdwWD9+Fbm7lhwJV49gsfhgKeXJA7+89dxMYIJ7hrnBbs9mTmmm6W9s997JiS0R++YoJwrioMEwCr02F0CNL7zg48Tqk5bXPLN7+QX5TYX3AdZF75y516zxcrYHjKr8bs2Pa3/4THQTRUcdKskv9MzXI5QqLo1d0FDQ2kMsUZs7pPRIssGy4+5oasO9ad9qot3hJuwiIFbY+FWeEEN27rZLcVXKPZ50HxnyHZnD4JIuu04VDUg6N1ziEfR8f/pxqWB3HXDmQkweEjsNtCdgFYHJ0JlhaLw0jkM9MKbk1aq2wYz1886wMQH7T02HJbEGBTq0AUriA0uz3nbp8RXfexvCG4WVeSwlB5qoe29PMNQXFkIG+4O2fuEf51GPqAIG+IXdMl8Lb010EeHk5b3WYxO5UDc9nvi77v8H7HP9Sg7ePx3kYnNp2IABiGVc/yJwpoJq5oRRpiEFN08xPSrGhjBiA/npT4w3YNio8OpjxexQUDMHcJl/Fd+Nkrj/g0i3o5kWUeghAh4llgO1UhEqOLidu6KvU4q+GxV/jqw/ouqYbkDrM68OU7wtkyDmpzJpIOSvomGypgxi2zHFgp38u8gLV1giSVaJe6IGZ35JMgmIPoZs5klKtmLIuatREGJQ6rJia3C/Wav7M7Bmgrj+a1a7lAP/9IZoewQinERJ/5eld9tPTiywZlwvcdPYemJ7sA5whf27Lyxtj+IDdYRpsssxeopmwBvvJI2ygp8UeBhrVHNocQT4OKKokT6hFsKbhCyjj/CUQUm17wIoXOTH5a3uwaO/HIUNg15ER3XEx2pbstFReF++jzYOwWNr9omzLwOfQtgSA1sxvJc5Np7mAiPygWbs6KSqi4xjCFjnnu4Ry2bFa0j+aoA+t/s1kTV57b65ijDHEB5apUWpwRiRsAQ1iHqfHXQfpSjWY5G2IKMZAI/qtgGtA0HRvQ1F1Q1BTt8X+QZ16hKxB6PKX9KyvYU66xI5JZYTzH68C14vyhbQnKypvv8rdhhzVyjJlK7JBntOhzWb2blAePOn2NlknIgPPE2bwWOqp5QFrJjkZcazTR6rr2RAATUy3VYw1B4qi2wfYnF5wsa8vOYAjwoiqf8WO47a3sn2H2iexSnLLbYXJVVfu32wqD80wfNmSo4gBDWKNW7VNdFGylpto0J/hRRAnh4LZEcivEsYxYaSu14bwZ4NqB+wSMJOogmMboBuUMjB7t1JLupEGOrq5GKCHp2JegTU4tqaM35goUUarrkguCiDlGONsi12dxYbECGKtjQyaS3z3ghcxQs8Ue3mLKULi5K+Oo7VJjp8T1WGBwqO4pHJ8Al1bFWcaZiyAtLuPyPsnjzBgOeho2dyKjcCTECy46VhWlsx0s7txqR8XIcJIQ1+Pz30lOw3684QtxXtcwmYPXIjVP+a8HjBjFRcLIgCA3JE31/JLH+GAlZRTocVozBIVkNjZJUrhwrY1zbBpEBgUGz1EVM2nmtX8Oy6c4ApX2xRm/TGsZCrgV29QaeDZi1XB89r7c0ueTz+PL2GLydqPZwFlL5krkT15Q0jsJ0g5vVpxAYX+33WNdy3nFCIQqiyNTbijbnkWxmWp6lU9xq8jitn+o7/BVgwrnHbaN14FMMD3c91F+o2m/KQxB4VUlNPvwno= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: a13ff737-526d-42db-80dd-08d9e077e715 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:43.3772 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: FPKdQzJ5IPWgXtY5Gwj3PgqLMNyQFZ1HqYLc6SXXisFecnYaj7HHT0a14yo92K8UeuSlZ0/gHqZc53kAx8kYpueRXJJ+dvnUfhlOPDZwRbk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: g8PBvEq1UPo_pR_QWJmLNHZ1fw719aWo X-Proofpoint-ORIG-GUID: g8PBvEq1UPo_pR_QWJmLNHZ1fw719aWo Precedence: bulk List-ID: A new Machine Owner Key (MOK) variable called MokListTrustedRT has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themselves that they wish to trust MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the MOK keys should not be trusted within the kernel. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen --- v1: Initial version v2: Removed mok_keyring_trust_setup function v4: Unmodified from v2 v5: Rename to machine keyring v6: Unmodified from v5 v7: Use mokvar table instead of EFI var (suggested by Peter Jones) v9: Unmodified from v7 v10: Added Jarkko's Reviewed-by --- .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index ea2ac2f9f2b5..09fd8f20c756 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -5,6 +5,7 @@ * Copyright (c) 2021, Oracle and/or its affiliates. */ +#include #include "../integrity.h" static __init int machine_keyring_init(void) @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t if (rc) pr_info("Error adding keys to machine keyring %s\n", source); } + +/* + * Try to load the MokListTrustedRT MOK variable to see if we should trust + * the MOK keys within the kernel. It is not an error if this variable + * does not exist. If it does not exist, MOK keys should not be trusted + * within the machine keyring. + */ +static __init bool uefi_check_trust_mok_keys(void) +{ + struct efi_mokvar_table_entry *mokvar_entry; + + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT"); + + if (mokvar_entry) + return true; + + return false; +} From patchwork Wed Jan 26 02:58:34 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 12724506 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAA9AC63684 for ; Wed, 26 Jan 2022 03:00:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236718AbiAZDAI (ORCPT ); Tue, 25 Jan 2022 22:00:08 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:38474 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236713AbiAZDAI (ORCPT ); Tue, 25 Jan 2022 22:00:08 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 20PMn0ao006704; Wed, 26 Jan 2022 02:59:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=DX13d+PiMvfyMGWKE5ro69EtugCuC09WkcKuPazoMi0=; b=DIGUhdJi2OqJ4q++2pNL6JFMiYlWLxJCdXbPkha3IEkCwh96ZlROrkrS4+TEqhkBapXW Cd+f/1TaGxnZDytEKU394d2TGokJSO/WbHPKz7ecweT9xJKPtyj5q+SMHDgB6NvkSZvg 17ycbJTtgosU9bt+4XULW977vXZbA2+dW51C2JGJDCfJeP9NUZlGf9FC6ZfB3gowlSfE 04heSGGOSGwFRNjVikqqFLTlKLcXLVCIjdBZDkUgGyxNELThoRk4dkNDq1subfQOU+Pa DWrOub4JygMq9XVWY+999cGo/z6P8/nIwpcdBdJ+dF/Na25jB+uMH4SopMaJGhwKEabd AA== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3dsvmjdgrg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:48 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 20Q2oSt1068412; Wed, 26 Jan 2022 02:59:47 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2049.outbound.protection.outlook.com [104.47.74.49]) by userp3020.oracle.com with ESMTP id 3drbcq7vab-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 26 Jan 2022 02:59:47 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=Aw6kUkN/Ckqz2k9l2SQ3tSKXSSidrQEwv7Kh1E3L0ri++xYoD5dNC+OogOcZkt4PNjuGhBj5uVZCKtD86MWfshvC65Ax9j0V+lAj6hAiOQ76tQ6c5blEv2z8CwRzq45+syMzIJTWBCWPIf/tXwz7bJSaGB+wRPJnCCRxXQnW4YetbE4k+OmyhYcqhiYmaWjgKIMgQyaoXUK1s2lMPLsC+ZcopMrJHPobfhfkvPElrrH3PabZsDXwdwWyau+rOMNurvHFiwuXB0GCZy+BqW6hv6Pmryh/Tkd7yhSMuOXz1ctDaRz5vueYuMbdp4x5NZYUd2Th64OzStFXZYvjSKs4Lw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=DX13d+PiMvfyMGWKE5ro69EtugCuC09WkcKuPazoMi0=; b=Hfxl8wE7Sq5w4+sU0Kh7CLg8H0A7itm2jiBBcPZhaK69pQ9dgSTnQ5s7vV0BbcK8RjGYNi0T9BtlwfVG3k8VHDOF0TfTr9hDvMkm2vcLuMVPK31dHTUyBdD1Hjtpl1nQpGd+fshgJ6VTUYvcbRAAc3J0WuJyVaRfQH+qErXFp9zKwQzCEww04J8JbiwpvlaKxCdT3aKwLz00o7LdNRraXT1DDQ2OT43Fn5hms3wRXpinzwMpEkiDQUqGTWHZel9ucGZWkiMidE/lplyckPh3SeDGefU7TfNWS7hAIAXSWkG8a+IBvj7q3DxMvofDy3zgrECR+0yZxRtZ78SZ7mmFVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DX13d+PiMvfyMGWKE5ro69EtugCuC09WkcKuPazoMi0=; b=u2gpJMN04u61V82Z/XTDtY7WWjSbY2DbW5LH0USkzs/yw7sxdaelWlgDs9kzGAY0jmzKgMTOYYw5TWvRrFwo6721zUSrku8IUt75jBDOBU84ltNx3l4jz8yg9KpoumOyNEbQaIqKqqN/tseQ2CKS1YmyCFByt0NjZkvF5f/Jb1o= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by SJ0PR10MB4654.namprd10.prod.outlook.com (2603:10b6:a03:2d2::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4909.8; Wed, 26 Jan 2022 02:59:45 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%5]) with mapi id 15.20.4909.017; Wed, 26 Jan 2022 02:59:45 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v10 8/8] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Date: Tue, 25 Jan 2022 21:58:34 -0500 Message-Id: <20220126025834.255493-9-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220126025834.255493-1-eric.snowberg@oracle.com> References: <20220126025834.255493-1-eric.snowberg@oracle.com> X-ClientProxiedBy: CY4PR04CA0027.namprd04.prod.outlook.com (2603:10b6:903:c6::13) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 7d470f1c-e83c-4659-9281-08d9e077e853 X-MS-TrafficTypeDiagnostic: SJ0PR10MB4654:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6108; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: L0V4BHUUWFtNgkWsEGdHoIqyLmOYMhiAsymKY7l3Hf2WYvxoIkHPnSFvozjR9UGhAIBeFUHO2k3ByK/8Fjq9lU7t9vd/cwNF+hh1gBoXWoP++pzXEswoEE9+t3DkeDbDNqVmNix0lE+prKEUHzwTFtcim8ikcziOx/QDV1D1eQMEhl8/Z2QWA0rxBB5P4ntmDn/MzJpP68N37vyKaX3AxfJIGx/Fc9kvzN7CC2YYaD8nAIx0IYYVjOKVEzm+wV9nJWVEq9l53V3PWSY7Wrg80pFBxgGUcYPfRZzX4iNJoBHLpoYFBwXfCIjk0LComzx9495p7q6QfsTVJ05AqARvA5OgZbKCdgXPe31V2mZJ3fXDJ5WcSVblzobGXEge3JkdDJnqr2UY9E5MmF3qqR1I3lgDAgR0n4VCLXJ7aXM5oVjQ73aDa7q1KZ1/CNpAyI0siqj29PccUmeO0PCHh0Vy+HiqJM51ucPZcANPbHtrwpQ2OC4vaKupKe9XjUCP0sxafXJP7fuGE+ojUrFOOTBhjFhxuDXAIapCObgSUkNtRIEilYzRKM/+6tDmScpuFNdTYHr2oWiCsEb5NAV2hgR+QK/0bwueOfaiIo/5PWgaS25ELsHwTJk1siqCC4OKyiJw7DKEhz9gKM6FlbIg61s5XfpuzdmpFwM0Ly5hq8IS0/oTuhsaWhTMq2Iur70dT0MOFhwADvK5r8/42Ch1zE3p+w== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(6666004)(83380400001)(8936002)(8676002)(5660300002)(1076003)(66556008)(66476007)(52116002)(6486002)(66946007)(316002)(2616005)(2906002)(44832011)(86362001)(36756003)(4326008)(508600001)(186003)(6512007)(107886003)(26005)(6506007)(38350700002)(38100700002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6m1aX3joed9PmrLhUs5zlPmiGzH6NzuAfgBPARVuH+76f9okX8yRI5NfObV4oVYdkm8vTIMLJKFNJOMC0B3FadR2tg485s+/kTnGMYMk1FRFBxPif5MsK6Ia0bZ69e/KsngJ0FOCDSmqH9f4Jin27MXGDSXFRcZHmdCBSq/0BxXqj5T04kLR9bcjnqLTkEzPaaLzJHKiOQ3FTIYfFxpuUZblEYSfmwBEWoPwSn9vv+GMPEK/UaKVOQU9IARmFww7NIfG+FOIUh6hpyuX+kaPwnOYBqU7BXVQmnq3XITCJgowGrIUnNYJzIk3wu1lABay/BgvXjuCR3c5ej0QLhJ4pWAlUDaHH0F47BaYq/qBH5nLM7Fp3xuE9+BGcnkr2GpL37qXh+qxtQo5H4veELV8wmt6bv+dhWousXeYNycLb2dGcZjsYYQN9EjqcZwa4xa0pMnKhOjn9ghodQ5CRMKWy+F9RN3erANIQ2RjmHCytpdx/GggBsPxtPcFW/roDvC74vvFutT9dSpkMB5+7k9ixdKwfi3v/Jxvmwrj/+8o8ayNdO1n8JLbbnOtvYPtunTkcORVC1o7h9h4eL/kdi7Htkc9L3/LVE9ZpbdV5g2W6XgyEfSMaO/kRtt+um7mP0ah+pCPsBATeA0DswXjq1t44K+TCpPQF1NhI5B/gsBX9wkDpfTVt8c9bwrvp4x2tS5FpBiQVWo1X3twwB4s5KTuaoCgg5ZIvgpQhsxLn0h1yg24S+cPSjkNEAjc6TdI/EiPyn1f2U41BHRwdrP47/uwmQHAUAkaV6gSOC4oBRRvCi0uZ+57TGbrRcC5WJPSD1mZZ0yq4J/IZrH9Pfk+ZAku2My1SiyAbvRlJLmg+t3n9D/G0rdKnlQmJn6A+cH4e+BQrxNrzXGwZ2XVRFWzZC4yu2b1EHqeoGk63qIzRPFXvRqv/4mvR354j0CkdbfhleTJvYxHgwozeCOQ7w71B1SwNtWdEEBAQTrmXobApclBWNrTXZ5LU5XtnaxXq3jwUd+ZkwuLVd0hYO5m5XfIGgyJYArCcA0E8BV5/vY7JQdP022VSaBmnzpiuewrZ48/x3Nix2p4oUFtEsoO42CdhktkdDkJC3QrI7XMDw6DTuhNm7xj22gIQTigMp/fo6PjpSvZ8BZX++q594HdsM9kZJKZRP3H+IF6hlHYLC7wlgkURnGjvxXLV9AE+dSMr9yAs4Q+EBuWwzQnQww24saElzXi3n5YU40V0IYRz1otvVUMyMOQAvuFIR0g8Vx1hgNbfJKkWfhhBzvDudtadSByYMqf9kSEbfkqYPj10AwHpMYmhq6LCcsuzU0lEqoSFJjryukz9n9wbq7pbFTzq2xpZo0lA1hByFk/qg2OGfLrIGt04siCdmhonBQs2mu2KSOF6eMhFtoFFt2xgK8Lvj1XeJ/8oABY97UK+JLGd0EM9wnz4KXRUkWH/rZSDss19czwy3eXeo+wa5ndXavzWDo/Ae8vZS6ex2n6FfKdCyPCLVG+hQNLWRAqfkpIlQ9gRrwSljoV4nYPDU/goH3bcgvFQx51LKGfs3YA/Aa9b7FEtrAHjRqdU/EfwAnEv6TfQB92IiLi0gosrzm5VtH20KZgi2/9JaiTnob0MSVtiUvopEdv0i0QtBPOudAhsAZogD75wU/DGWnlySWWTLUippriOALt+i38G1R0WzqwBN0ZVl0HMkc= X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7d470f1c-e83c-4659-9281-08d9e077e853 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jan 2022 02:59:45.4406 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: ET8OXapE9S/dKW7SZj94lAtVV1t5Zr/CHETcUWxO9oZ5xSGS4C3srETzq/mWHCKKLT4iIhHbCS6lvwrK4Lk+KnEKUn3S/HeYywkXYaDYN6o= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4654 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10238 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000 definitions=main-2201260011 X-Proofpoint-GUID: AHqjLRdYUHiKVdhuz4W9ATjBDJpjW-3m X-Proofpoint-ORIG-GUID: AHqjLRdYUHiKVdhuz4W9ATjBDJpjW-3m Precedence: bulk List-ID: With the introduction of uefi_check_trust_mok_keys, it signifies the end- user wants to trust the machine keyring as trusted keys. If they have chosen to trust the machine keyring, load the qualifying keys into it during boot, then link it to the secondary keyring . If the user has not chosen to trust the machine keyring, it will be empty and not linked to the secondary keyring. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen --- v4: Initial version v5: Rename to machine keyring v6: Unmodified from v5 v7: Made trust_mok static v8: Unmodified from v7 v10: Added Jarkko's Reviewed-by --- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 5 +++++ .../integrity/platform_certs/keyring_handler.c | 2 +- .../integrity/platform_certs/machine_keyring.c | 16 ++++++++++++++++ 4 files changed, 23 insertions(+), 2 deletions(-) diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 7b719aa76188..c8c8a4a4e7a0 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -112,7 +112,7 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); - if (id == INTEGRITY_KEYRING_MACHINE) + if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 730771eececd..2e214c761158 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source, #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +bool __init trust_moklist(void); #else static inline void __init add_to_machine_keyring(const char *source, const void *data, size_t len) { } +static inline bool __init trust_moklist(void) +{ + return false; +} #endif diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 4872850d081f..1db4d3b4356d 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) { if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) return add_to_machine_keyring; else return add_to_platform_keyring; diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index 09fd8f20c756..7aaed7950b6e 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -8,6 +8,8 @@ #include #include "../integrity.h" +static bool trust_mok; + static __init int machine_keyring_init(void) { int rc; @@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void) return false; } + +bool __init trust_moklist(void) +{ + static bool initialized; + + if (!initialized) { + initialized = true; + + if (uefi_check_trust_mok_keys()) + trust_mok = true; + } + + return trust_mok; +}