LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Eric Snowberg <eric.snowberg@oracle.com>,
	keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
	dhowells@redhat.com, dwmw2@infradead.org,
	herbert@gondor.apana.org.au, davem@davemloft.net,
	jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc: keescook@chromium.org, gregkh@linuxfoundation.org,
	torvalds@linux-foundation.org, scott.branden@broadcom.com,
	weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com,
	ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com,
	linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	James.Bottomley@HansenPartnership.com, pjones@redhat.com,
	konrad.wilk@oracle.com
Subject: Re: [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine
Date: Thu, 09 Sep 2021 11:19:43 -0400	[thread overview]
Message-ID: <02024a370f3180e5a6668282e5843ab58bf2a073.camel@linux.ibm.com> (raw)
In-Reply-To: <20210907160110.2699645-2-eric.snowberg@oracle.com>

On Tue, 2021-09-07 at 12:00 -0400, Eric Snowberg wrote:
> Many UEFI Linux distributions boot using shim.  The UEFI shim provides
> what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
> Boot DB and MOK keys to validate the next step in the boot chain.  The
> MOK facility can be used to import user generated keys.  These keys can
> be used to sign an end-users development kernel build.  When Linux
> boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
> .platform keyring.
> 
> Add a new Linux keyring called machine.  This keyring shall contain just

^Define

> MOK CA keys and not the remaining keys in the platform keyring. This new
> machine keyring will be used in follow on patches.  Unlike keys in the
> platform keyring, keys contained in the machine keyring will be trusted
> within the kernel if the end-user has chosen to do so.
> 
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
> ---
> v1: Initial version
> v2: Removed destory keyring code
> v3: Unmodified from v2
> v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" 
> v5: Rename to machine keyring
> ---
>  security/integrity/Kconfig                    | 11 +++++
>  security/integrity/Makefile                   |  1 +
>  security/integrity/digsig.c                   |  1 +
>  security/integrity/integrity.h                | 12 +++++-
>  .../platform_certs/machine_keyring.c          | 42 +++++++++++++++++++
>  5 files changed, 66 insertions(+), 1 deletion(-)
>  create mode 100644 security/integrity/platform_certs/machine_keyring.c
> 
> diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig
> index 71f0177e8716..52193b86768a 100644
> --- a/security/integrity/Kconfig
> +++ b/security/integrity/Kconfig
> @@ -62,6 +62,17 @@ config INTEGRITY_PLATFORM_KEYRING
>           provided by the platform for verifying the kexec'ed kerned image
>           and, possibly, the initramfs signature.
>  
> +config INTEGRITY_MACHINE_KEYRING
> +	bool "Provide a keyring to which CA Machine Owner Keys may be added"
> +	depends on SECONDARY_TRUSTED_KEYRING
> +	depends on INTEGRITY_ASYMMETRIC_KEYS
> +	depends on SYSTEM_BLACKLIST_KEYRING
> +	help
> +	 If set, provide a keyring to which CA Machine Owner Keys (MOK) may
> +	 be added. This keyring shall contain just CA MOK keys.  Unlike keys
> +	 in the platform keyring, keys contained in the .machine keyring will
> +	 be trusted within the kernel.

No sense in creating the ".machine" keyring, unless it is possible to
safely load CA certificates on it.  At least for the time being, this
should also be dependent on EFI.

<snip>

> +++ b/security/integrity/platform_certs/machine_keyring.c
> @@ -0,0 +1,42 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Machine keyring routines.
> + *
> + * Copyright (c) 2021, Oracle and/or its affiliates.
> + */
> +
> +#include "../integrity.h"
> +
> +static __init int machine_keyring_init(void)
> +{
> +	int rc;
> +
> +	rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE);
> +	if (rc)
> +		return rc;
> +
> +	pr_notice("Machine keyring initialized\n");
> +	return 0;
> +}
> +device_initcall(machine_keyring_init);
> +
> +void __init add_to_machine_keyring(const char *source, const void *data, size_t len)
> +{
> +	key_perm_t perm;
> +	int rc;
> +
> +	perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;
> +	rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm);
> +
> +	/*
> +	 * Some MOKList keys may not pass the machine keyring restrictions.
> +	 * If the restriction check does not pass and the platform keyring
> +	 * is configured, try to add it into that keyring instead.
> +	 */
> +	if (rc)

In addition to the comment, also test to see if the ".platform" keyring
is configured.

thanks,

Mimi

> +		rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source,
> +					 data, len, perm);
> +
> +	if (rc)
> +		pr_info("Error adding keys to machine keyring %s\n", source);
> +}



  parent reply	other threads:[~2021-09-09 15:20 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-07 16:00 [PATCH v5 00/12] Enroll kernel keys thru MOK Eric Snowberg
2021-09-07 16:00 ` [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine Eric Snowberg
2021-09-09 13:55   ` Jarkko Sakkinen
2021-09-09 15:19   ` Mimi Zohar [this message]
2021-09-09 17:32     ` Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 02/12] integrity: Do not allow machine keyring updates following init Eric Snowberg
2021-09-09 13:43   ` Jarkko Sakkinen
2021-09-07 16:01 ` [PATCH v5 03/12] KEYS: CA link restriction Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 04/12] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Eric Snowberg
2021-09-09 13:49   ` Jarkko Sakkinen
2021-09-09 17:25   ` Mimi Zohar
2021-09-09 17:53     ` Eric Snowberg
2021-09-09 18:19       ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 05/12] integrity: add new keyring handler for mok keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 06/12] KEYS: add a reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 07/12] KEYS: Introduce link restriction to include builtin, secondary and machine keys Eric Snowberg
2021-09-09 17:26   ` Mimi Zohar
2021-09-09 18:03     ` Eric Snowberg
2021-09-09 18:19       ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring Eric Snowberg
2021-09-09 17:27   ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 09/12] KEYS: link secondary_trusted_keys to machine trusted keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 10/12] integrity: store reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 11/12] integrity: Trust MOK keys if MokListTrustedRT found Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 12/12] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Eric Snowberg
2021-09-09 13:58   ` Jarkko Sakkinen
2021-09-08 16:03 ` [PATCH v5 00/12] Enroll kernel keys thru MOK Jarkko Sakkinen
2021-09-08 16:49   ` Jarkko Sakkinen
2021-09-08 22:25     ` Eric Snowberg
2021-09-09 13:02       ` Mimi Zohar
2021-09-08 17:09   ` Eric Snowberg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=02024a370f3180e5a6668282e5843ab58bf2a073.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=ardb@kernel.org \
    --cc=davem@davemloft.net \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=ebiggers@google.com \
    --cc=eric.snowberg@oracle.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=jarkko@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=keyrings@vger.kernel.org \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=lszubowi@redhat.com \
    --cc=nayna@linux.ibm.com \
    --cc=nramas@linux.microsoft.com \
    --cc=pjones@redhat.com \
    --cc=scott.branden@broadcom.com \
    --cc=serge@hallyn.com \
    --cc=torvalds@linux-foundation.org \
    --cc=weiyongjun1@huawei.com \
    --subject='Re: [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).