LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Eric Snowberg <eric.snowberg@oracle.com>
To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
	zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
	herbert@gondor.apana.org.au, davem@davemloft.net,
	jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc: eric.snowberg@oracle.com, keescook@chromium.org,
	gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
	scott.branden@broadcom.com, weiyongjun1@huawei.com,
	nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
	nramas@linux.microsoft.com, lszubowi@redhat.com,
	linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	James.Bottomley@HansenPartnership.com, pjones@redhat.com,
	konrad.wilk@oracle.com
Subject: [PATCH v4 12/12] integrity: Only use mok keyring when uefi_check_trust_mok_keys is true
Date: Wed, 18 Aug 2021 20:21:09 -0400	[thread overview]
Message-ID: <20210819002109.534600-13-eric.snowberg@oracle.com> (raw)
In-Reply-To: <20210819002109.534600-1-eric.snowberg@oracle.com>

With the introduction of uefi_check_trust_mok_keys, it signifies the end-
user wants to trust the mok keyring as trusted keys.  If they have chosen 
to trust the mok keyring, load the qualifying keys into it during boot, 
then link it to the secondary keyring .  If the user has not chosen to 
trust the mok keyring, it will be empty and not linked to the secondary 
keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v4: Initial version
---
 security/integrity/digsig.c                      |  2 +-
 security/integrity/integrity.h                   |  5 +++++
 .../integrity/platform_certs/keyring_handler.c   |  2 +-
 security/integrity/platform_certs/mok_keyring.c  | 16 ++++++++++++++++
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 0f14ffef9c43..fd255e5b6293 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -116,7 +116,7 @@ static int __init __integrity_init_keyring(const unsigned int id,
 	} else {
 		if (id == INTEGRITY_KEYRING_PLATFORM)
 			set_platform_trusted_keys(keyring[id]);
-		if (id == INTEGRITY_KEYRING_MOK)
+		if (id == INTEGRITY_KEYRING_MOK && trust_moklist())
 			set_mok_trusted_keys(keyring[id]);
 		if (id == INTEGRITY_KEYRING_IMA)
 			load_module_cert(keyring[id]);
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index be56ba49dc19..57683fdea2af 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source,
 
 #ifdef CONFIG_INTEGRITY_MOK_KEYRING
 void __init add_to_mok_keyring(const char *source, const void *data, size_t len);
+bool __init trust_moklist(void);
 #else
 static inline void __init add_to_mok_keyring(const char *source,
 					     const void *data, size_t len)
 {
 }
+static inline bool __init trust_moklist(void)
+{
+	return false;
+}
 #endif
diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c
index fc4ad85d9223..471bf103b444 100644
--- a/security/integrity/platform_certs/keyring_handler.c
+++ b/security/integrity/platform_certs/keyring_handler.c
@@ -82,7 +82,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
 __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
 {
 	if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) {
-		if (IS_ENABLED(CONFIG_INTEGRITY_MOK_KEYRING))
+		if (IS_ENABLED(CONFIG_INTEGRITY_MOK_KEYRING) && trust_moklist())
 			return add_to_mok_keyring;
 		else
 			return add_to_platform_keyring;
diff --git a/security/integrity/platform_certs/mok_keyring.c b/security/integrity/platform_certs/mok_keyring.c
index bcfab894a9dc..3dbb6d17e17d 100644
--- a/security/integrity/platform_certs/mok_keyring.c
+++ b/security/integrity/platform_certs/mok_keyring.c
@@ -8,6 +8,8 @@
 #include <linux/efi.h>
 #include "../integrity.h"
 
+bool trust_mok;
+
 static __init int mok_keyring_init(void)
 {
 	int rc;
@@ -67,3 +69,17 @@ static __init bool uefi_check_trust_mok_keys(void)
 	 */
 	return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE)));
 }
+
+bool __init trust_moklist(void)
+{
+	static bool initialized;
+
+	if (!initialized) {
+		initialized = true;
+
+		if (uefi_check_trust_mok_keys())
+			trust_mok = true;
+	}
+
+	return trust_mok;
+}
-- 
2.18.4


  parent reply	other threads:[~2021-08-19  0:25 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-19  0:20 [PATCH v4 00/12] Enroll kernel keys thru MOK Eric Snowberg
2021-08-19  0:20 ` [PATCH v4 01/12] integrity: Introduce a Linux keyring for the Machine Owner Key (MOK) Eric Snowberg
2021-08-19  0:20 ` [PATCH v4 02/12] integrity: Do not allow mok keyring updates following init Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 03/12] KEYS: CA link restriction Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 04/12] integrity: restrict INTEGRITY_KEYRING_MOK to restrict_link_by_ca Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 05/12] integrity: add new keyring handler for mok keys Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 06/12] KEYS: add a reference to mok keyring Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 07/12] KEYS: Introduce link restriction to include builtin, secondary and mok keys Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 08/12] KEYS: integrity: change link restriction to trust the mok keyring Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 09/12] KEYS: link secondary_trusted_keys to mok trusted keys Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 10/12] integrity: store reference to mok keyring Eric Snowberg
2021-08-19  0:21 ` [PATCH v4 11/12] integrity: Trust MOK keys if MokListTrustedRT found Eric Snowberg
2021-08-19  0:21 ` Eric Snowberg [this message]
2021-08-19 11:38 ` [PATCH v4 00/12] Enroll kernel keys thru MOK Jarkko Sakkinen
2021-08-19 13:10   ` Mimi Zohar
2021-08-19 15:23     ` Eric Snowberg
2021-08-19 17:32       ` Mimi Zohar
2021-08-23 17:51         ` Jarkko Sakkinen
2021-08-23 20:48           ` Nayna
2021-08-24 14:34             ` Mimi Zohar
2021-08-25 22:21               ` Jarkko Sakkinen
2021-08-25 22:27                 ` James Bottomley
2021-08-27 20:44                   ` Nayna
2021-08-30 17:39                     ` Eric Snowberg
2021-09-01  0:52                       ` Nayna
2021-09-01  1:51                         ` Eric Snowberg
2021-09-02 10:18                           ` Mimi Zohar
2021-09-01  4:34                     ` Jarkko Sakkinen
2021-09-01  4:36                       ` Jarkko Sakkinen
2021-09-01  4:46                         ` Jarkko Sakkinen
2021-08-23 17:37       ` Jarkko Sakkinen
2021-08-23 17:35     ` Jarkko Sakkinen
2021-08-23 17:48       ` Eric Snowberg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210819002109.534600-13-eric.snowberg@oracle.com \
    --to=eric.snowberg@oracle.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=ardb@kernel.org \
    --cc=davem@davemloft.net \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=ebiggers@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=jarkko@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=keyrings@vger.kernel.org \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=lszubowi@redhat.com \
    --cc=nayna@linux.ibm.com \
    --cc=nramas@linux.microsoft.com \
    --cc=pjones@redhat.com \
    --cc=scott.branden@broadcom.com \
    --cc=serge@hallyn.com \
    --cc=torvalds@linux-foundation.org \
    --cc=weiyongjun1@huawei.com \
    --cc=zohar@linux.ibm.com \
    --subject='Re: [PATCH v4 12/12] integrity: Only use mok keyring when uefi_check_trust_mok_keys is true' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).