LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Eric Snowberg <eric.snowberg@oracle.com>
To: keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
	zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
	herbert@gondor.apana.org.au, davem@davemloft.net,
	jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc: eric.snowberg@oracle.com, keescook@chromium.org,
	gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
	scott.branden@broadcom.com, weiyongjun1@huawei.com,
	nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
	nramas@linux.microsoft.com, lszubowi@redhat.com,
	linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	James.Bottomley@HansenPartnership.com, pjones@redhat.com,
	konrad.wilk@oracle.com
Subject: [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring
Date: Tue,  7 Sep 2021 12:01:06 -0400	[thread overview]
Message-ID: <20210907160110.2699645-9-eric.snowberg@oracle.com> (raw)
In-Reply-To: <20210907160110.2699645-1-eric.snowberg@oracle.com>

With the introduction of the machine keyring, the end-user may choose to
trust Machine Owner Keys (MOK) within the kernel. If they have chosen to
trust them, the .machine keyring will contain these keys.  If not, the
machine keyring will always be empty.  Update the restriction check to
allow the secondary trusted keyring and ima keyring to also trust
machine keys.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v4: Initial version (consolidated two previous patches)
v5: Rename to machine keyring
---
 certs/system_keyring.c      | 5 ++++-
 security/integrity/digsig.c | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 955bd57815f4..747f0c528fec 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -89,7 +89,10 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void
 	if (!restriction)
 		panic("Can't allocate secondary trusted keyring restriction\n");
 
-	restriction->check = restrict_link_by_builtin_and_secondary_trusted;
+	if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
+		restriction->check = restrict_link_by_builtin_secondary_and_ca_trusted;
+	else
+		restriction->check = restrict_link_by_builtin_and_secondary_trusted;
 
 	return restriction;
 }
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 2b75bbbd9e0e..c3c1939be2f1 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -34,7 +34,11 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
 };
 
 #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_ca_trusted
+#else
 #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
+#endif
 #else
 #define restrict_link_to_ima restrict_link_by_builtin_trusted
 #endif
-- 
2.18.4


  parent reply	other threads:[~2021-09-07 16:03 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-07 16:00 [PATCH v5 00/12] Enroll kernel keys thru MOK Eric Snowberg
2021-09-07 16:00 ` [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine Eric Snowberg
2021-09-09 13:55   ` Jarkko Sakkinen
2021-09-09 15:19   ` Mimi Zohar
2021-09-09 17:32     ` Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 02/12] integrity: Do not allow machine keyring updates following init Eric Snowberg
2021-09-09 13:43   ` Jarkko Sakkinen
2021-09-07 16:01 ` [PATCH v5 03/12] KEYS: CA link restriction Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 04/12] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Eric Snowberg
2021-09-09 13:49   ` Jarkko Sakkinen
2021-09-09 17:25   ` Mimi Zohar
2021-09-09 17:53     ` Eric Snowberg
2021-09-09 18:19       ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 05/12] integrity: add new keyring handler for mok keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 06/12] KEYS: add a reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 07/12] KEYS: Introduce link restriction to include builtin, secondary and machine keys Eric Snowberg
2021-09-09 17:26   ` Mimi Zohar
2021-09-09 18:03     ` Eric Snowberg
2021-09-09 18:19       ` Mimi Zohar
2021-09-07 16:01 ` Eric Snowberg [this message]
2021-09-09 17:27   ` [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 09/12] KEYS: link secondary_trusted_keys to machine trusted keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 10/12] integrity: store reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 11/12] integrity: Trust MOK keys if MokListTrustedRT found Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 12/12] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Eric Snowberg
2021-09-09 13:58   ` Jarkko Sakkinen
2021-09-08 16:03 ` [PATCH v5 00/12] Enroll kernel keys thru MOK Jarkko Sakkinen
2021-09-08 16:49   ` Jarkko Sakkinen
2021-09-08 22:25     ` Eric Snowberg
2021-09-09 13:02       ` Mimi Zohar
2021-09-08 17:09   ` Eric Snowberg

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210907160110.2699645-9-eric.snowberg@oracle.com \
    --to=eric.snowberg@oracle.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=ardb@kernel.org \
    --cc=davem@davemloft.net \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=ebiggers@google.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=jarkko@kernel.org \
    --cc=jmorris@namei.org \
    --cc=keescook@chromium.org \
    --cc=keyrings@vger.kernel.org \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=lszubowi@redhat.com \
    --cc=nayna@linux.ibm.com \
    --cc=nramas@linux.microsoft.com \
    --cc=pjones@redhat.com \
    --cc=scott.branden@broadcom.com \
    --cc=serge@hallyn.com \
    --cc=torvalds@linux-foundation.org \
    --cc=weiyongjun1@huawei.com \
    --cc=zohar@linux.ibm.com \
    --subject='Re: [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).