Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
	Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
	Kingdom.
	Registered in England and Wales under Company Registration No. 3798903
From: David Howells <dhowells@redhat.com>
In-Reply-To: <20150521213829.GH23057@wotan.suse.de>
References: <20150521213829.GH23057@wotan.suse.de> <20150515123513.16723.96340.stgit@warthog.procyon.org.uk> <555BD715.40202@kernel.org> <31772.1432128969@warthog.procyon.org.uk> <CALCETrUt+OO8sk=7j+rBToHujV7ONDzQ1Z6UMJ9HHUB44Jmtpw@mail.gmail.com> <20150520162059.GC10473@localhost>
To: "Luis R. Rodriguez" <mcgrof@suse.com>
Cc: dhowells@redhat.com, Andy Lutomirski <luto@amacapital.net>,
        Andy Lutomirski <luto@kernel.org>,
        Rusty Russell <rusty@rustcorp.com.au>, Michal Marek <mmarek@suse.cz>,
        Matthew Garrett <mjg59@srcf.ucam.org>, keyrings@linux-nfs.org,
        Dmitry Kasatkin <dmitry.kasatkin@gmail.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Seth Forshee <seth.forshee@canonical.com>,
        LSM List <linux-security-module@vger.kernel.org>,
        David Woodhouse <dwmw2@infradead.org>
Subject: Re: [PATCH 0/8] MODSIGN: Use PKCS#7 for module signatures [ver #4]
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <32539.1432280936.1@warthog.procyon.org.uk>
Content-Transfer-Encoding: 8BIT
Date: Fri, 22 May 2015 08:48:56 +0100
Message-ID: <32540.1432280936@warthog.procyon.org.uk>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 953
Lines: 24

Luis R. Rodriguez <mcgrof@suse.com> wrote:

> > This is similar to what i am doing right now - create CA hierarchy so we can 
> > have something like:
> > 
> >                                +-> KeyB
> >                                |
> > RootCA --->  CertA ---> CertB ---> CertC ---> KeyC
> >                     |
> >                     +-> CertA' ---> KeyA"
> 
> How exactly do you go about uploading CertB to the kernel BTW?

Assuming RootCA or CertA is present in the kernel, the idea would be to use
the add_key() system call or the request_key() mechanism to add the key to the
system keyring.  The key in the cert would only be added to the keyring if it
is trusted by a key already there.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/