Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <6eb8f66b6f297bcab82c2f5e8c4cd2d4dbcffda7.camel@linux.ibm.com>
Subject: Re: [GIT PULL] integrity subsystem updates for v5.13
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     linux-integrity <linux-integrity@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>
Date:   Sun, 02 May 2021 00:27:40 -0400
In-Reply-To: <CAHk-=wjBSomE81D=dXN5Z1r_qTLDeKfOzXH4T+mPK6AeSWhW0w@mail.gmail.com>
References: <33e5687f1e4c7becdc41136704fa239f81b82fec.camel@linux.ibm.com>
         <CAHk-=wjBSomE81D=dXN5Z1r_qTLDeKfOzXH4T+mPK6AeSWhW0w@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Sat, 2021-05-01 at 15:49 -0700, Linus Torvalds wrote:
> On Wed, Apr 28, 2021 at 6:47 AM Mimi Zohar <zohar@linux.ibm.com> wrote:
> >
> > In addition to loading the kernel module signing key onto the builtin
> > keyring, load it onto the IMA keyring as well.
> 
> This clashed pretty badly with the other cert changes.
> 
> I think the end result looks nice and clean (the cert updates mesh
> well with the _intention_ of your code, just not with the
> implementation), but you should really double-check that I didn't mess
> anything up in the merge and whatever test-case you have for IMA still
> works.
> 
> I only verified that the kernel module signing key still works for
> modules - no IMA test-case.

I'm really sorry I forgot to mention in the pull request that Stephen
was carrying a merge conflict fix.  Everything looks good.  I tested
it, making sure that the kernel module signing key is loaded onto the
builtin and/or IMA keyrings properly.

thanks,

Mimi