Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chunxin Zang <zangchunxin@bytedance.com>
Content-Type: text/plain;
        charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\))
Subject: =?utf-8?Q?Documentation/admin-guide/module-signing=2Erst=3A_Does_?=
 =?utf-8?Q?the_function_of_adding_a_key_to_=E2=80=98Builtin=5Ftrusted=5Fke?=
 =?utf-8?Q?y=E2=80=99_work=3F?=
Message-Id: <49DB247F-F485-45D5-87F9-4FCB85CB7767@bytedance.com>
Date:   Mon, 24 May 2021 17:02:07 +0800
Cc:     keyrings@vger.kernel.org, linux-doc@vger.kernel.org,
        linux-kernel@vger.kernel.org
To:     dhowells@redhat.com, dwmw2@infradead.org, corbet@lwn.net
Precedence: bulk

Recently, I am learning how to use module signature.
But I got 'Permission denied' when I trying to add a=20
public key to the 'builtin_trusted_keys' keyring.

root@:~# cat /proc/keys
3471e123 I------     1 perm 1f030000     0     0 asymmetri Build time =
autogenerated kernel key: xxxx: X509.rsa xxxx []
37e8db03 I------     1 perm 1f0b0000     0     0 keyring   =
.builtin_trusted_keys: 1
root@:~# keyctl padd asymmetric "" 0x37e8db03  < =
./signing_key_test_sign.x509
add_key: Permission denied

The reason is the 'builtin_trusted_keys'  keyring's perm was set=20
'1f0b0000' by below operate when kernel starting.=20

builtin_trusted_keys =3D
                keyring_alloc(".builtin_trusted_keys",
                              KUIDT_INIT(0), KGIDT_INIT(0), =
current_cred(),
                              ((KEY_POS_ALL & ~KEY_POS_SETATTR) |=20
                              KEY_USR_VIEW | KEY_USR_READ | =
KEY_USR_SEARCH),
                              KEY_ALLOC_NOT_IN_QUOTA,
                              NULL, NULL);

And,  'add_key' interface pass the KEY_NEED_WRITE
perm to lookup_user_key.=20
So -EACCES returned in key_task_permission check.

Is there something wrong in  module-signing.rst ?
Or I missed some information about it.

Best wishes
Chunxin=