Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <856359f263575f01d0ce2fcf8f042321f750b38c.camel@linux.ibm.com>
Subject: Re: [PATCH v3] KEYS: trusted: Fix trusted key backends when
 building as module
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Andreas Rammhold <andreas@rammhold.de>,
        Ahmad Fatoum <a.fatoum@pengutronix.de>
Cc:     James Bottomley <jejb@linux.ibm.com>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        David Howells <dhowells@redhat.com>,
        James Morris <jmorris@namei.org>,
        "Serge E. Hallyn" <serge@hallyn.com>,
        Sumit Garg <sumit.garg@linaro.org>,
        linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Date:   Mon, 27 Sep 2021 07:27:04 -0400
In-Reply-To: <20210927085104.vq42feghtaqiv6ni@wrt>
References: <20210730012822.3460913-1-andreas@rammhold.de>
         <0d42a11a-0117-49a9-d2c9-bc6cc405235d@pengutronix.de>
         <20210927085104.vq42feghtaqiv6ni@wrt>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Mon, 2021-09-27 at 10:51 +0200, Andreas Rammhold wrote:
> On 09:47 13.09.21, Ahmad Fatoum wrote:
> > Dear trusted key maintainers,
> > 
> > On 30.07.21 03:28, Andreas Rammhold wrote:
> > > Before this commit the kernel could end up with no trusted key sources
> > > even though both of the currently supported backends (TPM and TEE) were
> > > compiled as modules. This manifested in the trusted key type not being
> > > registered at all.
> > > 
> > > When checking if a CONFIG_… preprocessor variable is defined we only
> > > test for the builtin (=y) case and not the module (=m) case. By using
> > > the IS_REACHABLE() macro we do test for both cases.
> > > 
> > > Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
> > > Signed-off-by: Andreas Rammhold <andreas@rammhold.de>
> > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> > Does anyone intend to pick this up?
> 
> Did this end up in any tree by now? I am wondering if I should resend
> the patch instead. Perhaps it was just overlooked?

For EVM environments only using trusted and encrypted keys, not file
signatures, the trusted key is needed to decrypt the "master" key in
order to verify kernel modules.

Mimi