From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v7 10/17] KEYS: add a reference to machine keyring
Date:   Mon, 15 Nov 2021 19:15:38 -0500
Message-Id: <20211116001545.2639333-11-eric.snowberg@oracle.com>
In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com>
References: <20211116001545.2639333-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QCqvUn0uR9K0b2Fl4jIf3HViwCuRC7vnMXZH2w7iwB+SewNaIHgXn+DBM0Jt?=
 =?us-ascii?Q?lNH/8iPZMAHxfui8/zIAZb0xCuemu58ufgNYL8CoSnD9SsgQAPJUzi8Ys8Ne?=
 =?us-ascii?Q?qaGo2D7up05GkvQTT9ZxVglhcUfEsDRwFnIGQo6fphCxPiYUUP+23z23TQgO?=
 =?us-ascii?Q?bCJ9LgBK1QLBVdFOAxlCem6ts/NssgH0KMiqvXW6XDQZmbf2a7Q2qbPVzzo6?=
 =?us-ascii?Q?4ij+ywqvtIuJahTfCdIr/umv00DiRAO+SFXqdg2AewnqHkmiG/5LPlAk612o?=
 =?us-ascii?Q?eUT4BGrjqkeolsVfR2t5x+vHOq7m+L4rWSU93lwcpJWjmNbi0CqVal5DQgHs?=
 =?us-ascii?Q?IEdr6J/piKQEmBA/vYZscC6fvzeRYavBGcRCK+B72MiLkKDH8O6VbkPeYMAf?=
 =?us-ascii?Q?8o2D06WdDXOhvAYpoG12sCS1VnW42vGhuTD7PJS0Q81RlO1pYTQ9SE/DF93y?=
 =?us-ascii?Q?js6VZO+2GOn2JikG4Qsw3wNFlPpO8ew6nuY0Dn2n8cP3yCWjdTc9yF7U3Z+r?=
 =?us-ascii?Q?ZZ/dFstPBrj2T4Ym4aQ3JqybxQODfPbPnWVCbFgNPmIxe9yVtqcroVPnmoeF?=
 =?us-ascii?Q?2X+seRAkNAVVC5fgndNnjyxBm1MCXZ2m9gCSTxdHveAhvFeXcxQh+K758hDV?=
 =?us-ascii?Q?YcrJpU6D4+8cIquMCqogsNUtkacAPCk04cS513rWfIWfphgi8Ei9qwnAK7vx?=
 =?us-ascii?Q?a047tcAMYliE82Tl6ZJ1mKwRXW6RWNi8dKkfLYc43BXX2P7g8Ok1e63MxMRX?=
 =?us-ascii?Q?aWAOQBnJrm2fsno2vkJ1tdv+LyCd1RjI/IrsWvh9V0rjmbIKqtCWdYfly8X5?=
 =?us-ascii?Q?TX8u2W6xVFY1P7LfvoHooERP0Ebu065FtUONw7oUq1cC9UOPdsE+D89b6bhy?=
 =?us-ascii?Q?cr8R1WIOPRRRCbiBIvQaWKhFEuLi42bushZ1B0wQ48973kfctxQMnNV0MjK+?=
 =?us-ascii?Q?rLn+8ga+ZO0Yyp4bdNQBWRiPtCcpDIWpZmmWzZm2Tg2zdu0OCpw45Ip2TrwB?=
 =?us-ascii?Q?k5JI6tPAgcOgge8Eh/F2CSlIq3g9f1piECVTYLx7jKCOKbATZ422EuYZF6GS?=
 =?us-ascii?Q?bfryXokTI+Rh0oqKJhf+/fvM+FLTDolEz338xuwx10mA16hrOM7KXAYIQ6Ak?=
 =?us-ascii?Q?xMmbWzxjrp0pfRCGgDstwsVnN0VexDVWZdFSga+vr+EpK0j5NWvtwsfDAE6V?=
 =?us-ascii?Q?ZwbAp9Tw0M0k3sBJQDRDYU5YIMLZglthI9hHNaAQ8nBBTkQ5LjORONfIYwUK?=
 =?us-ascii?Q?RXqDY/8Husm2PnBk5FzbY8kySN7pnDUX4xRpY3ZWI5PMdOoRkyJ49AX4n0vM?=
 =?us-ascii?Q?dMlAx13IooqxH6sbCeF2fLVj3d5VFTvBwuczOJ+IW0xMyMjZOB48NPnGV48a?=
 =?us-ascii?Q?NTv27TF2naZ12W5dMXLXsfWvKRzyTOv7aTsQTjKZFSnKFagNwQ8S+LRbO10q?=
 =?us-ascii?Q?7bb+u82uRV8+mOC3lYBGXq708ftE8ZEL6yjkDdjuA0hAIGa2Q/vlaw1CPNw0?=
 =?us-ascii?Q?xsefxnNYYE/CHLpXJsllKbiRqu9DczXx7f6xjUElE4KQPWtXh3NiDHge2U8/?=
 =?us-ascii?Q?9OJeTg7jv3ymClBCJRO7DM2QdWhDBD+YtrFSKLtCJZHu9vwKkH2ZgyIGu9Yq?=
 =?us-ascii?Q?smx/llJyCc1DvET/tA+fryqWVJyPB2Jf5PCgBebO1iwWJOtTuKkKUd+5Zh9P?=
 =?us-ascii?Q?CJKDWg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: de3fdd3b-f61a-4871-a12e-08d9a8965b6a
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:38.4440
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ytz49Zk6MTMraiPbmiSnLl9dndNVEphuxSITmLCgiAQ/O+0FxXmrxmueeDp5YcCpFCL6bu4ujwuLLiydQonEkJ1c39DaNjGpUWttdtRbZ4k=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0
 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111150124
X-Proofpoint-ORIG-GUID: 99r2Qnuo7JQ3W6rqeR2tjnI5QMCAqnHA
X-Proofpoint-GUID: 99r2Qnuo7JQ3W6rqeR2tjnI5QMCAqnHA
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Expose the .machine keyring created in integrity code by adding
a reference.  This makes the machine keyring accessible for keyring
restrictions in the future.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v2: Initial version
v3: set_mok_trusted_keys only available when secondary is enabled
v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING
v5: Rename to machine keyring
v7: Unmodified from v5
---
 certs/system_keyring.c        | 9 +++++++++
 include/keys/system_keyring.h | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 8f1f87579819..bc7e44fc82c2 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
 static struct key *secondary_trusted_keys;
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+static struct key *machine_trusted_keys;
+#endif
 #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
 static struct key *platform_trusted_keys;
 #endif
@@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void)
 	return restriction;
 }
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+void __init set_machine_trusted_keys(struct key *keyring)
+{
+	machine_trusted_keys = keyring;
+}
+#endif
 
 /*
  * Create the trusted keyrings
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 6acd3cf13a18..98c9b10cdc17 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
 #endif
 
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+extern void __init set_machine_trusted_keys(struct key *keyring);
+#else
+static inline void __init set_machine_trusted_keys(struct key *keyring)
+{
+}
+#endif
+
 extern struct pkcs7_message *pkcs7;
 #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
 extern int mark_hash_blacklisted(const char *hash);
-- 
2.18.4