From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org,
        jarkko@kernel.org
Cc:     jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com,
        nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v9 8/8] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true
Date:   Wed,  5 Jan 2022 18:50:12 -0500
Message-Id: <20220105235012.2497118-9-eric.snowberg@oracle.com>
In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com>
References: <20220105235012.2497118-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?/7Yr9DIMBzv60RjiK4MHBpY3M8K3qMMclbru+WWRx1GGD1kFHEb81bh0cMYV?=
 =?us-ascii?Q?v1ILUE+MeYtg7MAiNcyYGddtLXsA100ReeZ3HLBkKxI/N9Ws+QDdxZV9i1cG?=
 =?us-ascii?Q?u5TH8890rxHrIMFsKKaNR6YCwFLDouL7x8qIDlTu3WsolF6pja+mmbUTZWjF?=
 =?us-ascii?Q?ZxYVjyHJjWnjWhR80XIfA+uxKDANHCprE7cWtwgzPlK9z1bq1zW6Xh6gJrPO?=
 =?us-ascii?Q?UFgFDBCASx5ilP1jnEID25amZqtGj7ABVQvmD2Pyoc3Qxs1Kt1/FZ2l8DllX?=
 =?us-ascii?Q?5JEoAmiAH7sBfCYHfDci8ZGvO+VNl+paOpXK+WHS2z/8/J/7qrQFWrFvB/F7?=
 =?us-ascii?Q?Y0KJ/cQRuL0SUHFE/u8uQIYyMnreDRApdSa6PEUd4xdNx+aeUWEerB/X8AlG?=
 =?us-ascii?Q?d/JCPRdu6VfaWvLpWWCe+qS8aQeyA/WHMRhnQN8sSd7IqoJeXaNcyJZ5ikKk?=
 =?us-ascii?Q?ZxFU1ag+2YvbulcTVZ77LhfMFG5yHqyooPt4n7XYxf86F66pvw0BxEBR9p7i?=
 =?us-ascii?Q?ti7xSXpRwuWytSyiBWocYidAnzqjfwVdSMHwo5WbNvLrFkMhjs5SYfRYr2O2?=
 =?us-ascii?Q?CVYDLIbvgOnDdLb5QBf2sfhSvaAFGTHAgraHlYxI52snMBl9YSGRjWwJaX4Y?=
 =?us-ascii?Q?JscXRypPd6jG7IrllRXyAPHqI80cd7IUwNbNH9HDyj+oEJIkpPUXXGd+0l9a?=
 =?us-ascii?Q?Bxf1yrvBYsN4pzn/sbvX5zqiyFVa0UFRVc0v+Rzveckpk7B75dkeFENxEky5?=
 =?us-ascii?Q?U4yoALIlcKLuYxuNEiyDdrDzxPivVrQvWWEUHWG+MH9ZoFFFGrrHoo3cu9+M?=
 =?us-ascii?Q?DB7kXthWXqyVbQ69JoZYKUFXq22ABRan9qp+/kdrB1+oqPhbxqQi62FjIDqA?=
 =?us-ascii?Q?u7y+pCX26xPs9VxFM1pnZZhvEy9okrZ7jP2EjQXHdTShint5e/VqkVqumhqM?=
 =?us-ascii?Q?fXHBhViGqJCBPsXd18hrp/uQrw9sTiJ4SZHnPZuM/woZPIF1Bj/x/O1motwl?=
 =?us-ascii?Q?eE9odfj6bkZxkD2XspG7HtU3GuMPijWI/rajcxN8ckvqI8hFKvzh20js7uBq?=
 =?us-ascii?Q?GWQ0fZCDGYvPxsO3M8SmgGw2e7kA06uDKGK7Y2BbywEFuytEa7FZEypcvrth?=
 =?us-ascii?Q?gPQd7ep+q+zVtJdYTfK3htSEzPffncpCX7ALQNF51DR8b5g0Wih8L63Oce43?=
 =?us-ascii?Q?dr1m1lqvEGZMs78lMotcFzN4aLJvNR2Cl1451WFGEjdXSOKpmNs68icY4QZ8?=
 =?us-ascii?Q?y6cvqPDkazvWdur6Mf3iPLFZUm6tx8DOmyz28XJT4ks2S8+gbl50IIdZRzQc?=
 =?us-ascii?Q?H2Lzxf9g1haleMVVNTsHn9Xjp/JYpuWUgcF4MZH+DibFXzc4o/dezblyrLGs?=
 =?us-ascii?Q?MD5jsDRGE8tc22ywaervTpApJcwaOx5EE9PosTHpbj2RU0etW+UiLeBnGXN4?=
 =?us-ascii?Q?skNtzTxhrmEhLF2jHZoiK5OZldCjyEXT3M6oJB4o7fiaVuGa97g61fLqx/5h?=
 =?us-ascii?Q?uoaw67nJVWu6aIpmmMiRkT8HtlEMWB37OYhh3T5ULJLXahivgtn9nJHPyzNP?=
 =?us-ascii?Q?E2GqyTb0bRZ7cxzHXxzINxnj2evJofOHpIzMUPWTSB5ZC3LG+iIbovDZE1xP?=
 =?us-ascii?Q?26SCMT0fq1UYqGNv7lngk0uERdhtRGk41Ye/GX0cUsHyomin4NwV73j/zGcI?=
 =?us-ascii?Q?YLO4LA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5935e9ea-2f11-45a0-3965-08d9d0a631a0
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:46.6930
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: J9/y3O0Rllr0KPSCdw7DoZf8y/gg9WEdg1VIlA9spFZlUByM19ee9uIUEnshG/gDMISVsJ19WwZcPL2OEbmHSFLqKYBCLgZ6TkNwLric7eI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4261
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0 spamscore=0
 suspectscore=0 mlxlogscore=662 phishscore=0 bulkscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000
 definitions=main-2201050150
X-Proofpoint-ORIG-GUID: uC3muoxp4Ud5NqZkrJE5lydhP346tQ0s
X-Proofpoint-GUID: uC3muoxp4Ud5NqZkrJE5lydhP346tQ0s
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

With the introduction of uefi_check_trust_mok_keys, it signifies the end-
user wants to trust the machine keyring as trusted keys.  If they have
chosen to trust the machine keyring, load the qualifying keys into it
during boot, then link it to the secondary keyring .  If the user has not
chosen to trust the machine keyring, it will be empty and not linked to
the secondary keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v4: Initial version
v5: Rename to machine keyring
v6: Unmodified from v5
v7: Made trust_mok static
v8: Unmodified from v7
---
 security/integrity/digsig.c                      |  2 +-
 security/integrity/integrity.h                   |  5 +++++
 .../integrity/platform_certs/keyring_handler.c   |  2 +-
 .../integrity/platform_certs/machine_keyring.c   | 16 ++++++++++++++++
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 7b719aa76188..c8c8a4a4e7a0 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -112,7 +112,7 @@ static int __init __integrity_init_keyring(const unsigned int id,
 	} else {
 		if (id == INTEGRITY_KEYRING_PLATFORM)
 			set_platform_trusted_keys(keyring[id]);
-		if (id == INTEGRITY_KEYRING_MACHINE)
+		if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist())
 			set_machine_trusted_keys(keyring[id]);
 		if (id == INTEGRITY_KEYRING_IMA)
 			load_module_cert(keyring[id]);
diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 730771eececd..2e214c761158 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source,
 
 #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
 void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
+bool __init trust_moklist(void);
 #else
 static inline void __init add_to_machine_keyring(const char *source,
 						  const void *data, size_t len)
 {
 }
+static inline bool __init trust_moklist(void)
+{
+	return false;
+}
 #endif
diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c
index 4872850d081f..1db4d3b4356d 100644
--- a/security/integrity/platform_certs/keyring_handler.c
+++ b/security/integrity/platform_certs/keyring_handler.c
@@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
 __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
 {
 	if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) {
-		if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
+		if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist())
 			return add_to_machine_keyring;
 		else
 			return add_to_platform_keyring;
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index 09fd8f20c756..7aaed7950b6e 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -8,6 +8,8 @@
 #include <linux/efi.h>
 #include "../integrity.h"
 
+static bool trust_mok;
+
 static __init int machine_keyring_init(void)
 {
 	int rc;
@@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void)
 
 	return false;
 }
+
+bool __init trust_moklist(void)
+{
+	static bool initialized;
+
+	if (!initialized) {
+		initialized = true;
+
+		if (uefi_check_trust_mok_keys())
+			trust_mok = true;
+	}
+
+	return trust_mok;
+}
-- 
2.18.4