Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
From:   Darren Kenny <darren.kenny@oracle.com>
To:     Eric Snowberg <eric.snowberg@oracle.com>, keyrings@vger.kernel.org,
        linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: Re: [PATCH v8 14/17] KEYS: link machine trusted keys to
 secondary_trusted_keys
In-Reply-To: <20211124044124.998170-15-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
 <20211124044124.998170-15-eric.snowberg@oracle.com>
Date:   Mon, 14 Feb 2022 12:28:20 +0000
Message-ID: <m2fsoltyxn.fsf@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TdHcZ0SQtAzyceMe7I7pVcyiIFWLchBqXcl+jy43b4TxJ9PL6n0eeQSGkP1i?=
 =?us-ascii?Q?hHZDTT5BRCH5Ts2XbK5uEWsc3LqDv+n66lJ/m/a6MdHEI7BCoDsgOoaLVRb4?=
 =?us-ascii?Q?ccynhjQMYp9tQAEPRMFpep65WbI+LwnuWryT2a085Sc7dC6GR/UVlGv+3USC?=
 =?us-ascii?Q?oPdLTGMmmhCijc9Tr9y/drsIPoUcc+0GcNueo9icpE7VgC0ENElvX7zplk2W?=
 =?us-ascii?Q?Q3cx2PohqnPyAk7W1vSq5K70UqVVu6uQumnbkwpCtgXM3ch3u6mLeTzYI7GB?=
 =?us-ascii?Q?xPyY4U106c0KqZRE0qFae0Y0t0T9VaHEHdi5grpt6bxvmjgiTZ8SC0OirVPs?=
 =?us-ascii?Q?XlFaI2ysF2LU8yV1HBQf6VQp3+zTtzWy9YeGx+74MqXRYP8B60o9HDcB5b9Y?=
 =?us-ascii?Q?7lcFlzs+0YCoYlBEPdFC7rufMXafLbJzjOHVQuG7BFhG22t6zwu7fZVVepr1?=
 =?us-ascii?Q?wi/5LCY0iNS+EcNhzbw79tzwsu9uvkeldmVeksVf6hU0Ggw41nyD1Df1wm/U?=
 =?us-ascii?Q?sppeA6SoAndkn8ckBfXDYVrj1h6p7Scnl9/OxRWif/yqzze8Qdt+mYxIXLgl?=
 =?us-ascii?Q?aES1QUfyaW2RfkSXKj+M56KD3WaaahqrLNTnZYQ4Wa6krOyIJuwNChSMhHlu?=
 =?us-ascii?Q?YcLpF3Pnp1U5+pFPfEq6Fl5W0+XbmZuhogmwxCp+N5O396bPh54Dzd2UDC6N?=
 =?us-ascii?Q?dswXQqJ0uzhtv8CVP3DccNYyuOpEfPwKmSbKzgy+fm31LCdOgg6JVYfCMU8X?=
 =?us-ascii?Q?pcS8L9TlbK4//11BPZp/Lt/R8kJbxZvKHAm/97cthBtZtarKfJmwBz2qbn3N?=
 =?us-ascii?Q?nQKBt7qxsuKsEGjXvsbWP2+tTZunJhqyskVgtd6poHjjNQBYTad0gEm973ct?=
 =?us-ascii?Q?NFHJbjMld6dOXm23G0jPV/P0BHwWn2u/yiXDm3SKFe51yRLi3o2PQU5qu1DW?=
 =?us-ascii?Q?VeIljNQowHTa23vW+ZBSnmF+B5hWuY5skl09OBK4MoUdvphrV3zbz9q25v48?=
 =?us-ascii?Q?vRruL7+VNu/pcJg5yu8RZrq1HylD7AOiUnx6CwhkMaJBwJoPGG2RE7rdfKSo?=
 =?us-ascii?Q?uI43JontmgvUbIx1qE5tQfSNorRbUcqPkukpyAEeA5Mp/OswIKlm5LTT9gln?=
 =?us-ascii?Q?qAJ2pbKVz0ZXYJihG1jhHAE+ygAaQa1CxjZwCqXkFMVxasmTNOgTrj9xEjaq?=
 =?us-ascii?Q?YdZOdyTbGx6oukYL2STKMP6EhABNAVv3HLEwjS3GD26SxOVKZW/D1C0zGPaN?=
 =?us-ascii?Q?UxLTHsNkkaxRWH7pHPEZOFYUB1NfHF+0uY9n8wVLkScS9+/BYrPCpJLUhYQf?=
 =?us-ascii?Q?/vM0TkYQoxf1KeJFcq0tl4vuAVRSNotzz8isyfaopPHFNShZaQM4Ze+MzMyM?=
 =?us-ascii?Q?lI1DFnFrBP06eRWUWckj0mo/qsjPHuNpxUsG+/tzmM4BhkhMlLExC5ym+ybN?=
 =?us-ascii?Q?cKpCxQUuH4l5M6Epx9qOBKkb+7j+nAnyU2CKeIEWmPBLDugYUn31GVpQWZUo?=
 =?us-ascii?Q?BMVskabdMqXrNJLH3BZ6ZAd5n2d9zK/5Cag0iQlSDItbXp9mslEsY+UW0G9v?=
 =?us-ascii?Q?qOuXE3BWEQqaFmnx2YPkBuVVmDkEiXGAChTxnQ1J7W9a4xwl7s8s7ziP+c3k?=
 =?us-ascii?Q?CrpeC4RfOhOLHG+ZgKZCZwo=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4ff91230-5184-4f03-f9af-08d9efb57eba
X-MS-Exchange-CrossTenant-AuthSource: BLAPR10MB5138.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Feb 2022 12:28:24.6905
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: fLUGAjILhussJZ1l0qhRcBWPjt+ISDxXd4H1KzHGePTFehjrnrj+v2uKQeAMywW8wBfzVE1Api8zq8BHoVGCww==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4037
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10257 signatures=673431
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0
 mlxlogscore=999 bulkscore=0 spamscore=0 adultscore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2201110000 definitions=main-2202140075
X-Proofpoint-GUID: -IKUjZHweQwef8SvlR8FXj4_5JXbIojt
X-Proofpoint-ORIG-GUID: -IKUjZHweQwef8SvlR8FXj4_5JXbIojt
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tuesday, 2021-11-23 at 23:41:21 -05, Eric Snowberg wrote:
> Allow the .machine keyring to be linked to the secondary_trusted_keys.
> After the link is created, keys contained in the .machine keyring will
> automatically be searched when searching secondary_trusted_keys.
>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

> ---
> v3: Initial version
> v4: Unmodified from v3
> v5: Rename to machine keyring
> v7: Unmodified from v5
> v8: Change patch subject name, code unmodified from v7
> ---
>  certs/system_keyring.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 07f410918e62..463f676857f0 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void)
>  void __init set_machine_trusted_keys(struct key *keyring)
>  {
>  	machine_trusted_keys = keyring;
> +
> +	if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0)
> +		panic("Can't link (machine) trusted keyrings\n");
>  }
>  
>  /**
> -- 
> 2.18.4