Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
From:   Darren Kenny <darren.kenny@oracle.com>
To:     Eric Snowberg <eric.snowberg@oracle.com>, keyrings@vger.kernel.org,
        linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: Re: [PATCH v8 13/17] integrity: store reference to machine keyring
In-Reply-To: <20211124044124.998170-14-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
 <20211124044124.998170-14-eric.snowberg@oracle.com>
Date:   Mon, 14 Feb 2022 12:27:17 +0000
Message-ID: <m2ilthtyze.fsf@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bzOr6SvbuCsq08hSrHNMwgbF7TRj/Iq0stv7k7QBq3D4FegnY+bGvCpng79O?=
 =?us-ascii?Q?nnkWXqr/mDMk1s0neLnt3cRq+Yalzj1xkPkRhektj21KGkJDuecxlmf9me2k?=
 =?us-ascii?Q?kkiEL0ImO75XV175d838wbff+p8IDWtvVa6UbQ5RAszlvEMUnZ9A95aa4vtu?=
 =?us-ascii?Q?4kqSKFls5CfXu1Mm7gZybr4X7/kkVdQo6FKnemL/rtwJqvprLDzuLyZcUuJq?=
 =?us-ascii?Q?h+jKq6uuIKF2kAZcZYls71JXlIH1rNFfgWMm3M1/3PWarldRSa8/nkLZTqS6?=
 =?us-ascii?Q?VbWZyCeVHh/1u4YJU6FQiIHOarKT4uFMMUAEm65SSF6sKvTGcVzZBzsNHlDR?=
 =?us-ascii?Q?XYrjI1QyXaNqeRmN+Z4kNkVHdH8nja+VZ2prJCZCEoehar3mb/BhQ29Kwa0R?=
 =?us-ascii?Q?EnKYL3Z1lGKb95zXN6hFctM05fZUa/bhIl2s7JlBHBqcaYnlkdCUWA+DYP1C?=
 =?us-ascii?Q?FE9lk/aDWylfqNsiCIcA8OfIZfXPvLCZS/iRbw+wGJHJ269Wj7QXoqCgBcc2?=
 =?us-ascii?Q?B5foYbkihusUx+ZJrKnAmEH3amnOZ5ZvcMH0Qj4Sr71QfkWmnH8bFRetjJob?=
 =?us-ascii?Q?e0N4+ETSyhhYnkaf0ZGlIpRWusmZ2xaLX1iIk3oVj1e3fsfQ8FBQ8bD1iTd2?=
 =?us-ascii?Q?AXrXBC2sobnXdewvwyD7iakxA+u3Qj7Bs2kQop3zcHyKEQXiPWuSpyb9ssa7?=
 =?us-ascii?Q?QvRKBKeOJXM+CMgxoMuWBxX/cOvK56gdLrK9i35ra+I1ari2GwBPY4ejky2C?=
 =?us-ascii?Q?NjT06hmrNBwG6VV79lrQWiaPh+L02celrPMBA8U9nlY31KlCIspqunuXv2E+?=
 =?us-ascii?Q?b2GY9YrIvLoXv7FXQZqbOWEywGsiBvSWhe5BbNoqnsHUfwUQS3Pyp6ZPIPlW?=
 =?us-ascii?Q?CWbQMuSx6CkCkHfUQ2FzH3V/548TAs68us+7Zs7t2Xczeyz505SHcFk/ao7w?=
 =?us-ascii?Q?NdSYuUvpRRjF+fqqMrcDzNvzvXxXYDEpakbHbiyw/LJOFrs59bPCVGLVdP3X?=
 =?us-ascii?Q?pBLG2jt0zbWkX9Nmo9jJc+te2wBzg3mwn5USeGsDA9q0vFEwGxJGmFsH0H/x?=
 =?us-ascii?Q?voDIqMBVbSKgODjhMSyum0HBsJbm2/dyXiL9LgBPHdrmybF4NCUijVEIEgrw?=
 =?us-ascii?Q?GpoJXr5xscjr1ubH9WpXc3OeY8mqKGaxEvuQVlfisTzkPChpcgVe0Dxb8ATN?=
 =?us-ascii?Q?Mxa1ZKtLb0IldnoMULN2+Tggl/KSW2ikp0p0SriqX8zIfkBKpZpudTmEdAoT?=
 =?us-ascii?Q?vQ5aX6ttbxMyWiG24WQdX9s/aHw6mPtkm2Gq/r5aLNy8ujJxk/zNdRUszyRc?=
 =?us-ascii?Q?vi+bLIv+kHhaWGhdOXYtFvxnaq1fjfQ6gyiV+KL6ikXXcVtRiwvHAP+JABK4?=
 =?us-ascii?Q?MuXap9JWFBICRC9v0AWo6ucmh8FEntn4bRmJsudpVIijI7dO98kp8xmfDl6C?=
 =?us-ascii?Q?TXMsVP55mYrhmI+9hb47wdSkAh6mqfHKk3ILPOJo+vg2BKcStPXKxYykzinB?=
 =?us-ascii?Q?myTluqIsnbiRJBgDub1q0H7pcH20hx2N1sRFlLSTueoXSmFpxJgkv4o5jM5s?=
 =?us-ascii?Q?6tJuaJLnjIk+WyKV/+qDKdsFsFdjpnp79uSksDVtcfnJBS1vLh2koxjYgjSz?=
 =?us-ascii?Q?Ra/EBVJl/NBg7N1oqqEwg24=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b85dc0c0-590f-4970-c56b-08d9efb55998
X-MS-Exchange-CrossTenant-AuthSource: BLAPR10MB5138.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Feb 2022 12:27:22.4219
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YtmLecGToUHqNz93PDTL5/YMURTWRQqHbqbIOtZj33th67ke9iuYKxdx26qPxdHVNF/VDvdjjd9Us9lMMu2JLA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB4037
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10257 signatures=673431
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 bulkscore=0 suspectscore=0
 phishscore=0 malwarescore=0 mlxscore=0 mlxlogscore=999 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2201110000
 definitions=main-2202140075
X-Proofpoint-GUID: Jf1VTBigLIZPUKyO2N2qoU72GzBg6waZ
X-Proofpoint-ORIG-GUID: Jf1VTBigLIZPUKyO2N2qoU72GzBg6waZ
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tuesday, 2021-11-23 at 23:41:20 -05, Eric Snowberg wrote:
> Store a reference to the machine keyring in system keyring code. The
> system keyring code needs this to complete the keyring link to
> to machine keyring.
>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

> ---
> v2: Initial version
> v3: Unmodified from v2
> v4: Removed trust_moklist check
> v5: Rename to machine keyring
> v8: Unmodified from v5
> ---
>  security/integrity/digsig.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
> index 74f73f7cc4fe..109b58840d45 100644
> --- a/security/integrity/digsig.c
> +++ b/security/integrity/digsig.c
> @@ -116,6 +116,8 @@ static int __init __integrity_init_keyring(const unsigned int id,
>  	} else {
>  		if (id == INTEGRITY_KEYRING_PLATFORM)
>  			set_platform_trusted_keys(keyring[id]);
> +		if (id == INTEGRITY_KEYRING_MACHINE)
> +			set_machine_trusted_keys(keyring[id]);
>  		if (id == INTEGRITY_KEYRING_IMA)
>  			load_module_cert(keyring[id]);
>  	}
> -- 
> 2.18.4