Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     =?utf-8?B?TWljaGFsIFN1Y2jDoW5law==?= <msuchanek@suse.de>
CC:     David Howells <dhowells@redhat.com>,
        "dwmw2@infradead.org" <dwmw2@infradead.org>,
        "ardb@kernel.org" <ardb@kernel.org>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "nayna@linux.ibm.com" <nayna@linux.ibm.com>,
        Mimi Zohar <zohar@linux.ibm.com>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "torvalds@linux-foundation.org" <torvalds@linux-foundation.org>,
        "weiyongjun1@huawei.com" <weiyongjun1@huawei.com>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-efi@vger.kernel.org" <linux-efi@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        "James.Bottomley@hansenpartnership.com" 
        <James.Bottomley@hansenpartnership.com>,
        "pjones@redhat.com" <pjones@redhat.com>,
        Konrad Wilk <konrad.wilk@oracle.com>
Subject: Re: [PATCH v10 8/8] integrity: Only use machine keyring when
 uefi_check_trust_mok_keys is true
Thread-Topic: [PATCH v10 8/8] integrity: Only use machine keyring when
 uefi_check_trust_mok_keys is true
Thread-Index: AQHYEmDFShDCf3sk8k+AOahiwptnWqzrA64AgABdC4CAAAyeAIAANRyA
Date:   Mon, 11 Apr 2022 20:34:55 +0000
Message-ID: <54B1CDD9-F690-4F1F-9A9A-9412AAB21A72@oracle.com>
References: <20220126025834.255493-1-eric.snowberg@oracle.com>
 <20220126025834.255493-9-eric.snowberg@oracle.com>
 <20220411110640.GC163591@kunlun.suse.cz>
 <C970A5DB-0238-4B5A-9935-588DF9B1DDEF@oracle.com>
 <20220411172450.GD163591@kunlun.suse.cz>
In-Reply-To: <20220411172450.GD163591@kunlun.suse.cz>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?utf-8?B?VitxRUxMcDBiRENLaWM0ejFRZEQxeVZrM2pOTEVSRTBzQnVIMjZRMWF1b1ZZ?=
 =?utf-8?B?eHlnb0o3U3R5RGx0Wk91MG5GZUJxa0tnTlJNTWZHSFRZOE9pMldDVnlmOFNJ?=
 =?utf-8?B?NWpaSndDWXhoSGI2L3VITFhpQ0M5RjVyV2xEWUtzKzBSKzhTSWtKNmJBUGt1?=
 =?utf-8?B?V2VkTzh2SkdVemxKR2ZMWXBlSlhkMW96eDNNbHFhMllqVVpyRDFscC8xOW5H?=
 =?utf-8?B?dFFJa0JLSm5VODNYRHNMZi9oc3ZRbEsyRldvQjJlemp6dWtSRzBBN1BMTHRJ?=
 =?utf-8?B?NnZVU20reE5PK0NES1liblVFcmdiNEQ3clIxSkxmaHhEVFdobnphWUplUllQ?=
 =?utf-8?B?aWVLcFVZVGZNcFBCNWp4anNhVmNJRXZ5UGtmUGM1cElsbHlXZjVaWlkwREZC?=
 =?utf-8?B?WDcvN1dBUGJQZ0VwWk8veEw2eHlDZXNSKytvaHJXRmdGd1lSRXZYbTBDK0k2?=
 =?utf-8?B?MG1MMEJKS0Q3WXpGTE9mbDdES25Iak9qeWxPZkpkaGVDWVBjWXdMWWN2VDQr?=
 =?utf-8?B?ZW9DYThDWklvV3AxbVVoZ3JSYTFxbXk5M1g0aWN4REtGUEUrSGVOV0lFV01F?=
 =?utf-8?B?cVF2SHVMTDZvdmZ1R1RrWTNic0ZXYUMzTHFkYWdxZGFkTnlOR0NrSnllcE9M?=
 =?utf-8?B?VE9oZTg2TFpkK3UzNVlISlJDa3lHQ2RicURWYXo5RFNRYzUzd3AyUnAwRHRZ?=
 =?utf-8?B?U2FycE52L2FYb0RsMm9wekVoVnBvaXBZMmFkc05uYlhqQTNXMjNrOTBtbjJv?=
 =?utf-8?B?QWJrcm9sRWdLMEZPM1Bka1pWMDdxbGNZeUNpUUZuSEZoV1VVM3VEMjFsaHB4?=
 =?utf-8?B?d3MwMUI1UDBxV0tLdkhqZHhKUFlZY1phNlcrYUZpSUVadDFmNG9oVWZIVzZX?=
 =?utf-8?B?bDBFaVRjOEdnUXNWR1VVeGtxa0xHYW1YbGZONUxaLytEQkZFMTNNNmRkMlpx?=
 =?utf-8?B?ME94aUcraXlLZ0dJcGlibDVtb0UwM3o2cWEvc2ZkRTBtM0xWL0lWMlhiMk9i?=
 =?utf-8?B?bnBMWUJkWkg1bHljbjM5U3E1aDhlUllYOGtiVDVxZkplVnpzTlpxMGtkOVQ4?=
 =?utf-8?B?NEZNL0ZkVlJmZ0pYQVgxRWNzV05VbGhKbVMwZnROaUR2OFFkSE5QejBJSWdF?=
 =?utf-8?B?YUtmTmxBclg3WWpDdlRtcU5EOWp6UXF1Y3BDaUwxQjJxM3JVNjUwNmVkSzVJ?=
 =?utf-8?B?c3daY0tnNEwzMUFZUm5xK296YjdhMzdrVmJmSHBnWW1wRGpSeGxNbXptVjZq?=
 =?utf-8?B?RVFCR1pLZ2Y2SGxDRUsxU1ZlQ1BSZU9WczYrT2U2YytNRTkwK1Q5T2RhMGxy?=
 =?utf-8?B?aStNUTNrN3B5d2V2eERRM256R3hWWGp3WEd2cGU5R3ZDSnNrQkJOUFdEVDIz?=
 =?utf-8?B?Z1JsVWtBQ2tOYUEyd3Y5V28wWkJzbFhraWxRV2ZLM2NkZ1AzYlNONXBGZEdZ?=
 =?utf-8?B?aEJ2TENJYk83MTB2RnN2UDM0SkxpaGRsVk1vWmFMWE1sWHVSRDhoTE1qb251?=
 =?utf-8?B?eTJ2Z2xSeDJTWUpkWVpxVmI5Z3krNkIwZGFtTDVPTExrejhlZnIrVlNqc0pl?=
 =?utf-8?B?Vm0wbzZCejdJRW9sQTNVcURjekcvV2V1QUJGSnZFYXk1N29acFpIdngyYlBp?=
 =?utf-8?B?SEhyZXl4LytVRTVxbWdDTDM5eElvR1Y0TGpHelBjRzI5T3ViKzJtOWw5Q0JR?=
 =?utf-8?B?cDUwcmRrdDdQQ2JkK0RWaVppck9sYVdvdU9aSEpSUWdHVHpRMDczeGg0WWhy?=
 =?utf-8?B?SHdvMmRLQTNGWGgvK2N4YzVrbnlXR3hkR3hvdyt4TU14b2Y3TmNIZVAzOVg5?=
 =?utf-8?B?R0duVUJEYVRJTmNyOEFZaE5YcE4wRVdRTVFmZXA5dGxXUEowZlJSYjY2bmdk?=
 =?utf-8?B?ejZBeW9jYjcyY2VDejlhQ21hN2l2MzNNejI4NVhqdjZYUU5XVXdRWENsRmts?=
 =?utf-8?B?OTFPN0VGbHB0N282WVJFSzNtY1lRNVpyMENTWWQ3c3NXMVlRVmNPZW0ya2F5?=
 =?utf-8?B?SXJadmQ2UjlHWjlQOG92SVVkMENXRkJQaWdhZUloa0VVU0I2MmxaRjZWeUU2?=
 =?utf-8?B?V05sL0V3VE5QbHB3WUc2dXQ4ckNQcm1vYjRFNjV1akZmekMzcyt3MzQ3VjE5?=
 =?utf-8?B?aUhad0RNNmxOaDIvWUlORzkyMlZMOWN5R1B3ejZ5MHc2OFJJaW8xOUtxRjdV?=
 =?utf-8?B?bWlBRVJnUWJQUk1LWGwvazZwOUtyYUNTbHE4ZWVrZ1YxVG9Weko4SHV2S3Z6?=
 =?utf-8?B?Rk1VNGw3QTBNYm5IZllTT090RWVLTVJnSDhMeEtnK3c1SmpDekIrNDJ1VWtz?=
 =?utf-8?B?OVdFdHJLSjZpa09IUXVPUS9TZlBsNlBzMi93VWFXTEJHdGNKK1h4MGtCdzVU?=
 =?utf-8?Q?h/p2O8EEeZ844AAw=3D?=
Content-Type: text/plain; charset="utf-8"
Content-ID: <DC6EA9B19FCE84409BC82AA3D1445643@namprd10.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9119993a-f19e-4069-d07e-08da1bfabd67
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Apr 2022 20:34:55.9036
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: M+7xjoh69J7W+CWfO+D3joNBjJH/1c9bxA5GqM/wd6abw0RCQ6SLVAjI1Q5s0EGLdurHjtLtwGpILhWYUzInD6NHWtU0e1Md8QE4XwkL+oY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR10MB1772
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.425,18.0.858
 definitions=2022-04-11_08:2022-04-11,2022-04-11 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxlogscore=999
 spamscore=0 suspectscore=0 malwarescore=0 adultscore=0 bulkscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2202240000 definitions=main-2204110113
X-Proofpoint-ORIG-GUID: i2b0fx0qqEzYVnGYg1LuawYvlt45_DHh
X-Proofpoint-GUID: i2b0fx0qqEzYVnGYg1LuawYvlt45_DHh
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

DQoNCj4gT24gQXByIDExLCAyMDIyLCBhdCAxMToyNCBBTSwgTWljaGFsIFN1Y2jDoW5layA8bXN1
Y2hhbmVrQHN1c2UuZGU+IHdyb3RlOg0KPiANCj4gT24gTW9uLCBBcHIgMTEsIDIwMjIgYXQgMDQ6
Mzk6NDJQTSArMDAwMCwgRXJpYyBTbm93YmVyZyB3cm90ZToNCj4+IA0KPj4gDQo+Pj4gT24gQXBy
IDExLCAyMDIyLCBhdCA1OjA2IEFNLCBNaWNoYWwgU3VjaMOhbmVrIDxtc3VjaGFuZWtAc3VzZS5k
ZT4gd3JvdGU6DQo+Pj4gDQo+Pj4gSGVsbG8sDQo+Pj4gDQo+Pj4gT24gVHVlLCBKYW4gMjUsIDIw
MjIgYXQgMDk6NTg6MzRQTSAtMDUwMCwgRXJpYyBTbm93YmVyZyB3cm90ZToNCj4+Pj4gV2l0aCB0
aGUgaW50cm9kdWN0aW9uIG9mIHVlZmlfY2hlY2tfdHJ1c3RfbW9rX2tleXMsIGl0IHNpZ25pZmll
cyB0aGUgZW5kLQ0KPj4+IA0KPj4+IFdoYXQgdmFsdWUgZG9lcyBzdWNoIGZsYWcgaGF2ZT8NCj4+
PiANCj4+PiBUaGUgdXNlciBpcyBhcyBtdWNoIGluIGNvbnRyb2wgb2YgdGhlIGZsYWcgYXMgdGhl
IE1PSyBrZXlzLg0KPj4gDQo+PiBUaGUgZmxhZyBhbGxvd3MgdGhlIHN5c3RlbSBvd25lciAobm90
IHJvb3QpIHRoZSBhYmlsaXR5IHRvIGRldGVybWluZSANCj4+IGlmIHRoZXkgd2FudCB0byBsb2Fk
IE1PS0xpc3QgaW50byB0aGUgbWFjaGluZSBrZXlyaW5nLiAgS2V5cyBjb250YWluZWQgDQo+PiBp
biB0aGUgbWFjaGluZSBrZXlyaW5nIGFyZSB0aGVuIGxpbmtlZCB0byB0aGUgc2Vjb25kYXJ5LiAg
VGhlIGZsYWcgaXMgbm8gDQo+PiBkaWZmZXJlbnQgdGhhbiB0aGUgJ+KAlGlnbm9yZS1kYicgY3Vy
cmVudGx5IGF2YWlsYWJsZSBpbiBzaGltLCB3aGljaCB0aGVuIA0KPj4gZ2V0cyBwcm9wYWdhdGVk
IHRvIExpbnV4ICh1ZWZpX2NoZWNrX2lnbm9yZV9kYikuICBUaGVzZSBmbGFncyBjYW4gYmUgDQo+
PiBzZXQgYnkgdGhlIHN5c3RlbSBvd25lciwgd2hvIGNhbiBwcm92ZSBwaHlzaWNhbCBwcmVzZW5j
ZS4gIA0KPiANCj4gTWFuYWdpbmcgdGhlIE1PSyBrZXlzIHJlcXVpcmVzIHBoeXNpY2FsIHByZXNl
bmNlIGVxdWFsbHkuDQo+IA0KPiBNb3Jlb3ZlciwgdGhlc2Uga2V5cyBhcmUgdHJ1c3RlZCBmb3Ig
cnVubmluZyBjb2RlIGF0IHJpbmcwLCBpbiBmYWN0IHRoZQ0KPiBydW5uaW5nIGtlcm5lbCBpcyBl
eHBlY3RlZCB0byBiZSBzaWduZWQgYnkgb25lIG9mIHRoZW0sIGFuZCBjYW4gYmUNCj4gc2lnbmVk
IGJ5IGFueSBvZiB0aGVtLg0KPiANCj4gVGhlbiB3aGF0IGV4YWN0IHB1cnBvc2UgZG9lcyB0aGlz
IGV4dHJhIGZsYWcgc2VydmU/DQo+IA0KPiBJZiBzdWNoIGNvbXBpbGUtdGltZSBmbGFnIGV4aXN0
cyBpbiB0aGUga2VybmVsIGl0IGNhbm5vdCBiZSBvdmVycmlkZW4gYnkNCj4gdGhlIHJvb3Qgb25j
ZSB0aGUga2VybmVsIGlzIHNpZ25lZCwgZWl0aGVyLg0KPiANCj4+Pj4gdXNlciB3YW50cyB0byB0
cnVzdCB0aGUgbWFjaGluZSBrZXlyaW5nIGFzIHRydXN0ZWQga2V5cy4gIElmIHRoZXkgaGF2ZQ0K
Pj4+PiBjaG9zZW4gdG8gdHJ1c3QgdGhlIG1hY2hpbmUga2V5cmluZywgbG9hZCB0aGUgcXVhbGlm
eWluZyBrZXlzIGludG8gaXQNCj4+Pj4gZHVyaW5nIGJvb3QsIHRoZW4gbGluayBpdCB0byB0aGUg
c2Vjb25kYXJ5IGtleXJpbmcgLiAgSWYgdGhlIHVzZXIgaGFzIG5vdA0KPj4+PiBjaG9zZW4gdG8g
dHJ1c3QgdGhlIG1hY2hpbmUga2V5cmluZywgaXQgd2lsbCBiZSBlbXB0eSBhbmQgbm90IGxpbmtl
ZCB0bw0KPj4+PiB0aGUgc2Vjb25kYXJ5IGtleXJpbmcuDQo+Pj4gDQo+Pj4gV2h5IGlzIGltcG9y
dGluZyB0aGUga2V5cyBhbmQgdXNpbmcgdGhlbSBsaW5rZWQgdG9nZXRoZXI/DQo+Pj4gDQo+Pj4g
SWYgbGF0ZXIgd2UgZ2V0LCBzYXksIG1hY2hpbmUga2V5cmluZyBvbiBwb3dlcnBjIG1hbmFnZWQg
Ynkgc2VjdmFyY3RsDQo+Pj4gdGhlbiBpdCBoYXMgaXRzIHZhbHVlIHRvIGltcG9ydCB0aGUga2V5
cmluZyBhbmQgYmUgYWJsZSB0byBsaXN0IHRoZQ0KPj4+IGNvbnRlbnQgd2l0aCB0aGUgc2FtZSB0
b29scyBvbiBFRkkgYW5kIHBvd2VycGMuDQo+PiANCj4+IFRoZSBtYWNoaW5lIGtleXJpbmcgaXMg
bGlua2VkIHRvIHRoZSBzZWNvbmRhcnkga2V5cmluZywgZXhhY3RseSB0aGUgc2FtZSB3YXkgDQo+
PiB0aGUgYnVpbHRpbiBpcyBsaW5rZWQgdG8gaXQuICBMaW5raW5nIHRoaXMgd2F5IHNob3VsZCBl
bGltaW5hdGUgdGhlIG5lZWQgdG8gY2hhbmdlIA0KPj4gYW55IHVzZXIgc3BhY2UgdG9vbHMgdG8g
bGlzdCB0aGUgY29udGVudHMuIA0KPiANCj4gVGhhdCdzIGFuc3dlciB0byBhIGNvbXBsZXRlbHkg
ZGlmZmVyZW50IHF1ZXN0aW9uLCB0aG91Z2guDQo+IA0KPiBZb3UgZWl0aGVyIGltcG9ydCB0aGUg
a2V5cyBhbmQgdXNlIHRoZW0sIG9yIHlvdSBkb24ndCB1c2UgdGhlbSBhbmQgZG9uJ3QNCj4gaW1w
b3J0IHRoZW0uIFRoZSBvcHRpb24gdG8gaW1wb3J0IGFuZCBub3QgdXNlIGlzIG5vdCBhdmFpbGFi
bGUuDQoNCldoeSBpbXBvcnQgc29tZXRoaW5nIGludG8gYSBrZXlyaW5nIHRoYXQgY2FuIG5vdCBi
ZSB1c2VkPw0KDQpNT0tMaXN0IGtleXMgZ2V0IGltcG9ydGVkIGludG8gb25lIG9mIHR3byBrZXly
aW5ncywgZWl0aGVyIHRoZSBtYWNoaW5lIG9yIHRoZSANCnBsYXRmb3JtLiAgSWYgdWVmaV9jaGVj
a190cnVzdF9tb2tfa2V5cyByZXR1cm5zIGZhbHNlLCB0aGUgTU9LTGlzdCBrZXlzIGFyZSANCmxv
YWRlZCBpbnRvIHRoZSBwbGF0Zm9ybSBhbG9uZyB3aXRoIHRoZSBVRUZJIFNCIERCIGtleXMuICBJ
ZiB0cnVlLCB0aGV5IGFyZSBsb2FkZWQgDQppbnRvIHRoZSBtYWNoaW5lIGtleXJpbmcuDQoNCj4+
PiBJdCBhbHNvIG1ha2VzIHNlbnNlIHRvIGJlIGFibGUgdG8gY29uZmlndXJlIHRoZSBrZXJuZWwg
dG8gaW1wb3J0IHRoZQ0KPj4+IGtleXMgYW5kIG5vdCB1c2UgdGhlbS4gSSBkb24ndCBzZWUgYW55
IHZhbHVlIGluIGNvbmZpZ3VyaW5nIHRoYXQgaW4NCj4+PiBzaGltLCB0aG91Z2guIHNoaW0gaXMg
Ym90aCBzb3VyY2Ugb2YgdGhlIGtleSBtYXRlcmlhbCBhbmQgdGhlIGZsYWcgc28NCj4+PiB0aGUg
ZmxhZyBpcyByZWR1bmRhbnQsIGl0IGRvZXMgbm90IGV4aXN0IG9uIGV4aXN0aW5nIHNoaW0gdmVy
c2lvbnMNCj4+PiBpbnN0YWxsZWQgb24gdXNlciBzeXN0ZW1zLCBhbmQgaXQncyB1bmxpa2VseSB0
byBleGlzdCBvbiBvdGhlcg0KPj4+IHBsYWx0Zm9ybXMsIGVpdGhlci4NCj4+IA0KPj4gSeKAmW0g
c3VyZSBvdGhlciBzb2x1dGlvbnMgdG8gZW5hYmxlIGl0IHdpbGwgYmUgYWNjZXB0ZWQgYXMgd2Vs
bC4gIEkga25vdyBNaW1pIHdhcyB0ZXN0aW5nIA0KPj4gd2l0aG91dCBzaGltIHVzaW5nIGEgZGlm
ZmVyZW50IG1ldGhvZC4NCj4gDQo+IExpa2Ugbm90IHVzaW5nIHRoYXQgZXh0cmEgZmxhZyBhdCBh
bGw/DQoNClRoYXQgd291bGQgYmUgdXAgdG8gdGhlIG1haW50YWluZXJzLg0KDQpPdGhlcndpc2Us
IGlmIHlvdSBhcmUgdXNpbmcgc2hpbSwgeW91IGNhbiBidWlsZCBvbmUgd2l0aCB0aGUgZmxhZyBv
biBieSBkZWZhdWx0Lg0KDQo=