Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 31 Mar 2023 23:52:07 +0200
From:   Ahelenia =?utf-8?Q?Ziemia=C5=84ska?= 
        <nabijaczleweli@nabijaczleweli.xyz>
To:     Luis Chamberlain <mcgrof@kernel.org>
Cc:     "open list:MODULE SUPPORT" <linux-modules@vger.kernel.org>,
        "open list:MODULE SUPPORT" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] KEYS: Make use of platform keyring for module signature
 verification
Message-ID: <oyf37idsgn3qgonracgtoj6k5lshzt37j5bulnqgigy4t3iy4q@nxy53nmnzuud>
References: <qvgp2il2co4iyxkzxvcs4p2bpyilqsbfgcprtpfrsajwae2etc@3z2s2o52i3xg>
 <ZCc8J6wS1EpXrLQW@bombadil.infradead.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="ctfue7uj2awdz525"
Content-Disposition: inline
In-Reply-To: <ZCc8J6wS1EpXrLQW@bombadil.infradead.org>
User-Agent: NeoMutt/20230322
Precedence: bulk


--ctfue7uj2awdz525
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 31, 2023 at 01:01:43PM -0700, Luis Chamberlain wrote:
> On Fri, Mar 31, 2023 at 04:30:21PM +0200, Ahelenia Ziemia=C5=84ska wrote:
> > This allows a cert in DB to be used to sign modules,
> > in addition to certs in the MoK and built-in keyrings.
> >=20
> > This key policy matches what's used for kexec.
> Before I nose dive, the commit log should explain why this patch never
> was sent upstream, if it was, why it was rejected.=20
How would I know that?

Searching around on the list, I found an equivalent 2022-02-15 patch:
  https://lore.kernel.org/linux-kernel/840433bc93a58d6dfc4d96c34c0c3b158a0e=
669d.1644953683.git.msuchanek@suse.de/t/#u
and there's even a reply from you in there.

The discussion appears to boil down to
".platform is restricted to kexec",
"there are common setups in which it'd make much more sense to allow
 this, and also it's prety equivalent security-policy-wise",
(this repeats).

MoK/shim is also mentioned, for some reason, even though that solves a
different problem.

> What makes it good now?
Debian and Fedora are using it, and it's what users expect to work.

> Who is using it?
Debian (since 5.3.9-1, #935945) and Fedora (since the time of that bug
 at the very least, as Debian imported from there, so 2019-11-09).

> What are other distributions doing about it?
What does that mean, and also how would I know that?

Best,

--ctfue7uj2awdz525
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmQnVgQACgkQvP0LAY0m
WPHbrw//SBTenWvEm3w9KT+/Tf5ZMHvPzqWyHK7Gk4S2x2ivRamjAQY0Y/fRpFU3
PknBjiApowWa8Y8DKi1Q3SOZe55QGssZL4SXRhFsRPH5Mh+Kp7PfBtuRrtSqxd6s
ZS9cRR5HbzdNtieqkOV1G3k+FgTiL9Aj+g49h7wkdpg5wfmsGElVM3dadzG6xUc4
laUhdmds98iWOIGb8gdaUtb0c9ybJpH/h5IyxvkMPui54C2hOoGc8/0XAvjLiItk
PyH7Mw8j4dMA59zMOU+4qel7FhQF0mY24hBa1raEgxmD5x1SBPekplsKnpRxd2Zk
xK4RowUcErTCOGwnwanDJH2EYERKvHeXm87tPENI9FUXGpZFvX773Cr52QadN0iu
k/zDzresRxhdnKrcAzO3gkTYVVIZuA3mx3Sg+9ZYJ5yXVGdaIYhVKrV24VCmuAER
U2i/H4HApPaX368SPNSCVXulXrYYuApSPKRfuWo6Oarx4BLOUeUk3OcYWKH38RCi
A4kjw8eT38fkcbKYN5/PqlYIoRFnDG8NfHUjvnprGw2wVrfGjFUCUNXvDKEqw2X8
Y7IS0oTF/QoatchfqLumkmAS/tozduFAeIhAvIS9tJ6t6Ss3Twt7SzZ2gROtl5JG
a+zVNTcHajZQSFYeb2BJ/wv/djOxpGJKDJ2IYQQwHXEQ8tv7WLM=
=et90
-----END PGP SIGNATURE-----

--ctfue7uj2awdz525--