Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <a312804f17f273ee0b31d28fc2bb95ef99cbb150.camel@linux.ibm.com>
Subject: Re: [PATCH 0/6] Enable loading local and third party keys on
 PowerVM guest
From:   Mimi Zohar <zohar@linux.ibm.com>
To:     Nayna Jain <nayna@linux.ibm.com>, linux-integrity@vger.kernel.org
Cc:     Jarkko Sakkinen <jarkko@kernel.org>,
        Eric Snowberg <eric.snowberg@oracle.com>,
        Paul Moore <paul@paul-moore.com>,
        linuxppc-dev <linuxppc-dev@lists.ozlabs.org>,
        linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Date:   Wed, 02 Aug 2023 18:58:27 -0400
In-Reply-To: <20230714153435.28155-1-nayna@linux.ibm.com>
References: <20230714153435.28155-1-nayna@linux.ibm.com>
Content-Type: text/plain; charset="ISO-8859-15"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Fri, 2023-07-14 at 11:34 -0400, Nayna Jain wrote:
> On a secure boot enabled PowerVM guest, local and third party code signing
> keys are needed to verify signed applications, configuration files, and
> kernel modules.
> 
> Loading these keys onto either the .secondary_trusted_keys or .ima
> keyrings requires the certificates be signed by keys on the
> .builtin_trusted_keys, .machine or .secondary_trusted_keys keyrings.
> 
> Keys on the .builtin_trusted_keys keyring are trusted because of the chain
> of trust from secure boot up to and including the linux kernel.  Keys on
> the .machine keyring that derive their trust from an entity such as a
> security officer, administrator, system owner, or machine owner are said
> to have "imputed trust." The type of certificates and the mechanism for
> loading them onto the .machine keyring is platform dependent.
> 
> Userspace may load certificates onto the .secondary_trusted_keys or .ima
> keyrings. However, keys may also need to be loaded by the kernel if they
> are needed for verification in early boot time. On PowerVM guest, third
> party code signing keys are loaded from the moduledb variable in the
> Platform KeyStore(PKS) onto the .secondary_trusted_keys.

Thanks, Nayna.   I've reviewed and done some initially testing up to
5/6.

Mimi