Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
        scott.branden@broadcom.com, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        glin@suse.com, konrad.wilk@oracle.com
Subject: [PATCH RFC 07/12] integrity: add add_to_mok_keyring
Date:   Tue,  6 Jul 2021 22:43:58 -0400
Message-Id: <20210707024403.1083977-8-eric.snowberg@oracle.com>
In-Reply-To: <20210707024403.1083977-1-eric.snowberg@oracle.com>
References: <20210707024403.1083977-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost.us.oracle.com (148.87.23.5) by SJ0PR03CA0245.namprd03.prod.outlook.com (2603:10b6:a03:3a0::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4308.20 via Frontend Transport; Wed, 7 Jul 2021 02:44:37 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: e59a91c6-577a-4970-00b6-08d940f12a31
X-MS-TrafficTypeDiagnostic: CH2PR10MB3863:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <CH2PR10MB38631E8EAAE7E4A53ECF0AD1871A9@CH2PR10MB3863.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:1303;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: wEtfjukE3sVZBk8DX9ZEVDdNoMbDdoi9cma3naJPR8YAd8QghrYzACOr26Rl4+ZO+gIy+XoYcjAYpEynQKH3+x2ZYCoJBTHHdvOs0Zn74NOfw+cqHPpTsQYbhA5Ojrd1pqokFEYL2j3S1HAkPT2i4czg4tNPUm91kOJcsx3pEv76rpD6Oq3f/+5Wu09FiCX4ptmyiXmGNuPH2b40gszWe/chuGemUrofA3vkR8RIehIUtIJZEyotJ1wPZeRNgeKf6KIWbbLLT87p8BGqGXZ/O2RoDfgC9RlhJIBCxOWRT2Em7LdYqA4Q81ZIOkeL7i4zxyQdN/9iLDmKkZpektIhoNMKlUfxdkD8F9aIwqjrY//J3brXQ0qWN1uu6oSA5CtyDH4k+gDC6xAB0fCdM40rcPzE2U+trkeL2GwefXVjNQh31eImgAJKfAwQy5/gjAS3469+QU2HoRSZ16U5BMkrY2nPZKchHMp+BncCIa+V3E5p724U5XrvogHVJv7J5l6EB1EviBSNFvtZlRCbmka4FcogKLstBXYoXuqosD1rgaEJFuGG31Eqw0xYrWgmNluCZ596WdsWzfkEvNGUQY6yp+c0pG/1D2IpRv0NheHAhHK3+Aw3c4av1nyLUHlDOPggVsC+hrpX+o9aMjMPCTGZD25xbzZLCrERS5AWuKR+z5UsopHRaqYhFgSdEfUeYnn/WQ8uF3pHoW/imeiq2EeLPUQyEtryui8xSZNUW++Vdqw=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(39860400002)(136003)(366004)(346002)(396003)(376002)(921005)(107886003)(6486002)(7696005)(316002)(66946007)(1076003)(44832011)(86362001)(38350700002)(6666004)(36756003)(83380400001)(186003)(4326008)(956004)(26005)(7416002)(8676002)(52116002)(2906002)(38100700002)(2616005)(8936002)(66476007)(5660300002)(478600001)(66556008);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?61Pf4O40z2xKnEO1LjhNbkfUIvUoYqyFWA9yq6vSSwXV+hsKITAukaU3veDY?=
 =?us-ascii?Q?Lkxsx64dpfAllku2mDDUBU16S7bqT7fnK0Frtb0WyiMpIZrHLEOApeNhrcB/?=
 =?us-ascii?Q?YdgGNe3DU3m6q7WFC5KAqC47EwU0WUmLPkiLU+hql5KScMpYoKEyNfRSAo0R?=
 =?us-ascii?Q?yjgUcMDZIBpphBbqwfKJcECC48KcEVkU7JNiCxmpEmuKDIZET1V01u8FM6HQ?=
 =?us-ascii?Q?yA72cdmve0VHAUsG3l4I2hrniwG/rZL0X76LweE2ku42BbILRMfnZzyYiyNZ?=
 =?us-ascii?Q?C7qbtIRSumMJXJSRwPjDc/A36WtFlO2C9ZkpgkrC8/apjhNf+njLcbhYCEWe?=
 =?us-ascii?Q?h2PvML27apwN1z4qHX/mB99SvBSdN7OSd1wiCNpKnUXz7RI9ItSMXPwwgilq?=
 =?us-ascii?Q?WYC1+Fn3JZw96cncyk19Hs66GCNT4by2BSHLNkZDDavVs+DcQkfF3R6xF4Mz?=
 =?us-ascii?Q?ajHIttER8eQTHOxciNlds8ziz+CffD/JG0sgKElAkoAgOS8vAN7ucMKLTz5Y?=
 =?us-ascii?Q?jib0jWE5Xh9+rJB0Jk/Uk7/RyJ2kV5Ua+eC8TtdOCOMkmf9BifPfTrwoz0hS?=
 =?us-ascii?Q?361ewcWChMHiQu2iKBpDAxhcz/ldTyXaodvoCJpLUfkHGUqh2ssLCIZz5/zw?=
 =?us-ascii?Q?owPX2Q5cTqtGrfnpwNnV5ixw1JAeML/Y2W1xkLIk+7FMMqSs+UWlIk69YrYf?=
 =?us-ascii?Q?T4PHJQYi16QUN7bu3a1nxTS7NvRPkpv7WL9Na8JjNBJt2FCUzahBZWxWi5qF?=
 =?us-ascii?Q?ecc5/CvMzgVfWPJNowqKVNz6cNpMAYBBFufs2lAkCjkyTKOEDDQt6YpsjeDW?=
 =?us-ascii?Q?CAYNwmdto7rh2aEyRrOlKJO1cNXG8m0z2aOta7+BUqclLfJwnzP0JJ1K41Ca?=
 =?us-ascii?Q?niJItmcNpb7eNyTz86+fR5xmJId9W6eympj+ne2fVD0lGoBy9CWK17BgcDFu?=
 =?us-ascii?Q?E+4U/qEUMw2fXlKcnSVIyIWrUoJP+SCIXZ6T0Y0XXMsb/B2MCnDtur/KXaZ5?=
 =?us-ascii?Q?Dj6NVTHx06PCLOcTWfJt1nEe2+QYOrrHmWgy1IYqlOkpVfRsYRnRHzyRSkqB?=
 =?us-ascii?Q?nzr66TW6SSWQLsWYmq+TlCm/cY7u8epaHINw1OfscyJQAEFY72dbmbG1+GAu?=
 =?us-ascii?Q?kHo0r9+i/G8oU8rN9Ljh4w+sPFlrPK93nT62b63IyPk/ICbnLqzn4xtTmQbX?=
 =?us-ascii?Q?cGQ1FawrThUH+fg8+7IjMXbecA8Uh0oCzxi/ey2XA9OJ6HHFLEp85B4fq8/g?=
 =?us-ascii?Q?1R4mkADqFPE8TVGYzPTgFPyow3dhaeDwIfBML8U8s9fBrBnKf0f3SA1MJPGn?=
 =?us-ascii?Q?TKBtoPW3qFmPFJzo70SEHgaL?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e59a91c6-577a-4970-00b6-08d940f12a31
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2021 02:44:39.0807
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: DLNXBKUvFIypRQbH4M69DgGGEQu4i2PSJz/pahxvUYIHltu+qgqMLtONxhnENQIijLfaISS/Jj6opo72mab3Sz98NlOsMB3ZKv+NbKcGfPg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3863
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10037 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 spamscore=0 phishscore=0
 mlxscore=0 bulkscore=0 malwarescore=0 adultscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2104190000
 definitions=main-2107070012
X-Proofpoint-GUID: sV4X-iYLqK-M82kNBRj1rJKkqvj-Maw6
X-Proofpoint-ORIG-GUID: sV4X-iYLqK-M82kNBRj1rJKkqvj-Maw6
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Add the ability to load MOK keys to the mok keyring. If the permssions
do not allow the key to be added to the MOK keyring this is not an
error, add it to the platform keyring instead.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
 security/integrity/integrity.h                |  4 ++++
 .../integrity/platform_certs/mok_keyring.c    | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 5126c80bd0d4..68720fa6454f 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -284,6 +284,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
 void __init add_to_platform_keyring(const char *source, const void *data,
 				    size_t len);
 void __init destroy_mok_keyring(void);
+void __init add_to_mok_keyring(const char *source, const void *data, size_t len);
 #else
 static inline void __init add_to_platform_keyring(const char *source,
 						  const void *data, size_t len)
@@ -292,4 +293,7 @@ static inline void __init add_to_platform_keyring(const char *source,
 static inline void __init destroy_mok_keyring(void)
 {
 }
+void __init add_to_mok_keyring(const char *source, const void *data, size_t len)
+{
+}
 #endif
diff --git a/security/integrity/platform_certs/mok_keyring.c b/security/integrity/platform_certs/mok_keyring.c
index 666fa355996d..a5644a8a834c 100644
--- a/security/integrity/platform_certs/mok_keyring.c
+++ b/security/integrity/platform_certs/mok_keyring.c
@@ -28,6 +28,27 @@ void __init destroy_mok_keyring(void)
 	return integrity_destroy_keyring(INTEGRITY_KEYRING_MOK);
 }
 
+void __init add_to_mok_keyring(const char *source, const void *data, size_t len)
+{
+	key_perm_t perm;
+	int rc;
+
+	perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW;
+	rc = integrity_load_cert(INTEGRITY_KEYRING_MOK, source, data, len, perm);
+
+	/*
+	 * If the mok keyring restrictions prevented the cert from loading,
+	 * this is not an error.  Just load it into the platform keyring
+	 * instead.
+	 */
+	if (rc)
+		rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source,
+					 data, len, perm);
+
+	if (rc)
+		pr_info("Error adding keys to mok keyring %s\n", source);
+}
+
 /*
  * Try to load the MokListTrustedRT UEFI variable to see if we should trust
  * the mok keys within the kernel. It is not an error if this variable
-- 
2.18.4