Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
        scott.branden@broadcom.com, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        glin@suse.com, konrad.wilk@oracle.com
Subject: [PATCH v3 06/14] integrity: accessor function to get trust_moklist
Date:   Wed, 11 Aug 2021 22:18:47 -0400
Message-Id: <20210812021855.3083178-7-eric.snowberg@oracle.com>
In-Reply-To: <20210812021855.3083178-1-eric.snowberg@oracle.com>
References: <20210812021855.3083178-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from localhost.us.oracle.com (148.87.23.9) by BYAPR05CA0062.namprd05.prod.outlook.com (2603:10b6:a03:74::39) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4436.9 via Frontend Transport; Thu, 12 Aug 2021 02:19:26 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: c3a7f66c-38e1-426f-79f6-08d95d379cac
X-MS-TrafficTypeDiagnostic: CH2PR10MB3960:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <CH2PR10MB39601CF4906E7BC737BB4AFC87F99@CH2PR10MB3960.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:2089;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: sZ0XskAdtGGA762KWpSe+nQRtbUikw7O5Fq0OQXmrRwrNs33WY6fs1/1Ils4Gl70tPqH/H+I7yqUZu7XfLwbgbdmQ7t6aW1C0RU167WgK4mswOfzB+NqlQgFScRjGxZTJ8kfGoDytzJIY3d4uO+jx0nLUNX6WqWQQpBsr2UZRuT74lCIoTs1AbQitWFR65TU/Pw7om9cXLwrISC3N66lqbhBc8ndyYja2BK2nif2kftpjwwrioPSpzChPDr1ZMYJu+MKq8t53AGBa6OgOFlD6MzjEc6DQz1f20Dp/XwuKhqkpKcsQSFv513XmoZKk11/FxQ8xBkaH8lVVJd7Qv5wkMXdvoHFOxv72UbQ3rP1HfQUtMNXsTMPauRQEL4u5n4bzu+fmgj/f5JzWLrvdI5Z1xBuqclE5sIxuYuCl6Re93YDAr7rKXB4HXcjYPJrhXWiFtCvnpWRRYUzgD1UiRWPiBFxni3aBo2j3TpVll9c6yBAdCj4XYK1/51IR+z0EMcq/jugmzULHKpfsW+TZ3RBYKo8yuqzHHKGj4FocS5p6CdE9CV8vH+3ThVKU5aG3bm0j+0dXEzlFGkse8XFESsq8PKk09fQ7FXS/2pRMVnq4P6rL/ZJjvliXjXZQgyw5183hnL1gm6pNosYXGy2JzgyN/WtYEwuD6NdcSQGBoKr8sLgSV2TEsqhpCfeQb8Lgfq/amhMYK1/ew9R//oqEPnVLA+WfGk4gySPHWm2V6vcYS0=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(396003)(39860400002)(366004)(346002)(136003)(376002)(7696005)(2616005)(38100700002)(66476007)(956004)(38350700002)(8936002)(6486002)(52116002)(66946007)(2906002)(44832011)(478600001)(316002)(36756003)(26005)(86362001)(4326008)(66556008)(921005)(83380400001)(186003)(8676002)(5660300002)(1076003)(107886003)(6666004)(7416002);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?C8LXVeDOxcY2MKjqhArUomRQozNCdjdGlMg896tbkeNl97yq8PUpipL1xO4E?=
 =?us-ascii?Q?pOYVzbxCwXoZeuGkSUGHo2n3C4Y/eUt2bkarI+GLNTxg0KH2DkvnPo3yNoUJ?=
 =?us-ascii?Q?bLx97B3AiOtBGuNb/rsnsqIaxmVZ/SXbcIpOedCFLmC5xhY+9VdpnGYLx0hg?=
 =?us-ascii?Q?gv8HBNEU+/6FdU5H5VCQnfr5dPdpl6VDoNGQzkld76w2W/f6j/hXVRvdK9qs?=
 =?us-ascii?Q?d01v6oHPkGUr/09IadWmQUiR2XA9tvval4Db0YTaepeqFj8qRUgmEJmAR41Y?=
 =?us-ascii?Q?IspbeAmJ03iFtIGh6WTi7DpQVSV+N7MKH6/G1Rd+sm9VJoKKeeLCJmWdlRp2?=
 =?us-ascii?Q?/5uF7cME6LKZnCNvcXFD7bIrHHtNOHCfbNSyHTkFiZo4WFERZr9qwYhXgg52?=
 =?us-ascii?Q?DOFhxw0m5/uWDuPAanutw2lI2TB4L59p+N3krAxX5pdhZIMFKaEgWe4vEdnF?=
 =?us-ascii?Q?gpQVSXwuTBJSDVy/GogC2Hp4bd4lCPwcSxrQbEt8TOoEMFO5M4/fvyI1aQf5?=
 =?us-ascii?Q?yEwwu70fCZE8XfzlADvh4hnYho+JZjYxs6uXE1OR203yNzw4AGiZWalCvlEo?=
 =?us-ascii?Q?PXkZ2eeRu1naCIvhc24HLylZR4ODxzD+Yr8bARvHq+8WNFvp9H5KEveCa12+?=
 =?us-ascii?Q?JfjddUcsALNZX91wTBV0PlHsn0oEfp9fW7hZ0LU6g+8yDeno5zRRU6kD7TCu?=
 =?us-ascii?Q?cQZkxd7Rwp3FlJwya2Mo3V/LWgTLfxJheJbhYNwiutTtKIE4IgEJFYlQvEem?=
 =?us-ascii?Q?oZ/JioFSRgG2J//Z/fx9hSLVGjeHNaRzWiZQjDZYoOJ5e+U4RxWq1mJK+iN7?=
 =?us-ascii?Q?fod69d+3aiXbJTnsgLkNd0RqmjTt2/3bJm7YcPou4Cbiw97Zx92tR4wGkqog?=
 =?us-ascii?Q?2k4mCqsFbXEwweN/kvtH5X3mZtftHM22Dm/62yzy3apNVRAqXLNZp4ITa87E?=
 =?us-ascii?Q?9by7pWvBYKFNTe2aOs0zhm9y8Ok33jWSe/j/oh14aj8HdgKtTctge3mJ0La+?=
 =?us-ascii?Q?1ROrRgHwket9hsiwadV3vQvU/B6vdhVxmq4YLjHoMwokunlnfRI5mMGOWEJX?=
 =?us-ascii?Q?qgDym4CSepK3wcCrJ2Wtdq4oxwrYicrlK/AZvf2BInRBBqy7THBeMtU2Qv42?=
 =?us-ascii?Q?mWIQmtcW3UG5QkmaQeKhN5uAjPqjqcoK5zuPcwDTzhTEHNeNSO0LHqmkWKXK?=
 =?us-ascii?Q?c+ZrRNgZ6H8+7+8Io0BTe56BE+J7iUCdcCHi89DwdWJHru0WaAiC05vqfKMP?=
 =?us-ascii?Q?wTBZqXus1v/L1fvcyoK/AeH1hSbJ0nHg2hEerTwT6n4vwzmWARv4i/mtCk/+?=
 =?us-ascii?Q?l3ZVAFArczWgQzLgVYxuXrjH?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c3a7f66c-38e1-426f-79f6-08d95d379cac
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2021 02:19:28.4053
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: yCW271t7+4o/ARlpuaSgkSw+q53cqr++Juo26XDKykWYRMalL2+rFwtGKAunwKvL/Wko+axHb+rMnAJzz5BDhPKkWfj3vuvxjiBLoWYagLU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3960
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10073 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 malwarescore=0 adultscore=0 spamscore=0 bulkscore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2107140000 definitions=main-2108120013
X-Proofpoint-ORIG-GUID: RjeI_Tp25u_6VIAamuDOpUIGVVKw7CZr
X-Proofpoint-GUID: RjeI_Tp25u_6VIAamuDOpUIGVVKw7CZr
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Add an accessor function to see if the mok list should be trusted.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v1: Initial version
v2: Added trust_moklist function
v3: Unmodified from v2
---
 security/integrity/integrity.h                  |  5 +++++
 security/integrity/platform_certs/mok_keyring.c | 16 ++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
index 60d5c7ba05b2..1fcefceb0da1 100644
--- a/security/integrity/integrity.h
+++ b/security/integrity/integrity.h
@@ -279,6 +279,7 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type)
 void __init add_to_platform_keyring(const char *source, const void *data,
 				    size_t len);
 void __init add_to_mok_keyring(const char *source, const void *data, size_t len);
+bool __init trust_moklist(void);
 #else
 static inline void __init add_to_platform_keyring(const char *source,
 						  const void *data, size_t len)
@@ -287,4 +288,8 @@ static inline void __init add_to_platform_keyring(const char *source,
 void __init add_to_mok_keyring(const char *source, const void *data, size_t len)
 {
 }
+static inline bool __init trust_moklist(void)
+{
+	return false;
+}
 #endif
diff --git a/security/integrity/platform_certs/mok_keyring.c b/security/integrity/platform_certs/mok_keyring.c
index f260edac0863..c7820d9136f3 100644
--- a/security/integrity/platform_certs/mok_keyring.c
+++ b/security/integrity/platform_certs/mok_keyring.c
@@ -8,6 +8,8 @@
 #include <linux/efi.h>
 #include "../integrity.h"
 
+bool trust_mok;
+
 static __init int mok_keyring_init(void)
 {
 	int rc;
@@ -67,3 +69,17 @@ static __init bool uefi_check_trust_mok_keys(void)
 	 */
 	return (status == EFI_SUCCESS && (!(attr & EFI_VARIABLE_NON_VOLATILE)));
 }
+
+bool __init trust_moklist(void)
+{
+	static bool initialized;
+
+	if (!initialized) {
+		initialized = true;
+
+		if (uefi_check_trust_mok_keys())
+			trust_mok = true;
+	}
+
+	return trust_mok;
+}
-- 
2.18.4