Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Subject: Re: [PATCH v4 00/12] Enroll kernel keys thru MOK
From:   Eric Snowberg <eric.snowberg@oracle.com>
In-Reply-To: <f76fcf41728fbdd65f2b3464df0821f248b2cba0.camel@linux.ibm.com>
Date:   Thu, 19 Aug 2021 09:23:20 -0600
Cc:     keyrings@vger.kernel.org,
        linux-integrity <linux-integrity@vger.kernel.org>,
        David Woodhouse <dwmw2@infradead.org>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S . Miller" <davem@davemloft.net>,
        James Morris <jmorris@namei.org>,
        "Serge E . Hallyn" <serge@hallyn.com>, keescook@chromium.org,
        gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
        scott.branden@broadcom.com, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
        lszubowi@redhat.com, linux-kernel@vger.kernel.org,
        linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James Bottomley <James.Bottomley@HansenPartnership.com>,
        pjones@redhat.com,
        "konrad.wilk@oracle.com" <konrad.wilk@oracle.com>,
        Patrick Uiterwijk <patrick@puiterwijk.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <91B1FE51-C6FC-4ADF-B05A-B1E59E20132E@oracle.com>
References: <20210819002109.534600-1-eric.snowberg@oracle.com>
 <fcb30226f378ef12cd8bd15938f0af0e1a3977a2.camel@kernel.org>
 <f76fcf41728fbdd65f2b3464df0821f248b2cba0.camel@linux.ibm.com>
To:     Mimi Zohar <zohar@linux.ibm.com>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        David Howells <dhowells@redhat.com>
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from [IPv6:2606:b400:2001:92:8000::1af] (2606:b400:8024:1010::17c6) by BYAPR05CA0059.namprd05.prod.outlook.com (2603:10b6:a03:74::36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4457.5 via Frontend Transport; Thu, 19 Aug 2021 15:23:26 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 2094ca5a-53a5-4d0a-6eb1-08d963254e20
X-MS-TrafficTypeDiagnostic: CH0PR10MB4891:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <CH0PR10MB4891A3284E1872397F3FE3C987C09@CH0PR10MB4891.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8273;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 5n0OUaBVco2cZHroxFJV9KJ4/MOlSfsFN1Gzlgp6j2xML+OoU13kxd2LLINWGobWieP8sFT1d4HITTokLNBUnIWXZHWlbjmK/IVJo0kJLSMYUtF6p3T/GiTbHGfNwRC1T077CoBkp941+DUrPPCmz69YgRpO6UUxBfxSjF5HLwxkeBQEZXtT3fe+BGT4/qO3NEKU0a7bQ1FRhvRHlE52SSJ5bq/1O9+oiNLszTO+WyJVqu3P8/H82UIuQ4UQI5dxDK5fJVNdIlCctdmc1o9AC7uZlIcVsgQP4w3VNh92Aqtu+cROnZxbrEHPvKM8nDForbbSnJ9ISgI29iNRm4+RB7YoqcLXn/9W74nd7HbIs8STRNAuKnaA9omh85Lv7fhzsHSPsQM3HC/kiI3WrkQmP9ZgvwMwUlhrqQ+RdaDDpRieG2UkgGdaLr3+9ZaoWKaJDY8XVkUn79DLiKg3DsnoNMogASg0DN1OiKQONWaOifH3hlSBTv8ThwQbpCv7bgL2gqidUr8GMNNSMYiQHiZ/+LZzA0NdB2OLq+C+pIytqrZoAuAR0nzhcMDFkRjl8AIS1HEOXvs2QaTqP9HPqaA/stl2sWSfjNq5+/4i8OmJt/9uwZCtjQkGV360AP+EQhrZb923rPY4MjHbX7ryZuaYdRsgU2PAx9P6dEI4n5LmKZCTcxWjLfd7nO/AXTc6LhIaony3zJL6/y1cx8DSduJ/1A==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(366004)(7416002)(86362001)(6486002)(38100700002)(44832011)(66946007)(54906003)(2906002)(2616005)(66476007)(8936002)(66556008)(52116002)(5660300002)(110136005)(316002)(508600001)(8676002)(83380400001)(53546011)(186003)(6666004)(4326008)(33656002)(36756003)(45980500001);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QnljMktvZXY2SWhPbFZmOVZWQktLZEtTYVZLdFdvWmRTdWtsU0JVOHA5TWRn?=
 =?utf-8?B?aGdDcmZmWVZPRER3WHpjRW5TR2UrbkR6VkpDRGswU1ZLU2xEL1lOVDhVYkRj?=
 =?utf-8?B?aFpaTkhFc1JSUXkyQlQxR0dPVjNlQVJyUmdCMWtsK1lzdDV4ZGFOQ1VlSkt6?=
 =?utf-8?B?YnkxaUJaRHBtcnBxQ3o1SjRrM3JMSUp4T3A0dkxtL2I5ck5SV1luaVI2ZE9v?=
 =?utf-8?B?ZHBETlExRC8xQ21qTVQvT1Bneld2VThtaTdiSllTMmY4QlhyMzlQNkdvWWtZ?=
 =?utf-8?B?Zms1eS9NWkFyTmptVE9BT2c4ZlVQeUY4VXFWV28wZnpRV3JscTFaL2wwVDkr?=
 =?utf-8?B?QUpjZFoweU5nSDkvMmhCL2VTS2FqenRWdDJzMnZCTXlURzE4VGNHdU5mcDhM?=
 =?utf-8?B?T1VFSEhEZ2tNcG1ISHNJMzZxbjdJZnNtTFdKVjhVZUlVU0pVdmdYaHVIRWxn?=
 =?utf-8?B?djdxbW5iMGwxbGw1d2NodjBZcGhnK3BvNmtDd0l3dCt3UGl4SU44b2hwWlNU?=
 =?utf-8?B?V0h2eUJTb29KZHlYeStiNi9MeWx5RzByelpURTJBbTBZM1NYaUJZVHlBK0RG?=
 =?utf-8?B?a3ZkZzNWenJucVFPOGZGVTV5S0xQZTVXTkprNk9VVnpxS0h4TC9DUFNVNHFp?=
 =?utf-8?B?MWlZaDRVVGRScEJWUzZORUtWRFg1OTZhWEVIY3gzWHZkQk5ZbG5odTVHQURj?=
 =?utf-8?B?dkpVdFdzWHEwVEYzdmQ0ZHVlMEg4L0RvN0pOZEU2ZGlpYUZudGdWWFg1cm50?=
 =?utf-8?B?M010eDFtREFpVTY0SHpVZmVBNXVsa1NNR1AzL1czSlBLZWgvREU0SXRzbmpW?=
 =?utf-8?B?L2IxRXdZajdDaEQzRkMxU2UvVUYwTFlQN2hJdkdxMkRPMlhPL01GaG5mZkFy?=
 =?utf-8?B?aWlJTXNFeG5tMktYQ0g2czViTzFxWWloeWNnWitxaWtSbVJpVFl2VEwybkVH?=
 =?utf-8?B?Q1JtVFBSODJGSkVtSlFhZVVDQkk2QkpYdUI4MWdZWE9DbFA3UXNUU2ZzZmZE?=
 =?utf-8?B?dEIweWRFQ1JqUlJBWnR1SWZaWERxVm9wMUJ5aEM3SXZEd0xteS8xMk5OZUMv?=
 =?utf-8?B?bElJWTVDQTNuYitlNk9IWEVFcTY2bTNPSllhZHlRbVlMU3NENStQQzFVcW5s?=
 =?utf-8?B?NDg5UFJiaThjM0dRaDlxakdmU293dTB3ZExiOUdndDlDRGJ1QmUrL0M5RkN4?=
 =?utf-8?B?QjZuMXU5WkRyY0NZVTllRjhxL0tXNitNM0dWSmQ5SitiNkpWUnJicENVM0M2?=
 =?utf-8?B?QmU0U1hlUmFId2RsaW1kMmlUTkg1ZkZTZnVjaXE0Y3lpLytKdDFOMXlLZFAy?=
 =?utf-8?B?NXZnTWhibE5wMWpoOTdWZ09KTTZnemVKYVpldUFoZDdrQ3pBaFh3WlZ2Vkoy?=
 =?utf-8?B?QkVoYVdVcEtLclQ5enlrTFdzQ3M2TURtZERSZTdGZWhraEp1Y28xY0dxNjlW?=
 =?utf-8?B?b1JmQTlueGMyemZGMnBjczJQamJwdGN2WGQrVk1IV2l4UWx0MjZyL2kwN040?=
 =?utf-8?B?SGVHTUVPNFp5eWp2TXZvS3hhVEx0RUdxQVc0WnppZDc0ekNTS0NjTm5YVDkx?=
 =?utf-8?B?dmJzNU9pR1FuWFhQL1FmVmZtYnd3eUYvZTFkYlM0NmdiTGNqNnNBS05lRmdK?=
 =?utf-8?B?VmgwUkp4c25aSndwSFdFaERiUFY2U0RvNDJLdCtQc0VIVUhCNFNaMHJBVDlB?=
 =?utf-8?B?WFBCVDNUc2tRcWFMSkZnODViL1QwNVo2bjV5Nml1d0ZrUkdkamEwSDdyYUNW?=
 =?utf-8?B?WHo1REJieGtHK2h1SXRIWDBCbHBGUEVweWVKN0w3SW9CK0UwY0JzUm1uZTR2?=
 =?utf-8?Q?4dW6POROQAf7D8kE5Zg/P3DY8FVXl9FOPT7VY=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2094ca5a-53a5-4d0a-6eb1-08d963254e20
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Aug 2021 15:23:32.7554
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: bFOoicmdD0bpgNUJDA57uSTiZ0yse5KwNM7IFOLM/jZIQVflw3ntQZ0sBiRGRh3G/NKIJ9cz4jJG46lRpKPdDKTmVi+WJZRpz43hbbyD5/U=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB4891
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=10081 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0 malwarescore=0
 mlxscore=0 spamscore=0 suspectscore=0 mlxlogscore=999 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2107140000
 definitions=main-2108190090
X-Proofpoint-ORIG-GUID: HyyEVGQl8qlzKpFMWjeQE877S-PFPA3c
X-Proofpoint-GUID: HyyEVGQl8qlzKpFMWjeQE877S-PFPA3c
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Aug 19, 2021, at 7:10 AM, Mimi Zohar <zohar@linux.ibm.com> wrote:
>=20
> On Thu, 2021-08-19 at 14:38 +0300, Jarkko Sakkinen wrote:
>> On Wed, 2021-08-18 at 20:20 -0400, Eric Snowberg wrote:
>>> Downstream Linux distros try to have a single signed kernel for each
>>> architecture.  Each end-user may use this kernel in entirely different
>>> ways.  Some downstream kernels have chosen to always trust platform key=
s
>>> within the Linux trust boundary for kernel module signing.  These
>>> kernels have no way of using digital signature base IMA appraisal.
>>>=20
>>> This series introduces a new Linux kernel keyring containing the Machin=
e
>>> Owner Keys (MOK) called .mok. It also adds a new MOK variable to shim.
>>=20
>> I would name it as ".machine" because it is more "re-usable" name, e.g.
>> could be used for similar things as MOK. ".mok" is a bad name because
>> it binds directly to a single piece of user space software.
>=20
> Nayna previously said,
>   "I believe the underlying source from where CA keys are loaded might va=
ry=20
>   based on the architecture (".mok" is UEFI specific.). The key part is=20
>   that this new keyring should contain only CA keys which can be later=20
>   used to vouch for user keys loaded onto IMA or secondary keyring at=20
>   runtime. It would be good to have a "ca" in the name, like .xxxx-ca,=20
>   where xxxx can be machine, owner, or system. I prefer .system-ca."
>=20
> The CA keys on the MOK db is simply the first root of trust being
> defined, but other roots of trust are sure to follow.  For this reason,
> I agree naming the new keyring "mok" should be avoided.

As I said previously, I=E2=80=99m open to renaming, I just would like to ha=
ve an=20
agreement on the new name before changing everything.  The current proposed=
=20
names I have heard are =E2=80=9C.machine" and ".system-ca".  Is there a pre=
ference=20
the maintainers feel is appropriate?  If so, please let me know and I=E2=80=
=99ll=20
rename it. Thanks.