Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        gregkh@linuxfoundation.org, torvalds@linux-foundation.org,
        scott.branden@broadcom.com, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v5 06/12] KEYS: add a reference to machine keyring
Date:   Tue,  7 Sep 2021 12:01:04 -0400
Message-Id: <20210907160110.2699645-7-eric.snowberg@oracle.com>
In-Reply-To: <20210907160110.2699645-1-eric.snowberg@oracle.com>
References: <20210907160110.2699645-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?axoAiYdJ6EqPU6YgqMmYvEQm8pVX1L7ksKgCmchguLllEiF3a8jJBmDyEK0K?=
 =?us-ascii?Q?I58JrXH4+IHUl2QLibScMfP1PQsoYD3T4LXr+xyU0gEUKndzWmXoVzvp5Zrm?=
 =?us-ascii?Q?hQqpv3DxBpQHfd3YF6f0FJudJZTsK0giKQNd9y2imGD1wu4fIO/fyX7+0qgM?=
 =?us-ascii?Q?OVDz2L2CMWEiDfou//i6kqP0GPWSotSAK5JdAJ60ZNkTL5SliVJni32NkD2U?=
 =?us-ascii?Q?505KNFCA6Q5O8xQB7ZcbnKwmNKS3SBtldPi6znogwwxnzgLa6XkUIs2ZvQ4l?=
 =?us-ascii?Q?42j15zvcYyy5qeM4d1mq9IpfkOebIiJntelmZjTDEDKb58H26LLi21j/tjiN?=
 =?us-ascii?Q?/9kAn6YGAQQRXjKthsVc+W1EfgtW2wn8m7+dAWqPr/4qK3+jI8QsDp2+U5Cv?=
 =?us-ascii?Q?8p/dBYUHpN8d7KPFZBGXHsfcNO9nfwvD17hKdK/Uf1kpKzEJwMGTBqd63HaR?=
 =?us-ascii?Q?d8e0UqItfUUSgM6a0WgBsHrNiQT4ZOodfdGpHTtgKo05roOD2LsawVM9+44Y?=
 =?us-ascii?Q?+kpVykB1TOPX1VD7aIPwq/inZYlMDYq9WjWgk1QMeBIy3d8H7g2wb/uIddHV?=
 =?us-ascii?Q?116cUd8kL8gSVaiKjukoIr92svlUwp7LoIdS+wAdxwJiBk1w8MuwC6caweKQ?=
 =?us-ascii?Q?A8vFWp75OdlOoGAB+L99Aa07y5+7O7l200Kn2A7x6RAzLk1S/nZMHIboXZIa?=
 =?us-ascii?Q?lVZFpSbx1m+Vc4xcO59RVSw5Ywd4pFnlpYJ7/2ci3if7krvH/QyMPcqzjVpx?=
 =?us-ascii?Q?aBshVGQWcogkS/s8+lxpCxp0cdnp9z2XjFiwb2WTx/lTv52kNoha+UWqq4MT?=
 =?us-ascii?Q?2gqZmY4MJSdb8KerA9K1X1RBt3I8I58TThZIdsy68irji+HAnPYAnG01CgSu?=
 =?us-ascii?Q?VanX575ycFWgdDEO008ReKWQtu0NaE/idjepDNXo/WSAACX2SLE6i3KtUsKK?=
 =?us-ascii?Q?jDZ5dnN7BelV+JkgynefCm/6j5cVNXxk2qxZQtJUZ8Dp2vXce1e1nV02gTal?=
 =?us-ascii?Q?5X5I1Onoy3YpdYSnPlxjaMJMXu1Ro6iblqoqH/Z0dfvOrKbw/tXWk+yDG4vX?=
 =?us-ascii?Q?pFS7+WUq/7zGle3b966PvZuvxYJU/yameqjgKy3RUS110ujarXJ4+0PwgxE9?=
 =?us-ascii?Q?ShTC02NgeGMLfIWV9lwAHY1aWJxV1HUiOXf2jJupKZbMqsr4R9QtZ4wH1VFj?=
 =?us-ascii?Q?v/7eBvljDggo5VK3WgT4DdpvB3ROM0hJOiOUpiuIkRYthyySjJfGc2cBEa+l?=
 =?us-ascii?Q?P8RADQWDQOT2DB5+jGls0i9dKwy7wNKTS3IfMQsz3XvYNjwGw0hYaiikQMGA?=
 =?us-ascii?Q?pevQY/5JQ/6LiqOysE3JkH+U?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5f05f752-19e7-481f-5539-08d97218c707
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2021 16:01:39.5007
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: /ARFhON8NnszfeDUtwUPu0qzSbZ0aD2UQ24hiNpL6gUw990J0JhzTIpl5U5LmvFLA/jRz6TWBft5S5JEJa1Fs6oHJ6lasT/76D2gFjOwhIE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5004
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10099 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 adultscore=0
 bulkscore=0 suspectscore=0 spamscore=0 malwarescore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2108310000 definitions=main-2109070105
X-Proofpoint-ORIG-GUID: A2D3X4v3p0vz9Yw4rJ8GhhqHhZEXXBJr
X-Proofpoint-GUID: A2D3X4v3p0vz9Yw4rJ8GhhqHhZEXXBJr
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Expose the .machine keyring created in integrity code by adding
a reference.  This makes the machine keyring accessible for keyring
restrictions in the future.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v2: Initial version
v3: set_mok_trusted_keys only available when secondary is enabled
v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING
v5: Rename to machine keyring
---
 certs/system_keyring.c        | 9 +++++++++
 include/keys/system_keyring.h | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 692365dee2bd..08ea542c8096 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
 static struct key *secondary_trusted_keys;
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+static struct key *machine_trusted_keys;
+#endif
 #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
 static struct key *platform_trusted_keys;
 #endif
@@ -91,6 +94,12 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void
 	return restriction;
 }
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+void __init set_machine_trusted_keys(struct key *keyring)
+{
+	machine_trusted_keys = keyring;
+}
+#endif
 
 /*
  * Create the trusted keyrings
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 6acd3cf13a18..98c9b10cdc17 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
 #endif
 
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+extern void __init set_machine_trusted_keys(struct key *keyring);
+#else
+static inline void __init set_machine_trusted_keys(struct key *keyring)
+{
+}
+#endif
+
 extern struct pkcs7_message *pkcs7;
 #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
 extern int mark_hash_blacklisted(const char *hash);
-- 
2.18.4