From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v7 06/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
Date:   Mon, 15 Nov 2021 19:15:34 -0500
Message-Id: <20211116001545.2639333-7-eric.snowberg@oracle.com>
In-Reply-To: <20211116001545.2639333-1-eric.snowberg@oracle.com>
References: <20211116001545.2639333-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?GSqzdgQvNyaGxm2cK1JMM5os5gbw9MO3ySgriem+T0QEuq5+5UVL7V+LOYA6?=
 =?us-ascii?Q?1/wOHFOhbIA6LJi9dps9Ay0bH02luV5r+tQ87rWQ9EHrcVLVhfgS9L9xoVVW?=
 =?us-ascii?Q?G7MscSiNOPQi+y+5D8BEePZiV0wH9XY6umL6uO37cBB8gBpgPsrCaz13G30L?=
 =?us-ascii?Q?ICyvkQLq9pRyjDUi2uyjRku1RFaLkYYPRQayk5XGW4AzYpJ71xDsE1EcdKwK?=
 =?us-ascii?Q?/MscMUQD+WToPNFSvKiuALavvGMGUz7V+6CUcC1V4YV4a6yR99Vo7OYEe9My?=
 =?us-ascii?Q?sBSpHs2Ti0V1laXIl/TYxFFzHZyLPdSjeBQ0W6mobgaYKHI19WTsnJNv81yD?=
 =?us-ascii?Q?sxrnpKhMuK7IxIAwjojvFZUPUqzMUY8U3K8pOqs8en+TLhdsbGJk0vAMCTm1?=
 =?us-ascii?Q?15GcrF/n0eSzHMkSPRHEoJhn4H9KUKuvZZyutiZHORzmdonuAQqMBBkDVnmF?=
 =?us-ascii?Q?xVQwM6MW6kjSer5aqor7qKjBsSbKBfc0Oh87kToSx+ytESGFB6LM/DmoMXXE?=
 =?us-ascii?Q?4s/fPQBNJkmw1A3SYsgyuoz77yGjNhjXp7jUZkL/fUQ1w8YE+niYRA8qfOgZ?=
 =?us-ascii?Q?V4Dh7KZiVwdUAtmWYZfglDX3KnJt6c3jEvxVCwcvjtVUimJvJYkuTrBeuuEL?=
 =?us-ascii?Q?cW+9yhAQnW9sMhpYmjX0IJeE7Ij1OiybxnJ4MClDn0McOB0OsnbsAz8ChSAS?=
 =?us-ascii?Q?UzTTGuyUi/yAe/TRs+sPGKA5d7tfpKdMbDe5+Ex+DqnHQe5ibyRdElTmaVC+?=
 =?us-ascii?Q?tUg0kRQh3b1G9PpHylyrtJprC4UhNGqjA+l0m3tL/B4ktAz68ulV8Zx8onWn?=
 =?us-ascii?Q?qmoIXPLNxLHn27Ou93hiIH+HcwGLm90gVPTFrPNkTaCuZsHjja9fnF9m3F6i?=
 =?us-ascii?Q?NTxy55X/GQAbilmX+/MMvXNZke4oOqyDYIYw4bIodonBieBgqJr7BrxJFaIY?=
 =?us-ascii?Q?5OSVbU04j+BqnFY+s4El/U/Jn2H1ntTkOsMosHIcUNJUYRakzpeVH23j0pyd?=
 =?us-ascii?Q?J39SeiZ2siV5JeoKAgTHhMmiYzmao83ByBw0N0uEkLtAa0lP+5TGpohq2038?=
 =?us-ascii?Q?vCYjLBSo0mrbylD/mrSbcg2mSXKjfg6XeGBMevu0M52z90BcDtkDHMrGpDGz?=
 =?us-ascii?Q?xDHGWoXox3AOQJonHnOy7VjPk1wqsICRBiVmufOwO+ksi5FwY2LyBiNwiorZ?=
 =?us-ascii?Q?XWIgOAu0jd7exgq0yHxIWqw+qFTsiJXAzVpma+ijyd8FZ68M9Msdapr+ebQM?=
 =?us-ascii?Q?JNbVL2qHInr1eG+pDYbv3A77ENUEwGBj0bXTwE9SEtk3nPwERjIOXUsz37gX?=
 =?us-ascii?Q?Mq42yATm1WhklSl85q0bXbpkRvvmGurQY89XwS2ebQsihZzeUTfTh+qvO7ni?=
 =?us-ascii?Q?CHtum+dedX3aJCqtHD3bcLLzmCaChNqb/BnEh15Bok0MZqiJ5o2MY9Ggxv/Q?=
 =?us-ascii?Q?qzZNE/DXbTQ0Dr14J0gKLnS2/rJxbsbR4LO/CirowzOwR7Qog9IEAGuIRFJh?=
 =?us-ascii?Q?q8Pk6t6mh31dtyluvEm/LfBYdEX36yU8VTs4XcFrZZ+i9UiQF3Hyv+bDWX5j?=
 =?us-ascii?Q?3vxI77GRvfVZbCrUw+BZUQzvnQLstfwZX/mnyV7b4io8Q2u0a6+xx0cNssZA?=
 =?us-ascii?Q?rWFdb+fC3kp1Dwmf5mwUgwb7TbOqPOvQ9zgcCDx+StZgFwHCf/f1pkHAi8Tc?=
 =?us-ascii?Q?sfq5yg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 048d7d6b-27b6-4240-43b2-08d9a89654e9
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Nov 2021 00:16:27.6304
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: v5Q2bRnoWpHDtEvKyZp8pDia7TpZSMIg9FrMxZF9+SC+FAOfqA6LCd9xQcZ1SrNno+SAZgDeZTCLn1Tj3USxCXwIwocze08p8KgXpRhF4aE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5276
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10169 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0
 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111150124
X-Proofpoint-ORIG-GUID: IUIAz4gGrj5yIyfnK-YsNQ_5y2REHYT0
X-Proofpoint-GUID: IUIAz4gGrj5yIyfnK-YsNQ_5y2REHYT0
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to
restrict_link_by_ca.  This will only allow CA keys into the machine
keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v1: Initial version
v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok
    keyring gets created even when it isn't enabled
v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca
v4: removed unnecessary restriction->check set
v5: Rename to machine keyring
v6: split line over 80 char (suggested by Mimi)
v7: Unmodified from v6
---
 security/integrity/digsig.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 910fe29a5037..e7dfc55a7c55 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id)
 		goto out;
 	}
 
-	if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING))
+	if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) &&
+	    id != INTEGRITY_KEYRING_MACHINE)
 		return 0;
 
 	restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
 	if (!restriction)
 		return -ENOMEM;
 
-	restriction->check = restrict_link_to_ima;
+	if (id == INTEGRITY_KEYRING_MACHINE)
+		restriction->check = restrict_link_by_ca;
+	else
+		restriction->check = restrict_link_to_ima;
 
 	/*
 	 * No additional keys shall be allowed to load into the machine
-- 
2.18.4