Date:   Wed, 17 Nov 2021 12:02:14 -0500
From:   Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To:     Jarkko Sakkinen <jarkko@kernel.org>
Cc:     Eric Snowberg <eric.snowberg@oracle.com>, keyrings@vger.kernel.org,
        linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jmorris@namei.org, serge@hallyn.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com
Subject: Re: [PATCH v7 00/17] Enroll kernel keys thru MOK
Message-ID: <YZU1lkBkphf73dF+@0xbeefdead.lan>
References: <20211116001545.2639333-1-eric.snowberg@oracle.com>
 <eac5f11d7ddcc65d16a9a949c5cf44851bff8f5f.camel@kernel.org>
 <YZPZww0bafYEQ0VS@0xbeefdead.lan>
 <f30a1399208a88257b3ff25b369088cf88a96367.camel@kernel.org>
 <YZPevFtTucji7gIm@0xbeefdead.lan>
 <8fcadcf2a5da5118fb7f9caea0a61440525a67b2.camel@kernel.org>
 <3939a2fac50d2e836c48855b1b00c7b36659f23f.camel@kernel.org>
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <3939a2fac50d2e836c48855b1b00c7b36659f23f.camel@kernel.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?iso-8859-1?Q?S8Zgc18hbmlMga0rLBnt/+IWZI1I7hG6jF5jEkRhSpytoUlIbRr8oz0nRp?=
 =?iso-8859-1?Q?80iLlCtWdPZLWODJo9dDyeDnACsvV6wyFmOV9mlTGtV87E9aTv8TR3WiPh?=
 =?iso-8859-1?Q?Xg1fwty7I6ih6MOB/g3wPqrAR15dRP7VA2n7BxVQzEOowBEgdde1qogJ7+?=
 =?iso-8859-1?Q?vxg7Ne/FgiBAMR7TaWbEjScgmOxIDtOzFK6A+fHAxXH1cvrUO5b1U+b96h?=
 =?iso-8859-1?Q?TweteVC7JviKY3qVwZcOTD1gt1jU9kWmrmAx6b3+80WhuvIjE65SeUpz56?=
 =?iso-8859-1?Q?glWfTT8bzcXW34ZlSkQv/df5xw65HLbbW+TGtcWYnMH/I3rxp1nesWh5Fv?=
 =?iso-8859-1?Q?HFfo8xfEbiuo0SG51GD4rkE63gnhA6vuTgjhLdRKlDnU0EVDNpciufhNs3?=
 =?iso-8859-1?Q?ROdB5zXs1kDSMpuZtNqwSDaZfdBkD5ckHUGtM19YM/rhOp0n4GsW8NoyvH?=
 =?iso-8859-1?Q?5O96jsrr+sA2HU8fHIL/f0NOkfMKWbfSzuJugxHf3cHlphhsm4BMYAxKVE?=
 =?iso-8859-1?Q?rNCi97FIqZXtLmW1kSnWfvI0ar5XXqv5PswbfykrZZBvQ+aik132At/8+P?=
 =?iso-8859-1?Q?UNf0pvXEDP0TgvI6GDW105kXHRkFAGRZI/ckYQpGVUdSG4v+TsLOytGvvl?=
 =?iso-8859-1?Q?160nmzua8aCllI7SsMEOJ4T6Ut/0UvK5TEaEPWvUVDyO9ZywvctLsiMxXY?=
 =?iso-8859-1?Q?GTyiuWUV1aUNyzYedwb0HYN/wqLONCqKNSoDjPjmhJE+9Ll4Y6WP7BN6jU?=
 =?iso-8859-1?Q?+Odl2JeKnMZK/KimVfkOYtOZPbP6tgbhb8y8YGbATf+19V+cuKRegcCfao?=
 =?iso-8859-1?Q?33UUOMgITRrwr4E7gWfsrx1zJqjERT6G8padF3IAu2FFIf+XALTamRVsd7?=
 =?iso-8859-1?Q?7lB/e1U8NeaqruPYZdplho8PY/LKkGLt/MBE07yg2VFlwfiGJOZtK6VNbz?=
 =?iso-8859-1?Q?DUzi+9KkGk++t69hphIpu+X2x+4+C2UnLEaLI9Y5I973AUWorwxZ5owowd?=
 =?iso-8859-1?Q?blKkkrmbblLe6KUCK4V8YWc9Gmya/x0NEmeFe8J1Gpi0CRG2JDGVGDk5BJ?=
 =?iso-8859-1?Q?AMwKtjgQ9j4ZH9vI3f+gzUAPgy8syXY0iBo1VT3422bStOAgpgKSlo1Fhe?=
 =?iso-8859-1?Q?9YUTf7rvAFhWUJu6VyRCTX/2/DbRdHSng833zDk7xC5iUVrj+A9UNUAG13?=
 =?iso-8859-1?Q?uXAr1ZTFCiF/MLBeAx6i87VFPnbslRQ4Xw3tnolHOQfbe10Kftkr7S/5lR?=
 =?iso-8859-1?Q?yPJkfyBhx7tjBXE7yNAPROFRFGo5OSD9o7OKfiiKF3a+bsWrzIotdgdAsO?=
 =?iso-8859-1?Q?bHUvh9PppE+oXvNpyvT9us5+AEwXrTY5nq4bDpApy1gXqIyjY9m3MSUULi?=
 =?iso-8859-1?Q?uCqa9Li+96qJgXQNynr0bkkJOSspEowSiUQESoI0RsQwZvbYJQMbYUxToY?=
 =?iso-8859-1?Q?cS4t2s6J/hPGzkgHV3vSc1DdIc4mPA1aXpcqOzTnH+r3Mhd4m666kNyypS?=
 =?iso-8859-1?Q?EQNUokGa0l3BopITirFznwse63895ps2nc6EITRLtmq7L3dMjwHvWZh21d?=
 =?iso-8859-1?Q?yWkaFta6ifRTpaBsxBxfeMnDXN5eLULAtZYDMddoyLzj8sOXgoGHlPvXFF?=
 =?iso-8859-1?Q?ln5hC/HX77ywnJJFZNv3T3x7FvS7d5QldBfrd1tvFE754MDWi7C6J2l34g?=
 =?iso-8859-1?Q?OjZ7R/x5erUpVhqukoA=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ac2c4d8e-cf70-4467-0cfa-08d9a9ec044f
X-MS-Exchange-CrossTenant-AuthSource: BYAPR10MB2999.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2021 17:02:20.1979
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ZseFaSzbmM8gaUIFz0aLozyiGrVluIPWCxko7gwBG7dNYls6uaFFVOIu0NkMrywBLg9VO2rrQWYYD4U6PUB4Ng==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB3399
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10171 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 mlxscore=0
 phishscore=0 bulkscore=0 mlxlogscore=999 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111170078
X-Proofpoint-GUID: zVYld7jJzNklWawAJofttbMa1vYSgYyc
X-Proofpoint-ORIG-GUID: zVYld7jJzNklWawAJofttbMa1vYSgYyc
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On Wed, Nov 17, 2021 at 09:51:25AM +0200, Jarkko Sakkinen wrote:
> On Wed, 2021-11-17 at 09:50 +0200, Jarkko Sakkinen wrote:
> > On Tue, 2021-11-16 at 11:39 -0500, Konrad Rzeszutek Wilk wrote:
> > > On Tue, Nov 16, 2021 at 06:24:52PM +0200, Jarkko Sakkinen wrote:
> > > > On Tue, 2021-11-16 at 11:18 -0500, Konrad Rzeszutek Wilk wrote:
> > > > > > > I have included? a link to the mokutil [5] changes I have made to support 
> > > > > > > this new functionality.? The shim changes have now been accepted
> > > > > > > upstream [6].
> > > > > 
> > > > > ..snip..
> > > > > > > [6] https://github.com/rhboot/shim/commit/4e513405b4f1641710115780d19dcec130c5208f
> > > > > 
> > > > > ..snip..
> > > > > > 
> > > > > > Does shim have the necessary features in a release?
> > > > > 
> > > > > Hi!
> > > > > 
> > > > > It has been accepted in the upstream shim. If you are looking
> > > > > for a distribution having rolled out a shim with this feature (so signed
> > > > > by MSF) I fear that distributions are not that fast with shim releases.
> > ???????? ~~~
> > 
> > Should that be MS, or what does MSF mean?

Microsoft :-)

> > 
> > > > > 
> > > > > Also these:
> > > > > https://github.com/rhboot/shim/pulls
> > > > > https://github.com/rhboot/shim/issues
> > > > > 
> > > > > do mean some extra work would need to go in before an official
> > > > > release is cut.
> > > > > 
> > > > > Hope this helps?
> > > > 
> > > > Yes. I'll hold with this up until there is an official release. Thank you.
> > > 
> > > Not sure I understand - but what are the concerns you have with shim
> > > code that has been accepted?
> > 
> > Maybe my concern is that none of the patches have a tested-by?
> > 
> > Probably would be easier to get a test coverage, e.g. for people like
> > me who do not even know how to self-compile Shim, how to setup user
> > space using the product and so forth.
>         ~~~~~~~~~~~~~~~~~
> 
> for the end product

<nods> That makes total sense. Thanks for the explanation, let me double
check whether

https://github.com/rhboot/shim/blob/main/BUILDING

is still correct.
> 
> /Jarkko
> 
> 
>