From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 04/17] integrity: Do not allow machine keyring updates following init
Date:   Tue, 23 Nov 2021 23:41:11 -0500
Message-Id: <20211124044124.998170-5-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?AlOX9FNJ6ys90aHOl8f/6e2OWD4dCZgbCqWE9En/lSfZmZYxE+txRYJzAIRl?=
 =?us-ascii?Q?M8S+/SIXCYwrkxDw0OJ4hALVBy4glVY2GLgpE29a7HiN2LtUz9Z2c38CcsH7?=
 =?us-ascii?Q?ZjVOlUe0QrOAHU2CJ0GYDygvhfvNK4R+OTGOP+ctSsnb7dEvFetB9GsS4RRM?=
 =?us-ascii?Q?X2hS9wt6+5NI6h7NLUDeHjQuXtbrXrlxaLsmomICpn/d+/7pOkjzH7UUTr4u?=
 =?us-ascii?Q?Pl/U2G7h017ZTGq5gc+HF39r9wv1zo8V1bu1BGxRKh6NdzERtKZ/l1WT2dWI?=
 =?us-ascii?Q?3JJ6+Y4SsNxAC5V8BksiJdJQgiRvMGdtfB9vstTo/HvYNGOUPDC87r8EWFjp?=
 =?us-ascii?Q?MCdMtfg/p2bQXyDjnE0EamcudAAzMKWxN1Vx0a7NBc28dEJJ+KtWQeV/LCyz?=
 =?us-ascii?Q?WeDVJQyyPqPNM/xWt4gXrC8ENxT6iFbKQlwHY99swB91Vfx/qPvcUdJI8rKb?=
 =?us-ascii?Q?nOymA2gluf1G9j8rIAg9cPOqg5gkcDOtwtI4Xou5Lfen3USaMt2praQKR5RR?=
 =?us-ascii?Q?QYcQ8TrvcdfOgn8or4LCDuII9MvGRZcLP4RMDe+rQcUTbD3Fk2DcDTV4Q0r5?=
 =?us-ascii?Q?SE/BKHZNsu2S0ruwVlCOUv9gyq+Lnm2Ba3xlWR30avFF9rDguRtVf9r5/3Xy?=
 =?us-ascii?Q?clpe2KU2nK/v6dANMlNuLA3d0l2ToEJCH+M/xnj/Q6Mo23zbVN5p64gPdxpW?=
 =?us-ascii?Q?7LxYc9ogria0xL0X2Iirg0dwVBwYKeach2OQ96wHN26rhcg4SH5ZmBCi1GEt?=
 =?us-ascii?Q?43HeK8O6OaD3a/re9uluvkfLuo1jQnXTOoblkt01VdWcEYl3JJtYDOiEgxSj?=
 =?us-ascii?Q?MgJ2FrqCGs1c+d0ObP1uozSS+OxQdaXvyTi8TGhCSkSgJv6Bq5KAJcRzIV7R?=
 =?us-ascii?Q?xvpS0I5wej9foV6P3N12Abcc6FTMwJFyaHMnKGRUPJ8VXrNahqdPqXcSXHRH?=
 =?us-ascii?Q?WSETNkKE07mJLBgvhBis46i71IpXp9V4GyS5vpWSs7mR9Tj6vPYevVU7/vcf?=
 =?us-ascii?Q?ALzNUgF1vCcO1Zj2FW+D6tsk/0ozOVlEzb8tJ715AwX+1JDaMRfz7nQ2HYX1?=
 =?us-ascii?Q?7wPRvq0YoDTBYnMLs+qcIaMUtLPp6kXJoIqhSRX+d4rCnhNmhYfR2mXuvPAp?=
 =?us-ascii?Q?xKFhMVlANTdimG1tidTETK58YtGb+LdzpTUTHgvRQo088IrRgdBvBqwS8Zg0?=
 =?us-ascii?Q?JmzvJtPFVfmeTy5GJhr2JmD0KaDeb02Aw7FckQzB973D9KxKLALhLWEBhSXX?=
 =?us-ascii?Q?0jWylA2zIcSQPUwBABxpshev60aqejP/87X8tHffvL+pqssqTrem69g0od1J?=
 =?us-ascii?Q?IFBmUyPyovDW0hQTe5a/cTnm4XeldoVvM5jQdDUCL21SfkBoOxKffYILZyaU?=
 =?us-ascii?Q?Gzl30e2DxoNX3LZ2IM9oSN7JuT2tAEJn38YwViYPTW9dQK/tdeA39egiMzWI?=
 =?us-ascii?Q?v1wKnTQi1IDYh3iTOWM9hntTM8cAKBmBDYr1wZkTlTGlAGIs98Gkx353+ZYb?=
 =?us-ascii?Q?m0mAK1i33qRbeUlW9i2s+gd99lt2pgOGGFN9b8PQFLvxzDr5eokTW2yrDx34?=
 =?us-ascii?Q?J7PR15aBDmkITSGAqFWBhYZnPSieIhOvUh9HK/BMdLmztKFCRZOr/QCY56fw?=
 =?us-ascii?Q?REnEU8N2yxiHNLXno0QpH/XKDKyfbZBuhuwfKSdHvqAnajkCN49UIBoPI3Em?=
 =?us-ascii?Q?dQw9oQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1bac9187-fa2e-4dfa-8932-08d9af04c30c
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:03.9143
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 7RIuUa9wdWE/j65m4vio5p/uzND1iHqk1iF9m2acv8Nq/mn3SAnmF2FHpbqexe6fSggm2TauMh3jGPv/SSTD2Ov5QO3axKJlvPTEjANwLi4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 adultscore=0 spamscore=0
 bulkscore=0 suspectscore=0 mlxscore=0 mlxlogscore=999 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-GUID: Pp4dHcrNsWgZ7Vm1EnoVOb_CInAOmdRT
X-Proofpoint-ORIG-GUID: Pp4dHcrNsWgZ7Vm1EnoVOb_CInAOmdRT
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

The machine keyring is setup during init.  No additional keys should be
allowed to be added afterwards.  Leave the permission as read only.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
v2: Initial version
v4: Unmodified from v2
v5: Rename to machine keyring
v6: Add additional comment (suggested by Jarkko)
v7: Unmodified from v6
v8: Code unmodified from v7 added Mimi's Reviewed-by
---
 security/integrity/digsig.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 8c315be8ad99..910fe29a5037 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -140,7 +140,13 @@ int __init integrity_init_keyring(const unsigned int id)
 		return -ENOMEM;
 
 	restriction->check = restrict_link_to_ima;
-	perm |= KEY_USR_WRITE;
+
+	/*
+	 * No additional keys shall be allowed to load into the machine
+	 * keyring following init
+	 */
+	if (id != INTEGRITY_KEYRING_MACHINE)
+		perm |= KEY_USR_WRITE;
 
 out:
 	return __integrity_init_keyring(id, perm, restriction);
-- 
2.18.4