From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 07/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
Date:   Tue, 23 Nov 2021 23:41:14 -0500
Message-Id: <20211124044124.998170-8-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?IWYt5K5JgM8aM4KA/1SIqB0VZzVJMyqO3fWncgzVu5U7AMNmjKlFEtYvzzst?=
 =?us-ascii?Q?mu9yKl6xUSLodGpRPPM+6SE1KNB17Xrn931+pcRBmULgh3AdVBX64wLRPrxp?=
 =?us-ascii?Q?kPcItUegxaP+PE2pzu7j0V+ogu4fx0OBpq6cL4zRfbUjj8jJ/+JAhON7NDX8?=
 =?us-ascii?Q?27xiWbDIPIrFcfHOtIqrfLjpv1Gjm71tfDcviy9JSunByGhOeRM0/bICIZ8o?=
 =?us-ascii?Q?nE3ak8Py5xvg0qtlI+WdnSxdGYmtxCccH/1AVCvhG4ouL9W/XW7LM5vb0Eob?=
 =?us-ascii?Q?ZqxYKCIgq3JcNmgNaM7pEoxytMh3TQwOrE20IoDmHh8NHW2+IlrU2UxVoq7S?=
 =?us-ascii?Q?Wk6VoUDzoT/XiBG6zofVOqQkYyLl9M+bYnNwXFjvbBcyzzM4JnYxJA7Wrv7n?=
 =?us-ascii?Q?SDjcNZebPlG8olrmBDdjY76JXnCpWWPRsHB3svz58v944mJn3z8CXXLLGweu?=
 =?us-ascii?Q?XaWzV1e5nXY6tan1WFopztSREsyeo+iPHp9aqPh581RSOJnynqSKNOjfOVnk?=
 =?us-ascii?Q?9i5VhmfLcqYjtuqUvCUp3Wn9LuYLaIjEmA/KaSVjAKPm/JEzavW6j2TST4Je?=
 =?us-ascii?Q?JWn51j3LxX+jJY+Z1437H1TCgec6j0/EY/rsxdMWYE+CCRkvpB0UMr3OZIm6?=
 =?us-ascii?Q?ss1TMYRIDJC1adl8DEFpi15rU5VR/7lpmaIKYLsI4YcvSJEH7VHYr+4/aqZV?=
 =?us-ascii?Q?9Usu3txnqwyu/7XBRlTSDH+2PRsTlQLDloKP+/Y/j61Dtj4pr4iKKGDygOgC?=
 =?us-ascii?Q?wwPgvs9goEfTd6BXWfqKZyCFBUD2Eab1OyEfp/vlLNZoxb++3s19nLADjAOU?=
 =?us-ascii?Q?KcMAyMbquof4TuPrF+iOFk0ns2BRyLc8eGCWqwYpLX3oZFMPwUyc0/CKpqZq?=
 =?us-ascii?Q?5LrW6NN51yRxJ2A/QExRGad7l36aj8xwQkx6KErMs4btrPEcTY69AhhmETsM?=
 =?us-ascii?Q?1QsRxgcy31LACJD8GWhf4C/Cr69E2S0cW8Z94ezSg3agc5w2dMrTo3Qbdc9h?=
 =?us-ascii?Q?M5wiVyp1y066QMeKNy58lgiz/uLENF4pTCLdEEuKmUWI+BlPshRuqBeHIE0S?=
 =?us-ascii?Q?OA49qsLX6BelGgz/n1c0LCAiEHvSRfeIm5IACr97dMmsYpnWHPJ8lr5FtWhz?=
 =?us-ascii?Q?zQJKyX2WukyyWWkQ0zu1nAOlvEuJkaZ9vOwPQBzFEMDcQuoWjOHkJ+cjD4Va?=
 =?us-ascii?Q?YHr5g/n+gfKZBY0vwH4UzRbtUpwLcgih6iE2A54aEFbxdXqX5at3dvv5ELGv?=
 =?us-ascii?Q?2l8wzy/wyQpeG98vfrK8xNmEElAgK6JUbZPYfDpj1hxfwq50Vp5l/AiVpAS0?=
 =?us-ascii?Q?1DyXUbHrg9+009CxpHvgO3GvEb4L68/8gf18CPdDtQl2VjH6hXdq76JXc8Js?=
 =?us-ascii?Q?mDsct4vMkufYUrKpqs27CsAZNs4e3rckwNgjLGN5mc75HnJNY2HV/ahv8u5+?=
 =?us-ascii?Q?+t5ThctghAYRtzTNvgOb/cl+B+w8rifPs76tBzmhpGmlPEID+c0fqXhrVR25?=
 =?us-ascii?Q?fN2zHhWg1R/3lO+QQrmS8tbJTG2Ic8wSOGCvhBDIkXY4QApm3n9/UgquJ680?=
 =?us-ascii?Q?8xFiOl7quZrMu8bqyxqu5Qq4EqQzgPVIDsgbkSZtIUprVzxde2U7KJcIjEDQ?=
 =?us-ascii?Q?h7s4NTaGoFK8fiXs3GJ8Qfg/yaIycg/yYSXb6sqfNcy+c5N0+JA8/9SRg8QV?=
 =?us-ascii?Q?izsjfg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9fe09eab-3884-43e5-7865-08d9af04c892
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:13.1250
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 9aAc2tpCWHUMZeVb4vvZ5fjIL6mPZzdoUY06jv4Kx8Q3RIyvf442Y1qH6q+3VFSwkKv5n+hO1lfKOXRyBnEwZEbITXcGN83js9AiuAM3KFo=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0
 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-ORIG-GUID: 5xYJVHHetiEcw9BmYQgHpbLMfBbn8A2i
X-Proofpoint-GUID: 5xYJVHHetiEcw9BmYQgHpbLMfBbn8A2i
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Set the restriction check for INTEGRITY_KEYRING_MACHINE keys to
restrict_link_by_ca.  This will only allow CA keys into the machine
keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v1: Initial version
v2: Added !IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING check so mok
    keyring gets created even when it isn't enabled
v3: Rename restrict_link_by_system_trusted_or_ca to restrict_link_by_ca
v4: removed unnecessary restriction->check set
v5: Rename to machine keyring
v6: split line over 80 char (suggested by Mimi)
v8: Unmodified from v6
---
 security/integrity/digsig.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index 910fe29a5037..e7dfc55a7c55 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -132,14 +132,18 @@ int __init integrity_init_keyring(const unsigned int id)
 		goto out;
 	}
 
-	if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING))
+	if (!IS_ENABLED(CONFIG_INTEGRITY_TRUSTED_KEYRING) &&
+	    id != INTEGRITY_KEYRING_MACHINE)
 		return 0;
 
 	restriction = kzalloc(sizeof(struct key_restriction), GFP_KERNEL);
 	if (!restriction)
 		return -ENOMEM;
 
-	restriction->check = restrict_link_to_ima;
+	if (id == INTEGRITY_KEYRING_MACHINE)
+		restriction->check = restrict_link_by_ca;
+	else
+		restriction->check = restrict_link_to_ima;
 
 	/*
 	 * No additional keys shall be allowed to load into the machine
-- 
2.18.4