From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 12/17] KEYS: integrity: change link restriction to trust the machine keyring
Date:   Tue, 23 Nov 2021 23:41:19 -0500
Message-Id: <20211124044124.998170-13-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+bKYSUPR3J1wpXf6OFFpXPC4mJPWlJc0/lo12ZAIi/c+YvTUB1Z1IUossAqU?=
 =?us-ascii?Q?lqnwxL17eF+Q+TjSqY+3krX8Dh3FdY/uRMOT7PFp0JNbzSfky3DIMyu6SG/z?=
 =?us-ascii?Q?6a/bOB3fgvsNj0CXjxgg5Y98uOSdCIWnT/px7IcKZ5erAu7ae8QRWe4R0mHB?=
 =?us-ascii?Q?WQ9MsKTA0Rg06JbS0b+n3vZfIOxaR6MGJAM37OiznxjdtOZgYSrWTkyiOSTm?=
 =?us-ascii?Q?r8/rctHeN/5htKBYMmTOevA6dGKGsoWFGf4k2VLMTKkfmXyLFukKBJPw0gVy?=
 =?us-ascii?Q?Dn862NbnsGKhPlBjfCcHMHSfNcXSI9vIG2soHbOtmqdIN5PxnUi2r0DmnEK4?=
 =?us-ascii?Q?X9hTTg7nsAEYsEEe1hQonWmH82M+xogfgPI1Y8fUg5zQ4sWEOuJDVJP0Thxb?=
 =?us-ascii?Q?FipfZO3toxXjGjBtrFHwhfxCIvhS+8A1PVQ9kFSTL112HRSHR/PhIBa8Pn+Q?=
 =?us-ascii?Q?LKnTbwLDrpuoddarQSREWPE1k6ChorjqUote0GswFcDx9brG/s90f7/1/W34?=
 =?us-ascii?Q?fe+Nel63x7CrurnxO+5zWSHWqCsVaV/ipUUHldw1+uQIAZAGezqXy37wtpSb?=
 =?us-ascii?Q?qVKJdgwX7Drvug+IhfN+d7Wd/UAqYIS9WZyvKF91+tbIRgccZTm6zoKJYLiB?=
 =?us-ascii?Q?p8tYfkwUJ05qdo4w/rh6qccmYEF58GJloEjvKzr6C2NfIASuoMnXCG/aNZjS?=
 =?us-ascii?Q?UqPgnYQNz8IWVGXfNThGUmzqRlQYBo52YKIlD7Wj7kE0SIlRJ5mBcDDkmwm4?=
 =?us-ascii?Q?GqS5mZuphL25Kivl5gNUfSTalTjAevjl2g4W9CwgIfzvtZN3dahvZmAUmEja?=
 =?us-ascii?Q?CP2PgYiPHbvVScei5XmbIamjgqn4Wcd1oQwT3lPca3IUeVKa/n54lwUUNcEp?=
 =?us-ascii?Q?9/QjfWmS7ieeBG7QPoZ0+D251VH02msYtL0mDEmCqVdWSjOTs/KW+niI0RpX?=
 =?us-ascii?Q?wpiMl+jhJenkYs68fUu7nD9IY2n30955OSxhXrhDRG0hHuFfcemVjoZ7y5J0?=
 =?us-ascii?Q?OfOu9NH30QvBrzaoJKoU3DNoJF9QAHMBxNQmksWnPWRYUX9JMULcf4b2jBER?=
 =?us-ascii?Q?yrPRyYyAERGRl/5cE9Se83Xur+sg97R0gVGOifZgKSHr+ahzBY2TyfLYhMvo?=
 =?us-ascii?Q?Q4WEkuXw3USGxcJu+0RZNkOhtr1jK6xnkN9MPHt/f8x5ZasteJW1sVjohfca?=
 =?us-ascii?Q?VfRWIMxi6FNO9GjuCSH0/ZeBRfA83F8S0mSy79dwAvdike4S0krq0UPdLl4W?=
 =?us-ascii?Q?mXzGgx80TjPqpG+oaQPotiU0QHB+0fDygic6P9V29sBmcaudkUttl6juYCF2?=
 =?us-ascii?Q?wFG9k4bEu9WTmvOprfrChFeTOD/lqaCfUJtd0xvvEo3Qr0uWAazqv8IlhPOQ?=
 =?us-ascii?Q?5tGuM5WnPK/htZlwp69HJ9KeI4RwRRpD/BNeCPcKVJ5mdAmP/vc+oaUj8VTm?=
 =?us-ascii?Q?HU3iLkwHUK2uUNiKCH/DcO8diB1Smr43++uPL0jXcoVEao442bN0UzzpgU1Q?=
 =?us-ascii?Q?2KuayNA//sDLmTHNGEfdNMupd3yYslIB5/IhyvLjIIM9hExJG0K5M5W1tyWt?=
 =?us-ascii?Q?PUCv4NymHhAm7OU13HubeeKey3n6aAKDZv6jZh7a0H6WEL4pg5eAq64sktQ+?=
 =?us-ascii?Q?9Yoh6634OXopY1iQVx06l5I5QWLjgNDaEYZg+xN38qSMQDq5x3X596ajJOwj?=
 =?us-ascii?Q?AP5Nag=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 88512a71-2208-47ca-7959-08d9af04d134
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:27.6293
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: elI2YMwJMB9iupqwmESWJ0o56qMG1B3eRXL91zjlq8/O5TO3mzZIMDA7sPM1BdPcS/k1uuiaqATDiTE5KJwpLEknUeEPCVBdY9Jgope/fnA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0
 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-GUID: zZ5l-7G7ta7hAKK0aKHgEjdDQ79EjkZ8
X-Proofpoint-ORIG-GUID: zZ5l-7G7ta7hAKK0aKHgEjdDQ79EjkZ8
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

With the introduction of the machine keyring, the end-user may choose to
trust Machine Owner Keys (MOK) within the kernel. If they have chosen to
trust them, the .machine keyring will contain these keys.  If not, the
machine keyring will always be empty.  Update the restriction check to
allow the secondary trusted keyring and ima keyring to also trust
machine keys.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
v4: Initial version (consolidated two previous patches)
v5: Rename to machine keyring
v6: Account for restriction being renamed earlier
v7: Unmodified from v6
v8: Code unmodified from v7 added Mimi's Reviewed-by
---
 certs/system_keyring.c      | 5 ++++-
 security/integrity/digsig.c | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 8a2fd1dc15db..07f410918e62 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -89,7 +89,10 @@ static __init struct key_restriction *get_secondary_restriction(void)
 	if (!restriction)
 		panic("Can't allocate secondary trusted keyring restriction\n");
 
-	restriction->check = restrict_link_by_builtin_and_secondary_trusted;
+	if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
+		restriction->check = restrict_link_by_builtin_secondary_and_machine;
+	else
+		restriction->check = restrict_link_by_builtin_and_secondary_trusted;
 
 	return restriction;
 }
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c
index e7dfc55a7c55..74f73f7cc4fe 100644
--- a/security/integrity/digsig.c
+++ b/security/integrity/digsig.c
@@ -34,7 +34,11 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = {
 };
 
 #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+#define restrict_link_to_ima restrict_link_by_builtin_secondary_and_machine
+#else
 #define restrict_link_to_ima restrict_link_by_builtin_and_secondary_trusted
+#endif
 #else
 #define restrict_link_to_ima restrict_link_by_builtin_trusted
 #endif
-- 
2.18.4