From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 14/17] KEYS: link machine trusted keys to secondary_trusted_keys
Date:   Tue, 23 Nov 2021 23:41:21 -0500
Message-Id: <20211124044124.998170-15-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?CUwxmUvyC3BiBp0z2P4h7SiKBS773hXL5xRmepH200SK4PTLI9u5lL6k1ZT1?=
 =?us-ascii?Q?A9bexjlufIvWDUNGFnS0tzOvzGDmzgSitL2yWUJaHGs/4yOovZeMb5irGSJe?=
 =?us-ascii?Q?rqeMPwvM3gyK8GG2BNfLUNuuZ8GX35FFwy/y6+MujAd2XqKH4H/geyKVph7r?=
 =?us-ascii?Q?+WTxfd5akSuNBak3tfGaTphYeCNFxiDf2csQQtzDY/PT6PCRLRHtr4XfOEt3?=
 =?us-ascii?Q?Qvw/YsYz64/h/PApuYTbOu1m1yivA10xJZrLIX+KK766a6zDnGHeSZzc0X9t?=
 =?us-ascii?Q?RToBOt4+BbhHBfXcg3CIzUTUy7xNdSSOe3NGpQZVs3ibrssdZA0mGMrDQGAZ?=
 =?us-ascii?Q?NMfofMXzYpLHaeb2UVHlVRKkRSE/Mu84RPOCGs9m1w5ERT0YiJkvogKDBL4E?=
 =?us-ascii?Q?U1r2G+bbOGw0JRdmq8RibDZtSxI9TXbl+GmCpwOLeXO/69JxlxfuU5YTM0kP?=
 =?us-ascii?Q?MlPL27Ax/++E20jbtW001jVJo2QwMPFd446WgnilyHQTWaWomMd4lnSJvd6H?=
 =?us-ascii?Q?g7RaUw++CbyyfawXmEdg7Yxu5H83Vg04AYIJt0k3a/N2FQIJ15N/dfWBS1Hn?=
 =?us-ascii?Q?3iO6vfD6WKXtYosu2Ql/n9OE3dPADDLM9puO7AgWZN1GxpFiXsFaqbYaoBAe?=
 =?us-ascii?Q?18Y5Wnu9/cIwZGGS1J8lUvi+2+BfuUot6EC11ySGFwBDfCtYDz74iK2UDDmT?=
 =?us-ascii?Q?76D0JLftQyB0Oo+zLDIQaUz3G0c5u3lQ3gnJm/XfIEv5WCBzRPHH3E/3/eAB?=
 =?us-ascii?Q?fn9UNjOKyJPP00EN6/duGZdt3L+yXYHB8OPcO8X0dTYaSrIKi2v0LzvXVD+3?=
 =?us-ascii?Q?hxDeJvNuaY+gHVZIX/QQQ/6rZ+1NhrY6E9/jLJ/pdJ6GzzHKYk8yMeNba7Ub?=
 =?us-ascii?Q?tKNpGBddsFy5gKrFmclymmd9CpuRN2cS7+mPEvpySWcbP12LOSVWlYt7Qd5q?=
 =?us-ascii?Q?HimMN+pTSYysaldU/S1MWA1sxAVPPJigwrk8Fh7InbJYGGH5lwxyJI/t7xmN?=
 =?us-ascii?Q?K7ZV2VJMTFytoGwBprdewqHKSayGJ1bJQCljgPHMXQVVI9Ef2WGsqKUNqKwB?=
 =?us-ascii?Q?L/GsEPOtvLkLMWjucWwXjEIAgl2AVlP3NUB4CdWNeZERvRTwnevomP/Tgjvf?=
 =?us-ascii?Q?612V+6dOfmkeNKxc1ng0iPN7hfEG25/KrWCeq1+ZzeEohtqP6bUdubZfS5y+?=
 =?us-ascii?Q?/YkazDHNk+1MPt+dAFYMQh9FaSXZNNAPg4hkIyNQoajz7ugFurTno6028zUc?=
 =?us-ascii?Q?kQUUh4PTbkIpHz7EOB5/Ogp6BXeiS/QPttVPbHAjmK1wtKYYL7hIntcwNvGp?=
 =?us-ascii?Q?cpecygk6N+qM7+B0TGgNyAP7JInsxI+FQWNxZfj9KgeFpcNh5h7Ypb4SY5Oh?=
 =?us-ascii?Q?yo0d+8ZQXkg1viYbYQm/+jatHNbpLFwh/XzXpNi2ygI03eYt03E/6VNngD1A?=
 =?us-ascii?Q?FhUaznyuAu7hI61q/F2JIdLfMuW1Exm6SOWBQevAcLjmGKljujXxBCQepuGs?=
 =?us-ascii?Q?i+JeDwul/uGYOYT0ia8YYkPtDUFGe++NgYO8f0YmH3OlvE7ro79BP3gd3nNy?=
 =?us-ascii?Q?VEbKeN2Zrv0BFPCkz3FpD5pDttuV2taZACBg4zuYEUKVXy27+OIm52tNSrS/?=
 =?us-ascii?Q?/b7HxHxEMPzIO9QrGlkAKZSKwLku2i7F9B8H9nh7PmQuU6cdkzHGIfFZUAvM?=
 =?us-ascii?Q?gzERyQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 24923dc1-08f3-49ae-7a3d-08d9af04d53c
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:34.5062
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: SUpAPXTEHBbEG9vwX52HUTO/Xlr5ttJX9Gm6PsGMizskEc3eQznGQwtbHWlfcmNaslk/J52E33/urU7Nee6slpMeZ9w7VOChDUDK+JS5U/Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3894
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 malwarescore=0
 mlxlogscore=999 bulkscore=0 mlxscore=0 suspectscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-GUID: M2xTQeEWS3EmWVSzX1gspJpaIyx5J_mK
X-Proofpoint-ORIG-GUID: M2xTQeEWS3EmWVSzX1gspJpaIyx5J_mK
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Allow the .machine keyring to be linked to the secondary_trusted_keys.
After the link is created, keys contained in the .machine keyring will
automatically be searched when searching secondary_trusted_keys.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v3: Initial version
v4: Unmodified from v3
v5: Rename to machine keyring
v7: Unmodified from v5
v8: Change patch subject name, code unmodified from v7
---
 certs/system_keyring.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 07f410918e62..463f676857f0 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -101,6 +101,9 @@ static __init struct key_restriction *get_secondary_restriction(void)
 void __init set_machine_trusted_keys(struct key *keyring)
 {
 	machine_trusted_keys = keyring;
+
+	if (key_link(secondary_trusted_keys, machine_trusted_keys) < 0)
+		panic("Can't link (machine) trusted keyrings\n");
 }
 
 /**
-- 
2.18.4