From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
        zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: [PATCH v8 10/17] KEYS: add a reference to machine keyring
Date:   Tue, 23 Nov 2021 23:41:17 -0500
Message-Id: <20211124044124.998170-11-eric.snowberg@oracle.com>
In-Reply-To: <20211124044124.998170-1-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?PVtHUw5Un1RBCQYNqnJOPEwZ8iuMP0SXpXlL2VJAHnvQ8cl9rCXGIOfGCfTq?=
 =?us-ascii?Q?UAYzfmDdOJZDjgqD/rZH2mMt+JIA540FDF6EF9K+pECbambFSVmWBT1Kerfo?=
 =?us-ascii?Q?pZ62JN45Hf5DqOCFyxsGB5goTgXUSi1aN9VKP4tsct833zRfHxHPdiO1fYjS?=
 =?us-ascii?Q?f+rhx+LGe67iVELecaulbJ34oeA+g+Ud6XphDShrermBPl3r5VLXXmeT6hMB?=
 =?us-ascii?Q?/mCh2kBuPt21Gm1tZaWWu/HV5V4yQoL014iOArm/4A0M4dHVHrwtrkfYNvD6?=
 =?us-ascii?Q?cTwN3HE5ephHZxgtgw7uhRNxRBukL1bqsPTvUgZG2rNw185wHdPy6g3EBAA5?=
 =?us-ascii?Q?pUPPUA7pejZEl7oURkRGVSPV9Y8qch5UdwSH42t0CvYuFZQQUP/EUFYESNhm?=
 =?us-ascii?Q?OQkcksnT+7/jknsykn59AFjibxLdiaxAOmSt8DqmJTDwHDdhqJifjw8e6g7w?=
 =?us-ascii?Q?+6bDeZ5u3+C7bmpYsCAyLDa3r6H/XICnKvUxmngEeTTO/bAXVvuA8RSCbp0n?=
 =?us-ascii?Q?Ce3pFCBCODdVRz4lgmnFGUItfHbZeFUWORaAXeWJfX41drIkA+PYWiX+TIeh?=
 =?us-ascii?Q?Kow8Rvxbyum7DmkGy+1pEcT21tdmPmGOjl/cGCJ8ftaISkrizRtyZNotJbrw?=
 =?us-ascii?Q?TgV+k6PxTTq7sxkHUDDCBE883k4JkIyctcWcZr27YAr2zb0+MgH5mVmjg0JL?=
 =?us-ascii?Q?FAuN+8ydg9Z29WS+1MWUr6+2ACvq1eEraqW4LFzfF8fgHrleP9rJRUmdB7Dx?=
 =?us-ascii?Q?nxHkb0Yz2JMf6I6WGaqKiCBQaJwAzz6Zv5Gzax83lnKEFOR7qogcHomvu3XD?=
 =?us-ascii?Q?UM4Q/n0A+ql8pcDCjrGFI94KnoE0hat8lBfTJOqKj+KUwyqddRaibP3p24Lm?=
 =?us-ascii?Q?Nk0QKMhn5mb+3LfmR9WNmaz/BgxcqeSz0y6xyvKQP5ulsMvPZ+m1/FuhcLN8?=
 =?us-ascii?Q?lEtWTCZVwS6o9aLs6El5z212MvxSwda15vYSVZlDAQ99E0TjDvhZ/YoRVw8h?=
 =?us-ascii?Q?sfNTj24i/Ad4v5AMnizUaG2IMK0CoiHTexfjNFcLurmXjYn0o8U7aKuujuhO?=
 =?us-ascii?Q?VhyV8+DE0BcQLjM0QfZe+Jw97vwJS6G72m7D/gsKFpWix8Vczt4hG+BSVfya?=
 =?us-ascii?Q?gS0Pft0fjE7yRLi4fZeqVA2ohQbksnuIdr0amarzkXZxCBokJSHQjgFFyb/a?=
 =?us-ascii?Q?vYCJCWETIyrNuqUyHCDiskPQ/3wtnrrSa3UrFii553mLzThilPoygShGWbMX?=
 =?us-ascii?Q?NIM4DNsw5moTOAoL135X2bpx2wnResYEzwUe6PWfI0Cmj5XmZdhrVClsGQe8?=
 =?us-ascii?Q?8XM9GPH8Qsbkd/xqnbbqQOvbM//1UFz6+wQaKg/b+PUNde4bcwOuK3lOo+5i?=
 =?us-ascii?Q?gnbshkrj7Iu6k7ulup5VDdOkcMsTyyUhzCpIKLaM+bw+sXaOKIbTOsBT5CGb?=
 =?us-ascii?Q?qr6vpQnDc46Zkp5u1nAf3rePp95P/+b53OGfHhj4tBZyP9ZW0KVcCoKQ+Vv0?=
 =?us-ascii?Q?+UtuF/sMIJSAfu7aGQZTKZIEAuC5EMi5QVPrULG6AovgOZ/5uMI1m59S+Glp?=
 =?us-ascii?Q?fz/sReQzcsazDKbqj6EwDM7el1NTvCFOEy5ljIhG/5Re7Bvqn0k+Gjg3fjVE?=
 =?us-ascii?Q?7VwBAmR7N4C2x3qhx0GR+Rr34h7H3Ycg/ZyOrD09D58+i1n9+CLnriUSXm3m?=
 =?us-ascii?Q?EZE5JQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5aa295e1-450a-481a-1a02-08d9af04cdc9
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Nov 2021 04:42:21.8796
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: /hYUpqsGdGyM5VEIowaRxVL6HWfCtUxGfPgzpFzbUTLswnDoYKsYnoooG7PUNb6kA2fh714w4tIzLHxExNeggZJOJsTkOhq2lQ9kljgyHEw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR10MB3957
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10177 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxscore=0 spamscore=0
 mlxlogscore=999 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111240026
X-Proofpoint-ORIG-GUID: h659-a8sXTh92LbCVKQOpcaqE-iF68h7
X-Proofpoint-GUID: h659-a8sXTh92LbCVKQOpcaqE-iF68h7
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

Expose the .machine keyring created in integrity code by adding
a reference.  This makes the machine keyring accessible for keyring
restrictions in the future.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v2: Initial version
v3: set_mok_trusted_keys only available when secondary is enabled
v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING
v5: Rename to machine keyring
v8: Unmodified from v5
---
 certs/system_keyring.c        | 9 +++++++++
 include/keys/system_keyring.h | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 8f1f87579819..bc7e44fc82c2 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
 static struct key *secondary_trusted_keys;
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+static struct key *machine_trusted_keys;
+#endif
 #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
 static struct key *platform_trusted_keys;
 #endif
@@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void)
 	return restriction;
 }
 #endif
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+void __init set_machine_trusted_keys(struct key *keyring)
+{
+	machine_trusted_keys = keyring;
+}
+#endif
 
 /*
  * Create the trusted keyrings
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 6acd3cf13a18..98c9b10cdc17 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
 #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
 #endif
 
+#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
+extern void __init set_machine_trusted_keys(struct key *keyring);
+#else
+static inline void __init set_machine_trusted_keys(struct key *keyring)
+{
+}
+#endif
+
 extern struct pkcs7_message *pkcs7;
 #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
 extern int mark_hash_blacklisted(const char *hash);
-- 
2.18.4