Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Darren Kenny <darren.kenny@oracle.com>
To:     Eric Snowberg <eric.snowberg@oracle.com>, keyrings@vger.kernel.org,
        linux-integrity@vger.kernel.org, zohar@linux.ibm.com,
        dhowells@redhat.com, dwmw2@infradead.org,
        herbert@gondor.apana.org.au, davem@davemloft.net,
        jarkko@kernel.org, jmorris@namei.org, serge@hallyn.com
Cc:     eric.snowberg@oracle.com, keescook@chromium.org,
        torvalds@linux-foundation.org, weiyongjun1@huawei.com,
        nayna@linux.ibm.com, ebiggers@google.com, ardb@kernel.org,
        nramas@linux.microsoft.com, lszubowi@redhat.com, jason@zx2c4.com,
        linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org,
        James.Bottomley@HansenPartnership.com, pjones@redhat.com,
        konrad.wilk@oracle.com
Subject: Re: [PATCH v8 10/17] KEYS: add a reference to machine keyring
In-Reply-To: <20211124044124.998170-11-eric.snowberg@oracle.com>
References: <20211124044124.998170-1-eric.snowberg@oracle.com>
 <20211124044124.998170-11-eric.snowberg@oracle.com>
Date:   Mon, 14 Feb 2022 12:18:20 +0000
Message-ID: <m2o839tzeb.fsf@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?O9MpXWBNoqpf7Sz/Jtwwq0sje4MARdURCIJr/2qsfBLt+AQ5w6vsSdhIfIfP?=
 =?us-ascii?Q?5T9RQXcIdLGNw7qZJymXpq6pVInE6fdDxalP+gg7QF6n938z41+YkhX4iEJq?=
 =?us-ascii?Q?PWYJxIfk7pJJALAC8g4Teqlg8XbcEQ84ojTO1xM1QSgnMGhfKdekcvuR2CXg?=
 =?us-ascii?Q?g3NriStQbeY2QszSLJ/OQ7J72NseHsj9kg4w2vtnHCz33nLHNQGQxuKoGthm?=
 =?us-ascii?Q?7k7mzfQf8lmov5fUVjmWz5p+oMaygSbF1xqosD/tgcStNcQzBlxH9bY5KKm/?=
 =?us-ascii?Q?IHh2siPY9K0R9fG7KY9t7riQu1XSIUrlrxbiJpA5HIPDg0WyHCsr+0zjJBFu?=
 =?us-ascii?Q?Q0LXA7n5Rj+wpfHRRyGLdAVyRIWlzh/zxsxmyQQj4zix88jlb5eVi30Ix7ga?=
 =?us-ascii?Q?y5Iz88vA7KYvHrREavziNmsA66Iu+X3awTKoyXth9MlohUKchoe8YF1YQNpz?=
 =?us-ascii?Q?C4cmPO5d8YkCb2DWAsbcTxKndz31bvDjs9DFv0r3il7DHy9/kxTAYBJE4/mq?=
 =?us-ascii?Q?wBOpo3vsnZDZ1pix7Jb9X9jmsveO22i5U7Ixf0ysIXpnZUQB7Un5yfTwqAQk?=
 =?us-ascii?Q?ydge+2AL9dSgb5yBuiO2PmnUUXUOgT9UeeGUZaLW/o8BAK+U5M5qs+TGY0QB?=
 =?us-ascii?Q?HQ1qTDCJPCorB0sMTOC1tLaua8eNLzlMW/sk8jTevEnnr9nPuBuCUCQuEb7a?=
 =?us-ascii?Q?iQ+MPxERoUWvHqil7l5sEAAlazcBy8LVjGlUC0qVGTsy+OWv5MvjTuJ+3pfl?=
 =?us-ascii?Q?LEaSyPRanVdB/2+X4ascQKGsEJioZaJZ4KFYfZdcQ6zSGEx7yl0o11yIJ/ho?=
 =?us-ascii?Q?gtlZ//vJgmJCnV1aNDjNLetkdAhmeKxdUyqGFDcJFyPg8BZdchAw7FxKNum4?=
 =?us-ascii?Q?RIDbmRSHg6dr1Opc41CSPkSiGddqyvPN7AG9YOAsV5SadC0VwE99ZdIIDuS5?=
 =?us-ascii?Q?u/pCNPZX3xkOWWkl7uoc+EZkpSrtZDiJ8VZpJjdR9YeUfmZLOXFix4kL/sZW?=
 =?us-ascii?Q?k58AXUn931n2hlNRaydg+L37DZmBACf95lhRrjaCaRHeauu5Xpg9FJvrGdbV?=
 =?us-ascii?Q?xVs/JiyqTFC9RQUxh5vSURQEI5vKHyv3N6EO2PYNXUnvRwcsQZfY18pNF5hY?=
 =?us-ascii?Q?JtOEL0HGF9cE7R54u0PFdlKvAhZohUWnD/8h9wKbsf5uI6QBmKS6CKh7AOJh?=
 =?us-ascii?Q?Rm36KogAO2+0XvXxZcyC9gpsL9yddRsJDeylMJoqED01gFznga5aejf0FNsH?=
 =?us-ascii?Q?7qMq8drI8Kc7GHU4Nb0emxlLU5mq/Q839bT9CeYDFHuNPNZqwMyAnTj88yz7?=
 =?us-ascii?Q?QXRfGKVzcK1uvRppUDSqdeHEZyODNZmIdNk59nEIqHjOUkbKqLI81lo2GH+C?=
 =?us-ascii?Q?Nzrq51J2b+X57yYaHSS8+f41T2M520lhMFJGTuUaKsq7ljv7B6mdKdHEHUz2?=
 =?us-ascii?Q?wZyOsf7U9D/c1ExW9pKdfl28mKy+fBjVOF16hqyJjsf6Iizs3KwHVXXcVaBF?=
 =?us-ascii?Q?66ZtPpI/vBfv8UuRAzojHBSaVuvSK2KzoAx5Y+LjjUs9fxCXYbAj+LakN5Fj?=
 =?us-ascii?Q?s8YvUsij5fdKKCWGLynME6cdYwYCBxwfHvB27BX1gh434XFrg2LxdYXAVZmz?=
 =?us-ascii?Q?XGg/i3DI8z+WELroOMir2Lg=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f4526de3-9aac-4cda-ea82-08d9efb419d9
X-MS-Exchange-CrossTenant-AuthSource: BLAPR10MB5138.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Feb 2022 12:18:26.7290
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: QOuR6icegdXn+YoQw5Mg4bnLxW0Yze0eO4TrYe4P1mH6Pnv67NNhqbs/DDSdWdgdDNPboQV9YXvZbmIWUsO1+Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3186
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10257 signatures=673431
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0
 mlxlogscore=999 bulkscore=0 spamscore=0 adultscore=0 mlxscore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2201110000 definitions=main-2202140075
X-Proofpoint-GUID: UqDwvWtGzSiF_AHOgmbjm5VCXqfRtE90
X-Proofpoint-ORIG-GUID: UqDwvWtGzSiF_AHOgmbjm5VCXqfRtE90
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org

On Tuesday, 2021-11-23 at 23:41:17 -05, Eric Snowberg wrote:
> Expose the .machine keyring created in integrity code by adding
> a reference.  This makes the machine keyring accessible for keyring
> restrictions in the future.
>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Reviewed-by: Darren Kenny <darren.kenny@oracle.com>

> ---
> v2: Initial version
> v3: set_mok_trusted_keys only available when secondary is enabled
> v4: Moved code under CONFIG_INTEGRITY_MOK_KEYRING
> v5: Rename to machine keyring
> v8: Unmodified from v5
> ---
>  certs/system_keyring.c        | 9 +++++++++
>  include/keys/system_keyring.h | 8 ++++++++
>  2 files changed, 17 insertions(+)
>
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 8f1f87579819..bc7e44fc82c2 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys;
>  #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
>  static struct key *secondary_trusted_keys;
>  #endif
> +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
> +static struct key *machine_trusted_keys;
> +#endif
>  #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING
>  static struct key *platform_trusted_keys;
>  #endif
> @@ -91,6 +94,12 @@ static __init struct key_restriction *get_secondary_restriction(void)
>  	return restriction;
>  }
>  #endif
> +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
> +void __init set_machine_trusted_keys(struct key *keyring)
> +{
> +	machine_trusted_keys = keyring;
> +}
> +#endif
>  
>  /*
>   * Create the trusted keyrings
> diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
> index 6acd3cf13a18..98c9b10cdc17 100644
> --- a/include/keys/system_keyring.h
> +++ b/include/keys/system_keyring.h
> @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted(
>  #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted
>  #endif
>  
> +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
> +extern void __init set_machine_trusted_keys(struct key *keyring);
> +#else
> +static inline void __init set_machine_trusted_keys(struct key *keyring)
> +{
> +}
> +#endif
> +
>  extern struct pkcs7_message *pkcs7;
>  #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING
>  extern int mark_hash_blacklisted(const char *hash);
> -- 
> 2.18.4