Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     Coiby Xu <coxu@redhat.com>
CC:     "davem@davemloft.net" <davem@davemloft.net>,
        David Howells <dhowells@redhat.com>,
        "dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
        "dwmw2@infradead.org" <dwmw2@infradead.org>,
        "herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
        jarkko Sakkinen <jarkko@kernel.org>,
        "jmorris@namei.org" <jmorris@namei.org>,
        Konrad Wilk <konrad.wilk@oracle.com>,
        Kanth Ghatraju <kanth.ghatraju@oracle.com>,
        Elaine R Palmer <erpalmer@us.ibm.com>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>,
        Lakshmi Ramasubramanian <nramas@linux.microsoft.com>,
        "pvorel@suse.cz" <pvorel@suse.cz>,
        Roberto Sassu <roberto.sassu@huawei.com>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "tiwai@suse.de" <tiwai@suse.de>, Mimi Zohar <zohar@linux.ibm.com>
Subject: Re: [PATCH 0/7] Add CA enforcement keyring restrictions
Thread-Topic: [PATCH 0/7] Add CA enforcement keyring restrictions
Thread-Index: AQHYSVko0FaTAwO/wkyht4hUdft6wK4wDb+AgACCKAA=
Date:   Fri, 4 Nov 2022 21:06:27 +0000
Message-ID: <2A078A99-880A-4C6B-91F3-22047BF90ECD@oracle.com>
References: <20221104132035.rmavewmeo6ceyjou@Rk>
In-Reply-To: <20221104132035.rmavewmeo6ceyjou@Rk>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?RSvJVrrR+LpK9I9IB0fqNenrEqZGBPq4WhegpoofTXhaUExSAMFt39jzEioy?=
 =?us-ascii?Q?/dkFDVFiDMfOykjnP2vrkHEqGP+TRZslGJC0WIjexq2Bnh44HTUoNDIXyw/M?=
 =?us-ascii?Q?TaLjJVd5TAyGrc/7TAdao9tRJM9mW7BGXd7xD6XFphBNDW8pBpx6Z2xrO0CI?=
 =?us-ascii?Q?wiCnIO7qE7AwrHIE4FTcbsu6aJINbF9a8UZSuumoGw4qoo5dcH4rosWzFcTn?=
 =?us-ascii?Q?uEXXVOoSqTNwqKXgyW/BG613XkqxS32lywHW15+Z0OQsRJQBqzVn809SEf1P?=
 =?us-ascii?Q?Lz62s8VzcsL0/jEsB5EAabGUwAYRe46nORaB8Mbsth1m94ensCGDsmTUlPRn?=
 =?us-ascii?Q?g/8kTiltMrnB9fJln/B2jf1TPyS4+bmVWY9Kjk+xQUvjzLluUHxMwg5mysdR?=
 =?us-ascii?Q?FGjjS/UyhhjDvIKg0CMMCKaYPwG/xUKLcTNimSP+EeVOcuJJifF+aqRroemN?=
 =?us-ascii?Q?pT7R5vERuVy8/XZ0dpkT/C3irC1uo94zbl264NWxUlgRmU9Kc1TyTNRj4p/o?=
 =?us-ascii?Q?imjFzV3UMt5LAIbL9F0cUsgufZSNheZP96S38Ea0DU6iXLlZ4j9yl9nbcCbd?=
 =?us-ascii?Q?93sCGjEROADxIg0BlLOG8rGoXpAMz8iZAW3UdVwqDeXdQlQlMAmlMcbDI7C7?=
 =?us-ascii?Q?7vB27ooP//pOKXyYNEmkpjGoFMeljrEKtmuxXxXfKjdmZtWju0yunQmeNJiu?=
 =?us-ascii?Q?gU938leXL1m1/fkpy/BrauY2AhyjnIMkSAs7kQWuWpucIgjfPgORqTy6PI7S?=
 =?us-ascii?Q?iw/LnmpegK+DJrMQssqEeLhKiQvfP3lUms1h36xR8AXbiQKRuvl7U3UOUHTd?=
 =?us-ascii?Q?SbxMmsyhegAjDTqzP7P0ClrGm0GsgSphkuG5FwleZY7kH30mhPX9DkgTUqDt?=
 =?us-ascii?Q?h5MOucSJG84myUH/4Hl0UZN7ugd5Pfkgd8AGyqX1FdLh9N4fOhzK+SbhEv2x?=
 =?us-ascii?Q?JUOYFY2O0fIomKMBO/GPephLXVS/dTUvc44C+SEsdMESglpSRoDIuN1xcUpt?=
 =?us-ascii?Q?C+8JIswX+Ah0/hvw2QGEOMl0vGQ9JZg8eMMfXlWvz6Aqywq+2+tVBbBH13Sa?=
 =?us-ascii?Q?0FD8ja+mFSIPpRD4VObN9Mg2Ac3sQHJ3CL7+O7qfLJbL5+TKIcGyCaMWtj4m?=
 =?us-ascii?Q?6jJKlf1eB85If18OdAbthmxsldaqGFzH+p6PHwbXR6xbm+EuiavQxbTrke32?=
 =?us-ascii?Q?ryDx5y2Pv+SXYAJTdrzMSozeG+v3ZS+feflVGCExRI05HoFtxQj+7ozPYYC0?=
 =?us-ascii?Q?VDmugPDbV2Goxf69fc0Z9v7EU3LSMwsHPAUApyeh84sVamLxWWKa+l3TM/fK?=
 =?us-ascii?Q?eZdlZXFqhhTZYfCa5957u1ykQ8U35g+kHKUp8tMX3P5/GExDUNOsBlaFUprL?=
 =?us-ascii?Q?9afdQKFiOvfWpIPaI830dHl29rGtF32l7Bn76Fn4pPK24HP06i8v3Om3ew9G?=
 =?us-ascii?Q?h8/ZZ3K1QNc5EewPoETg2uXx27YejhPX8KFIky7bLaCAUSrWNkZIAWunfhTx?=
 =?us-ascii?Q?NQTYV/yb2DPtZJ7b9+YILR3e/q6ZTn3gTZCTF7ko7ktzfFpKfs/9CEqLSwdn?=
 =?us-ascii?Q?ahloUYCq4JEn3nNNUcMumCcvnHXJ6KDsZuaXrCQ73FoZnYtl6xZKeIRvQmAW?=
 =?us-ascii?Q?nA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <B8C94C18DF374341AEDAE7337D194CED@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7d0a8148-0475-48cc-1ebd-08dabea87016
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Nov 2022 21:06:27.0471
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: y2XnPsqPNZQRvyGETeQR0CLRvIg1dpLOcM7sVU7URAGjjBystDnaQvQv+rgiOA6BJExdIR0BslNbQ4ud2naGN7AokAtuYYPGAqB1xM+WW6c=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR10MB6186
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.219,Aquarius:18.0.895,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-11-04_11,2022-11-03_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 mlxscore=0
 suspectscore=0 mlxlogscore=999 spamscore=0 adultscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2211040128
X-Proofpoint-ORIG-GUID: VUw9Aoe-7399tOoHqQ-u87bBwS4hv8x3
X-Proofpoint-GUID: VUw9Aoe-7399tOoHqQ-u87bBwS4hv8x3
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Nov 4, 2022, at 7:20 AM, Coiby Xu <coxu@redhat.com> wrote:
>=20
> Hi Eric,
>=20
> I wonder if there is any update on this work? I would be glad to do
> anything that may be helpful including testing a new version of code.
>=20
> --=20
> Best regards,
> Coiby


The discussion on this topic briefly moved over to this thread [1].  I took=
=20
the lack of response to mean an approach like this would not be considered.=
 =20
If it would be considered, I am willing to continue working on a solution=20
to this problem.

1. https://lore.kernel.org/linux-integrity/8BB9D406-0394-4E2E-9B84-4A320AFD=
BDC4@oracle.com/