Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     Mimi Zohar <zohar@linux.ibm.com>, Coiby Xu <coxu@redhat.com>,
        Jarkko Sakkinen <jarkko@kernel.org>
CC:     David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        "herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
        "paul@paul-moore.com" <paul@paul-moore.com>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "pvorel@suse.cz" <pvorel@suse.cz>,
        "noodles@fb.com" <noodles@fb.com>, "tiwai@suse.de" <tiwai@suse.de>,
        "bp@suse.de" <bp@suse.de>,
        Kanth Ghatraju <kanth.ghatraju@oracle.com>,
        Konrad Wilk <konrad.wilk@oracle.com>,
        Elaine Palmer <erpalmer@linux.vnet.ibm.com>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v2 00/10] Add CA enforcement keyring restrictions
Thread-Topic: [PATCH v2 00/10] Add CA enforcement keyring restrictions
Thread-Index: AQHZCl8bkpg6/vUjKkKDWz2KOwAYDq5lXJMAgABY3gA=
Date:   Fri, 9 Dec 2022 15:44:17 +0000
Message-ID: <5AF81A9E-C4E7-4BEB-86E1-4D2DB613FBF1@oracle.com>
References: <20221207171238.2945307-1-eric.snowberg@oracle.com>
 <20221209102612.wa3oftpqupzplx6h@Rk>
In-Reply-To: <20221209102612.wa3oftpqupzplx6h@Rk>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kwO0l4hUUBXeaGpj7S3QndmCEjG9NOd6ituvCRGQ/Bqg0fkpfiQkvINWAOIr?=
 =?us-ascii?Q?hNcJe3ctJWELiWs4cVU2QZeA3x2hJsRrfZkGXUDivyqh8T48xAMdZ9u8K++K?=
 =?us-ascii?Q?KNH4v6XsOzkqW0q/DcgxEdPzdZuZvtk82dKIDv+jnU12WDb7ey17B9Lqo+ja?=
 =?us-ascii?Q?oHU9fumNbz87yIe6j9NCo7npcCHWSIA+3SOq9TlYnaMDVsTcEy3rktBJ4zb2?=
 =?us-ascii?Q?mu5G+T1xvZFutxCw4O43PQfooPCfUQdUejMwdJCqpgdVIfSNVVG+LMPRbdTl?=
 =?us-ascii?Q?7D5IZFJI/E7cgJxeYIJKq5eQQmripTQBQs/sfNpYS3xzbB5JrPfvO6lJhgwJ?=
 =?us-ascii?Q?CQ1cpukn5KgjGpuyQP6+EkTc54y9QKcZKJBAROcJ/Q3cXM8O7qQumhHr6TYb?=
 =?us-ascii?Q?VL6Irnlek/wUiKaL+t0Rk55lZ2yxUg/LyawlNJAxYhBHJGS9cGuU2RNUmC4D?=
 =?us-ascii?Q?/mYToID+qJroiwKWrlrF1JpUmO/Ddmx9TT4y3yf2vVuT/jrmqLvuYTPU60VD?=
 =?us-ascii?Q?6AHgT5SeKZxA95WSiE11rxLzFKCZKMjQFPGjPYJ96GvgBJh90DrzAHKg39Ln?=
 =?us-ascii?Q?LMcerFC04Lw48CLtckNbjTOCMXOyyx+hPA355ydK1BKNuQfXZc5OReC7ohry?=
 =?us-ascii?Q?9DAOh1N10q/EnIvdtu3uy+rXdsJnE/P6sjS9kWbNwtJZk9lPzjbfRIkL73Sg?=
 =?us-ascii?Q?q/iTN8/xrF553WCcEY1E6o+4IaX1xNzfBweH3xa1wPioD+hVNYfyzb3kZK1Z?=
 =?us-ascii?Q?fv/aycYqShLeSUJDRRKNUDGgDaYMByAWWnjkEjJy8oUjWlN68cOiFZNoD4sb?=
 =?us-ascii?Q?fCdD96XcupP4uSfH9zW2tz/+JyJpcEr8UoV9HIiGwMPCIUsm5N8lml973Dbf?=
 =?us-ascii?Q?f4BGz9UBYzEVilXDIhOgF26fces5FIAG/TxF3ALWUmDIcFulgIlpJ2an6Svw?=
 =?us-ascii?Q?M8wnYnAyC8YaExeVafkk4a1t+Awdo6S61W2GMIdEeaSfU23WqGannxQ7OPEA?=
 =?us-ascii?Q?bCPLX8/1swC1vEpmC7m6QsxJfxfDa9v9jvnRwMTr+9p+DKs2uarqXG6mKSkF?=
 =?us-ascii?Q?Y6aOhArEKsQDiwCg92dvk9znGOUJtH0bTnXzHVuyj89UJyLH4Q75il3U+CuI?=
 =?us-ascii?Q?FpxbofMddIK3EAlEtZ7kv+y70bdxRZNFIwctQTcCgjPMchACZj11DPOwnx5c?=
 =?us-ascii?Q?GGUOq4FSwackPQ57A2296ODiPhk26KrnvLIxKpyj5kVjnlaOXSDcXcnbEPof?=
 =?us-ascii?Q?qqAbvk+G+oc1Qp5VqhRmbqKVrEj51e8QbfeFzzj7rycT4RKmNYB5nHYrVa7s?=
 =?us-ascii?Q?ESB1J/D9S8U7yv8CRyNfEj6hyTiCU43sp2ryRTAQqTyL4YKoq3uWHVv8jU9W?=
 =?us-ascii?Q?z1lbHx3akbeIcgtT1O8keZt1C8n7oM7jc2EPMY5bhGd+QrwoVp6xJoWmg6Qf?=
 =?us-ascii?Q?6XOfBVFu4zhLDdl8oJfVKAYb1WETCK2exhjaZIzzPWpHJAL3g7iNYEEK8cbG?=
 =?us-ascii?Q?ttVitxXgIJ43sEV+shApLdvWQl1Qoy7pPvYgGvMtKAIhnQO1rNiVl6s0wOst?=
 =?us-ascii?Q?lJEbJz/n568Nxa2N0qZ98zKdtRHJVWEZdvRlXW+gqt9DlCel0T6vdQ1Mdg7O?=
 =?us-ascii?Q?lg=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2D94D23D2990B84B90D67B3D2EF05FB8@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c3b3d20e-3fb1-4315-16e0-08dad9fc3b1d
X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Dec 2022 15:44:17.2625
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: dUpSL1qLL/vBQYAyHVGicg8uLXrta4Hlb8w9PZYyoNEyLbmxEC8kIUyWUrA/MFHxlFhseou8Da8f9FKF8GwznD11oJlG6l8hW98K/N+ckAc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5896
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-09_08,2022-12-08_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 spamscore=0 adultscore=0
 suspectscore=0 mlxlogscore=845 malwarescore=0 phishscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2212090121
X-Proofpoint-ORIG-GUID: wjjGgnpYtUYqSFN5WzRGqYMqT-Q3u9Q7
X-Proofpoint-GUID: wjjGgnpYtUYqSFN5WzRGqYMqT-Q3u9Q7
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Dec 9, 2022, at 3:26 AM, Coiby Xu <coxu@redhat.com> wrote:
>=20
> Thanks for your work! The patch set looks good to me except for the
> requirement of an intermediate CA certificate should be vouched for by a
> root CA certificate before it can vouch for other certificates. What if
> users only want to enroll an intermediate CA certificate into the MOK?

This question would need to be answered by the maintainers.  The intermedia=
te=20
requirement was based on my understanding of previous discussions requiring
there be a way to validate root of trust all the way back to the root CA.

> If this requirement could be dropped, the code could be simplified and
> some issues could be resolved automatically,

Agreed. I will make sure the issue below is resolved one way or the other,
once we have an agreement on the requirements.=20

> 1. "[PATCH v2 03/10] KEYS: X.509: Parse Basic Constraints for CA" added
>   a root_ca filed to a certificate to indicate the subject of the
>   certificate is a CA. The name root_ca implies it's also a root CA. But
>   according to [1], both an intermediate and root CA will have
>   root_ca=3DTrue. For example, the intermediate certificate of
>   https://www.kernel.org/ has "Certificate Authority=3DYes" in the basic
>   constraints. Btw, a root CA certificate by definition is self-signed,
>   so the following code in "[PATCH v2 05/10] KEYS: Introduce a CA
>   endorsed flag" looks a bit strange to me,
>    if (cert->kcs_set && cert->self_signed && cert->root_ca)
>        prep->payload_flags |=3D KEY_ALLOC_PECA;
>=20
> 2. Since an intermediate CA certificate also has root_ca=3DTrue,
>   "[PATCH v2 07/10] KEYS: X.509: Flag Intermediate CA certs as
>   endorsed" won't work as intended i.e. this following else branch
>   will never be reached,
>   else if (!cert->self_signed && !cert->root_ca)
>           prep->payload_flags |=3D KEY_MAYBE_PECA;
>=20
> 3. I see nowhere public_key->key_is_ca is set to true for an intermediate
>   CA certificate after it gains the KEY_ALLOC_PECA flag. So it will fail
>   restrict_link_by_ca even if the KEY_MAYBE_PECA flag is added.
>=20
> [1] https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.9

Thanks for reviewing the series.