From:   Eric Snowberg <eric.snowberg@oracle.com>
To:     Jarkko Sakkinen <jarkko@kernel.org>
CC:     Mimi Zohar <zohar@linux.ibm.com>,
        David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        "herbert@gondor.apana.org.au" <herbert@gondor.apana.org.au>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "dmitry.kasatkin@gmail.com" <dmitry.kasatkin@gmail.com>,
        "paul@paul-moore.com" <paul@paul-moore.com>,
        "jmorris@namei.org" <jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "pvorel@suse.cz" <pvorel@suse.cz>,
        Kanth Ghatraju <kanth.ghatraju@oracle.com>,
        Konrad Wilk <konrad.wilk@oracle.com>,
        "erpalmer@linux.vnet.ibm.com" <erpalmer@linux.vnet.ibm.com>,
        "coxu@redhat.com" <coxu@redhat.com>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
        "linux-integrity@vger.kernel.org" <linux-integrity@vger.kernel.org>,
        "linux-security-module@vger.kernel.org" 
        <linux-security-module@vger.kernel.org>
Subject: Re: [PATCH v5 5/6] KEYS: CA link restriction
Thread-Topic: [PATCH v5 5/6] KEYS: CA link restriction
Thread-Index: AQHZTSadjQtL2N5CiEKWrhYXc3GnW672MjAAgA3YHYA=
Date:   Mon, 20 Mar 2023 17:35:05 +0000
Message-ID: <07FFED83-501D-418C-A4BB-862A547DD7B0@oracle.com>
References: <20230302164652.83571-1-eric.snowberg@oracle.com>
 <20230302164652.83571-6-eric.snowberg@oracle.com>
 <ZAz8QlynTSMD7kuE@kernel.org>
In-Reply-To: <ZAz8QlynTSMD7kuE@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?L9P6q3S1q7T03s0bne8D4BX93J/vxphD5GvUpQU+u/cZ6+Y0/Tdn4KrjB+5Y?=
 =?us-ascii?Q?mP8K9yfPMxzrzZ5CK3r0dcnK4EM0ptKVERceRptxPT8bOn2OSwFNhqwaOgXK?=
 =?us-ascii?Q?WwGiza6eXgEp/BAuz4+jxuW9E0XKXrPSE/2rPe+rq3++B55ETHg5rNIBMnOI?=
 =?us-ascii?Q?d0ujaNrBrGXSvV61ZzM4qoP9NnlqSzEN0OU93tQ3RtRgxKfCwu+hHuEZcioI?=
 =?us-ascii?Q?giQwPird8Xouyd39VBVHBqhx0R5zSmbGDCAzD7+5dRIZhQcr9otoG0ymIvCf?=
 =?us-ascii?Q?7qd9+Cx7oWMz8OOQYfR1qRnIG+NIoHYYNTJ5uDF3lz3sQwvwOtCn/v9Dlrzg?=
 =?us-ascii?Q?bPAVxkNenvqTyZl3YIiDSkwCPFUFCDRpKifG7Ttu52wjGhhoWMpUIS8KmXXd?=
 =?us-ascii?Q?tUvJVYd9mKqHj210RnmdjdoP8+SvAjQDCfLURnQ7sDm41Cz7hJ4cu+TKxlQs?=
 =?us-ascii?Q?xHl/HPC9+cdepZj2jODUqzwwGYvc8bkM9yDrCjb0jvrryqDCb8Q32vVRkoZA?=
 =?us-ascii?Q?nxtAen7D/eokzioZuY0JxQ5SBg7H1vGBh6T2X0wZYjjk1iQv049DZLrjJl5o?=
 =?us-ascii?Q?7an2zvO9hivMjxedMTgN+DDQq8irJUR0q80TcL5zw8c90PbjHPYdbMW1OvjY?=
 =?us-ascii?Q?LGLpfkXlmawysKoVEZ3c3/eiBjWzIlvEbZ5k8OsOSjzd6ieRHJyFWwUVwKe7?=
 =?us-ascii?Q?4IYx+7fnyVoc9x439U1aBgsEX3va+yhjlBowJB7LvTy/AwFNoWaygj/mJ/ph?=
 =?us-ascii?Q?6kTd099eee0cR2NXlNydPVRkMvFJmSZQA+EVI+P+AR2yVjlnq2wBHb8rbYjI?=
 =?us-ascii?Q?KIPYdNysnvs7k9iHKHzin6ptd4U7g1qvev/9HNE+SCtqQLs8KF7gDqshb8UU?=
 =?us-ascii?Q?fEuf1duKxD54tMi8w8lY5AZu040oGdpd1p4f4//4HxHn2W4VTg2Owbh0Jb+q?=
 =?us-ascii?Q?Qi2AXNxyTIXmOLlDH0Vurci5o6J+eXRR05CooDxU6XTHcTvrizwqGFBNHDKI?=
 =?us-ascii?Q?AJrC2YeJO/+6Mwm/rL4SvOzsh5xniZkafGF5fw5gH47UNkv4BRQ6h1mD60yr?=
 =?us-ascii?Q?WDqYQBc9xjxqqG1QpWyDZDorvLXOHvzeOkjAKX+J+REIWvp+f5APMfSLn2WF?=
 =?us-ascii?Q?9YvRgJw5fPWjNsE7tCgmCs5EcS4HXwBbNGeLmiZRAhPfQ8ewkO9jVJ3GT8AD?=
 =?us-ascii?Q?vR0QfDPF84bDlO3QJzQXf/cvCSKJ/fIdTJPZSCBazUeO/tQos5YSEqzpSy4h?=
 =?us-ascii?Q?yCBRiDjNuhqUaYNVIaaaNqJr5Kc19zy7kT3kep/JyXjpI27eIJnCpJVJARaZ?=
 =?us-ascii?Q?iqe0DV2MHRtzKxqt8jdqPOySy6qrjgWq7T7OHj3SPqloANVLU/AV8sMoDw6H?=
 =?us-ascii?Q?3RUY5G+naFcRuT6FSZummLUVzOFCqBRR2Lbt80gOEvxzp9Axo4kIdrbuAQFH?=
 =?us-ascii?Q?QD8WNDKN9Ppi3W0+Xfj/WhNU+H1L0NRp2eBC3FRdV8BAT9kUk5cz2MNSjq0h?=
 =?us-ascii?Q?HYzWMnlQeTutXYwmB3BP8MOhsGrE5nHBNFKxEGOy/iRiT3U/aEMb3/CQmxX/?=
 =?us-ascii?Q?QWxJ98i8WC6P92mLaU92dfRJS9qT63/CUXndBbYPyKoD3rDRMtI/7vrilJtk?=
 =?us-ascii?Q?DA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1DB48034B6D25C4DA8918740313B6A7F@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?lWJ5l5SMSIlCBHDxIGN82YabBeA579F06JmpWQQ2F0g5dwysb5m1Z6d5UByv?=
 =?us-ascii?Q?Wx8pLe/66yfTWLj1ffb46O6VtFGRJzdzhqVtQ2l/iruqWUsVQrSyElNcmLEn?=
 =?us-ascii?Q?Vm04C1aY0eCXiYTrI1ljWQ5/YZUdqFbulGC8OGWM/Ul946g5vSbblOA/opKi?=
 =?us-ascii?Q?mqLdf7sqmbkJyvd8y/VHDUbSD/sGmYHVi2ui40ln5Rk5EIi5eHEbWhhID5zC?=
 =?us-ascii?Q?MCZ9w0Epb569dMHFlN43hvXhq72TPtS5e+NLAtlXooMbhf1GLt9lPPfN1mgy?=
 =?us-ascii?Q?kfA1Y6nNx3ITTJtMrwedXTuEK8GrqiLel7LkdEVE18IHz6fU5D8NfI8SFtEg?=
 =?us-ascii?Q?LqQAX7p0l/tacbxjzf803LdLlQQ+l2lLsONSfpW+oDXIbUH0+NxI7T9st+6P?=
 =?us-ascii?Q?ENM/gEKXz/KTA/mB3SnCzDCcqYMbZaqmIavEoBKDzcChpKvrRlKWUMMgFgZD?=
 =?us-ascii?Q?xVxenQdgyBmkSCXm1o3BRDFAcV+rVpq1qO8wbdgMuIKn6gyzIbSudDud6rWD?=
 =?us-ascii?Q?LD9cabPK0aLkwiHo+AOY8Cml8LSDFipZAZAwm7RWo2iRKrk9Zn91GbpR1ico?=
 =?us-ascii?Q?192htIHnDGKs40McmNDNb2r0/ch0nm0MF+9mSFBHOwIqYZt6wgd3H2zaPwbe?=
 =?us-ascii?Q?cMkXQhSfMdFlH8p0QvsLL+RiwiPG1cixSmKlPVR73ZCreft2hpIefrpxNPuz?=
 =?us-ascii?Q?2f4Hi3zvjnP59m1CNcDgYg4hTB8TzywDsx7cH3HqXRdrm/ZcnCkII8z7GhmM?=
 =?us-ascii?Q?3BwqkHIDY8J6lJGwGOkodJoENapTNxTZLEowF3XqSrYssNdWf+Fs639630yP?=
 =?us-ascii?Q?5CKNOFhmMsuZg1BYZBoJrKSO83tW4vk3OrQkPDsiiqURMyThLTwH6VgCjlCL?=
 =?us-ascii?Q?umAE+eLQ4f+DoiKQvaZPHEG8HksnuSA/AkOkuXFc/IWgyUFaGt/cZckHDNJe?=
 =?us-ascii?Q?n02JkFjTYweTeml0ORzOWsNPoAhCzCqNolo2IBgjPtFBKyzxRwBF814lLoJJ?=
 =?us-ascii?Q?ItS7AOxPs5P9WQFnFxakUnzYO1AkeDrkP03gpUj5pMJDGtuze+INJBQyHDXj?=
 =?us-ascii?Q?BSo7nIAlP87oZ8+0/4Z3URFH8QGCFncWj22469ZvFRo0RQUtvrILzLH+uuwL?=
 =?us-ascii?Q?Co216h9DjDSHtS2mWmKmnTOf239sSR8soOJMPCE4VdfiEMf+P04jrW8=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 987cde01-3b63-4899-df69-08db29697167
X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Mar 2023 17:35:05.3526
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: RmKHdGsMYRidUi8llOftPu+hfoYS5T9ei1dlImPy6xUZ/bhRN1E6IsVrWuwvSDVourkXSpQG1sMN2dgHsUB2EYRFFQihaiQuXF1S/6q0234=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR10MB7583
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-20_15,2023-03-20_02,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 malwarescore=0
 phishscore=0 bulkscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303150002
 definitions=main-2303200149
X-Proofpoint-GUID: F2oAjJPYKzYbEBSIbZ8qY2UoszzLUHzo
X-Proofpoint-ORIG-GUID: F2oAjJPYKzYbEBSIbZ8qY2UoszzLUHzo
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Mar 11, 2023, at 3:10 PM, Jarkko Sakkinen <jarkko@kernel.org> wrote:
>=20
> On Thu, Mar 02, 2023 at 11:46:51AM -0500, Eric Snowberg wrote:
>> Add a new link restriction.  Restrict the addition of keys in a keyring
>> based on the key to be added being a CA.
>>=20
>> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
>> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
>> ---
>> crypto/asymmetric_keys/restrict.c | 38 +++++++++++++++++++++++++++++++
>> include/crypto/public_key.h       | 15 ++++++++++++
>> 2 files changed, 53 insertions(+)
>>=20
>> diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/=
restrict.c
>> index 6b1ac5f5896a..48457c6f33f9 100644
>> --- a/crypto/asymmetric_keys/restrict.c
>> +++ b/crypto/asymmetric_keys/restrict.c
>> @@ -108,6 +108,44 @@ int restrict_link_by_signature(struct key *dest_key=
ring,
>> 	return ret;
>> }
>>=20
>> +/**
>> + * restrict_link_by_ca - Restrict additions to a ring of CA keys
>> + * @dest_keyring: Keyring being linked to.
>> + * @type: The type of key being added.
>> + * @payload: The payload of the new key.
>> + * @trust_keyring: Unused.
>> + *
>> + * Check if the new certificate is a CA. If it is a CA, then mark the n=
ew
>> + * certificate as being ok to link.
>> + *
>> + * Returns 0 if the new certificate was accepted, -ENOKEY if the
>> + * certificate is not a CA. -ENOPKG if the signature uses unsupported
>> + * crypto, or some other error if there is a matching certificate but
>> + * the signature check cannot be performed.
>> + */
>> +int restrict_link_by_ca(struct key *dest_keyring,
>> +			const struct key_type *type,
>> +			const union key_payload *payload,
>> +			struct key *trust_keyring)
>> +{
>> +	const struct public_key *pkey;
>> +
>> +	if (type !=3D &key_type_asymmetric)
>> +		return -EOPNOTSUPP;
>> +
>> +	pkey =3D payload->data[asym_crypto];
>> +	if (!pkey)
>> +		return -ENOPKG;
>> +	if (!test_bit(KEY_EFLAG_CA, &pkey->key_eflags))
>> +		return -ENOKEY;
>> +	if (!test_bit(KEY_EFLAG_KEYCERTSIGN, &pkey->key_eflags))
>> +		return -ENOKEY;
>> +	if (test_bit(KEY_EFLAG_DIGITALSIG, &pkey->key_eflags))
>> +		return -ENOKEY;
>=20
> nit: would be more readable, if conditions were separated by
> empty lines.

Ok, I will make this change in the next round.  Thanks.