Received-SPF: pass (google.com: domain of linux-crypto+bounces-2624-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Bharat Bhushan <bbhushan2@marvell.com>
To: Eric Snowberg <eric.snowberg@oracle.com>,
        "linux-security-module@vger.kernel.org"
	<linux-security-module@vger.kernel.org>
CC: "dhowells@redhat.com" <dhowells@redhat.com>,
        "dwmw2@infradead.org"
	<dwmw2@infradead.org>,
        "herbert@gondor.apana.org.au"
	<herbert@gondor.apana.org.au>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "ardb@kernel.org" <ardb@kernel.org>,
        "jarkko@kernel.org" <jarkko@kernel.org>,
        "paul@paul-moore.com" <paul@paul-moore.com>,
        "jmorris@namei.org"
	<jmorris@namei.org>,
        "serge@hallyn.com" <serge@hallyn.com>,
        "zohar@linux.ibm.com" <zohar@linux.ibm.com>,
        "roberto.sassu@huawei.com"
	<roberto.sassu@huawei.com>,
        "dmitry.kasatkin@gmail.com"
	<dmitry.kasatkin@gmail.com>,
        "mic@digikod.net" <mic@digikod.net>,
        "casey@schaufler-ca.com" <casey@schaufler-ca.com>,
        "stefanb@linux.ibm.com"
	<stefanb@linux.ibm.com>,
        "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>,
        "keyrings@vger.kernel.org"
	<keyrings@vger.kernel.org>,
        "linux-crypto@vger.kernel.org"
	<linux-crypto@vger.kernel.org>,
        "linux-efi@vger.kernel.org"
	<linux-efi@vger.kernel.org>,
        "linux-integrity@vger.kernel.org"
	<linux-integrity@vger.kernel.org>
Subject: RE: [EXTERNAL] [PATCH RFC 1/8] certs: Introduce ability to link to a
 system key
Thread-Topic: [EXTERNAL] [PATCH RFC 1/8] certs: Introduce ability to link to a
 system key
Thread-Index: AQHac9CFMcx0ZAmc50GyYG9txBMctrEznUOQ
Date: Tue, 12 Mar 2024 06:00:39 +0000
Message-ID: 
 <SN7PR18MB5314CEAF1CEDC95B2C874696E32B2@SN7PR18MB5314.namprd18.prod.outlook.com>
References: <20240311161111.3268190-1-eric.snowberg@oracle.com>
 <20240311161111.3268190-2-eric.snowberg@oracle.com>
In-Reply-To: <20240311161111.3268190-2-eric.snowberg@oracle.com>
Accept-Language: en-IN, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?vvwAmjHJIU9jPOtUcME4M+nVVuKEbL9C9uXmxm05GE4RIghACxP5OxMW9F0n?=
 =?us-ascii?Q?5RpwShaBJE+8YX8GYouKkdntLdTM+svZLVp42FwngUHTB7v6htzpI+XrnN26?=
 =?us-ascii?Q?SDHW/dxUJg3bMJy7w6PV5bRkPhxqyLPwDPE2YRKvmIoKHs8kgSyYHRQMisE+?=
 =?us-ascii?Q?A4F08KT2oiNGo2nLVY4M3Ceno9QMfs20NTyYLz1dpXk4mQhI23z2SX2rgGj8?=
 =?us-ascii?Q?FO6pTrbk8gDGEEGxEJCzY14nkY5sJWFZ/yTI2gXrNmtJXsT+orCCTs28k9jF?=
 =?us-ascii?Q?ZjU2EMzgVI72HSufsZ1ac7lyg2Dy3IiD8/7RUFVKtHCUuVEwFzbBy/RTUMyq?=
 =?us-ascii?Q?qk5asNFDuJjn5LvHKVEzGLIpzbbTtrJOeP0Zgm562NJQBQVMO/lM+4v4n0PZ?=
 =?us-ascii?Q?NA0KZBeVT0ilTUiS8DnJ8NKxbkx+JbDpMsH9YJDnbE6/vb8YUl1jnc21X+u/?=
 =?us-ascii?Q?5RDkabMKx7IaxZajDiryHID/fuli3lIr/J1KInLciP9GvCBPTMjU541sDV5W?=
 =?us-ascii?Q?Fr5FD09xTNzH0E0iy9r/q99Aq4FDgQABr8uMJ9Y9fSLEO36X7rmWtDN3lMQF?=
 =?us-ascii?Q?E4s6rFtcCohrbc8WnNFT7zKtXAKnbLLvHaWV4Vmo1ZGAwD8SdFgvozrQI0Uc?=
 =?us-ascii?Q?DiXLEcFnzvSv4CNBlxsf7QrPV25VpFOzOcV0Q/GwzpVIcOttU1/ht3/lGe9c?=
 =?us-ascii?Q?Wk6JTv22W/HHsSEw6H9xcs76ciWMJdqRYAUJ5U6aupjohBbnkPphGgN1qywh?=
 =?us-ascii?Q?OfWnvYEUGc5WBKeltHyss7g5CKgWdDCS+YpwiOKMBLAFgEOmv+ThfoHpsgqP?=
 =?us-ascii?Q?AjGiI+x2W+wZ7Fc4EqKRVL70f1JBRtGHDlH1i2KXVuhibCq8deVdmIFNEu3f?=
 =?us-ascii?Q?oCP/kE1v3xfzcajHgP9th0o1span65CYL2Hbzk9/JHE3nW6OVd+INL7fu0/2?=
 =?us-ascii?Q?Ri4hBVzMAamfm2Cs3pBorsvekrJRfU8nyqfcFueuivOahxmhJiPF2mWNoiBe?=
 =?us-ascii?Q?iYm1+w8LEx19wi5rZHwaeKd+qBCOoD5adHd3YuwmCPZaYwsewN0PnvPIxJ+q?=
 =?us-ascii?Q?ZaXo8wLm4Lh06vBFv3et0W9BEdYsQrMX3TQjV+Zkomt0ef6j9j3uGD+vxMV9?=
 =?us-ascii?Q?PrbYFiCDv3j/QhO5jfwIOeSHGuNIKnSUB0OS8zuhuOcHHBZP1VeLK3JpHvAy?=
 =?us-ascii?Q?5BocTyFJdXF7SIrWmD7b7Obn4p8cydGRQ3J7cIZLq99RkSdVlL+I86X0dKfy?=
 =?us-ascii?Q?c+HFJ7nKEZDDtbQzh3nPfNGuU9HGC5jN/ZEnv9SHciZZv1ByL6dnzVMs6qEZ?=
 =?us-ascii?Q?e2A+iZf8qaEtF4h5yyy4xdJDtaZ3GIA6gUMkS8tRJTG2ei21D741oaZefrLW?=
 =?us-ascii?Q?mKkkK1cgIYOUFPiedsuGREqZ8NS8tcGZWyE9Ha4ESGg0fhTVPkKsU/iYnGQJ?=
 =?us-ascii?Q?3fqAJCC5n6lwPUSj/1T/ZZmjSZbLmRKV48qTA8jZ7XYUTasllGZgUTxYVC18?=
 =?us-ascii?Q?I/6ivJADPpQiPr39WQw8xDYzw+mwWeyVBnTJg/GbimcVCSRTQqtEYeq2jWxc?=
 =?us-ascii?Q?LRSWmBiJQX7r2mhVhv/aSEiM2jltm/caV04R0ILn?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-crypto@vger.kernel.org
List-Id: <linux-crypto.vger.kernel.org>
List-Subscribe: <mailto:linux-crypto+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-crypto+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: marvell.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN7PR18MB5314.namprd18.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 52229d1a-11ee-457b-08aa-08dc4259beb4
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2024 06:00:39.8614
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 70e1fb47-1155-421d-87fc-2e58f638b6e0
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: i85vqeRD2nQNT3F1OLgzPHMCdp+r+82/9bi1yAuMbXip0LFpdcxxauI12wH9pugq7PmpEyuJohVI4ZNENiu1vQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR18MB3897
X-Proofpoint-ORIG-GUID: XU4hx-nmz1y0IemWA1ymkq1jqG2TGdyq
X-Proofpoint-GUID: 8kOb7gfFbKAlhzoDFl4hz8OfIbUXw5IE
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-03-12_05,2024-03-11_01,2023-05-22_02


> -----Original Message-----
> From: Eric Snowberg <eric.snowberg@oracle.com>
> Sent: Monday, March 11, 2024 9:41 PM
> To: linux-security-module@vger.kernel.org
> Cc: dhowells@redhat.com; dwmw2@infradead.org;
> herbert@gondor.apana.org.au; davem@davemloft.net; ardb@kernel.org;
> jarkko@kernel.org; paul@paul-moore.com; jmorris@namei.org;
> serge@hallyn.com; zohar@linux.ibm.com; roberto.sassu@huawei.com;
> dmitry.kasatkin@gmail.com; mic@digikod.net; casey@schaufler-ca.com;
> stefanb@linux.ibm.com; eric.snowberg@oracle.com; linux-
> kernel@vger.kernel.org; keyrings@vger.kernel.org; linux-
> crypto@vger.kernel.org; linux-efi@vger.kernel.org; linux-
> integrity@vger.kernel.org
> Subject: [EXTERNAL] [PATCH RFC 1/8] certs: Introduce ability to link to a
> system key
>=20
> Prioritize security for external emails: Confirm sender and content safet=
y
> before clicking links or opening attachments
>=20
> ----------------------------------------------------------------------
> Introduce a new function to allow a keyring to link to a key contained
> within one of the system keyrings (builtin, secondary, or platform).
> Depending on how the kernel is built, if the machine keyring is
> available, it will be checked as well, since it is linked to the secondar=
y
> keyring. If the asymmetric key id matches a key within one of these
> system keyrings, the matching key is linked into the passed in
> keyring.
>=20
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
> ---
>  certs/system_keyring.c        | 29 +++++++++++++++++++++++++++++
>  include/keys/system_keyring.h |  7 ++++++-
>  2 files changed, 35 insertions(+), 1 deletion(-)
>=20
> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
> index 9de610bf1f4b..b647be49f6e0 100644
> --- a/certs/system_keyring.c
> +++ b/certs/system_keyring.c
> @@ -426,3 +426,32 @@ void __init set_platform_trusted_keys(struct key
> *keyring)
>  	platform_trusted_keys =3D keyring;
>  }
>  #endif
> +
> +/**
> + * system_key_link - Link to a system key
> + * @keyring: The keyring to link into
> + * @id: The asymmetric key id to look for in the system keyring
> + */
> +int system_key_link(struct key *keyring, struct asymmetric_key_id *id)
> +{
> +	struct key *tkey;
> +
> +#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
> +	tkey =3D find_asymmetric_key(secondary_trusted_keys, id, NULL, NULL,
> false);
> +#else
> +	tkey =3D find_asymmetric_key(builtin_trusted_keys, id, NULL, NULL,
> false);
> +#endif
> +	if (!IS_ERR(tkey))
> +		goto found;
> +
> +	tkey =3D find_asymmetric_key(platform_trusted_keys, id, NULL, NULL,
> false);
> +
> +	if (!IS_ERR(tkey))
> +		goto found;
> +
> +	return -1;

Please use -ENOKEY.

Thanks
-Bharat

> +
> +found:
> +	key_link(keyring, tkey);
> +	return 0;
> +}
> diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.=
h
> index 8365adf842ef..b47ac8e2001a 100644
> --- a/include/keys/system_keyring.h
> +++ b/include/keys/system_keyring.h
> @@ -9,6 +9,7 @@
>  #define _KEYS_SYSTEM_KEYRING_H
>=20
>  #include <linux/key.h>
> +struct asymmetric_key_id;
>=20
>  enum blacklist_hash_type {
>  	/* TBSCertificate hash */
> @@ -28,7 +29,7 @@ int restrict_link_by_digsig_builtin(struct key
> *dest_keyring,
>  				    const union key_payload *payload,
>  				    struct key *restriction_key);
>  extern __init int load_module_cert(struct key *keyring);
> -
> +extern int system_key_link(struct key *keyring, struct asymmetric_key_id
> *id);
>  #else
>  #define restrict_link_by_builtin_trusted restrict_link_reject
>  #define restrict_link_by_digsig_builtin restrict_link_reject
> @@ -38,6 +39,10 @@ static inline __init int load_module_cert(struct key
> *keyring)
>  	return 0;
>  }
>=20
> +static inline int system_key_link(struct key *keyring, struct asymmetric=
_key_id
> *id)
> +{
> +	return 0;
> +}
>  #endif
>=20
>  #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
> --
> 2.39.3
>=20