Received-SPF: pass (google.com: domain of linux-crypto+bounces-4534-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Eric Snowberg <eric.snowberg@oracle.com>
To: linux-security-module@vger.kernel.org
Cc: dhowells@redhat.com, dwmw2@infradead.org, herbert@gondor.apana.org.au,
        davem@davemloft.net, ardb@kernel.org, jarkko@kernel.org,
        paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com,
        zohar@linux.ibm.com, roberto.sassu@huawei.com,
        dmitry.kasatkin@gmail.com, mic@digikod.net, casey@schaufler-ca.com,
        stefanb@linux.ibm.com, eric.snowberg@oracle.com, ebiggers@kernel.org,
        rdunlap@infradead.org, linux-kernel@vger.kernel.org,
        keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org
Subject: [RFC PATCH v2 1/8] certs: Introduce ability to link to a system key
Date: Thu, 30 May 2024 18:39:38 -0600
Message-ID: <20240531003945.44594-2-eric.snowberg@oracle.com>
In-Reply-To: <20240531003945.44594-1-eric.snowberg@oracle.com>
References: <20240531003945.44594-1-eric.snowberg@oracle.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?tDM4MY9PNv7o06+CFtGovj8HPD4tQ1TmCicyLQSzYiTDQ3q4HE9DYXrbAdC8?=
 =?us-ascii?Q?SGXOBO8OZ+4ltuGI89bfPGo1y7WSXOaw2dpHK9EegfJF21JRGb3u0xwRPsQy?=
 =?us-ascii?Q?4As2oXyYIlJlIfe/Nb9rMVeEbBjKvu1JLRDzILiFL5AA7iffWoXlYFND4BIs?=
 =?us-ascii?Q?TAyNEB3h2/+EGXolGcD+cIHNvhTOp+yNy2ejzaqrFuwHg/z04s3oOa8c1CPv?=
 =?us-ascii?Q?ONlQtd/G2c4KJj4KDb+7BusTCpAAnlHWVOoxAKLF0r4aRWQTfK7RlE3A9qFg?=
 =?us-ascii?Q?Cw/CdkGVXHyICusqbQGJJiz/dH1odz+if67wxTCp0SuDovJjJyrqRcthw39N?=
 =?us-ascii?Q?0bFYV5DXKx5Pwnfl7YV8y9/if2s8nVCTjaou6UxoAmrqyrOYNFUI6E341FdQ?=
 =?us-ascii?Q?Pk1AP6yav54BBB8yvgZ8iP0tfTNOu0QyvsWNcsWIMNC2clZq7ck0NA9mJeoi?=
 =?us-ascii?Q?kF3VgCJF4XWQyUsoy2P99Uw9TLfO+TPqY1RwOe2sCcsFMBMZ9vheLSEWerHd?=
 =?us-ascii?Q?8doiCpbj7CdrMSnZma+x+/rGGYdwRMAEH15pCovqK8x0OE0IP09WCcxYWhzF?=
 =?us-ascii?Q?fhF52yk9N5j7F5S5T1OfXkoCtGSJ1nxJCI3E7p+OX7/bM65ma32YwQK273Pk?=
 =?us-ascii?Q?zc4zKYkDfM4Ins6SHH64r3NYe0eTfwIgF/IXQ7NpSw2ky0fvC3+JDSgt01ol?=
 =?us-ascii?Q?rPPwtsSxBNMn/gXxqXLZkz3Pq4PTEVM1zxZvs7DbynwkdoP66JvEDDXqeYa+?=
 =?us-ascii?Q?AIjjxPFGVDKE/6zmldKv0VYgOR2/4e4+Vogr84AZwAbDDSAg+MlSQBDVOw6O?=
 =?us-ascii?Q?CBlsqAMMJTJ16n3VOuEc9foFpE53BedY5Ers0vIOAmmIlw4tdvTq6xnZAisA?=
 =?us-ascii?Q?eE7xD2u4JUu8Y+GcYBSf1kOn7YYsIPkgm7hcxUj9QmTEkXl7750e7+WKs/hq?=
 =?us-ascii?Q?yHops/t0f3W6y41udBV9JYZGSnQj3h2WnKySE7N72tYzqO+kC7UwfMhtscGD?=
 =?us-ascii?Q?pmfraSdaivOJtRIBDuXZrSqw9V11QFZ3SXvqEU8lp024/6dRFZjv0A5JNPzl?=
 =?us-ascii?Q?Ll6eweV2pE8ZySPknNROj9MAJQRzARZ5da1rGIPEvjNstJYOyoKkVKLEDvtp?=
 =?us-ascii?Q?4dQloUBrv9YiCrxxROnCLCR8RdsoYN7lNLeAYKP/Ip1azTLB8r9uEUqLtfAj?=
 =?us-ascii?Q?kbTFfKEbQgDmKbrazffdEdxQPAzYxo8tBntwMHfja9vzEmxDFaSOfoT27Ji0?=
 =?us-ascii?Q?u+PhPDOMMdFAXaJ00SYGDU38y70jVODic/4YvmwRMLTTibhDPQW6FtQv2J1v?=
 =?us-ascii?Q?VatA3POvqVpgXrLZx3/w0ZvGJCyHXdoJfFXTF2qIZsyCg4Z5/k/M0SgY8WKu?=
 =?us-ascii?Q?9lpgjuZorO2V/QTHu/0j5H7eeOp6w73mX7Ca6I6A3R9UH2PIw1pmh9H/gqyZ?=
 =?us-ascii?Q?OCiNqIH+MyxWv4agG/kgS64skCNcqTca5wgFXS3gUzQUgHzbTd9EAeHQlef9?=
 =?us-ascii?Q?EDEifE5N53WiBQkjwf3nsh0FIU5d0Kc0MBGDB7sgiJYZadKgZZhYP+WmcLcA?=
 =?us-ascii?Q?GbDBt/CtGoEZm3x1VK1yzWh/lGePkWQCurV1yUXUVdvAxl29pgpq1H4YFPOT?=
 =?us-ascii?Q?Iw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	daAoPpdVcY/6wuPdt52DSCHHSFPIqYGdVsIfzF2Tbes6ZFLzSME12wh4pohUrFsMfHDgNum/9+BX1PP2GzSzPdXi8GhjgkSCR1H61RAKyYkVih7p19Qn0mEgM6TameURT7a2OXRybchARuaJ/v25EnddoszUmO+t8mxuw2PSDUmLTQVeVf2nN3r4MjpivEAxZLz6VHo7XuLQncUKESZRRDr+i2EXjBt4lpaGFMojbZy9CApIJCrd7fwjBbyYp5PRfNMktvEnJUYP7mBzdQ8iN9Q0oGuJ6OWxZ1LO59uw+CgouNMk91imFTnbN154cYNoVl0XTv4vLh0Gm0og8jPsvk8Wzd59vlKsAI0AUxWhCXcPY10r0pMq2Zj7N28fUZZzY+EI/J2ErkaiJxfgtKEnq6n/kxg3E9Y/H+/yi6YilYxOYOC3FkrmBxNrwkHH4pCoHS4fRGMFn0EPSUdOQDpfWCxZB7M1FtHSgWA9h9Ir0hTdfD5b3YJZc2oa1+7tXwv7R6ggMT8k4KW0XZBvemZowBKw4S6/RlutFVqYdlJms1cFhpU81CpcfQIyOYIB/Tk3Z00m37hK8IeuFHYeWSzZs1E/vQm/Ko+jWOlPpx3b25o=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d2ef8dc0-a1a9-47dc-dfff-08dc810a30f2
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2024 00:39:55.2397
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4cNwofvojJqIbdy3jSQdGes6RVFXtso5A03VBcL/dYTci3po4qkCZ4JREY9cBbe176DlFzmbvmg8Z/b2i1MDFF57vgciE803YaP92WjKXLU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4274
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.12.28.16
 definitions=2024-05-30_21,2024-05-30_01,2024-05-17_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 mlxscore=0 adultscore=0
 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2405010000
 definitions=main-2405310002
X-Proofpoint-GUID: cZNSQUa0p7ntgEWo6e5yWTgiWunZA6_k
X-Proofpoint-ORIG-GUID: cZNSQUa0p7ntgEWo6e5yWTgiWunZA6_k

Introduce a new function to allow a keyring to link to a key contained
within one of the system keyrings (builtin, secondary, or platform).
Depending on how the kernel is built, if the machine keyring is
available, it will be checked as well, since it is linked to the secondary
keyring. If the asymmetric key id matches a key within one of these
system keyrings, the matching key is linked into the passed in
keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
 certs/system_keyring.c        | 31 +++++++++++++++++++++++++++++++
 include/keys/system_keyring.h |  7 ++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/certs/system_keyring.c b/certs/system_keyring.c
index 9de610bf1f4b..94e47b6b3333 100644
--- a/certs/system_keyring.c
+++ b/certs/system_keyring.c
@@ -426,3 +426,34 @@ void __init set_platform_trusted_keys(struct key *keyring)
 	platform_trusted_keys = keyring;
 }
 #endif
+
+/**
+ * system_key_link - Link to a system key
+ * @keyring: The keyring to link into
+ * @id: The asymmetric key id to look for in the system keyring
+ */
+int system_key_link(struct key *keyring, struct asymmetric_key_id *id)
+{
+	struct key *system_keyring;
+	struct key *key;
+
+#ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
+	system_keyring = secondary_trusted_keys;
+#else
+	system_keyring = builtin_trusted_keys;
+#endif
+
+	key = find_asymmetric_key(system_keyring, id, NULL, NULL, false);
+	if (!IS_ERR(key))
+		goto found;
+
+	key = find_asymmetric_key(platform_trusted_keys, id, NULL, NULL, false);
+	if (!IS_ERR(key))
+		goto found;
+
+	return -ENOKEY;
+
+found:
+	key_link(keyring, key);
+	return 0;
+}
diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h
index 8365adf842ef..b47ac8e2001a 100644
--- a/include/keys/system_keyring.h
+++ b/include/keys/system_keyring.h
@@ -9,6 +9,7 @@
 #define _KEYS_SYSTEM_KEYRING_H
 
 #include <linux/key.h>
+struct asymmetric_key_id;
 
 enum blacklist_hash_type {
 	/* TBSCertificate hash */
@@ -28,7 +29,7 @@ int restrict_link_by_digsig_builtin(struct key *dest_keyring,
 				    const union key_payload *payload,
 				    struct key *restriction_key);
 extern __init int load_module_cert(struct key *keyring);
-
+extern int system_key_link(struct key *keyring, struct asymmetric_key_id *id);
 #else
 #define restrict_link_by_builtin_trusted restrict_link_reject
 #define restrict_link_by_digsig_builtin restrict_link_reject
@@ -38,6 +39,10 @@ static inline __init int load_module_cert(struct key *keyring)
 	return 0;
 }
 
+static inline int system_key_link(struct key *keyring, struct asymmetric_key_id *id)
+{
+	return 0;
+}
 #endif
 
 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
-- 
2.43.0