linux-kernel - Re: [PATCH v8 03/17] integrity: Introduce a Linux keyring called machine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15a001964945969dd7fc2422f0ab1eecfa299211.camel@linux.ibm.com>
Date:   Wed, 24 Nov 2021 21:49:19 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Eric Snowberg <eric.snowberg@...cle.com>, keyrings@...r.kernel.org,
        linux-integrity@...r.kernel.org, dhowells@...hat.com,
        dwmw2@...radead.org, herbert@...dor.apana.org.au,
        davem@...emloft.net, jarkko@...nel.org, jmorris@...ei.org,
        serge@...lyn.com
Cc:     keescook@...omium.org, torvalds@...ux-foundation.org,
        weiyongjun1@...wei.com, nayna@...ux.ibm.com, ebiggers@...gle.com,
        ardb@...nel.org, nramas@...ux.microsoft.com, lszubowi@...hat.com,
        jason@...c4.com, linux-kernel@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-efi@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        James.Bottomley@...senPartnership.com, pjones@...hat.com,
        konrad.wilk@...cle.com
Subject: Re: [PATCH v8 03/17] integrity: Introduce a Linux keyring called
 machine

Hi Eric,

On Tue, 2021-11-23 at 23:41 -0500, Eric Snowberg wrote:
> +config INTEGRITY_MACHINE_KEYRING
> +       bool "Provide a keyring to which CA Machine Owner Keys may be added"
> +       depends on SECONDARY_TRUSTED_KEYRING
> +       depends on INTEGRITY_ASYMMETRIC_KEYS

Shouldn't this be "ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y"?   With this
change, is  "KEYS: Create static version of
public_key_verify_signature" trusted needed?

Mimi

> +       depends on SYSTEM_BLACKLIST_KEYRING
> +       depends on LOAD_UEFI_KEYS
> +       help
> +        If set, provide a keyring to which CA Machine Owner Keys (MOK) may
> +        be added. This keyring shall contain just CA MOK keys.  Unlike keys
> +        in the platform keyring, keys contained in the .machine keyring will
> +        be trusted within the kernel.
> +