linux-kernel - Re: [PATCH v9 8/8] integrity: Only use machine keyring when uefi_check_trust_mok

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <099cdb4d6d8f74247d57f9d48472968e57c9e5c2.camel@linux.ibm.com>
Date:   Sun, 09 Jan 2022 19:12:44 -0500
From:   Mimi Zohar <zohar@...ux.ibm.com>
To:     Jarkko Sakkinen <jarkko@...nel.org>,
        Eric Snowberg <eric.snowberg@...cle.com>
Cc:     dhowells@...hat.com, dwmw2@...radead.org, ardb@...nel.org,
        jmorris@...ei.org, serge@...lyn.com, nayna@...ux.ibm.com,
        keescook@...omium.org, torvalds@...ux-foundation.org,
        weiyongjun1@...wei.com, keyrings@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        James.Bottomley@...senpartnership.com, pjones@...hat.com,
        konrad.wilk@...cle.com
Subject: Re: [PATCH v9 8/8] integrity: Only use machine keyring when
 uefi_check_trust_mok_keys is true

On Sat, 2022-01-08 at 20:47 -0500, Mimi Zohar wrote:
> On Sun, 2022-01-09 at 00:30 +0200, Jarkko Sakkinen wrote:
> > Reviewed-by: Jarkko Sakkinen <jarkko@...nel.org>
> > 
> > Mimi, have you tested these patches already?
> 
> Sorry, not yet this version this of the patch set.  Planning to test
> shortly.

I've only tested v9 1/8 - 6/8 patches on top of Takashi Iwai and Joey
Lee's patches, which are queued to be upstreamed.

92ad19559ea9 integrity: Do not load MOK and MOKx when secure boot be
disabled
54bf7fa3efd0 ima: Fix undefined arch_ima_get_secureboot() and co

With secure boot enabled and
IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY disabled,  all of
the MOK keys are loaded onto the .machine keyring.  With secure boot
disabled, none of the MOK keys are loaded onto either the .platform or
.machine keyrings, irrespective of
IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY.

This patch set is working as expected, but the v9 2/8 & 5/8 patch
descriptions haven't been updated, nor have the related comments been
updated.  Please note that the subsequent patch set will limit the MOK
keys being loaded onto the .machine keyring to only the MOK CA keys.

thanks,

Mimi