linux-kernel - Re: [RFC PATCH v3 02/13] certs: Introduce ability to link to a system key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <97B1D2D6-DB0A-4EE3-A24C-C70D81650707@oracle.com>
Date: Thu, 17 Oct 2024 16:53:17 +0000
From: Eric Snowberg <eric.snowberg@...cle.com>
To: Jarkko Sakkinen <jarkko@...nel.org>
CC: "open list:SECURITY SUBSYSTEM" <linux-security-module@...r.kernel.org>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "ardb@...nel.org"
	<ardb@...nel.org>,
        "paul@...l-moore.com" <paul@...l-moore.com>,
        "jmorris@...ei.org" <jmorris@...ei.org>,
        "serge@...lyn.com"
	<serge@...lyn.com>,
        "zohar@...ux.ibm.com" <zohar@...ux.ibm.com>,
        "roberto.sassu@...wei.com" <roberto.sassu@...wei.com>,
        "dmitry.kasatkin@...il.com" <dmitry.kasatkin@...il.com>,
        "mic@...ikod.net"
	<mic@...ikod.net>,
        "casey@...aufler-ca.com" <casey@...aufler-ca.com>,
        "stefanb@...ux.ibm.com" <stefanb@...ux.ibm.com>,
        "ebiggers@...nel.org"
	<ebiggers@...nel.org>,
        "rdunlap@...radead.org" <rdunlap@...radead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "keyrings@...r.kernel.org" <keyrings@...r.kernel.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
        "linux-integrity@...r.kernel.org" <linux-integrity@...r.kernel.org>
Subject: Re: [RFC PATCH v3 02/13] certs: Introduce ability to link to a system
 key



> On Oct 17, 2024, at 10:16 AM, Jarkko Sakkinen <jarkko@...nel.org> wrote:
> 
> On Thu, 2024-10-17 at 09:55 -0600, Eric Snowberg wrote:
>> Introduce system_key_link(), a new function to allow a keyring to
>> link
>> to a key contained within one of the system keyrings (builtin,
>> secondary,
>> or platform). Depending on how the kernel is built, if the machine
>> keyring is available, it will be checked as well, since it is linked
>> to
>> the secondary keyring. If the asymmetric key id matches a key within
>> one
>> of these system keyrings, the matching key is linked into the passed
>> in
>> keyring.
>> 
>> Signed-off-by: Eric Snowberg <eric.snowberg@...cle.com>
>> ---
>>  certs/system_keyring.c        | 30 ++++++++++++++++++++++++++++++
>>  include/keys/system_keyring.h |  7 ++++++-
>>  2 files changed, 36 insertions(+), 1 deletion(-)
>> 
>> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
>> index e344cee10d28..4abee7514442 100644
>> --- a/certs/system_keyring.c
>> +++ b/certs/system_keyring.c
>> @@ -20,6 +20,9 @@
>>  static struct key *builtin_trusted_keys;
>>  #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
>>  static struct key *secondary_trusted_keys;
> 
> /*
> * Explain system_trusted_keys (nothing too detailed, only the gist)
> */
> 
>> +#define system_trusted_keys secondary_trusted_keys
>> +#else
>> +#define system_trusted_keys builtin_trusted_keys
>>  #endif
>>  #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
>>  static struct key *machine_trusted_keys;
> 
> We have enough these to make this quite convoluted so let's put some
> helpful reminders. I would forget this in no time ;-) So if it comes
> down to that, please put something because I have a goldfish memory.

I'll add a comment explaining this in the next round, thanks.