From: Jarkko Sakkinen <jarkko@kernel.org>
To: Eric Snowberg <eric.snowberg@oracle.com>,
keyrings@vger.kernel.org, linux-integrity@vger.kernel.org,
zohar@linux.ibm.com, dhowells@redhat.com, dwmw2@infradead.org,
herbert@gondor.apana.org.au, davem@davemloft.net,
jmorris@namei.org, serge@hallyn.com
Cc: keescook@chromium.org, gregkh@linuxfoundation.org,
torvalds@linux-foundation.org, scott.branden@broadcom.com,
weiyongjun1@huawei.com, nayna@linux.ibm.com, ebiggers@google.com,
ardb@kernel.org, nramas@linux.microsoft.com, lszubowi@redhat.com,
linux-kernel@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-security-module@vger.kernel.org,
James.Bottomley@HansenPartnership.com, pjones@redhat.com,
konrad.wilk@oracle.com
Subject: Re: [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine
Date: Thu, 09 Sep 2021 16:55:56 +0300 [thread overview]
Message-ID: <1d6fa8c32123e3e3708214540a45a940fab01ee1.camel@kernel.org> (raw)
In-Reply-To: <20210907160110.2699645-2-eric.snowberg@oracle.com>
On Tue, 2021-09-07 at 12:00 -0400, Eric Snowberg wrote:
> Many UEFI Linux distributions boot using shim. The UEFI shim provides
> what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
> Boot DB and MOK keys to validate the next step in the boot chain. The
> MOK facility can be used to import user generated keys. These keys can
> be used to sign an end-users development kernel build. When Linux
> boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
> .platform keyring.
>
> Add a new Linux keyring called machine. This keyring shall contain just
> MOK CA keys and not the remaining keys in the platform keyring. This new
> machine keyring will be used in follow on patches. Unlike keys in the
> platform keyring, keys contained in the machine keyring will be trusted
> within the kernel if the end-user has chosen to do so.
>
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
I guess this is somewhat sealed so
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
/Jarkko
next prev parent reply other threads:[~2021-09-09 13:57 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-07 16:00 [PATCH v5 00/12] Enroll kernel keys thru MOK Eric Snowberg
2021-09-07 16:00 ` [PATCH v5 01/12] integrity: Introduce a Linux keyring called machine Eric Snowberg
2021-09-09 13:55 ` Jarkko Sakkinen [this message]
2021-09-09 15:19 ` Mimi Zohar
2021-09-09 17:32 ` Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 02/12] integrity: Do not allow machine keyring updates following init Eric Snowberg
2021-09-09 13:43 ` Jarkko Sakkinen
2021-09-07 16:01 ` [PATCH v5 03/12] KEYS: CA link restriction Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 04/12] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca Eric Snowberg
2021-09-09 13:49 ` Jarkko Sakkinen
2021-09-09 17:25 ` Mimi Zohar
2021-09-09 17:53 ` Eric Snowberg
2021-09-09 18:19 ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 05/12] integrity: add new keyring handler for mok keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 06/12] KEYS: add a reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 07/12] KEYS: Introduce link restriction to include builtin, secondary and machine keys Eric Snowberg
2021-09-09 17:26 ` Mimi Zohar
2021-09-09 18:03 ` Eric Snowberg
2021-09-09 18:19 ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 08/12] KEYS: integrity: change link restriction to trust the machine keyring Eric Snowberg
2021-09-09 17:27 ` Mimi Zohar
2021-09-07 16:01 ` [PATCH v5 09/12] KEYS: link secondary_trusted_keys to machine trusted keys Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 10/12] integrity: store reference to machine keyring Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 11/12] integrity: Trust MOK keys if MokListTrustedRT found Eric Snowberg
2021-09-07 16:01 ` [PATCH v5 12/12] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true Eric Snowberg
2021-09-09 13:58 ` Jarkko Sakkinen
2021-09-08 16:03 ` [PATCH v5 00/12] Enroll kernel keys thru MOK Jarkko Sakkinen
2021-09-08 16:49 ` Jarkko Sakkinen
2021-09-08 22:25 ` Eric Snowberg
2021-09-09 13:02 ` Mimi Zohar
2021-09-08 17:09 ` Eric Snowberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1d6fa8c32123e3e3708214540a45a940fab01ee1.camel@kernel.org \
--to=jarkko@kernel.org \
--cc=James.Bottomley@HansenPartnership.com \
--cc=ardb@kernel.org \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=ebiggers@google.com \
--cc=eric.snowberg@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=herbert@gondor.apana.org.au \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=keyrings@vger.kernel.org \
--cc=konrad.wilk@oracle.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=lszubowi@redhat.com \
--cc=nayna@linux.ibm.com \
--cc=nramas@linux.microsoft.com \
--cc=pjones@redhat.com \
--cc=scott.branden@broadcom.com \
--cc=serge@hallyn.com \
--cc=torvalds@linux-foundation.org \
--cc=weiyongjun1@huawei.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.