From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752407AbcDAQvN (ORCPT ); Fri, 1 Apr 2016 12:51:13 -0400 Received: from e23smtp01.au.ibm.com ([202.81.31.143]:36811 "EHLO e23smtp01.au.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751949AbcDAQvK (ORCPT ); Fri, 1 Apr 2016 12:51:10 -0400 X-IBM-Helo: d23dlp03.au.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: keyrings@vger.kernel.org;linux-kernel@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1459529396.2657.68.camel@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 12/12] IMA: Use the the system trusted keyrings instead of .ima_mok [ver #3] From: Mimi Zohar To: David Howells Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Date: Fri, 01 Apr 2016 12:49:56 -0400 In-Reply-To: <29226.1459521213@warthog.procyon.org.uk> References: <1459462702.2657.61.camel@linux.vnet.ibm.com> <1459426888.2657.26.camel@linux.vnet.ibm.com> <1459166340.2751.52.camel@linux.vnet.ibm.com> <20160309111814.28811.95697.stgit@warthog.procyon.org.uk> <20160309111939.28811.7952.stgit@warthog.procyon.org.uk> <12767.1459354776@warthog.procyon.org.uk> <13142.1459437486@warthog.procyon.org.uk> <1459439733.2657.41.camel@linux.vnet.ibm.com> <29226.1459521213@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16040116-1618-0000-0000-0000453F0A0B Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2016-04-01 at 15:33 +0100, David Howells wrote: > Mimi Zohar wrote: > > > The only place where "KEY_ALLOC_BYPASS_RESTRICTION" is specified is in > > load_system_certificate_list(), when adding keys to > > the .builtin_trusted_keys keyring. There is no other set of keys > > builtin and added to the IMA keyring. > > Are the keys loaded by integrity_load_x509() required to be validly signed by > the builtin/secondary keys? Or is that unnecessary given that they are loaded > and thus protected through integrity_read_file()? Loading keys on the IMA keyring is safe, because the certificates must be signed by a key on the builtin keyring or the secondary keyring, if it is Kconfig enabled. Mimi