* Documentation/admin-guide/module-signing.rst: Does the function of adding a key to ‘Builtin_trusted_key’ work?
@ 2021-05-24 9:02 Chunxin Zang
0 siblings, 0 replies; only message in thread
From: Chunxin Zang @ 2021-05-24 9:02 UTC (permalink / raw)
To: dhowells, dwmw2, corbet; +Cc: keyrings, linux-doc, linux-kernel
Recently, I am learning how to use module signature.
But I got 'Permission denied' when I trying to add a
public key to the 'builtin_trusted_keys' keyring.
root@:~# cat /proc/keys
3471e123 I------ 1 perm 1f030000 0 0 asymmetri Build time autogenerated kernel key: xxxx: X509.rsa xxxx []
37e8db03 I------ 1 perm 1f0b0000 0 0 keyring .builtin_trusted_keys: 1
root@:~# keyctl padd asymmetric "" 0x37e8db03 < ./signing_key_test_sign.x509
add_key: Permission denied
The reason is the 'builtin_trusted_keys' keyring's perm was set
'1f0b0000' by below operate when kernel starting.
builtin_trusted_keys =
keyring_alloc(".builtin_trusted_keys",
KUIDT_INIT(0), KGIDT_INIT(0), current_cred(),
((KEY_POS_ALL & ~KEY_POS_SETATTR) |
KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH),
KEY_ALLOC_NOT_IN_QUOTA,
NULL, NULL);
And, 'add_key' interface pass the KEY_NEED_WRITE
perm to lookup_user_key.
So -EACCES returned in key_task_permission check.
Is there something wrong in module-signing.rst ?
Or I missed some information about it.
Best wishes
Chunxin
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2021-05-24 9:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-24 9:02 Documentation/admin-guide/module-signing.rst: Does the function of adding a key to ‘Builtin_trusted_key’ work? Chunxin Zang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).