| From: |
| Eric Snowberg <eric.snowberg-AT-oracle.com> |
| To: |
| zohar-AT-linux.ibm.com, jarkko-AT-kernel.org, dhowells-AT-redhat.com, dwmw2-AT-infradead.org |
| Subject: |
| [PATCH 0/4] Add CA enforcement in the machine keyring |
| Date: |
| Tue, 01 Mar 2022 12:36:47 -0500 |
| Message-ID: |
| <20220301173651.3435350-1-eric.snowberg@oracle.com> |
| Cc: |
| herbert-AT-gondor.apana.org.au, davem-AT-davemloft.net, jmorris-AT-namei.org, serge-AT-hallyn.com, eric.snowberg-AT-oracle.com, stefanb-AT-linux.ibm.com, nayna-AT-linux.ibm.com, mic-AT-linux.microsoft.com, konrad.wilk-AT-oracle.com, keyrings-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, linux-crypto-AT-vger.kernel.org, linux-security-module-AT-vger.kernel.org |
| Archive-link: |
| Article |
A key added to the IMA keyring must be signed by a key contained in either the
built-in trusted or secondary trusted keyring. IMA also requires these keys
to be a CA. The only option for an end-user to add their own CA is to compile
it into the kernel themselves or to use the insert-sys-cert. Many end-users
do not want to compile their own kernels. With the insert-sys-cert option,
there are missing upstream changes.
Currently, all Machine Owner Keys (MOK) load into the machine keyring. Add
a new Kconfig option to only allow CA keys into the machine keyring. When
compiled with the new INTEGRITY_MACHINE_KEYRING_CA_ENFORCED Kconfig, non CA
keys will load into the platform keyring instead. This will allow the end-
user to enroll their own CA key into the machine keyring for use with IMA.
These patches are based on Jarkko's linux-tpmdd tree.
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git
Eric Snowberg (4):
KEYS: Create static version of public_key_verify_signature
X.509: Parse Basic Constraints for CA
KEYS: CA link restriction
integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
certs/system_keyring.c | 9 ++--
crypto/asymmetric_keys/restrict.c | 43 +++++++++++++++++++
crypto/asymmetric_keys/x509_cert_parser.c | 9 ++++
include/crypto/public_key.h | 25 +++++++++++
include/keys/system_keyring.h | 3 +-
security/integrity/Kconfig | 21 +++++++++
security/integrity/Makefile | 1 +
security/integrity/digsig.c | 14 ++++--
security/integrity/integrity.h | 3 +-
.../platform_certs/keyring_handler.c | 4 +-
10 files changed, 123 insertions(+), 9 deletions(-)
base-commit: c9e54f38976a1c0ec69c0a6208b3fd55fceb01d1
--
2.27.0
