Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-27 21:33:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

integrity: Only use machine keyring when uefi_check_trust_mok_keys is true

Browse Source 
With the introduction of uefi_check_trust_mok_keys, it signifies the end-
user wants to trust the machine keyring as trusted keys.  If they have
chosen to trust the machine keyring, load the qualifying keys into it
during boot, then link it to the secondary keyring .  If the user has not
chosen to trust the machine keyring, it will be empty and not linked to
the secondary keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Eric Snowberg 2022-01-25 21:58:34 -05:00 committed by Jarkko Sakkinen
parent 74f5e30051
commit 3d6ae1a5d0
4 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
security/integrity/digsig.c
View File

@ -112,7 +112,7 @@ static int __init __integrity_init_keyring(const unsigned int id,
} else {
if (id == INTEGRITY_KEYRING_PLATFORM)
set_platform_trusted_keys(keyring[id]);
if (id == INTEGRITY_KEYRING_MACHINE)
if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist())
set_machine_trusted_keys(keyring[id]);
if (id == INTEGRITY_KEYRING_IMA)
load_module_cert(keyring[id]);

5
security/integrity/integrity.h
View File

@ -287,9 +287,14 @@ static inline void __init add_to_platform_keyring(const char *source,
#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
void __init add_to_machine_keyring(const char *source, const void *data, size_t len);
bool __init trust_moklist(void);
#else
static inline void __init add_to_machine_keyring(const char *source,
const void *data, size_t len)
{
}
static inline bool __init trust_moklist(void)
{
return false;
}
#endif

2
security/integrity/platform_certs/keyring_handler.c
View File

@ -83,7 +83,7 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
{
if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) {
if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist())
return add_to_machine_keyring;
else
return add_to_platform_keyring;

16
security/integrity/platform_certs/machine_keyring.c
View File

@ -8,6 +8,8 @@
#include <linux/efi.h>
#include "../integrity.h"
static bool trust_mok;
static __init int machine_keyring_init(void)
{
int rc;
@ -59,3 +61,17 @@ static __init bool uefi_check_trust_mok_keys(void)
return false;
}
bool __init trust_moklist(void)
{
static bool initialized;
if (!initialized) {
initialized = true;
if (uefi_check_trust_mok_keys())
trust_mok = true;
}
return trust_mok;
}