linux/include/keys
Eric Snowberg 087aa4ed37 KEYS: Introduce link restriction for machine keys
Introduce a new link restriction that includes the trusted builtin,
secondary and machine keys. The restriction is based on the key to be
added being vouched for by a key in any of these three keyrings.

With the introduction of the machine keyring, the end-user may choose to
trust Machine Owner Keys (MOK) within the kernel. If they have chosen to
trust them, the .machine keyring will contain these keys.  If not, the
machine keyring will always be empty.  Update the restriction check to
allow the secondary trusted keyring to also trust machine keys.

Allow the .machine keyring to be linked to the secondary_trusted_keys.
After the link is created, keys contained in the .machine keyring will
automatically be searched when searching secondary_trusted_keys.

Suggested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2022-03-08 13:55:52 +02:00
..
asymmetric-parser.h docs: crypto: convert asymmetric-keys.txt to ReST 2020-06-19 14:03:46 -06:00
asymmetric-subtype.h docs: crypto: convert asymmetric-keys.txt to ReST 2020-06-19 14:03:46 -06:00
asymmetric-type.h keys: X.509 public key issuer lookup without AKID 2022-01-09 00:18:42 +02:00
big_key-type.h keys: Implement update for the big_key type 2020-06-02 17:22:31 +01:00
ceph-type.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dns_resolver-type.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
encrypted-type.h encrypted-keys: Replace HTTP links with HTTPS ones 2021-01-21 16:16:09 +00:00
keyring-type.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
request_key_auth-type.h request_key improvements 2019-07-08 19:19:37 -07:00
rxrpc-type.h rxrpc: Don't leak the service-side session key to userspace 2020-11-23 18:09:29 +00:00
system_keyring.h KEYS: Introduce link restriction for machine keys 2022-03-08 13:55:52 +02:00
trusted_tee.h KEYS: trusted: Introduce TEE based Trusted Keys 2021-04-14 16:30:30 +03:00
trusted_tpm.h KEYS: trusted: Add generic trusted keys framework 2021-04-14 16:30:30 +03:00
trusted-type.h KEYS: trusted: Add generic trusted keys framework 2021-04-14 16:30:30 +03:00
user-type.h KEYS: Replace zero-length array with flexible-array 2020-06-02 17:22:31 +01:00