| Message ID | 20230815112722.1591829-5-nayna@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Enable loading local and third party keys on PowerVM guest | expand |
On 15/08/23 4:57 pm, Nayna Jain wrote: > trust_moklist() is specific to UEFI enabled systems. Other platforms > rely only on the Kconfig. > > Define a generic wrapper named imputed_trust_enabled(). > > Signed-off-by: Nayna Jain <nayna@linux.ibm.com> > Reviewed-off-by: Mimi Zohar <zohar@linux.ibm.com> Tested with trustedcadb, moduledb scenarios Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com> > --- > security/integrity/digsig.c | 2 +- > security/integrity/integrity.h | 5 +++-- > .../integrity/platform_certs/keyring_handler.c | 3 ++- > .../integrity/platform_certs/machine_keyring.c | 18 ++++++++++++++++-- > 4 files changed, 22 insertions(+), 6 deletions(-) > > diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c > index d0704b1597d4..df387de29bfa 100644 > --- a/security/integrity/digsig.c > +++ b/security/integrity/digsig.c > @@ -113,7 +113,7 @@ static int __init __integrity_init_keyring(const unsigned int id, > } else { > if (id == INTEGRITY_KEYRING_PLATFORM) > set_platform_trusted_keys(keyring[id]); > - if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) > + if (id == INTEGRITY_KEYRING_MACHINE && imputed_trust_enabled()) > set_machine_trusted_keys(keyring[id]); > if (id == INTEGRITY_KEYRING_IMA) > load_module_cert(keyring[id]); > diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h > index 7167a6e99bdc..d7553c93f5c0 100644 > --- a/security/integrity/integrity.h > +++ b/security/integrity/integrity.h > @@ -320,13 +320,14 @@ static inline void __init add_to_platform_keyring(const char *source, > > #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING > void __init add_to_machine_keyring(const char *source, const void *data, size_t len); > -bool __init trust_moklist(void); > +bool __init imputed_trust_enabled(void); > #else > static inline void __init add_to_machine_keyring(const char *source, > const void *data, size_t len) > { > } > -static inline bool __init trust_moklist(void) > + > +static inline bool __init imputed_trust_enabled(void) > { > return false; > } > diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c > index 1649d047e3b8..586027b9a3f5 100644 > --- a/security/integrity/platform_certs/keyring_handler.c > +++ b/security/integrity/platform_certs/keyring_handler.c > @@ -61,7 +61,8 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) > __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) > { > if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { > - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) > + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && > + imputed_trust_enabled()) > return add_to_machine_keyring; > else > return add_to_platform_keyring; > diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c > index 9482e16cb2ca..a401640a63cd 100644 > --- a/security/integrity/platform_certs/machine_keyring.c > +++ b/security/integrity/platform_certs/machine_keyring.c > @@ -34,7 +34,8 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t > * If the restriction check does not pass and the platform keyring > * is configured, try to add it into that keyring instead. > */ > - if (rc && efi_enabled(EFI_BOOT) && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) > + if (rc && efi_enabled(EFI_BOOT) && > + IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) > rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, > data, len, perm); > > @@ -60,7 +61,7 @@ static __init bool uefi_check_trust_mok_keys(void) > return false; > } > > -bool __init trust_moklist(void) > +static bool __init trust_moklist(void) > { > static bool initialized; > static bool trust_mok; > @@ -75,3 +76,16 @@ bool __init trust_moklist(void) > > return trust_mok; > } > + > +/* > + * Provides platform specific check for trusting imputed keys before loading > + * on .machine keyring. UEFI systems enable this trust based on a variable, > + * and for other platforms, it is always enabled. > + */ > +bool __init imputed_trust_enabled(void) > +{ > + if (efi_enabled(EFI_BOOT)) > + return trust_moklist(); > + > + return true; > +}
diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index d0704b1597d4..df387de29bfa 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -113,7 +113,7 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); - if (id == INTEGRITY_KEYRING_MACHINE && trust_moklist()) + if (id == INTEGRITY_KEYRING_MACHINE && imputed_trust_enabled()) set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 7167a6e99bdc..d7553c93f5c0 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -320,13 +320,14 @@ static inline void __init add_to_platform_keyring(const char *source, #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING void __init add_to_machine_keyring(const char *source, const void *data, size_t len); -bool __init trust_moklist(void); +bool __init imputed_trust_enabled(void); #else static inline void __init add_to_machine_keyring(const char *source, const void *data, size_t len) { } -static inline bool __init trust_moklist(void) + +static inline bool __init imputed_trust_enabled(void) { return false; } diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 1649d047e3b8..586027b9a3f5 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -61,7 +61,8 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) { if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { - if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && trust_moklist()) + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING) && + imputed_trust_enabled()) return add_to_machine_keyring; else return add_to_platform_keyring; diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index 9482e16cb2ca..a401640a63cd 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -34,7 +34,8 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t * If the restriction check does not pass and the platform keyring * is configured, try to add it into that keyring instead. */ - if (rc && efi_enabled(EFI_BOOT) && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + if (rc && efi_enabled(EFI_BOOT) && + IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, data, len, perm); @@ -60,7 +61,7 @@ static __init bool uefi_check_trust_mok_keys(void) return false; } -bool __init trust_moklist(void) +static bool __init trust_moklist(void) { static bool initialized; static bool trust_mok; @@ -75,3 +76,16 @@ bool __init trust_moklist(void) return trust_mok; } + +/* + * Provides platform specific check for trusting imputed keys before loading + * on .machine keyring. UEFI systems enable this trust based on a variable, + * and for other platforms, it is always enabled. + */ +bool __init imputed_trust_enabled(void) +{ + if (efi_enabled(EFI_BOOT)) + return trust_moklist(); + + return true; +}
trust_moklist() is specific to UEFI enabled systems. Other platforms rely only on the Kconfig. Define a generic wrapper named imputed_trust_enabled(). Signed-off-by: Nayna Jain <nayna@linux.ibm.com> Reviewed-off-by: Mimi Zohar <zohar@linux.ibm.com> --- security/integrity/digsig.c | 2 +- security/integrity/integrity.h | 5 +++-- .../integrity/platform_certs/keyring_handler.c | 3 ++- .../integrity/platform_certs/machine_keyring.c | 18 ++++++++++++++++-- 4 files changed, 22 insertions(+), 6 deletions(-)