| Message ID | 20210914211416.34096-6-eric.snowberg@oracle.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Enroll kernel keys thru MOK | expand |
Hi Eric,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f]
url: https://github.com/0day-ci/linux/commits/Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
base: 6880fa6c56601bb8ed59df6c30fd390cc5f6dd8f
config: x86_64-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/18c80634d92ba6ecc8e3a7d0b2dd793b586fc828
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Eric-Snowberg/Enroll-kernel-keys-thru-MOK/20210915-051742
git checkout 18c80634d92ba6ecc8e3a7d0b2dd793b586fc828
# save the attached .config to linux build tree
make W=1 ARCH=x86_64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All errors (new ones prefixed by >>):
security/integrity/platform_certs/keyring_handler.c:71:30: error: no previous prototype for 'get_handler_for_db' [-Werror=missing-prototypes]
71 | __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
| ^~~~~~~~~~~~~~~~~~
>> security/integrity/platform_certs/keyring_handler.c:82:30: error: no previous prototype for 'get_handler_for_mok' [-Werror=missing-prototypes]
82 | __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
| ^~~~~~~~~~~~~~~~~~~
security/integrity/platform_certs/keyring_handler.c:97:30: error: no previous prototype for 'get_handler_for_dbx' [-Werror=missing-prototypes]
97 | __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type)
| ^~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
vim +/get_handler_for_mok +82 security/integrity/platform_certs/keyring_handler.c
66
67 /*
68 * Return the appropriate handler for particular signature list types found in
69 * the UEFI db tables.
70 */
> 71 __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type)
72 {
73 if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0)
74 return add_to_platform_keyring;
75 return 0;
76 }
77
78 /*
79 * Return the appropriate handler for particular signature list types found in
80 * the MokListRT tables.
81 */
> 82 __init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type)
83 {
84 if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) {
85 if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING))
86 return add_to_machine_keyring;
87 else
88 return add_to_platform_keyring;
89 }
90 return 0;
91 }
92
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..445d413aec74 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -66,7 +66,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -75,6 +75,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index f290f78c3f30..c1bfd1cd7cc3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -94,7 +94,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -109,7 +109,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc);
Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v6: Unmodified from v5 --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-)