| Message ID | 20230508220708.2888510-1-eric.snowberg@oracle.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add digitalSignature enforcement keyring restrictions | expand |
On Tue May 9, 2023 at 1:07 AM EEST, Eric Snowberg wrote: > X.509 certificates may contain a key usage extension [1]. The key usage > extension defines the purpose of the certificate. One area of > interest is the digitalSignature. The digitalSignature usage is > typically used for code signing (integrity). > > Within the "Add CA enforcement key restrictions" [2] series, the > digitalSignature is being saved. This series builds upon the previous > one and adds restrictions based on the digitalSignature usage. > > A new keyring restriction called restrict_link_by_digsig is added. The new > restriction only allows keys that contain digitalSignature usage within > it. > > The first two keyrings to use this restriction are the .ima and .evm > keyrings. With this update, only keys containing a digitalSignature > will be allowed in either keyring. ... and disallowed if not (for completeness)? Maybe you want to say that "With this update, keys can be filtered based on digitalSignature"? I know, it is only cover letter, not a big deal... > > 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3 > 2. https://lore.kernel.org/all/20230329220231.h6afgarrvdlwwdjc@kernel.org/T/ > > Eric Snowberg (3): > KEYS: DigitalSignature link restriction > integrity: Enforce digitalSignature usage in the ima and evm keyrings > integrity: Remove EXPERIMENTAL from Kconfig > > certs/system_keyring.c | 52 +++++++++++++++++++++++++++++++ > crypto/asymmetric_keys/restrict.c | 44 ++++++++++++++++++++++++++ > include/crypto/public_key.h | 11 +++++++ > include/keys/system_keyring.h | 11 +++++++ > security/integrity/digsig.c | 4 +-- > security/integrity/evm/Kconfig | 3 +- > security/integrity/ima/Kconfig | 5 +-- > 7 files changed, 125 insertions(+), 5 deletions(-) > > > base-commit: ac9a78681b921877518763ba0e89202254349d1b > -- > 2.27.0 BR, Jarkko