| Message ID | 20220105235012.2497118-8-eric.snowberg@oracle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Enroll kernel keys thru MOK | expand |
On Wed, Jan 05, 2022 at 06:50:11PM -0500, Eric Snowberg wrote: > A new Machine Owner Key (MOK) variable called MokListTrustedRT has been > introduced in shim. When this UEFI variable is set, it indicates the > end-user has made the decision themselves that they wish to trust MOK keys > within the Linux trust boundary. It is not an error if this variable > does not exist. If it does not exist, the MOK keys should not be trusted > within the kernel. > > Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> > --- > v1: Initial version > v2: Removed mok_keyring_trust_setup function > v4: Unmodified from v2 > v5: Rename to machine keyring > v6: Unmodified from v5 > v7: Use mokvar table instead of EFI var (suggested by Peter Jones) > v9: Unmodified from v7 > --- > .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++ > 1 file changed, 19 insertions(+) > > diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c > index ea2ac2f9f2b5..09fd8f20c756 100644 > --- a/security/integrity/platform_certs/machine_keyring.c > +++ b/security/integrity/platform_certs/machine_keyring.c > @@ -5,6 +5,7 @@ > * Copyright (c) 2021, Oracle and/or its affiliates. > */ > > +#include <linux/efi.h> > #include "../integrity.h" > > static __init int machine_keyring_init(void) > @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t > if (rc) > pr_info("Error adding keys to machine keyring %s\n", source); > } > + > +/* > + * Try to load the MokListTrustedRT MOK variable to see if we should trust > + * the MOK keys within the kernel. It is not an error if this variable > + * does not exist. If it does not exist, MOK keys should not be trusted > + * within the machine keyring. > + */ > +static __init bool uefi_check_trust_mok_keys(void) > +{ > + struct efi_mokvar_table_entry *mokvar_entry; > + > + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT"); > + > + if (mokvar_entry) > + return true; > + > + return false; > +} > -- > 2.18.4 > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> BR, Jarkko
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c index ea2ac2f9f2b5..09fd8f20c756 100644 --- a/security/integrity/platform_certs/machine_keyring.c +++ b/security/integrity/platform_certs/machine_keyring.c @@ -5,6 +5,7 @@ * Copyright (c) 2021, Oracle and/or its affiliates. */ +#include <linux/efi.h> #include "../integrity.h" static __init int machine_keyring_init(void) @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t if (rc) pr_info("Error adding keys to machine keyring %s\n", source); } + +/* + * Try to load the MokListTrustedRT MOK variable to see if we should trust + * the MOK keys within the kernel. It is not an error if this variable + * does not exist. If it does not exist, MOK keys should not be trusted + * within the machine keyring. + */ +static __init bool uefi_check_trust_mok_keys(void) +{ + struct efi_mokvar_table_entry *mokvar_entry; + + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT"); + + if (mokvar_entry) + return true; + + return false; +}
A new Machine Owner Key (MOK) variable called MokListTrustedRT has been introduced in shim. When this UEFI variable is set, it indicates the end-user has made the decision themselves that they wish to trust MOK keys within the Linux trust boundary. It is not an error if this variable does not exist. If it does not exist, the MOK keys should not be trusted within the kernel. Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> --- v1: Initial version v2: Removed mok_keyring_trust_setup function v4: Unmodified from v2 v5: Rename to machine keyring v6: Unmodified from v5 v7: Use mokvar table instead of EFI var (suggested by Peter Jones) v9: Unmodified from v7 --- .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)