From: Bruno Meneguele <bmeneg@xxxxxxxxxx> redhat: load specific ARCH keys to INTEGRITY_PLATFORM_KEYRING In the current upstream kernel state all RHEL supported arches (aarch64, x86_64, s390x and powerpc) supports loading platform keys (coming from the boot process) to a trusted keyring in the system. This patch enables CONFIG_INTEGRITY_PLATFORM_KEYRING to all ARK arches and each CONFIG_LOAD_<arch>_KEYS to their respective architecture folder. Signed-off-by: Bruno Meneguele <bmeneg@xxxxxxxxxx> diff a/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS b/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS --- /dev/null +++ b/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_UEFI_KEYS=y diff a/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS b/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS --- /dev/null +++ b/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_PPC_KEYS=y diff a/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS b/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS --- /dev/null +++ b/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_IPL_KEYS=y diff a/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS b/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS --- /dev/null +++ b/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_UEFI_KEYS=y diff a/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING b/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING --- a/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING +++ b/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING @@ -1 +1 @@ -# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set +CONFIG_INTEGRITY_PLATFORM_KEYRING=y diff a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS --- /dev/null +++ b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_UEFI_KEYS=y diff a/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING b/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING --- /dev/null +++ b/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING @@ -0,0 +1 @@ +# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set diff a/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS b/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS --- /dev/null +++ b/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_PPC_KEYS=y diff a/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS b/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS --- /dev/null +++ b/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS @@ -0,0 +1 @@ +CONFIG_LOAD_IPL_KEYS=y diff a/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING b/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING --- a/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING +++ /dev/null @@ -1 +0,0 @@ -CONFIG_INTEGRITY_PLATFORM_KEYRING=y -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127 _______________________________________________ kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
