Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Subject: Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
From: Mimi Zohar <zohar@xxxxxxxxxxxxx>
Date: Wed, 17 Nov 2021 08:18:26 -0500
Cc: keescook@xxxxxxxxxxxx, torvalds@xxxxxxxxxxxxxxxxxxxx, weiyongjun1@xxxxxxxxxx, nayna@xxxxxxxxxxxxx, ebiggers@xxxxxxxxxx, ardb@xxxxxxxxxx, nramas@xxxxxxxxxxxxxxxxxxx, lszubowi@xxxxxxxxxx, jason@xxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-crypto@xxxxxxxxxxxxxxx, linux-efi@xxxxxxxxxxxxxxx, linux-security-module@xxxxxxxxxxxxxxx, James.Bottomley@xxxxxxxxxxxxxxxxxxxxx, pjones@xxxxxxxxxx, konrad.wilk@xxxxxxxxxx
In-reply-to: <20211116001545.2639333-3-eric.snowberg@oracle.com>
References: <20211116001545.2639333-1-eric.snowberg@oracle.com> <20211116001545.2639333-3-eric.snowberg@oracle.com>

On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> The machine keyring is setup during init.  No additional keys should be
> allowed to be added afterwards.  Leave the permission as read only.
> 
> Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx>

Reviewed-by:  Mimi Zohar <zohar@xxxxxxxxxxxxx>

References:
- [PATCH v7 00/17] Enroll kernel keys thru MOK
  - From: Eric Snowberg
- [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
  - From: Eric Snowberg

Prev by Date: Re: [PATCH v7 01/17] integrity: Introduce a Linux keyring called machine
Next by Date: Re: [PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature
Previous by thread: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
Next by thread: [PATCH v7 07/17] integrity: Fix warning about missing prototypes
Index(es):
- Date
- Thread

[Index of Archives] [Kernel] [Gnu Classpath] [Gnu Crypto] [DM Crypt] [Netfilter] [Bugtraq]

Powered by Linux