On Tue, 2022-03-01 at 12:36 -0500, Eric Snowberg wrote: I would begin by saying, The "Enroll kernel keys thru MOK" patch set introduced a new root of trust by defining a "machine" keyring, which is linked to the secondary_trusted_keyring. All Machine Owner Keys (MOK) are loaded into the machine keyring. Then proceed with the IMA new root of trust requirements - root CA (self-signed CA) with keyUsage limited to keyCertSign. > A key added to the IMA keyring must be signed by a key contained in either the ^A certificate ... must be signed > built-in trusted or secondary trusted keyring. IMA also requires these keys > to be a CA. The only option for an end-user to add their own CA is to compile > it into the kernel themselves or to use the insert-sys-cert. Many end-users > do not want to compile their own kernels. With the insert-sys-cert option, > there are missing upstream changes. > > Currently, all Machine Owner Keys (MOK) load into the machine keyring. Moved to the beginning. > Add ^Define > > a new Kconfig option to only allow CA keys into the machine keyring. When Add the other criteria here as well. > compiled with the new INTEGRITY_MACHINE_KEYRING_CA_ENFORCED Kconfig, non CA > keys will load into the platform keyring instead. This will allow the end- > user to enroll their own CA key into the machine keyring for use with IMA. > > These patches are based on Jarkko's linux-tpmdd tree. > git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git thanks, Mimi
