Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Eric Snowberg <eric.snowberg@xxxxxxxxxx>, keyrings@xxxxxxxxxxxxxxx, linux-integrity@xxxxxxxxxxxxxxx, dhowells@xxxxxxxxxx, dwmw2@xxxxxxxxxxxxx, herbert@xxxxxxxxxxxxxxxxxxx, davem@xxxxxxxxxxxxx, jarkko@xxxxxxxxxx, jmorris@xxxxxxxxx, serge@xxxxxxxxxx
Subject: Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
From: Mimi Zohar <zohar@xxxxxxxxxxxxx>
Date: Wed, 17 Nov 2021 08:18:26 -0500
Cc: keescook@xxxxxxxxxxxx, torvalds@xxxxxxxxxxxxxxxxxxxx, weiyongjun1@xxxxxxxxxx, nayna@xxxxxxxxxxxxx, ebiggers@xxxxxxxxxx, ardb@xxxxxxxxxx, nramas@xxxxxxxxxxxxxxxxxxx, lszubowi@xxxxxxxxxx, jason@xxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, linux-crypto@xxxxxxxxxxxxxxx, linux-efi@xxxxxxxxxxxxxxx, linux-security-module@xxxxxxxxxxxxxxx, James.Bottomley@xxxxxxxxxxxxxxxxxxxxx, pjones@xxxxxxxxxx, konrad.wilk@xxxxxxxxxx
In-reply-to: <20211116001545.2639333-3-eric.snowberg@oracle.com>
References: <20211116001545.2639333-1-eric.snowberg@oracle.com> <20211116001545.2639333-3-eric.snowberg@oracle.com>

On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:
> The machine keyring is setup during init.  No additional keys should be
> allowed to be added afterwards.  Leave the permission as read only.
> 
> Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx>

Reviewed-by:  Mimi Zohar <zohar@xxxxxxxxxxxxx>

References:
- [PATCH v7 00/17] Enroll kernel keys thru MOK
  - From: Eric Snowberg
- [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
  - From: Eric Snowberg

Prev by Date: Re: [PATCH v7 02/45] x86/sev: detect/setup SEV/SME features earlier in boot
Next by Date: Re: [PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature
Previous by thread: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init
Next by thread: [PATCH v7 06/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca
Index(es):
- Date
- Thread

[Index of Archives] [Linux ARM Kernel] [Linux ARM] [Linux Omap] [Fedora ARM] [IETF Annouce] [Security] [Bugtraq] [Linux OMAP] [Linux MIPS] [ECOS] [Asterisk Internet PBX] [Linux API]