> On Oct 17, 2024, at 10:16 AM, Jarkko Sakkinen <jarkko@xxxxxxxxxx> wrote: > > On Thu, 2024-10-17 at 09:55 -0600, Eric Snowberg wrote: >> Introduce system_key_link(), a new function to allow a keyring to >> link >> to a key contained within one of the system keyrings (builtin, >> secondary, >> or platform). Depending on how the kernel is built, if the machine >> keyring is available, it will be checked as well, since it is linked >> to >> the secondary keyring. If the asymmetric key id matches a key within >> one >> of these system keyrings, the matching key is linked into the passed >> in >> keyring. >> >> Signed-off-by: Eric Snowberg <eric.snowberg@xxxxxxxxxx> >> --- >> certs/system_keyring.c | 30 ++++++++++++++++++++++++++++++ >> include/keys/system_keyring.h | 7 ++++++- >> 2 files changed, 36 insertions(+), 1 deletion(-) >> >> diff --git a/certs/system_keyring.c b/certs/system_keyring.c >> index e344cee10d28..4abee7514442 100644 >> --- a/certs/system_keyring.c >> +++ b/certs/system_keyring.c >> @@ -20,6 +20,9 @@ >> static struct key *builtin_trusted_keys; >> #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING >> static struct key *secondary_trusted_keys; > > /* > * Explain system_trusted_keys (nothing too detailed, only the gist) > */ > >> +#define system_trusted_keys secondary_trusted_keys >> +#else >> +#define system_trusted_keys builtin_trusted_keys >> #endif >> #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING >> static struct key *machine_trusted_keys; > > We have enough these to make this quite convoluted so let's put some > helpful reminders. I would forget this in no time ;-) So if it comes > down to that, please put something because I have a goldfish memory. I'll add a comment explaining this in the next round, thanks.
