On 12/03/22 2:33 am, Nayna Jain wrote:
Some firmware support secure boot by embedding static keys to verify the
Linux kernel during boot. However, these firmware do not expose an
interface for the kernel to load firmware keys onto the ".platform"
keyring, preventing the kernel from verifying the kexec kernel image
signature.
This patchset exports load_certificate_list() and defines a new function
load_builtin_platform_cert() to load compiled in certificates onto the
".platform" keyring.
Changelog:
v12:
* Replace Patch 3/4 with reverting of the commit as suggested by
Masahiro Yamada.
Tested the following four patches ov v12 with and with out setting
CONFIG_INTEGRITY_PLATFORM_KEYS
Tested-by: Nageswara R Sastry <rnsastry@xxxxxxxxxxxxx>
1. With CONFIG_INTEGRITY_PLATFORM_KEYS set to a key
# grep pem .config
CONFIG_INTEGRITY_PLATFORM_KEYS="certs/kernel.pem"
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
# grep
"CONFIG_INTEGRITY_PLATFORM_KEYS\|INTEGRITY_PLATFORM_KEYRING\|SYSTEM_REVOCATION_LIST"
.config
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYS="certs/kernel.pem"
# CONFIG_SYSTEM_REVOCATION_LIST is not set
# cat /proc/keys | grep platform
0a7a11a9 I------ 1 perm 1f0b0000 0 0 keyring .platform: 1
# keyctl show %keyring:.platform
Keyring
175772073 ---lswrv 0 0 keyring: .platform
519271447 ---lswrv 0 0 \_ asymmetric: IBM Corporation:
Guest Secure Boot Imprint Kernel Signing Key:
a0cf9069c30875320cb10a77325d4fa7012f8d12
2. With out CONFIG_INTEGRITY_PLATFORM_KEYS set, leaving empty
# grep pem .config
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"
# grep
"CONFIG_INTEGRITY_PLATFORM_KEYS\|INTEGRITY_PLATFORM_KEYRING\|SYSTEM_REVOCATION_LIST"
.config
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYS=""
# CONFIG_SYSTEM_REVOCATION_LIST is not set
# cat /proc/keys | grep platform
39c749b9 I------ 1 perm 1f0b0000 0 0 keyring .platform: empty
# keyctl show %keyring:.platform
Keyring
969361849 ---lswrv 0 0 keyring: .platform
base-commit: fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9
--
Thanks and Regards
R.Nageswara Sastry
