From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE, SPF_PASS,USER_AGENT_SANE_1,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 027CFCA9EC1 for ; Mon, 28 Oct 2019 15:56:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CDE7120717 for ; Mon, 28 Oct 2019 15:56:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=linux.microsoft.com header.i=@linux.microsoft.com header.b="lGKd8I/H" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731297AbfJ1P45 (ORCPT ); Mon, 28 Oct 2019 11:56:57 -0400 Received: from linux.microsoft.com ([13.77.154.182]:36340 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726550AbfJ1P45 (ORCPT ); Mon, 28 Oct 2019 11:56:57 -0400 Received: from [10.137.112.108] (unknown [131.107.174.108]) by linux.microsoft.com (Postfix) with ESMTPSA id 282CA20F3BFA; Mon, 28 Oct 2019 08:56:56 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 282CA20F3BFA DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1572278216; bh=0vTE/qkV4STG3iuGENrPgUCwQXT0AQDILjLoO16GOWg=; h=Subject:To:References:From:Date:In-Reply-To:From; b=lGKd8I/HWZ08jSVY9QbBMiIYNCiViY5cVGbBavRxR6xY9dCLaiIej2XLuZvXWnPSC PnA3SMOqatcRAaa1duOmX/7vsKWGFER7nVdRs2bjyGlUquYXvJE0I0Hypgh9Eup5tv LPtTp1jcbVutXmGfcjhYhb4Monjmc+PVnr7uvX70= Subject: Re: [PATCH v2 3/4] KEYS: Added BUILTIN_TRUSTED_KEYS enum to measure keys added to builtin_trusted_keys keyring To: Mimi Zohar , dhowells@redhat.com, casey@schaufler-ca.com, sashal@kernel.org, jamorris@linux.microsoft.com, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org References: <20191023233950.22072-1-nramas@linux.microsoft.com> <20191023233950.22072-4-nramas@linux.microsoft.com> <1572186810.4532.206.camel@linux.ibm.com> From: Lakshmi Ramasubramanian Message-ID: <0c81515a-0f0c-cec4-941f-3de4a8bc8a2c@linux.microsoft.com> Date: Mon, 28 Oct 2019 08:56:52 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.0 MIME-Version: 1.0 In-Reply-To: <1572186810.4532.206.camel@linux.ibm.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/27/19 7:33 AM, Mimi Zohar wrote: > Other examples of trusted keyrings are: .ima, .evm, .platform, > .blacklist, .builtin_regdb_keys.  Instead of defining a keyring > specific method of getting the keyring number, define a generic > method.  For example, the userspace command "keyctl describe > %keyring:.builtin_trusted_keys" searches /proc/keys, but the kernel > shouldn't need to access /proc/keys. "description" field in "struct key" is set to ".builtin_trusted_keys" for Built-In Trusted Keys keyring. Similarly, for other keyrings such as .ima, .evm, .blacklist, .builtin_regdb_keys, etc. > # measure keys on the BUILTIN and IMA keyrings into a different PCR > measure func=KEYRING_CHECK keyring=".builtin_trusted_keys|.ima" pcr=11 With IMA policy set like above, the keyring to keyring number mapping can be set at IMA policy load. My earlier point about mapping the "keyring" to "keyring number" at runtime (when the IMA hook is called) still needs to be done to know if the given keyring is in the policy or not. void ima_post_key_create_or_update(struct key *keyring, struct key *key, unsigned long flags, bool create) thanks, -lakshmi