Re: [GIT PULL for v7.4] vfs keyring

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Sat, 2026-10-24 at 12:44 +0200, Christian Brauner wrote:
> Hey Linus,
> 
> This is a delayed pull request which was waiting for the bpf merge.
> This used a shared branch.
> 
> /* Summary */
> This adds well-known key ids for the .dm-verity and .fs-verity
> keyrings.
> 
> Neither keyring is linked into any other keyring so request_key() and
> KEYCTL_SEARCH can't find them. Userspace has to scrape the serial out
> of /proc/keys before it can add a key to either of them. That's not
> great as any user can add a key with a newline in its description and
> make /proc/keys show a fake .dm-verity keyring line with whatever
> serial they like.
> 
> /* Testing */
> 
> No build failures or warnings were observed.
> 
> /* Conflicts */
> 
> Merge conflicts with mainline
> =============================
> 
> No known conflicts.
> 
> Merge conflicts with other trees
> ================================
> 
> No known conflicts.
> 
> The following changes since commit
> 1b7415bf70be95b9a1e7e87d544867881065613f:
> 
>   Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc2
> (2026-09-06 16:17:40 -0700)
> 
> are available in the Git repository at:
> 
>   git@gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-
> 7.4-rc1.keyring
> 
> for you to fetch changes up to
> 503b65da9a7e5447d91222f62399522f2f62a0fa:
> 
>   Merge patch series "keys: Add well known IDs for fs-verity/dm-
> verity keys" (2026-10-12 23:37:42 +0200)
> 
> ----------------------------------------------------------------
> vfs-7.4-rc1.keyring
> 
> Please consider pulling these changes from the signed vfs-7.4-
> rc1.keyring tag.
> 
> Thanks!
> Christian
> 
> ----------------------------------------------------------------
> Andrew Halaney (3):
>       keys: add KEY_SPEC_DM_VERITY_KEYRING
>       keys: add KEY_SPEC_FS_VERITY_KEYRING
>       Documentation: keys: document IDs added since
> KEY_SPEC_REQKEY_AUTH_KEY

It would actually have been nice to copy the keyrings list and
maintainers on this.  I don't think there's an objection but not cc'ing
the list and maintainers makes it look like some type of end run.

> Christian Brauner (2):
>       Merge bpf keyring work from of
> git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
>       Merge patch series "keys: Add well known IDs for fs-verity/dm-
> verity keys"

This is a bit nasty because the keyring specs get renumbered inside the
merges ... it would have been much clearer to people looking at the
history if the patches were rebased instead.

Regards,

James