From patchwork Wed Jan 5 23:50:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 530245 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B26F4C43219 for ; Wed, 5 Jan 2022 23:51:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245664AbiAEXvu (ORCPT ); Wed, 5 Jan 2022 18:51:50 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:43462 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245574AbiAEXvG (ORCPT ); Wed, 5 Jan 2022 18:51:06 -0500 Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 205N513Q032380; Wed, 5 Jan 2022 23:50:34 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=qhaiuoscMrCdKDZ5kfEtc647pOV6jruwyhnlcfy+kxg=; b=OpaZ6kufQ3BaPONm9NzSmvspjAoTeF835VO5u442lECPjkRnCFfp8NsUCP320f8Lsu1u mFxCfSRR2atINY9zQJZ2inl0T/8Qyc8VThDjIFy8UKSGvdZLaioPXxfGLgcn7MhRLno5 Xe4ERKYu+Wvyc+AfuzOVaImg95UmI82d3b1MPW9nCPzizeiOp3paAryCNDSTUPym5A0E FSGDaxrsEst+xmpwZh7emUnxXJuKs6BlDLcOSnzN0CJrabdjTq+ABBE0rNXbvQ/RVLv9 JSbHrmo/spJay/LP/xhq5FRfFKeVd50/N30X8oz+NkOBdVS55q4iZSaPQcwawn2KIoVg 3A== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3ddmpjr228-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:34 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 205NjfZ3150022; Wed, 5 Jan 2022 23:50:33 GMT Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2170.outbound.protection.outlook.com [104.47.56.170]) by aserp3020.oracle.com with ESMTP id 3ddmqa1j7v-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:33 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M67h9JTd2dtEsoFj1knCDYNalp6jYBtou2mXYRtYnSQZGVxKC4cQq3ccBMLFGbpQAYgMikbh7ptdEpe6S5VVkakp6VXpxYMUsS3UajfljHKPREHwaQ/hmTAawh4zuoHeEeeyiUbSKYrY0FArr9yvejvGZ8qr1HOvFoNAjtWpLCTqK6OPOulLiDG3N+Zev/f588wUTmBPc2dqHoVWA07qm0rIC3ffyt8vAs4FeqkDOufez/cwdPMXhue5vbYIQA4FZf/dbcL7NawZC5XEIWURlpFYqP4+AEFbbJQ6A7jCeLTKpsqNstmxwa2h4b6XVDFItp45UArNbUFfk+QRFVW7tQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=qhaiuoscMrCdKDZ5kfEtc647pOV6jruwyhnlcfy+kxg=; b=NYCf4XPU9th/yDFAvLuDSWU4gPplUil4S1awnMevz+pJK8HqN6HQEhRBhR0Uc3DwPA4AtG/AzJucwzRmSTj2H1P2PhE3VhNdrP/p9Xdy0tAxsJaCIq7/EmEkO1P3rQllcA6yP1VRHrGskCA+JpOD7GzEkgpegLudiw4IgPLjEsbvwJRsixXrh5LMgPoASgNGsLrFrmTM1MhP1yZfAEqMi6mriZalz5Deuxg92NSBeff0k3+bllpeTpHthJFNbD9NRy1vkK/GcdxhihiRLF6LxQTiKkS7+JJG0xzGJrGLFqCMQgKjiX0yI/ROfC6FPK3Z9FP5hQRIbighA9CUfa0k6A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=qhaiuoscMrCdKDZ5kfEtc647pOV6jruwyhnlcfy+kxg=; b=aSYzXYvls/woRL65AD1lA9NUsQqPFJZbctS2e+bk+4fXDu8A87dWcZWBXFilj2DVrZSskLFN8x24sguA0LwqWgUzQaRRMkkypiar21slfQE4Pat2Inw5EcLoKZRvEDDUmsAjqFsgKoaAs7AY1sB28fYVj+mPHNidN6se/k15bmo= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5034.namprd10.prod.outlook.com (2603:10b6:610:c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4844.15; Wed, 5 Jan 2022 23:50:32 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%4]) with mapi id 15.20.4867.009; Wed, 5 Jan 2022 23:50:32 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v9 1/8] integrity: Fix warning about missing prototypes Date: Wed, 5 Jan 2022 18:50:05 -0500 Message-Id: <20220105235012.2497118-2-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com> References: <20220105235012.2497118-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN4PR0501CA0095.namprd05.prod.outlook.com (2603:10b6:803:22::33) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 81dd07da-55c5-4faa-79c4-08d9d0a628f4 X-MS-TrafficTypeDiagnostic: CH0PR10MB5034:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:115; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Q5cgA3eYW9AgKOesWTDr4O7uV2S7WwSXX9k/D05H5yNxfpU6cXrlF+YPbzz9k/9Hh1KgK9oVfcjkhikuiUbJZx2HxqU3O1XES0kTyhWCkZ9U/Rgt/EOEUE0NAk4gvVCf8K5cpqgyBDgoDdEwyE507Ox+SkhOiPSgPRwNchYzJ0Hz+BX1RYrr2yjds1iELZqA3C2JALgQflpsL3ejkzgcAObUhLjfzvNYNQ1b1VE1FGFuczMa6Wj2wtTAHx2sUVpH05O119PorRxqlZvWu6z/sL8ThKTEnhs3YCroL6mwKCZ3u4q3CYsIEZqkACoguzJa0vfIkBiA8LuQkRlsk7bjsW2HYXvCh52w/DL5eDg6zSwAtaUCxa9yaERFW+7F+NEPJdjbHrtsIx87C2KvUqm8qGp/NFSCrQ4fgADDdFXpzVcoceZ5a8eI/sONN4H+Eksuk9VGXf54he6LsBzjLaxpRUfMUP0yGwgCEN8ZGsbQRJhzQNrdEaF+6CDSneZosO0D9hZkz2RoJuIjng+U8wYfQ6MEazrZ6uBUfzB1ctuZN/8n2fh3yRpLcOp7fHvUGBLbLuDNP8NJUTISuu7x3p48I/WGhl9nK4+De9J7nS0SAaFdf6qKtL3Bt342YtHB5xGfAyFLxhSjB/ayXPk2dNIpx6rWQpmKlWlyyM/+/9UtfHHlqSPAkr1o5lAf6TtT9LcvjnP3lhCdZDG3znSu/Eb0SA== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(186003)(6512007)(8676002)(316002)(2906002)(66556008)(6506007)(508600001)(8936002)(66476007)(52116002)(2616005)(86362001)(66946007)(4326008)(7416002)(36756003)(38100700002)(107886003)(6666004)(44832011)(26005)(6486002)(5660300002)(83380400001)(1076003)(38350700002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 2RmgVBnts3JAWLbKkC3CYGYK2Sxgjy4a0Zpfi1n0LaXTcEfsRL0FIrUJFJDc7anfwW0kHjz+fV5ccFU4ovSW3s5vvgMz+SAM19PuLa845wkhGBM55WnQean4AlpHvHcaE4HSb8FMulvg8PxiSvtQABtVzsbvtO7eC+vsel4My1nqSFoT6LXB4Lu9SOE2cgwGU6x9PO2rf0pWIbeMThhDQyVQ0hhwKONgzfRS831P+QrsSGQW9ygPDm4LN6bXR/8ZsHSc5hpJXMYZeN87/1fvSSu+J/oOH8hPxKNo76EbueM3Xyo/EQVmQiBgE64Oh0JBORFcDnBYNet5vurUO1bm7800usnifVnRyXlQLR2tRbcrDqf0fZ4RN6Milt/zryTojPghpAGU2K1U+YB2xAPuDUu/Eba6FpSPAAV54rvna0ETGFJS4Rx5oDwU4kEwE0373JmJc6sfDJru0VKI4VWzr0v20ZyIPX+oG937zCizAmyBIQS9i6ONxr4QMuU4yHHH3KJuSZS+uyeT0STHtp+ezsSDuZizdIHYfAcKRRJpcQJzl5siSBt/V09ZB+gB1aC3YBS0dbxt/5aQxB7WFH+JMTu7c7iANYZjAfvW2s3tv6j4isnz63fpwz/MSB23Gas9DjSZhj29kL1AtYePQdAMH9W+/ouT1vsAexshBbch9gCIe7i6qrB9aVFj8iFEgehGmGTqxMnm2eJ3osQ2sWavOL5bZoCrtpvythCnl2cWFN937nfTJEfbXCmR3WEdzslf46rr0ZPxSejMs66QLENBVxHt4gXMrWAd1liGNHj5x1pnGsqfzVB/UyPngTSWW63aU5T/wA//RdoYny+IhFZMKGkOtP1pxgqdj94axQZAdHWrXKLraIVM6IEFekndyKdRLq1Dwps4wt8mj1tMwOUeR4fUi/61eQ7WneZs7ksKIlqphUkium59vS0zWXp3TEUHkQbGutvzjH3bYnnzlatU9LqvWmEuXycYtfSItwfj6EYdHOBSbLTFZoeBsyRopB2tJ5Sg16Tn0s+bYlnXvKnpUf+ndc6clFSlqF5DcM7C0m8VKeU0VFvVLkwbsnBNKdiGZnwy1xeJYjhDLTnEuzItZyRIaqzmn3azannLiz5yJ4DOxGTiNCV7ilITescAI09FuwYei6ZUelHTsAs/p9keAOTy3uRQ0DG/hxuysxmdZLAexhBU0ipK81GqjVek3MV7tvCtPS/qHQMhyLJUVzSy2/AoJATB1/6GlKaZ5/hlcHaMkREhe7FLYqevPyZKSGq5vCnFJGi6iUTh48mn1BON0WNJlYO0x0+VGSiA/5CyZdF/5I2Bw/qymC/aWJL6f1Uu9+16LfOQ91cB7G6H/gaSz2rlP0VxcwQC4Ub0RqypN6ae5OuFcR8JHf5jqcKjeBr/K1ZlUdVq8fkLOC8CqbxzgKPgVmZR+2fBEUqh51lF4ItlFeuIu4EdRVGnX443ySG3cdSgzJhdExKq40xdSWdgI4s7kPoCxsY9fzrP/sctasvX+Cj9H3K2LV6DSH4KgZgYK2cyzbfpSRHJM/05sLaR/+YC36SEgaMn2DQw7L5DOH5T7Y5PFLbywCpnCcKNSCS0B8AP9+Ozqkfzq0Tn25bOsiY8nYyEFtSWOEDPBSkEuIA5UPgNGQ0V4YsRtzXe+t3oG4cfXjzAIm3FJNC68oarqw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 81dd07da-55c5-4faa-79c4-08d9d0a628f4 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:32.0987 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Zk/jPpS8+6E0vLfstfN9jkUH0b6orpOc/nkcr2q7DIME6H2R5LFyUGoJOhI0SrNeAzEEaygH9rKWjSltlOUXDae8Cwex9N2XDOj/3b+Fn+A= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5034 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 suspectscore=0 bulkscore=0 mlxlogscore=999 phishscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000 definitions=main-2201050150 X-Proofpoint-ORIG-GUID: K-YdHiGYpLdAEuftd6HeGCBRoH3JxaGu X-Proofpoint-GUID: K-YdHiGYpLdAEuftd6HeGCBRoH3JxaGu Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org make W=1 generates the following warning in keyring_handler.c security/integrity/platform_certs/keyring_handler.c:71:30: warning: no previous prototype for get_handler_for_db [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~ security/integrity/platform_certs/keyring_handler.c:82:30: warning: no previous prototype for get_handler_for_dbx [-Wmissing-prototypes] __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t *sig_type) ^~~~~~~~~~~~~~~~~~~ Add the missing prototypes by including keyring_handler.h. Reported-by: kernel test robot Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen --- v7: Initial version v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Unmodified from v8 --- security/integrity/platform_certs/keyring_handler.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index 5604bd57c990..e9791be98fd9 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -9,6 +9,7 @@ #include #include #include "../integrity.h" +#include "keyring_handler.h" static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; static efi_guid_t efi_cert_x509_sha256_guid __initdata = From patchwork Wed Jan 5 23:50:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 530244 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4158CC433F5 for ; Wed, 5 Jan 2022 23:51:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245582AbiAEXvz (ORCPT ); Wed, 5 Jan 2022 18:51:55 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:44396 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245577AbiAEXvG (ORCPT ); Wed, 5 Jan 2022 18:51:06 -0500 Received: from pps.filterd (m0246631.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 205N4xkU009805; Wed, 5 Jan 2022 23:50:38 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=QMEi5O3Jl5Afjymh1AR4uk3WdVIfSf7Sv5iPeWL0JkQ=; b=YUDQFF0pO8LsmJevMQ+lRMfcjGLk8+YtQm4l7FIodg3uykmV+phm3EVrgM0V9xRAwzu9 MXSsyGm0yBqoOuG/eAwS4+1AeXF889GCVWMgxmocKMD8oSFtuLpbQxX2sQSzrdCJT5EW H90idhtdQ0uqpNM6fFH0iAUgcmlCBgkTTtLlAE5fu15MPurHTcv9qzGi6f1oeeStvVYk MD9UdLqWW01mFtL6GVdat2qAMPqARsyaEODDyjk/GLkqQ/clDgzjGH9CulEWUthx17ZQ K8JQqozzsgaJEu2eVEe06ycO0VL0KGouS4N88z7uPa+F9KLPef2Ay1y3YYAPa+kow6iC Ew== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3ddmpp81yt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:37 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 205NjHnR177004; Wed, 5 Jan 2022 23:50:36 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2044.outbound.protection.outlook.com [104.47.74.44]) by userp3020.oracle.com with ESMTP id 3ddmq5shb6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:36 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jwjr84a5/PlYxQ92ahUB9ilmDypAEK1XUb0JoYEKMFjs6tCvFZ3mzW9kllwBUlB2uYqOIIbF2TMKBpVSF2zv2zPeJL3OBRPk/FBktaVyw3jpUVg6IkIhi3gDDweJ2O99MXwgdJHIrnebcZIJQ0w+nkNthjxsuhUpOuZoqWrQFhS0L1U5re/jFXPd6AqUcVteMw2FcOR9iogKAmdwQ1bxmYa6cP4zt296jhAgD/eMOeM6voSLicpqi9TFO8K/W11Q2Deppp55RCwZ9i0R/OFO7vSw8lpheU5qW7Egz1Og+PW7R//uNIwKiudDkRZJv4GOgEx5oGbf2vgpu5IdET21JQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QMEi5O3Jl5Afjymh1AR4uk3WdVIfSf7Sv5iPeWL0JkQ=; b=JIRS5t6JfL7fQpNK1AryL1yJIg4BHWmI7iTXW6IALJqdVUbrpIFnFb/Cm2pgdQlYzDHdxavEhFTPr/FSwq2Efa69OyQ7059ykN5v/KZU+aIKAS75MQUNTcvCy5B20Ygo7u8VRqkdPYA9AL8QlGTC0YvHUcGDeYItIJEdWonyK6TSmAaA3hxGiqdD6tY6zzB6TMOBpb5ERecrsRjc+wNMRO4L2HS5JvV0nt/I0jjci38gAKDSd8jGS+zv8vxdY7OBA7R4MhcbDjq2lXjy4AZKzb8hD4z6nbLg0+oVsXhThWAf0dmIgK2UCmpAeEuj+5ZpIBnHyqpB1t5PpVN4Wgq9Gw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=QMEi5O3Jl5Afjymh1AR4uk3WdVIfSf7Sv5iPeWL0JkQ=; b=hxZy+vM2gsOrmyQ2EMYQKYbhOr6qNzAcgKkTQPd1zh10cXYrahIq3c6X/NLRita2Mg7RY0Ee4Tg4W39fUrh9JdNT1wsWbgVbBX6t248ozuqkhYfo8ehmOE72aLQqBBK5tn8T8D3R75eUpmyrgVxcZ3wr9OU89oq4otICiTegLrs= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5034.namprd10.prod.outlook.com (2603:10b6:610:c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4844.15; Wed, 5 Jan 2022 23:50:34 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%4]) with mapi id 15.20.4867.009; Wed, 5 Jan 2022 23:50:34 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v9 2/8] integrity: Introduce a Linux keyring called machine Date: Wed, 5 Jan 2022 18:50:06 -0500 Message-Id: <20220105235012.2497118-3-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com> References: <20220105235012.2497118-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN4PR0501CA0095.namprd05.prod.outlook.com (2603:10b6:803:22::33) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 4cf19a74-817c-4b4a-043b-08d9d0a62a26 X-MS-TrafficTypeDiagnostic: CH0PR10MB5034:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:6790; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: oD7gbShQI75/HawdJXm0cZQH3zSSxO7WE+9uPz7mOwodBwrqQCcms/z7o247VVGahthhDQae8+2HhDT9bGXV0sgfVTOuxQkVm6aXEIOhjsOYHjQBXvr06QEdla2QA9Zen1tMkk1ZPYp9YfKgeDZBeJESniqacE44LnpzyCmsrF3ZE4RR7NZdrjvZ54h0FeJYocfHzXsO8hqTWjdg5v3mFNrxrydwYpuykCaL34QXOpV4ffQt7RN+Q3do93MQjYfX8VPgzp5JDkPTL3R6Dt8pqrtWeO1AYkk5SgMUniKhiDxLGahaUI7SICJ2G0H7Ym+EzRQ7Sa8xpPvIkN0kq+WwWFP3fEClcd4ozG9WqBYdA89bqAl2z207EM2s6L0LY4rnmoJKcFCmwLjIgiSN23yNdvDtBtDWNCvroN21UieCu/ZZJ7IYerl30jkt0D+OO6plW7nj49dQkO2P6KZutboIUhZ7esp7o8WruC7c4nVX7tD60N37tITcCTzEWHYkHBW0Zqmb+UgAKWA3qN/Gxk2gt92Gd3LsZFnjTg1FGtybHzZbxqwxRTNqdVYJtEfTcXGTbRakSmnMffaog8DFdHLc9DeY7UfyuSB8fVEeIAUwx82PucbiFWThZvwvqc4qzdkyuLWIe6+kyYdlJtY4ySluVQfJFzwNYAVYjGmjQFMVXX4rYao9Qs3uB6ZUht/KVVUSj2HvnVVT9Ttc3L/HaMD5PQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(186003)(6512007)(8676002)(316002)(2906002)(66556008)(6506007)(508600001)(8936002)(66476007)(52116002)(2616005)(86362001)(66946007)(4326008)(7416002)(36756003)(38100700002)(107886003)(6666004)(44832011)(26005)(6486002)(5660300002)(83380400001)(1076003)(38350700002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: UEcPBf8x38qO6zvTBQyKx4hjAh1yluTTTST0yh7xM/TFxVLeSOyKKNtAKaa6UFtggCPSNob0mcKnYsrXl69hlloABlQYhW/2OglfsTbT8/JeDxe10XW64AHVkHL1gRb9kpbVdd9RMlwNUpVpLrgbGGi/UPxkNiEkLV8+W+XE2tgyNjKif8iXWufdycBjwzZWhvKiIQJeunJcmLuUv3AYPatLJ289GqZ2ExTGtYgKBfRpjqJ27H8UHmx1Z+QnLaSO0lBEgbNaO6Z+55HNy3/6E9GJB23BsQdMM5pPhNdukHpIEt/GbyElNooAWF+gByQ3eJkvjLrTGAtwQOMhcEpmQQHl9gfqGcx2w17rNxNVU0+OWyJFC+RY2S2fvWDc7tlHVNwdSaJLmmoVS/CNctyXkW5cPj07Jr47hKqLyycIx1GLSsP00zzdJLhenlqODFD+yAF7iSGQw4sZ86uuNridgpHve1Wu6La9TINet/XPoajCwCWEzDiuDWXoL9AGpB7UMPzNTc50X8Rxz1ecO/PDMZEZUgpB9kvp/mAh7DFQZIIiQvPtNHpKftp7EmpCiwcbVKDb6v4r4vef5m8w+NMWSXdphvzOJ8GuhqwJtIqwWb/Fzw+Fwk30hY7KWemHGWVMAzSRs+gDxvG2oLw6cg9+LQ852JhPLxNfAmWo1FreZ3OdUCiuQVxasT4wt0gJ/gNwOYQXqNh/AVMP+as1+c8f6/TKzBQQm3ypWXUmtMBzPjoI5A6rXANyU1HetyUoBeQhA7u5YPnwTSXs1fSXttJUgm4KqIiUjq7PkUjRZctqt0+9HlGCs5lKLssuAr7mOhzb9Bx3Secnftt/oPCOkmT8t22GOLcHW2SI70kQl1HnwLNib+bRN2cdonIjLo4RvwFVATOioa5g2gBQrWU0sa8qWscJbu6HzJIdVr0ea1GUNwkbNmu/CB3Uuy9p0pENQg7X78xQkKDW8dMCIADa0nKLIc7CMbaw26AHUb3LO7ADt6Gmcf9j02WXiLnIu49GTrnrsukyXqpLwoyTdXIwfxNP2uka/GWVCgweysATae3cxcv6dweuHBWeMUWsBerGGfgB9ezMX5Zg0yoHxR9AVj+oD726YPfrpdxVqjecWiCWmauu1Vf4yLoX4s65oXSwwQ97rsxAclOadkZ6kM26VJMRUz/5m6lm6axFFbENwJ6S2dWJ5rHuUlC9r1GrNlheBie5w8OWQqhJRZUeVc+m9HLhVCileFTKGi2Tj+rg7NRVucmVJ1NKNWfzuqgOpIbL/iSQnweRtvq0poKVxP+ksRUeiCmtZcl3OEUDWo/deTpUlaeOnJnItaK8TvpBzGWTPe0UfI27p5gvo64OUlTnhF0nmOyxTzW9ZAvVlukts0RPo0Ssqdg/rrOl6gH9EifALO8CppJATw86HNMmApEmkgJw3lhbvB+m+efFyLUr8QOasVNx7P4KvBa3VskZVpcCkhdY2hs0CK/q7yJ+9zCwe/AnZXolXfkTSDlnrDFuMxQGSOkvU+iF/TW2jFXVpMWVy+YG6Gs1nhiue7BBey7AKi729cj7807FYLPzjerxwtCUEdy72X0kokwGAHLiaf18tCuY8G0rLYUWQNnhnjZSjEJJwjXpWY4lfHXwYG7/z8Mem+hMq4Bn+w9jGgxMRgWGH+1Zqlwf7prN1EN7JW2+esulcA== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4cf19a74-817c-4b4a-043b-08d9d0a62a26 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:34.2105 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 63ExE4Lj9hxCb7pVKJOsJHORu79CMUkqGod1pGqaQlAiP92DBl8lQwDPeBrfYmyHLwK9rZA8PxP+/K7csNvQ7pSGJEmhyQY8pBGYXg5JXaA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5034 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0 spamscore=0 suspectscore=0 mlxlogscore=730 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000 definitions=main-2201050150 X-Proofpoint-ORIG-GUID: _G7SDdvkmCFLEdSrAsfR0wWBY89J13q0 X-Proofpoint-GUID: _G7SDdvkmCFLEdSrAsfR0wWBY89J13q0 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Many UEFI Linux distributions boot using shim. The UEFI shim provides what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure Boot DB and MOK keys to validate the next step in the boot chain. The MOK facility can be used to import user generated keys. These keys can be used to sign an end-users development kernel build. When Linux boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux .platform keyring. Define a new Linux keyring called machine. This keyring shall contain just MOK CA keys and not the remaining keys in the platform keyring. This new machine keyring will be used in follow on patches. Unlike keys in the platform keyring, keys contained in the machine keyring will be trusted within the kernel if the end-user has chosen to do so. Signed-off-by: Eric Snowberg --- v1: Initial version v2: Removed destory keyring code v3: Unmodified from v2 v4: Add Kconfig, merged in "integrity: add add_to_mok_keyring" v5: Rename to machine keyring v6: Depend on EFI in kconfig (suggested by Mimi) Test to see if ".platform" keyring is configured in add_to_machine_keyring (suggested by Mimi) v7: Depend on LOAD_UEFI_KEYS instead EFI for mokvar code v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Removed Reviewed-by. Prevent IMA from being able to use the machine keyring since the CA restrictions have been removed. --- security/integrity/Kconfig | 13 ++++++ security/integrity/Makefile | 1 + security/integrity/digsig.c | 13 +++++- security/integrity/integrity.h | 12 +++++- .../platform_certs/machine_keyring.c | 42 +++++++++++++++++++ 5 files changed, 78 insertions(+), 3 deletions(-) create mode 100644 security/integrity/platform_certs/machine_keyring.c diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index 71f0177e8716..de02964dd421 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -62,6 +62,19 @@ config INTEGRITY_PLATFORM_KEYRING provided by the platform for verifying the kexec'ed kerned image and, possibly, the initramfs signature. +config INTEGRITY_MACHINE_KEYRING + bool "Provide a keyring to which CA Machine Owner Keys may be added" + depends on SECONDARY_TRUSTED_KEYRING + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on LOAD_UEFI_KEYS + depends on !IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY + help + If set, provide a keyring to which CA Machine Owner Keys (MOK) may + be added. This keyring shall contain just CA MOK keys. Unlike keys + in the platform keyring, keys contained in the .machine keyring will + be trusted within the kernel. + config LOAD_UEFI_KEYS depends on INTEGRITY_PLATFORM_KEYRING depends on EFI diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 7ee39d66cf16..d0ffe37dc1d6 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -10,6 +10,7 @@ integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o +integrity-$(CONFIG_INTEGRITY_MACHINE_KEYRING) += platform_certs/machine_keyring.o integrity-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/efi_parser.o \ platform_certs/load_uefi.o \ platform_certs/keyring_handler.o diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 3b06a01bd0fd..2b7fa85613c0 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -30,6 +30,7 @@ static const char * const keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif ".platform", + ".machine", }; #ifdef CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY @@ -126,7 +127,8 @@ int __init integrity_init_keyring(const unsigned int id) perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH; - if (id == INTEGRITY_KEYRING_PLATFORM) { + if (id == INTEGRITY_KEYRING_PLATFORM || + id == INTEGRITY_KEYRING_MACHINE) { restriction = NULL; goto out; } @@ -139,7 +141,14 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; - perm |= KEY_USR_WRITE; + + /* + * MOK keys can only be added through a read-only runtime services + * UEFI variable during boot. No additional keys shall be allowed to + * load into the machine keyring following init from userspace. + */ + if (id != INTEGRITY_KEYRING_MACHINE) + perm |= KEY_USR_WRITE; out: return __integrity_init_keyring(id, perm, restriction); diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 547425c20e11..730771eececd 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -151,7 +151,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_PLATFORM 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_MACHINE 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -283,3 +284,12 @@ static inline void __init add_to_platform_keyring(const char *source, { } #endif + +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init add_to_machine_keyring(const char *source, const void *data, size_t len); +#else +static inline void __init add_to_machine_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c new file mode 100644 index 000000000000..ea2ac2f9f2b5 --- /dev/null +++ b/security/integrity/platform_certs/machine_keyring.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Machine keyring routines. + * + * Copyright (c) 2021, Oracle and/or its affiliates. + */ + +#include "../integrity.h" + +static __init int machine_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_MACHINE); + if (rc) + return rc; + + pr_notice("Machine keyring initialized\n"); + return 0; +} +device_initcall(machine_keyring_init); + +void __init add_to_machine_keyring(const char *source, const void *data, size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + rc = integrity_load_cert(INTEGRITY_KEYRING_MACHINE, source, data, len, perm); + + /* + * Some MOKList keys may not pass the machine keyring restrictions. + * If the restriction check does not pass and the platform keyring + * is configured, try to add it into that keyring instead. + */ + if (rc && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, + data, len, perm); + + if (rc) + pr_info("Error adding keys to machine keyring %s\n", source); +} From patchwork Wed Jan 5 23:50:07 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 530243 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C89DCC4332F for ; Wed, 5 Jan 2022 23:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245709AbiAEXwE (ORCPT ); Wed, 5 Jan 2022 18:52:04 -0500 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:21086 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245546AbiAEXvK (ORCPT ); Wed, 5 Jan 2022 18:51:10 -0500 Received: from pps.filterd (m0246629.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 205N58RZ007603; Wed, 5 Jan 2022 23:50:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=85t9lE45oZAdWhOwZN7c5wL/sqiZsyYbYkitWW+aeUA=; b=ZDWeV8Q2Hnra/ot4wy9w3SjWpNvRZ+SZaXiA6Lku1RQBlUOHWunBe6kfMARDIOZ1bAKX ojinFbjO7MBWTJ8NnOJmU1QpCK5boSHAdi4zgVYw3uictWGhdT9qJwjXnfCIhjbMchpC adCdi7JQcxGryuqwi4h9jggy5ssN/BLpOd3Qoqx4yQzMYMzd9rEMkKK7o+/wPVvnuRmw DXk7+wBLiAtPgA3nIsd6YotciFFjG64opVhDDSkVhiWlQ2FWf67Srb4T2Xco5EtgXfjf 8Im7NEf7KUoGTDiKZiR+XzbWfqTcrvAcJ3w4MA7V39CoCINnPF3rMgE65sGACvnQOeqE wQ== Received: from aserp3020.oracle.com (aserp3020.oracle.com [141.146.126.70]) by mx0b-00069f02.pphosted.com with ESMTP id 3ddmpm0203-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:39 +0000 Received: from pps.filterd (aserp3020.oracle.com [127.0.0.1]) by aserp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 205NjfZ6150022; Wed, 5 Jan 2022 23:50:38 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2042.outbound.protection.outlook.com [104.47.74.42]) by aserp3020.oracle.com with ESMTP id 3ddmqa1jc8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:38 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SLft5uXKecdY2z6IXzdstBu7uwPHOM104T/yqbOh6lbZiv7K8yzINP4+ww0MBsayjdbl2SFlFHJmz0olSNP10duHdqRtp8iwqaC8IEyUErnwzX9dmYMKfjycwJmXieq3mrMm0Lbl0rl1HVGuhJ3TsvT3eccD27+You2qpO07DMk1K96pm0Srb6QVI2fieXTrWh9Lfr93IsQPbvxfvd6MNmvQ59FChPZhVhAy6S6foUK4VtgOcTCQz7Jsb2ZppDSSUvEWi33vb1EuguFscN5NU06nAO2CwxkfSc+bN1plYuEo2U+7Vg3j1PJyVDZx9wN/wXILh0WHEfhuLcQXW0tX+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=85t9lE45oZAdWhOwZN7c5wL/sqiZsyYbYkitWW+aeUA=; b=YjRRhzcVzoggVyxf3d/8liX9/MO++uv/F31Py8wfsEgZd5nUgIfJseJCoJGo2afpvPWan6pTdE/5IItdYaSogE/HAvVULRrJeNaCHB3vz/jvwvxNyehMRIk20pQa22KFG2M1gNvqAdgsP0kyWlmJiSTTT0wbjgT3GyBIlRKZqqL1vfsXHdfDxft4IOCdiqBwwqOgqybh+1pr2rRICjxvGPEtfi6dY/BOBOcfCh/d1lTqeCAS7W+8f7VP3yiBXQj+tRl18suVkE7WjYlV5STqtVtJct3ZYrViVbWLBSoB+SQE0T9Kflob4tTBEQ1UMp+kFE5jfK/rjnYmuGjdqPB4Cg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=85t9lE45oZAdWhOwZN7c5wL/sqiZsyYbYkitWW+aeUA=; b=oiaJPBlWa2sZEVOCEsApksxOZKrc7LktBk6GF6xGcDQGLKysjs7ITpxGr8d4xZpmk6G9n0AfSV2hZDV6hTrduXvAvr+IxDGtCPqCB8S26aYJD3TGjfWtQl1vwVQkL8tXYVvQlf8txp2YXoOl95NsRYvAeXIg5cEPrXVp3mh5ffg= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5034.namprd10.prod.outlook.com (2603:10b6:610:c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4844.15; Wed, 5 Jan 2022 23:50:36 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%4]) with mapi id 15.20.4867.009; Wed, 5 Jan 2022 23:50:36 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v9 3/8] integrity: add new keyring handler for mok keys Date: Wed, 5 Jan 2022 18:50:07 -0500 Message-Id: <20220105235012.2497118-4-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com> References: <20220105235012.2497118-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN4PR0501CA0095.namprd05.prod.outlook.com (2603:10b6:803:22::33) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 903d22aa-4355-4c40-4ab6-08d9d0a62b76 X-MS-TrafficTypeDiagnostic: CH0PR10MB5034:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 7RVa7+gISnrQSomBnnCWhwgZ+B9HJolyOFoQUJaAHvrvMJXVywYWJb1MC+fC70w7FHSXPl6KjXYfYYuTyyNPNqUGJbcLSesGzT176sXz3nZIeOOI1YU/KalP4YGNCJcu1RZsjoIrtXZtjo/MXK8PaPzs2C5XI+UMLyL+eTtWdBmlv+xd6AeN9TD4hF62OtmmnNuvDhdwOwMmqDfQRcTcBcj8B8MISGd5x1IHHDKUzTAeHMSBjrPK9VycF8od18tVLBVDIukBI7ETmZye1fZWel2XijGrPIC4u8NhPYEDSwMN3vWIp5P3u4shYbwd+DVQLpzuwY61cZszXdtkDsRf525qu2RjaZBVjHjrkzqLF5Eosk6pc/sGW4wAarliF1XOCpuNlHGCJEp94CwcBzdL81sIlv7ZS31ZXDBkFAqFptnpXUoNbEND9PY2T6f/xSCCBVUvOovGwf01nW3JagYgccUkJJ9UONPmt6tw3vkhZOI8YF2ViomFCI/VZwO6H7CBeb4AEeM344dagE24JbSLBSCqZFFqaaM2wCBA/4Yd3CwFo1cViVqRlHkUGYKEneGEmfVpSbONMxjzeaJgu1djM3rSPvXi7Y7wZ2ktY2OJVRUL8AYyCF6qtboZHmMrmeZOcOC+GHqzLk++SlP37o/o1TciVQhoTQ4EQEmXeavtuOqHVKBlpF/b6v7yVMgzsuGUuAHtsusmLdiIrjYVlMGY7Q== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(186003)(6512007)(8676002)(316002)(2906002)(66556008)(6506007)(508600001)(8936002)(66476007)(52116002)(2616005)(86362001)(66946007)(4326008)(7416002)(36756003)(38100700002)(107886003)(6666004)(44832011)(26005)(6486002)(5660300002)(83380400001)(1076003)(38350700002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 0GByRbHJ7gjJgu0ULA5LPqdM9adGJMK7qrbcOZ+jO1Uor8oM24bEAH3VQ+7ues8xHWjBqtsjWLjgNj5SbV84V0Ve9WtdlpoXQR/fX4iTDruWJ5AsycptnYVIkbju4RmBxGbdH2xif51gcOLfVma1ZPItVHePAVvqZdMULFKSmlD738pr02jA3RnV40tG0M7EYfxbMTnUFm6u/pWbXL9Hnfv00l/y6qigTyB6bNQ259OHxoAs1GzLvyPy3tD03/EMYPTJmmjNPpWtAD2bR0jJqtei9rZhou2yyR0IGRjv4TndEBRoKc5k8981qcCaC3HIhOjtGGDKEVaV7kHrYE86pNiceC17Yu4wqBjhEle114WXLxxsgGPqool4iK3J+SGdvfjYKB7CVv9R0U7+5mvzRdbLUk2HmOQ0mKSHBsWRhWaAaRBK0AVBuJK2zcN3NdQzRCgQQGhINFHMwF/h0HojhZeT2mT6Vh1BEbb84MiWR0YAnsYmNaDnvmsWjo01kYmKqhe948ZBOnQ+ys3SDXzNmyVUkucvUSfgJnTkIGIxH6GIfThewA2yLPirqV8QSdnSWyUEaKqRkAxcNV/8wCLBld+0W1PhVr0tz3joIko9rf/vSCG0Z4QhzEj2ZgWR1ToM+dood1ziE1wJMe5lVWkW0Bb4mvLcHmNWeHH+lYUs/Ks4ZyjC3ZNi/FHivGkXY+7TOJuHD2LN5diCXWH8hk3iN48BTjuFLocaISms8PFljvWdNbQcRg1BgpW3/HdVY1C7QrnvY3aBNK/INu2xJL2p7vkQvabDp+tJQNgBcs6p2SrmS3lq1qmNsNXoNbzBzyBLymhWkYGdUo/yToU5Gs2Uo0sZJ83+OwnmqVnjOw7MQZUaRYOIRZvu/HCfgP+fHRsxZE5xztxOTU2vocvzP2OOq4VhPYbb/MRrL9LHv5XisgDK0kqDuKxX5weBSHmaqlitmDWi++W8w7P/6n8llVAwDzf4yGaIB6yiOFro8OaBjvrelIWrtNCCdGrlApO3rcqAqjIOcCMAnwsU6cn22BhZkDlGGkyJOzhLOVxRrLlq7QbgBPhkzF1uyujSQvI4SWBUr2mgwGh3iN0d/qbT95eU938pz/FjniagrMLeIsIkof4XS2/SOXbgpc6wU+tBDXGL8+karVaGRIpi27kHYpba1IQjBI7qrFpsD5GZ4Mkk/9IWARB6U/pLXPixVqa0QpUpbR54G7o2eflGijDTGZSDEtx+bRonkMkPVteFl8J5uTej0pXPHPNvyJ0gVB2pdHrgfZW1oBzSOXEBeslHhkEKkmBP8dxhpY7HMwV83i2rg5K4aPEEJ7RK+UOqLz8rZ5gSxSBzJymcK9+QTMutEguf/8B7ieEicfHWg6YHisqxI/D4Q8spKj6Th+cRVJ3iqkhKlux2iKZRXyc51BarG/1X7/vQ6pD5LN+vySCmhpL8fBcV4LfRGWQrI5sg5MxJDq07B2tSE7UOKx9UINAiuS/+ZGAtQDleOJblMSAEpNT642NjMsCsfdmrnsaZlARXhtn4JCf/muVgyi0XPNF9SOR9IBErZZnRd12hI5ApKFsvrgzJP6nioL5htN35v2oBJvJT7NMgJaUkP9+NznINbrATLRNpnooOluJ1UaUVJoapUlnNaYVAaPKr7q3RTezbKpnhbr34+YIa9lKEmwUXN84FXw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 903d22aa-4355-4c40-4ab6-08d9d0a62b76 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:36.3363 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rSAOTmj5RqjxGt14nwmUEWOnDBGrevngQmAVnXShAu8wER/WcXgmTcElc6QqQpB1wuPNv6fuxJK6QWC4qJ9VKcT61rbbBYTfUJ+tnIGKOyw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5034 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 adultscore=0 suspectscore=0 bulkscore=0 mlxlogscore=687 phishscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000 definitions=main-2201050150 X-Proofpoint-ORIG-GUID: i-y_TEd-lIPWUFQip77lv0sAyt_GRKHB X-Proofpoint-GUID: i-y_TEd-lIPWUFQip77lv0sAyt_GRKHB Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Currently both Secure Boot DB and Machine Owner Keys (MOK) go through the same keyring handler (get_handler_for_db). With the addition of the new machine keyring, the end-user may choose to trust MOK keys. Introduce a new keyring handler specific for MOK keys. If MOK keys are trusted by the end-user, use the new keyring handler instead. Signed-off-by: Eric Snowberg Reviewed-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen --- v1: Initial version v3: Only change the keyring handler if the secondary is enabled v4: Removed trust_moklist check v5: Rename to machine keyring v7: Unmodified from v5 v8: Code unmodified from v7 added Mimi's Reviewed-by v9: Unmodified from v8 --- .../integrity/platform_certs/keyring_handler.c | 17 ++++++++++++++++- .../integrity/platform_certs/keyring_handler.h | 5 +++++ security/integrity/platform_certs/load_uefi.c | 4 ++-- 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/security/integrity/platform_certs/keyring_handler.c b/security/integrity/platform_certs/keyring_handler.c index e9791be98fd9..4872850d081f 100644 --- a/security/integrity/platform_certs/keyring_handler.c +++ b/security/integrity/platform_certs/keyring_handler.c @@ -67,7 +67,7 @@ static __init void uefi_revocation_list_x509(const char *source, /* * Return the appropriate handler for particular signature list types found in - * the UEFI db and MokListRT tables. + * the UEFI db tables. */ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) { @@ -76,6 +76,21 @@ __init efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type) return 0; } +/* + * Return the appropriate handler for particular signature list types found in + * the MokListRT tables. + */ +__init efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) { + if (IS_ENABLED(CONFIG_INTEGRITY_MACHINE_KEYRING)) + return add_to_machine_keyring; + else + return add_to_platform_keyring; + } + return 0; +} + /* * Return the appropriate handler for particular signature list types found in * the UEFI dbx and MokListXRT tables. diff --git a/security/integrity/platform_certs/keyring_handler.h b/security/integrity/platform_certs/keyring_handler.h index 2462bfa08fe3..284558f30411 100644 --- a/security/integrity/platform_certs/keyring_handler.h +++ b/security/integrity/platform_certs/keyring_handler.h @@ -24,6 +24,11 @@ void blacklist_binary(const char *source, const void *data, size_t len); */ efi_element_handler_t get_handler_for_db(const efi_guid_t *sig_type); +/* + * Return the handler for particular signature list types found in the mok. + */ +efi_element_handler_t get_handler_for_mok(const efi_guid_t *sig_type); + /* * Return the handler for particular signature list types found in the dbx. */ diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c index f290f78c3f30..c1bfd1cd7cc3 100644 --- a/security/integrity/platform_certs/load_uefi.c +++ b/security/integrity/platform_certs/load_uefi.c @@ -94,7 +94,7 @@ static int __init load_moklist_certs(void) rc = parse_efi_signature_list("UEFI:MokListRT (MOKvar table)", mokvar_entry->data, mokvar_entry->data_size, - get_handler_for_db); + get_handler_for_mok); /* All done if that worked. */ if (!rc) return rc; @@ -109,7 +109,7 @@ static int __init load_moklist_certs(void) mok = get_cert_list(L"MokListRT", &mok_var, &moksize, &status); if (mok) { rc = parse_efi_signature_list("UEFI:MokListRT", - mok, moksize, get_handler_for_db); + mok, moksize, get_handler_for_mok); kfree(mok); if (rc) pr_err("Couldn't parse MokListRT signatures: %d\n", rc); From patchwork Wed Jan 5 23:50:08 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 530246 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63583C433F5 for ; Wed, 5 Jan 2022 23:51:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245644AbiAEXvo (ORCPT ); Wed, 5 Jan 2022 18:51:44 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:40994 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245573AbiAEXvG (ORCPT ); Wed, 5 Jan 2022 18:51:06 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 205N50uP026084; Wed, 5 Jan 2022 23:50:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=FNOc3EZPudjSqWJajjAI5Xe/ScJLWHq6HO14BAVi8g8=; b=cLS4ImK+CtTq7h9R3TJQhKlfBmxB+Dmp61JeSY0dgWFN1+r+KgRajFa5J8E/yO2Ly2Wd BQksJDbzvf/TRYp6JyPb/A04eiPTNDI/R3LFt6PyGz1fXRwFmbp8C+cw05UMpjjG3BmU aoJj6zhAn+o2i7uTVpD7FJYXYDNqGB+5S2uuhn9e+4foCC+a9R2kg361jpXoGOddFIsd 78nJLWTUQrlLnLorUwTM75zO1QaBOxhmW5U2pXb3uPT4di4xVfGkmTkL/rkIYOiIeNfb KqAqHDFclXNt+7LCAQiRaVOgFyYG2xZvV7alzGuGWI5+QKynYJzPhPqEZHEwHQm0crO+ eQ== Received: from aserp3030.oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3ddmpmg202-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:41 +0000 Received: from pps.filterd (aserp3030.oracle.com [127.0.0.1]) by aserp3030.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 205No7Kc191080; Wed, 5 Jan 2022 23:50:40 GMT Received: from nam04-bn8-obe.outbound.protection.outlook.com (mail-bn8nam08lp2047.outbound.protection.outlook.com [104.47.74.47]) by aserp3030.oracle.com with ESMTP id 3ddmqgsh94-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:40 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=bqGhNtg0T4PWVErVBX0ICR2VODCqyrYJ9yuAB4f1+RlQSvOEMjAFWz3PeP+UkSpLc6FYZvNmzNw6vqxabiJkWeAHU87z3iMYeWyn7hL4BZJegQ3kgtyGJFBKbeivTGMtaEFu8I/VzT480C3PRTAq/NTUSeX4jfy+VdBYlZ9Cf1sDIOiqnjH8GkRAHLi7QILeF5MlKIJIOOjQUAmuGK8Jd8/RWP9QXsnTdzDDkAWU3Wt5Vbfd1Zao+CCpKgHVlSSXd1w1EnwndkB7ci3E5EJvkmW0AHJvuak/2VtVmbM/UC4MAwMErtdTO3aYTneX5rxotgCQAHDCmrMHzg+cWQFVCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FNOc3EZPudjSqWJajjAI5Xe/ScJLWHq6HO14BAVi8g8=; b=JZrD/XWMS1HTrbowqidlJmzL4wCovt5/zrcjJE22RQHdL71GrezhVAUdQFGo4+MVeM28m2R6lxiFlPZLWLJieHKKFyL9VC+n3hwgigxuR6qkjkQNGPNN8929k3JaBpXRD2uerHWYzX4YC1ZzkElNueigmpafH6wmlVNKsksv3jh9Xap0ashncnJADsKazOLjiPvFUCLe6h5055D0vGcDE17U7D1FwlEBYgaQJTzUlQl0ZY7tXNrb8YdOtPiyoMoCk4u99NC2EoYQo1tAdUQj9myMMr+VdePl01Sfrq/dnQpQ94bGwG2FbL/OIsTMSkXJZVEerTCcVBTyEwyTHxlGew== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FNOc3EZPudjSqWJajjAI5Xe/ScJLWHq6HO14BAVi8g8=; b=U4cxlmlmOy90QQohzozYaNnvJXYPgDBIWzK1LKEl5tSosCnHJk/hxRqyYPT/5U+mIiHMH03Lw272YLs5aOnV0C+FVgBpc736vRNIdthiVywuZHQ/KREdsn1rN/czQo0hEH3elg922mr6SYJ91V99WkQxfGb5NPEBwKCB5wjRmDY= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5034.namprd10.prod.outlook.com (2603:10b6:610:c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4844.15; Wed, 5 Jan 2022 23:50:38 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%4]) with mapi id 15.20.4867.009; Wed, 5 Jan 2022 23:50:38 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v9 4/8] KEYS: store reference to machine keyring Date: Wed, 5 Jan 2022 18:50:08 -0500 Message-Id: <20220105235012.2497118-5-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com> References: <20220105235012.2497118-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN4PR0501CA0095.namprd05.prod.outlook.com (2603:10b6:803:22::33) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d409cbba-bbcb-4225-8e00-08d9d0a62cb3 X-MS-TrafficTypeDiagnostic: CH0PR10MB5034:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: sEyc214tP8BeRcYmLeUUHQ8ntXTDs62Xu0tRdsaX16CE1MFLktaBDBwCqPr5eY7NUeEuLzNTfDBAJewYnhMZ7nRxXu/qcgzJk2Ixqo48bAFVmUNoRG0ooVmC5Prraz/6cPO43EdYHqx3Qx+al8BiXuE5sKXesYExJ0mPl4U7VHFlhDDqd01939SmWngFjv1mJGj6Cnj2xVC+SodmdgZzPPcRx5tjtZtmYFeg2NhNco3IhXzn9mtpUABcMrv9Xj6VpN9xjjU5okhNHD/E/LsSvNrCAHpJASrdC+9juFnPg+fIJdxywYyMxDkPNkOVnnYTrQmoCCfZlyooDW9Yjx376MXHpM7Pvlc5cbGK90s4KNpJFgRW8Yy2y6ytA7LdE8Yj3PYz1v0mBQeyPINsh9/S2QDHkV15heAK2zkUFXeSd7IIOXsjGrZxOBThkhGZMBqI3L/8xz1AdOI/II49ml15b2YdNhsCr78lG5EftHndVZahQdug8BhkD0qLTSIrCE+J0yoK0wU9D0AAOYIsU+lEgBNB9nNOSWWqFc8lucaS+dorGL6tFWEtcG1ZXMCmPTWO4NmtwsS/EbtR4yP55oKqQ8t5jonDL9OAexm0LnNJvwew4DtsfBPcqCL9uprm8ZRGYa7k4VF3LT3M4RPDN35VgzufAhANHqYA3RgBiUNwn8iUJ3SGO6sICEhs3G/4S1qxFqy0lpdF0G5J7preZOVMLQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(186003)(6512007)(8676002)(316002)(2906002)(66556008)(6506007)(508600001)(8936002)(66476007)(52116002)(2616005)(86362001)(66946007)(4326008)(7416002)(36756003)(38100700002)(107886003)(6666004)(44832011)(26005)(6486002)(5660300002)(83380400001)(1076003)(38350700002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 3Bcz0dvZxqiprp9H4iFxI95LRx8Uv7UOYjdJXt+Ppg8GFGFpwcFg6kpKhFPVXgMC6ca6pKvI6Cfm4L2MNHFRJPCNa41123J1pfL20EUIE3ybIX3qv/6i2VmSCoQgZ/R957KaCdhHtnSCbQB0EQSfGGmIyJa7Oqcimips4XuslseCKkyEnccGit26NLt3aZpnAHTaTvNnqYmWXVl+kUdY2xOyHp8iucl8MtOcbKUHI6ELxEOnVE909NK7dCKzxfqPe7HiSlke+El/v8MYdoA8zHhammi2+Frg6dqjpEQc+gYJ5PlfWOJQZxWnyrYEiyD7NWeEoXyNjXtCpSigB7g5PVW2+V6O1A9ztP8PvatBipfwRV6G3ebeTGc7rc5Yjp/nwz5z7ywKb/ez3mduRH/SMWpGPOa+PMUzuxmeWVCeSHQUIGrhlOgSDwha34QxjUIClWXBQLuAzugKK+jm5sN0ygy1AUU6lFejaZ7Nn3Hah/k/nLp2cWpUhjeTiS/Lh4r0eMA8XbsSFVYuDHeSbDRBKzLrXqRanf8yRk2TxuU717NLpF8JbxZ8lRa5uxm09sNdF+v7tbORJmwvw2PT7xOO1ISBLTInJOlXPUpCqB+bNG2OvBpdSGRN9Jh7TJxws/NNSzt6AY4hi9LC/T4wBV6jx/0bY4jP0hUPwyWYc8NSf8108YmI7qvZapw0iTacfufKFUw7WS0Wjar6ppcNQdwtR7omPdA1mYfloEsjq15m5NWwrZgINEWPzQa7I2W+5EKVx3/INVu9VLUtMh0vNb0oDeE+/bGA627YzPFLe0Jngb6twGV0V+Jxf8ctIcV1lEA0tAI2S52aDxqu6Qb9Q2FB+jvH/Pv3AfDxZizj0am2ouS4LjRhEyFB+6ykZ4pywulXw1fvRguQtt6lVbfc29H1qxOjp9vgwaKY64qG0BGw7NW3AVN5u7FN+3o14FK5mYNCLdg/ZeyZpqQ9iiXBHKlVZhFF18s4mFif4nZ1zAq+2mzOuZVIBI598lzS3x3nkxWguUtHeSVOHkdFRyRpV3mWXpPX9gsSRqp8HPHCu1ykWLw3Q6gtQJ+CR3TwNrpsxRqTPXGk1KZw8GiVWme2afnfgbuP0suQYhOMpUVOYWMnjYVbAMhPnqdYbBvh7SF85EwGQRoFLlXXmH159Hgh9XYh9pQus2NQHR5iaJiW85k25dSBVQKVdTRk4zOVR6wse44Y33i/hhHkxhk2hrcQi77DhqBUIlXRR3v28y6lhYiayRl+3ao8H2kSZB825/85hVq6LLQqrDaAsbXpLK27iRsAYkmIHhfMCN5pBDpBkDmr3vl3yWob6mbyFZW4JMGwhRoLyn+qGyQhdtdU6u5GH0/ahdj7ttbiN7Yp2k7szfiYV1meCNjN30LdcNILLgZJl3kbcRQJFHas4601kn44UO+CbPnpx8p+0FbCER4x0wzHyzAqSfRFkLZUBIIpo2Ej+eXH0Bp/tKVXK3GugF1NoOydRax+ts6dam4p6XpDlG4BzvJHA/QHj+22FFCYZXAbU5K4TC4OYnSDY1kMbs0kCe8PO6yMI7dkwNmtjEpJ962O6jp2ObDqaeDp/MiVxsqGDMZOiHzovCc0EBon6NI2iWnMWhK1QJFYga281kv8VWzI1NACPczmKlqzyZrzPl3SfxjA4hh87g2NXEtyxweOgiB+Zw== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: d409cbba-bbcb-4225-8e00-08d9d0a62cb3 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:38.4155 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: kgqlVLpohiMtgzQ8qb2eSJ/JUsGK0fkFRWy3tAspjTjOWp8YvBwrujSB9qAW01zntLIbSljCCAay1rByLDqQhgp9ItH4grjNlG/I3wpLyCs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5034 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 adultscore=0 mlxlogscore=712 phishscore=0 malwarescore=0 mlxscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000 definitions=main-2201050151 X-Proofpoint-GUID: 2XHDKSBV2hcy2p6roZyCXLaXc9fZVVP- X-Proofpoint-ORIG-GUID: 2XHDKSBV2hcy2p6roZyCXLaXc9fZVVP- Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Expose the .machine keyring created in integrity code by adding a reference. Store a reference to the machine keyring in system keyring code. The system keyring code needs this to complete the keyring link to the machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen --- v2: Initial version v3: Unmodified from v2 v4: Removed trust_moklist check v5: Rename to machine keyring v8: Unmodified from v5 v9: Combine with "add reference to machine keyring" patch --- certs/system_keyring.c | 9 +++++++++ include/keys/system_keyring.h | 8 ++++++++ security/integrity/digsig.c | 2 ++ 3 files changed, 19 insertions(+) diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 692365dee2bd..08ea542c8096 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -22,6 +22,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +static struct key *machine_trusted_keys; +#endif #ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING static struct key *platform_trusted_keys; #endif @@ -91,6 +94,12 @@ static __init struct key_restriction *get_builtin_and_secondary_restriction(void return restriction; } #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +void __init set_machine_trusted_keys(struct key *keyring) +{ + machine_trusted_keys = keyring; +} +#endif /* * Create the trusted keyrings diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 6acd3cf13a18..98c9b10cdc17 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -38,6 +38,14 @@ extern int restrict_link_by_builtin_and_secondary_trusted( #define restrict_link_by_builtin_and_secondary_trusted restrict_link_by_builtin_trusted #endif +#ifdef CONFIG_INTEGRITY_MACHINE_KEYRING +extern void __init set_machine_trusted_keys(struct key *keyring); +#else +static inline void __init set_machine_trusted_keys(struct key *keyring) +{ +} +#endif + extern struct pkcs7_message *pkcs7; #ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING extern int mark_hash_blacklisted(const char *hash); diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 2b7fa85613c0..7b719aa76188 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -112,6 +112,8 @@ static int __init __integrity_init_keyring(const unsigned int id, } else { if (id == INTEGRITY_KEYRING_PLATFORM) set_platform_trusted_keys(keyring[id]); + if (id == INTEGRITY_KEYRING_MACHINE) + set_machine_trusted_keys(keyring[id]); if (id == INTEGRITY_KEYRING_IMA) load_module_cert(keyring[id]); } From patchwork Wed Jan 5 23:50:10 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Snowberg X-Patchwork-Id: 530247 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDD1EC433F5 for ; Wed, 5 Jan 2022 23:51:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245567AbiAEXvm (ORCPT ); Wed, 5 Jan 2022 18:51:42 -0500 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:39982 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245569AbiAEXvF (ORCPT ); Wed, 5 Jan 2022 18:51:05 -0500 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.1.2/8.16.1.2) with SMTP id 205N4rFv025697; Wed, 5 Jan 2022 23:50:46 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : content-type : mime-version; s=corp-2021-07-09; bh=moN0N9AohXo6kI25Abl/whL3aL6xWbMk0+iw4AQavBA=; b=cEuTjykI1umvhjReQrGFnJUfG4UPtWbarCrKBx7CZi5gG9B7ot1vmpX6Tc61DZdZt85e zDHsBmqegeUW3YL7MqzzHZd5hULPYGsSVBk9FZem9+Oc31sJY94ljaRoW3hpl1dgxlu4 Eg1bPhbgcx3VbUCTRXrTuK1RzAhGVktdxpF14yYVGWod4MT7cbjFwahqRekvRoWQfmTg A6cdDBqHnLTG07P+nu+HQCR5majCyn6IwtmklPAMEaXz+sJk3VeLa0iQ35xGZazbYQwp atb1BlRDFsV/OeRtAuBeHrbCgwUkMul05Eew+6tLibz6XEpiWyzhuVqLHs/llvPIv4+E Ug== Received: from userp3020.oracle.com (userp3020.oracle.com [156.151.31.79]) by mx0b-00069f02.pphosted.com with ESMTP id 3ddmpmg209-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:46 +0000 Received: from pps.filterd (userp3020.oracle.com [127.0.0.1]) by userp3020.oracle.com (8.16.1.2/8.16.1.2) with SMTP id 205NjHlX177030; Wed, 5 Jan 2022 23:50:45 GMT Received: from nam11-co1-obe.outbound.protection.outlook.com (mail-co1nam11lp2175.outbound.protection.outlook.com [104.47.56.175]) by userp3020.oracle.com with ESMTP id 3ddmq5shfg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 05 Jan 2022 23:50:44 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ktsOn+QcRWJWxTfywr8YBNRiFDEJ17xmklwrXVJmfBxzurfRQdrbJntAbrjKg4rx8HyLQSNDHNH3H+4PefJQJYo0ECP6EnkV/xCbjn9w5VaGUnyDdB9zg1R2pXXiEn4Ng0K9x5Hdn0C4U306rEmmvn02W4RDgmpjwqGHDdRYNrndX+J3uZVsYvAH2QAiYg12Md+qyS6J23rW1wpQ+MMXsqoXNxZAqi9zlABrcK84jv4FT0wjHNIqDTpJyIhkay1mxUAFiUkkErdvQ5KCOtoRrMNyfYOvCsLEAASf8wIQe6ZUCaBo9smC9HbKWjPXcMIyvpxktExNo4XzA5N+TiSwMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=moN0N9AohXo6kI25Abl/whL3aL6xWbMk0+iw4AQavBA=; b=WOnIWTi0D+baL9TKf/u4lYtsk5hL8+UMBlPbtjYEpU3UCknpZ/691k5896uYeu2ABftAtdEj6lzbCpcFtTs35j6TzVwUvZcHxeIPlJMgR9hBYaIICE8A6uYZO8Gu/lGChbmEVtSJe8fc5DEC6W90nRBdC1JECEOlRJG3voeNq2SSJjaZgRpy5xfL52WNurPklKaN9oI+S+kwmDdp4+F0wrVvrmRr8j931erzZahI2nKWaHYxZIxgA2NqwXgfTGj3Ts/wcgwmEP1r0Ozs3XX7xtbwoani7hpGjx8G5TvDvCyWpzFoV9lLdsAxFydoaEQD+kPYk3E6CLE9q0lc8/Tauw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.onmicrosoft.com; s=selector2-oracle-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=moN0N9AohXo6kI25Abl/whL3aL6xWbMk0+iw4AQavBA=; b=mk2Xg5M+12K0fpGJ8/uxCuvkcE94CV2pxXuBQjBCCXAPcyUQ/9VwDY5ZL47CMB1z7Qg0XetpJpigwFinCYRZkcTmpmMHSzbif8I7+avAB7DuBhIJtJ7CLBbJtfxrIcp9OVTSF78raslhXvFDsPls/Ysie7pR7fIhaQWHfyKNVqw= Received: from CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) by CH0PR10MB5034.namprd10.prod.outlook.com (2603:10b6:610:c9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4844.15; Wed, 5 Jan 2022 23:50:42 +0000 Received: from CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a]) by CH2PR10MB4150.namprd10.prod.outlook.com ([fe80::cc63:ba5d:5d87:579a%4]) with mapi id 15.20.4867.009; Wed, 5 Jan 2022 23:50:42 +0000 From: Eric Snowberg To: dhowells@redhat.com, dwmw2@infradead.org, ardb@kernel.org, jarkko@kernel.org Cc: jmorris@namei.org, serge@hallyn.com, eric.snowberg@oracle.com, nayna@linux.ibm.com, zohar@linux.ibm.com, keescook@chromium.org, torvalds@linux-foundation.org, weiyongjun1@huawei.com, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module@vger.kernel.org, James.Bottomley@HansenPartnership.com, pjones@redhat.com, konrad.wilk@oracle.com Subject: [PATCH v9 6/8] efi/mokvar: move up init order Date: Wed, 5 Jan 2022 18:50:10 -0500 Message-Id: <20220105235012.2497118-7-eric.snowberg@oracle.com> X-Mailer: git-send-email 2.18.4 In-Reply-To: <20220105235012.2497118-1-eric.snowberg@oracle.com> References: <20220105235012.2497118-1-eric.snowberg@oracle.com> X-ClientProxiedBy: SN4PR0501CA0095.namprd05.prod.outlook.com (2603:10b6:803:22::33) To CH2PR10MB4150.namprd10.prod.outlook.com (2603:10b6:610:ac::13) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 529425aa-4282-4166-4488-08d9d0a62f27 X-MS-TrafficTypeDiagnostic: CH0PR10MB5034:EE_ X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:1443; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: d6pCyBKg7TZMV4kC2kVehoAH04dMRIFtQ7yyKGCjbgsEKz8JQWbsdhBvIgPUM30utHTmWb1yokCJN7piqggnQVP2lAAu+ixhAv+2rgA7mDHAZbxVxpGxYNOL2sVktQLWdFLq5t8Xjometmt9PEuPw0DdFGBQn8KfEjAlpWzRUucTXnmxnsfbi1M5o5oHFrNR6ICmg91SFDIUOerJNhVp4FbUboI1RwgDWsuazcRLXUG7z88CnS7RkFnAZJNtyujO+q+YD+xBCN53qgi5wtBm69H1DuOhAl6LZDhomnHq1A/Y22+q68o2wJdZArzajrC2ox8JDtjvYPrQORw29CTclZkdUk+F47oVvIsFOu8Nm1cliiXSqcuznmaZPU0oVjnoju0wTggc0J6hKzlmknVJevdQXpLJieUUbUPWQhI/kyNNf8epvWcaoZ6b1EuclAFEetS5eYGQ/prvyDhQq/TgmmYEHeS56IurTrHf+pMCSv741+WKZJsGbAe5czwaJc5HNnJPbUHOwqLXRQ1fLHCQ9D6wyREBhv58ASIaDSohgqgRL54HzX2ockHTt+85PWS+Oypd5Y+zIx9g9gy9EbXi4fn7oDxJojjznTYd3SLZaG0kM7CrOOyWo614I4h0GQcTn9BjONR5rk+pISJsh7uJugHDtHU0GkSpd6aYe1FTjnmz+lwhYcqQwFA9I4EMu9s09So0O9AiwCp/gwtINrWMXQ== X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH2PR10MB4150.namprd10.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(186003)(6512007)(8676002)(316002)(2906002)(66556008)(6506007)(508600001)(8936002)(66476007)(52116002)(2616005)(86362001)(4744005)(66946007)(4326008)(7416002)(36756003)(38100700002)(107886003)(6666004)(44832011)(26005)(6486002)(5660300002)(83380400001)(1076003)(38350700002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gtaFpKpdlrX3FZibBANviyAgrsqQlZfKF5RMo/2hsosfyGRa7XJnB2k5DXqnAVi8RkkisPBIEuCXy6fjW6l/CwfAFfiICynJ5TejujF8uYQDu5xMemErWzy3wkirSlG8LH8XvaBojJNOOZHMqKV8kkIwl2Bp/EfiXNKopHCCXEUa8V8KHdMuY7dKaeKIIcRbIoiMHsvAk7guVqXRbYDnCDdorwpPYy/odCgXaGjwIMuYrLwpRBFaOjuuPVI3z/GreJB//kBuRsxBFnoEf9QpPgaJbjPlE0d+fAXquCpjq/oBi6NXlrcX5hGZbH+FcQusKX30namftNJ59yBD8qN5wyREg2r5TQ+pb+iOLZ0NROk4OAq+4F39jkGxlZC8+dSaVjqNZoILdeanS+TQqgygFQQOSh5arvZ5bBm58qNB9LyB/L1xpZL+GKvFThVbaXDqKAAKVuLPdwEjGFWzeHWbROKcPCWrLwHFNB80bGwvnMQ5g0JIAFWw6TgwQlQuCV7kZJyp69pQMqzRhcMosXY/AARO4JffutgroGtQv6lo4hCMD1ul+VRmHg7AGq+zISafYx+lV4pXSTZE0bZue/+YND6o8p9XtPFMZd+ZQ9gmuMMjptw4tAa4QYlFrftqzBfwXJdPG09B4ijqORSrFfxD7NrGx39j8ZGHmI4idhaCuIDYnD+hH2lm3IDhbRIIqU30Je508ZmzZ2mp6OWys8OmidLffgoSvcN7HX+Dabg2gGQQgX54weJzJu5fO0jq6jv4qe/eHuJoSlohVHJMmFKqhEbBmJjgVUpXVCV4ieV7MHHUMRn9IzrYf09eUiGy6MiZ5dlU547+bQ1Rv+qIV9aOCI1M2OY78kkn2fRDq59xtt89lwVrsTvasTPMtsIUbw5YCXGxAqAFAgBQBKbBD+VxbLn/cBDLOHg9fXGYag4zVscrfuVCO8xmnd0kYryZAF0XlaMAVAdXdq+OyqTb2v+Cj0L0DXqy7ZzDyFcmz8AeuzQ7O64KxjwHwwMc55qfiwNWhZDgCChQU57cdDeu5nFYi6xWakrs2AsGeQVhQypiGBkJzLqaO9lzVSVNvxHdGKLN7a9kIqi+1eUs3nrsD81jT5GltxZtbampSyt1NxLpijyssyJnihFsAU4DbZKbnAwAb1PJ4Xkn/Nt1KnNi9yELBoEkiDG5WJkYX0DMIM5iH+8cOWgE1fRFPFWgZhjcREK0JIWlw8vE/u8o5fjf0bB02n5Bx8lva625ABLoLwnBux0zeCiAgMIYV035WPITitI02fQJreUIBYMhjt//9AG7aPBWObKANBlubAYIYJmHYJ0frllOmAh7RjJewSP4L75fPbEhpm58t5C6zNwdjlJIt+/Mn6wefwKMwpaa+QSvWIIpbgmx8u0/gPrilx7YiSq8KN6t4yum2+wH4l1iWEdbXKkUaonTibJ9UTJZBe1OjNHXSEskZqJQD5NNgxsFRoIJCQOmOw7dEJ0hciysfPCrtYnoV9LmaHyLj7ezifjs2ATNpTHVonrpoC0ubxoC/c5tm2Tg4icg1eQgkBxdKEWs4KIODrHNt+Pi1IsAcG6JkorJFcV8gnNOwhrfWefGobDF+enw/V2PN//NTbbxJMkdge5S/ZT0gAEelxgqJFLB+JDLo0LVzq5GPD7Fkh5IQLrl+9nrmWjns+izd309sGZZ/g== X-OriginatorOrg: oracle.com X-MS-Exchange-CrossTenant-Network-Message-Id: 529425aa-4282-4166-4488-08d9d0a62f27 X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jan 2022 23:50:42.5775 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: AUqR/EgvoJlquu4Xg2iu7YEv9kqA/+wrCpxvRfZjh1ugjI3ltBtuTWFsaRMJoijB2/4TXanBI2GwP2kOCVcf4APbYhnh4GvNgeWaXzb0h7c= X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5034 X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10218 signatures=668683 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 mlxscore=0 spamscore=0 suspectscore=0 mlxlogscore=999 phishscore=0 bulkscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2112160000 definitions=main-2201050150 X-Proofpoint-GUID: 6_ceHJItPutMruteO1WAwVdJHeZj1qc3 X-Proofpoint-ORIG-GUID: 6_ceHJItPutMruteO1WAwVdJHeZj1qc3 Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org Move up the init order so it can be used by the new machine keyring. Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen --- v7: Initial version v9: Unmodified from v7 --- drivers/firmware/efi/mokvar-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 38722d2009e2..5ed0602c2f75 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -359,4 +359,4 @@ static int __init efi_mokvar_sysfs_init(void) } return err; } -device_initcall(efi_mokvar_sysfs_init); +fs_initcall(efi_mokvar_sysfs_init);