lkml.org 
[lkml]   [2022]   [Jan]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v9 7/8] integrity: Trust MOK keys if MokListTrustedRT found
    On Wed, Jan 05, 2022 at 06:50:11PM -0500, Eric Snowberg wrote:
    > A new Machine Owner Key (MOK) variable called MokListTrustedRT has been
    > introduced in shim. When this UEFI variable is set, it indicates the
    > end-user has made the decision themselves that they wish to trust MOK keys
    > within the Linux trust boundary. It is not an error if this variable
    > does not exist. If it does not exist, the MOK keys should not be trusted
    > within the kernel.
    >
    > Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
    > ---
    > v1: Initial version
    > v2: Removed mok_keyring_trust_setup function
    > v4: Unmodified from v2
    > v5: Rename to machine keyring
    > v6: Unmodified from v5
    > v7: Use mokvar table instead of EFI var (suggested by Peter Jones)
    > v9: Unmodified from v7
    > ---
    > .../platform_certs/machine_keyring.c | 19 +++++++++++++++++++
    > 1 file changed, 19 insertions(+)
    >
    > diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
    > index ea2ac2f9f2b5..09fd8f20c756 100644
    > --- a/security/integrity/platform_certs/machine_keyring.c
    > +++ b/security/integrity/platform_certs/machine_keyring.c
    > @@ -5,6 +5,7 @@
    > * Copyright (c) 2021, Oracle and/or its affiliates.
    > */
    >
    > +#include <linux/efi.h>
    > #include "../integrity.h"
    >
    > static __init int machine_keyring_init(void)
    > @@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t
    > if (rc)
    > pr_info("Error adding keys to machine keyring %s\n", source);
    > }
    > +
    > +/*
    > + * Try to load the MokListTrustedRT MOK variable to see if we should trust
    > + * the MOK keys within the kernel. It is not an error if this variable
    > + * does not exist. If it does not exist, MOK keys should not be trusted
    > + * within the machine keyring.
    > + */
    > +static __init bool uefi_check_trust_mok_keys(void)
    > +{
    > + struct efi_mokvar_table_entry *mokvar_entry;
    > +
    > + mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT");
    > +
    > + if (mokvar_entry)
    > + return true;
    > +
    > + return false;
    > +}
    > --
    > 2.18.4
    >


    Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

    BR, Jarkko

    \
     
     \ /
      Last update: 2022-01-08 23:29    [W:5.757 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site