Changes in machine_keyring.c

4cb1ed94 - integrity: check whether imputed trust is enabled

Tue, 15 Aug 2023 11:27:20 +0000

integrity: check whether imputed trust is enabledtrust_moklist() is specific to UEFI enabled systems. Other platformsrely only on the Kconfig.Define a generic wrapper named imputed_trust_enabled().Signed-off-by: Nayna Jain Reviewed-by: Mimi Zohar Tested-by: Nageswara R Sastry Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c

7b9de406 - integrity: remove global variable from machine_keyring.c

Tue, 15 Aug 2023 11:27:19 +0000

integrity: remove global variable from machine_keyring.ctrust_mok variable is accessed within a single function locally.Change trust_mok from global to local static variable.Signed-off-by: Nayna Jain Reviewed-and-tested-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Tested-by: Nageswara R Sastry Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c

bc026676 - integrity: ignore keys failing CA restrictions on non-UEFI platform

Tue, 15 Aug 2023 11:27:18 +0000

integrity: ignore keys failing CA restrictions on non-UEFI platformOn non-UEFI platforms, handle restrict_link_by_ca failures differently.Certificates which do not satisfy CA restrictions on non-UEFI platformsare ignored.Signed-off-by: Nayna Jain Reviewed-and-tested-by: Mimi Zohar Acked-by: Jarkko Sakkinen Tested-by: Nageswara R Sastry Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c

3d6ae1a5 - integrity: Only use machine keyring when uefi_check_trust_mok_keys is true

Wed, 26 Jan 2022 02:58:34 +0000

integrity: Only use machine keyring when uefi_check_trust_mok_keys is trueWith the introduction of uefi_check_trust_mok_keys, it signifies the end-user wants to trust the machine keyring as trusted keys. If they havechosen to trust the machine keyring, load the qualifying keys into itduring boot, then link it to the secondary keyring . If the user has notchosen to trust the machine keyring, it will be empty and not linked tothe secondary keyring.Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c

74f5e300 - integrity: Trust MOK keys if MokListTrustedRT found

Wed, 26 Jan 2022 02:58:33 +0000

integrity: Trust MOK keys if MokListTrustedRT foundA new Machine Owner Key (MOK) variable called MokListTrustedRT has beenintroduced in shim. When this UEFI variable is set, it indicates theend-user has made the decision themselves that they wish to trust MOK keyswithin the Linux trust boundary. It is not an error if this variabledoes not exist. If it does not exist, the MOK keys should not be trustedwithin the kernel.Signed-off-by: Eric Snowberg Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c

d1996776 - integrity: Introduce a Linux keyring called machine

Wed, 26 Jan 2022 02:58:28 +0000

integrity: Introduce a Linux keyring called machineMany UEFI Linux distributions boot using shim. The UEFI shim provideswhat is called Machine Owner Keys (MOK). Shim uses both the UEFI SecureBoot DB and MOK keys to validate the next step in the boot chain. TheMOK facility can be used to import user generated keys. These keys canbe used to sign an end-users development kernel build. When Linuxboots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux.platform keyring.Define a new Linux keyring called machine. This keyring shall contain justMOK keys and not the remaining keys in the platform keyring. This newmachine keyring will be used in follow on patches. Unlike keys in theplatform keyring, keys contained in the machine keyring will be trustedwithin the kernel if the end-user has chosen to do so.Signed-off-by: Eric Snowberg Tested-by: Jarkko Sakkinen Tested-by: Mimi Zohar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen List of files: /linux-6.15/security/integrity/platform_certs/machine_keyring.c