github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

keys: add KEY_SPEC_FS_VERITY_KEYRING

Browse Source 
Same problem as the dm-verity keyring: .fs-verity is allocated unlinked,
so the only way for userspace to name it is to scrape /proc/keys.

Suggested-by: Christian Brauner (Amutable) <brauner@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-2-008456d189cb@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Andrew Halaney 2026-10-08 15:57:36 -05:00 committed by Christian Brauner
parent 1041fca2ee
commit 5ab0054676
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
4 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
fs/verity/signature.c
View File

@ -135,4 +135,6 @@ void __init fsverity_init_signature(void)
KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL);
if (IS_ERR(fsverity_keyring))
panic("failed to allocate \".fs-verity\" keyring");
key_register_fs_verity_keyring(fsverity_keyring);
}

1
include/linux/key.h
View File

@ -442,6 +442,7 @@ extern int keyring_restrict(key_ref_t keyring, const char *type,
extern void key_register_bpf_keyring(struct key *keyring);
extern void key_register_dm_verity_keyring(struct key *keyring);
extern void key_register_fs_verity_keyring(struct key *keyring);
extern struct key *key_lookup(key_serial_t id);

1
include/uapi/linux/keyctl.h
View File

@ -26,6 +26,7 @@
#define KEY_SPEC_REQUESTOR_KEYRING -8 /* - key ID for request_key() dest keyring */
#define KEY_SPEC_BPF_KEYRING -9 /* - key ID for the BPF-specific keyring */
#define KEY_SPEC_DM_VERITY_KEYRING -10 /* - key ID for the .dm-verity keyring */
#define KEY_SPEC_FS_VERITY_KEYRING -11 /* - key ID for the .fs-verity keyring */
/* request-key default keyrings */
#define KEY_REQKEY_DEFL_NO_CHANGE -1

25
security/keys/process_keys.c
View File

@ -29,6 +29,9 @@ static struct key *bpf_keyring __ro_after_init;
static struct key *dm_verity_keyring;
static DEFINE_SPINLOCK(dm_verity_keyring_lock);
/* fs-verity keyring reachable through KEY_SPEC_FS_VERITY_KEYRING */
static struct key *fs_verity_keyring __ro_after_init;
/* The root user's tracking struct */
struct key_user root_key_user = {
.usage = REFCOUNT_INIT(3),
@ -629,6 +632,20 @@ void key_register_dm_verity_keyring(struct key *keyring)
}
EXPORT_SYMBOL_GPL(key_register_dm_verity_keyring);
/**
* key_register_fs_verity_keyring - Publish the keyring for KEY_SPEC_FS_VERITY_KEYRING
* @keyring: The keyring to publish
*
* Make @keyring reachable by userspace through the KEY_SPEC_FS_VERITY_KEYRING
* special key ID, so that provisioning it does not require scraping its
* serial out of /proc/keys first. Called once, from an initcall, and never
* undone.
*/
void key_register_fs_verity_keyring(struct key *keyring)
{
fs_verity_keyring = keyring;
}
/*
* Look up a key ID given us by userspace with a given permissions mask to get
* the key it refers to.
@ -799,6 +816,14 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
key_ref = make_key_ref(key, 0);
break;
case KEY_SPEC_FS_VERITY_KEYRING:
key = fs_verity_keyring;
if (!key)
goto error;
__key_get(key);
key_ref = make_key_ref(key, 0);
break;
default:
key_ref = ERR_PTR(-EINVAL);
if (id < 1)