mirror of
https://github.com/torvalds/linux.git
synced 2026-11-06 21:58:01 +01:00
62c4575285
Please consider pulling these changes from the signed vfs-7.4-rc1.keyring tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatyIKQAKCRCRxhvAZXjc ogjWAQD1no3bS2OTeI91M1KGxwm4XoqBwg5DaRtW9SG1I284CgEA/lRwCMBT6Op7 on+ebYhp9krrycMx5n1xGDhL0lm+zg4= =5miC -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs keyring updates from Christian Brauner: "The kernel has two keyrings that userspace fills with X.509 certificates at boot: .fs-verity for fs-verity built-in signatures and .dm-verity for dm-verity root hash signatures. Neither is linked into any process keyring. Hence, request_key() and KEYCTL_SEARCH can't find them. The only way for userspace to identify them is to read their serial number out of /proc/keys. That is not just a large file often the names can also be reused and appear multiple times which allows forging these keyrings. This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter went in through bpf-next this merge window. lookup_user_key() resolves the fixed key ids to the two keyrings. So userspace can add a dm-verity (fixed keyring id: -10) certificate with keyctl padd asymmetric "" -10 < cert.der and seal the keyring with keyctl restrict_keyring -10 without looking anything up first" * tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY keys: add KEY_SPEC_FS_VERITY_KEYRING keys: add KEY_SPEC_DM_VERITY_KEYRING |
||
|---|---|---|
| .. | ||
| keys | ||
| secrets | ||
| tpm | ||
| credentials.rst | ||
| digsig.rst | ||
| IMA-export-delete.rst | ||
| IMA-templates.rst | ||
| index.rst | ||
| ipe.rst | ||
| landlock.rst | ||
| lsm-development.rst | ||
| lsm.rst | ||
| sak.rst | ||
| SCTP.rst | ||
| self-protection.rst | ||
| siphash.rst | ||
| snp-tdx-threat-model.rst | ||