github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.4-rc1
linux/security/keys
History
Linus Torvalds 62c4575285 vfs-7.4-rc1.keyring 
Please consider pulling these changes from the signed vfs-7.4-rc1.keyring tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatyIKQAKCRCRxhvAZXjc
 ogjWAQD1no3bS2OTeI91M1KGxwm4XoqBwg5DaRtW9SG1I284CgEA/lRwCMBT6Op7
 on+ebYhp9krrycMx5n1xGDhL0lm+zg4=
 =5miC
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs keyring updates from Christian Brauner:
 "The kernel has two keyrings that userspace fills with X.509
  certificates at boot: .fs-verity for fs-verity built-in signatures
  and .dm-verity for dm-verity root hash signatures.

  Neither is linked into any process keyring. Hence, request_key() and
  KEYCTL_SEARCH can't find them. The only way for userspace to identify
  them is to read their serial number out of /proc/keys. That is not
  just a large file often the names can also be reused and appear
  multiple times which allows forging these keyrings.

  This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
  KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
  went in through bpf-next this merge window.

  lookup_user_key() resolves the fixed key ids to the two keyrings. So
  userspace can add a dm-verity (fixed keyring id: -10) certificate with

	keyctl padd asymmetric "" -10 < cert.der

  and seal the keyring with

	keyctl restrict_keyring -10

  without looking anything up first"

* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
  keys: add KEY_SPEC_FS_VERITY_KEYRING
  keys: add KEY_SPEC_DM_VERITY_KEYRING
2026-10-27 08:01:30 -10:00
..
encrypted-keys KEYS: encrypted: fix integer overflow of datablob_len 2026-09-12 00:43:45 +03:00
trusted-keys KEYS: changes for v7.4-rc1 2026-10-22 10:02:37 -10:00
big_key.c mm: update shmem_[kernel]_file_*() functions to use vma_flags_t 2026-02-12 15:42:58 -08:00
compat_dh.c
compat.c
dh.c
gc.c keys: fix lost wakeup when reaping a dead key type 2026-09-12 00:43:45 +03:00
internal.h keys: Pin request_key_auth payload in instantiate paths 2026-06-15 15:19:13 +03:00
Kconfig KEYS: encrypted: Remove unnecessary selection of CRYPTO_RNG 2026-06-15 15:19:12 +03:00
key.c KEYS: Fix key_reject_and_link() race with keyring restriction 2026-10-20 18:13:06 +03:00
keyctl_pkey.c keys: keyctl_pkey: replace BUG with return -EOPNOTSUPP 2026-06-15 15:19:13 +03:00
keyctl.c keys: Protect the read method check against type removal 2026-10-20 18:14:52 +03:00
keyring.c keys: make keyring indexes independent of kernel addresses 2026-10-20 18:13:07 +03:00
Makefile
permission.c
persistent.c keys: finalize persistent keyring timeout after link attempt 2026-10-04 21:09:32 +03:00
proc.c keys: Avoid owner account dereferences in /proc/keys 2026-10-20 18:13:07 +03:00
process_keys.c vfs-7.4-rc1.keyring 2026-10-27 08:01:30 -10:00
request_key_auth.c keys: translate request_key_auth pid for the reading procfs instance 2026-09-12 00:43:45 +03:00
request_key.c umh, treewide: Explicitly include linux/umh.h where needed 2026-09-22 15:04:52 +02:00
sysctl.c treewide: const qualify ctl_tables where applicable 2025-01-28 13:48:37 +01:00
user_defined.c keys: use kmalloc_flex in user_preparse 2026-06-15 15:19:12 +03:00