Re: [PATCH 0/4] Add CA enforcement in the machine keyring

[Mimi Zohar <zohar@linux.ibm.com>]

On Tue, 2022-03-01 at 12:36 -0500, Eric Snowberg wrote:

I would begin by saying,

The "Enroll kernel keys thru MOK" patch set introduced a new root of
trust by defining a "machine" keyring, which is linked to the
secondary_trusted_keyring.  All Machine Owner Keys (MOK) are loaded
into the machine keyring.

Then proceed with the IMA new root of trust requirements - root CA
(self-signed CA) with keyUsage limited to keyCertSign.

> A key added to the IMA keyring must be signed by a key contained in either the

^A certificate ... must be signed

> built-in trusted or secondary trusted keyring. IMA also requires these keys 
> to be a CA. The only option for an end-user to add their own CA is to compile
> it into the kernel themselves or to use the insert-sys-cert.  Many end-users 
> do not want to compile their own kernels.  With the insert-sys-cert option, 
> there are missing upstream changes. 
> 
> Currently, all Machine Owner Keys (MOK) load into the machine keyring.

Moved to the beginning.


> Add

^Define
>  
> a new Kconfig option to only allow CA keys into the machine keyring.  When 

Add the other criteria here as well.

> compiled with the new INTEGRITY_MACHINE_KEYRING_CA_ENFORCED Kconfig, non CA 
> keys will load into the platform keyring instead. This will allow the end-
> user to enroll their own CA key into the machine keyring for use with IMA.
> 
> These patches are based on Jarkko's linux-tpmdd tree.
> git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git

thanks,

Mimi