From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D5347C433EF for ; Thu, 19 May 2022 15:11:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=RQ0R3gw91R1or3oGuhNdQX+nCzEXF8R6tO9B8ZeUfwU=; b=mDSZnt+XDEXGtc jZToH3EQk+ezg3cfHswhYEh+UtSb9sw1dgMhOgkzCBJqGfdnatbougM0W3m96RV+6EdjTB6uFgAFt KIS64J6Va0j2pP4kgtrrDXE5AaZ0Y86YOHzhkDgEQvCrqR/j+6M70gR1MA6x9RamtD2cMKvwQuMjE 1zcDnPFpBg283VCTPIXMS0Tc8eCGO2nbnm0TK3KccnBzbkVeFcoyBSTi+qp7BD4ImC99TWR8ThSlZ N0gql6/zATUOXSWbUNgeIm13FgSrwmTBj8ED9MEefvjV7lKclNQZ+zx49QuK+K5TbyGBygqrXohA4 JDzXzrrRHRQNDV0XkDCw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nrhmf-007kuK-K3; Thu, 19 May 2022 15:09:49 +0000 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nrh2u-007NO9-9p for linux-arm-kernel@lists.infradead.org; Thu, 19 May 2022 14:22:51 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1652970148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=8QmPbRB1QFxv/pF4z1RFQhVilnkWaoFyXeE0F38Hzf4=; b=CJk3zOTMwXQNpq5SW4aL/oxVm/LPXULTLOdcGZhdNhNKMCkIBMAJJqeLzqNg/MrBJUbdgn MbRfDgthlC5T69K6MLg9b6OYky/jXc0QP919w5ADyMtLDb/YZpyGcdaxZxWf00czcZT5AN JtM0wDFfTRnTqr6qp4GjfxmKSDcw87Q= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-452-yprCcXR-NICTCUXaCRUCMQ-1; Thu, 19 May 2022 10:22:21 -0400 X-MC-Unique: yprCcXR-NICTCUXaCRUCMQ-1 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 5157F397968A; Thu, 19 May 2022 14:22:20 +0000 (UTC) Received: from localhost (ovpn-13-136.pek2.redhat.com [10.72.13.136]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1CFF21121314; Thu, 19 May 2022 14:22:19 +0000 (UTC) Date: Thu, 19 May 2022 22:22:15 +0800 From: Baoquan He To: Mimi Zohar , Coiby Xu Cc: Heiko Carstens , akpm@linux-foundation.org, kexec@lists.infradead.org, keyrings@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Michal Suchanek , Dave Young , Will Deacon , "Eric W . Biederman" , Chun-Yi Lee , stable@vger.kernel.org, Philipp Rudo , linux-security-module@vger.kernel.org, Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Martin Schwidefsky , "open list:S390" , open list , linux-integrity , Jarkko Sakkinen Subject: Re: [PATCH v8 4/4] kexec, KEYS, s390: Make use of built-in and secondary keyring for signature verification Message-ID: References: <20220512070123.29486-1-coxu@redhat.com> <20220512070123.29486-5-coxu@redhat.com> <20220519003902.GE156677@MiWiFi-R3L-srv> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220519_072232_476017_8AD376D2 X-CRM114-Status: GOOD ( 34.55 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On 05/19/22 at 07:56am, Mimi Zohar wrote: > [Cc'ing Jarkko, linux-integrity] > > On Thu, 2022-05-19 at 08:39 +0800, Baoquan He wrote: > > On 05/18/22 at 01:29pm, Heiko Carstens wrote: > > > On Thu, May 12, 2022 at 03:01:23PM +0800, Coiby Xu wrote: > > > > From: Michal Suchanek > > > > > > > > commit e23a8020ce4e ("s390/kexec_file: Signature verification prototype") > > > > adds support for KEXEC_SIG verification with keys from platform keyring > > > > but the built-in keys and secondary keyring are not used. > > > > > > > > Add support for the built-in keys and secondary keyring as x86 does. > > > > > > > > Fixes: e23a8020ce4e ("s390/kexec_file: Signature verification prototype") > > > > Cc: stable@vger.kernel.org > > > > Cc: Philipp Rudo > > > > Cc: kexec@lists.infradead.org > > > > Cc: keyrings@vger.kernel.org > > > > Cc: linux-security-module@vger.kernel.org > > > > Signed-off-by: Michal Suchanek > > > > Reviewed-by: "Lee, Chun-Yi" > > > > Acked-by: Baoquan He > > > > Signed-off-by: Coiby Xu > > > > --- > > > > arch/s390/kernel/machine_kexec_file.c | 18 +++++++++++++----- > > > > 1 file changed, 13 insertions(+), 5 deletions(-) > > > > > > As far as I can tell this doesn't have any dependency to the other > > > patches in this series, so should I pick this up for the s390 tree, or > > > how will this go upstream? > > > > Thanks, Heiko. > > > > I want to ask Mimi if this can be taken into KEYS-ENCRYPTED tree. > > Otherwise I will ask Andrew to help pick this whole series. > > > > Surely, this patch 4 can be taken into s390 seperately since it's > > independent, both looks good. > > KEYS-ENCRYTPED is a type of key, unrelated to using the .platform, > .builtin, .machine, or .secondary keyrings. One of the main reasons > for this patch set is to use the new ".machine" keyring, which, if > enabled, is linked to the "secondary" keyring. However, the only > reference to the ".machine" keyring is in the cover letter, not any of > the patch descriptions. Since this is the basis for the system's > integrity, this seems like a pretty big omission. > > From patch 2/4: > "The code in bzImage64_verify_sig makes use of system keyrings > including > .buitin_trusted_keys, .secondary_trusted_keys and .platform keyring to > verify signed kernel image as PE file..." > > From patch 3/4: > "This patch allows to verify arm64 kernel image signature using not > only > .builtin_trusted_keys but also .platform and .secondary_trusted_keys > keyring." > > From patch 4/4: > "... with keys from platform keyring but the built-in keys and > secondary keyring are not used." > > This patch set could probably go through KEYS/KEYRINGS_INTEGRITY, but > it's kind of late to be asking. Has it been in linux-next? Should I > assume this patch set has been fully tested or can we get some "tags"? Right, it should be KEYS/KEYRINGS_INTEGRITY related, I made mistaken. Now it got two ACKs from Michal and me. Michal met the same issue on arm64 and posted another series of patches, finally Coiby integrated Michal's patch and his to make this patchset. That would be great if this can get reviewing from experts on key/keyring. Surely, Coiby need update the patch log to add the '.machine' keyring into patch logs as you pointed out. IIRC, Coiby has tested it on x86_64/arm64, not sure if he took test on s390. No, this hasn't been in linux-next. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel