Re: Question on loading trusted key with keyctl command

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Mon, 2022-12-19 at 15:50 +0530, Sughosh Ganu wrote:
> hi,
> I am trying to enable the evm hmac solution on my qemu arm64 virt
> platform running Debian. I am using the swtpm 2.0 implementation for
> the TPM trusted source. Before I get into trying out the evm hmac
> solution on the target system, I wanted to check creating the trusted
> and encrypted keys.  Other details on my set up are as follows
> 
> Distro - Debian 11
> TPM - swtpm
> Linux kernel - Linux version 6.1.0-13032, commit 77856d911a8c [1]
> keyctl --version
> keyctl from keyutils-1.6.1 (Built 2020-02-10)
> 
> When trying to follow the steps highlighted in the
> Documentation/security/keys/trusted-encrypted.rst, I can generate the
> trusted key. However, when I try to load the trusted key using the
> command shown in the document, it throws an error. Has there been a
> change in the code, or am I missing some step when trying to load the
> trusted key?
> 
> Steps that I am following (after having created the SRK).
> 
> # keyctl add trusted kmk "new 32 keyhandle=0x81000001" @u
> # keyctl show
> Session Keyring
>  442944693 --alswrv      0     0  keyring: _ses
>  925986946 --alswrv      0 65534   \_ keyring: _uid.0
>  401286062 --alswrv      0     0       \_ trusted: kmk
> # keyctl pipe 401286062 > kmk.blob
> # keyctl add trusted kmk "load `cat kmk.blob` keyhandle=0x81000001"
> @u
> add_key: Invalid argument

kmk is your invalid argument ... you already have a key there.  Either
unlink %trusted:kmk or add the new key at kmk1.

James