* [PATCH v4 1/3] KEYS: Introduce keyring_is_empty()
[not found] <20261029232437.2581640-1-jarkko@kernel.org>
@ 2026-10-29 23:24 ` Jarkko Sakkinen
2026-11-01 23:22 ` Eric Biggers
0 siblings, 1 reply; 3+ messages in thread
From: Jarkko Sakkinen @ 2026-10-29 23:24 UTC (permalink / raw)
To: David Howells
Cc: keyrings, Eric Biggers, Jarkko Sakkinen, Lukas Wunner,
Ignat Korchagin, Herbert Xu, David S. Miller, Alasdair Kergon,
Mike Snitzer, Mikulas Patocka, Benjamin Marzinski,
Theodore Y. Ts'o, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi,
Martin KaFai Lau, Song Liu, Yonghong Song, Jiri Olsa,
Emil Tsalapatis, Ihor Solodrai, Paul Moore, James Morris,
Serge E. Hallyn, Shuah Khan, Christian Brauner,
open list:ASYMMETRIC KEYS, open list,
open list:DEVICE-MAPPER (LVM),
open list:FSVERITY: READ-ONLY FILE-BASED AUTHENTICITY PRO...,
open list:BPF [GENERAL] (Safe Dynamic Programs and Tools),
open list:SECURITY SUBSYSTEM, open list:KERNEL SELFTEST FRAMEWORK
Introduce keyring_is_empty() in order to decouple for BPF, dm-verity and
fs-verity how keyring internally manages the keys.
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
drivers/md/dm-verity-verify-sig.c | 2 +-
fs/verity/signature.c | 2 +-
include/linux/key.h | 1 +
kernel/bpf/keys.c | 2 +-
security/keys/keyring.c | 10 ++++++++++
.../selftests/dm-verity/test-dm-verity-keyring.sh | 2 +-
6 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
index aadcf5e4a47c..cad21e9144ed 100644
--- a/drivers/md/dm-verity-verify-sig.c
+++ b/drivers/md/dm-verity-verify-sig.c
@@ -153,7 +153,7 @@ int verity_verify_root_hash(const void *root_hash, size_t root_hash_len,
if (ret != -ENOKEY && ret != -EKEYREJECTED)
return ret;
- if (dm_verity_keyring->keys.nr_leaves_on_tree &&
+ if (!keyring_is_empty(dm_verity_keyring) &&
dm_verity_keyring->restrict_link)
ret = verify_pkcs7_signature(root_hash, root_hash_len,
sig_data, sig_len,
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 0302a4e506ec..890d33b9d812 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c
@@ -67,7 +67,7 @@ int fsverity_verify_signature(const struct fsverity_info *vi,
return 0;
}
- if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
+ if (keyring_is_empty(fsverity_keyring)) {
/*
* The ".fs-verity" keyring is empty, due to builtin signatures
* being supported by the kernel but not actually being used.
diff --git a/include/linux/key.h b/include/linux/key.h
index c4486e938a06..20ca43f5eab1 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -439,6 +439,7 @@ extern int restrict_link_reject(struct key *keyring,
struct key *restriction_key);
extern int keyring_clear(struct key *keyring);
+bool keyring_is_empty(const struct key *keyring);
extern key_ref_t keyring_search(key_ref_t keyring,
struct key_type *type,
diff --git a/kernel/bpf/keys.c b/kernel/bpf/keys.c
index bffc356839ac..24e0416abc99 100644
--- a/kernel/bpf/keys.c
+++ b/kernel/bpf/keys.c
@@ -29,7 +29,7 @@ struct bpf_key *bpf_lookup_keyring(void)
if (!bpf_keyring)
return NULL;
- if (!READ_ONCE(bpf_keyring->keys.nr_leaves_on_tree) ||
+ if (keyring_is_empty(bpf_keyring) ||
!READ_ONCE(bpf_keyring->restrict_link))
return NULL;
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 5281da9d5bf7..ac48d6204915 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -443,6 +443,16 @@ static void keyring_destroy(struct key *keyring)
assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops);
}
+/**
+ * keyring_is_empty - Check whether a keyring is empty
+ * @keyring: The keyring to check.
+ */
+bool keyring_is_empty(const struct key *keyring)
+{
+ return READ_ONCE(keyring->keys.nr_leaves_on_tree) == 0;
+}
+EXPORT_SYMBOL(keyring_is_empty);
+
/*
* Describe a keyring for /proc.
*/
diff --git a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
index 1f9601ef22f8..792449d356cf 100755
--- a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
+++ b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
@@ -746,7 +746,7 @@ test_keyring_inactive_when_empty() {
log_info "TEST: Verify dm-verity keyring is inactive when sealed empty"
# When keyring_unsealed=0, the keyring is sealed immediately while empty
- # This means it should NOT be used for verification (nr_leaves_on_tree=0)
+ # An empty keyring should NOT be used for verification.
log_info "Keyring state (should be empty and sealed):"
list_keyring_keys
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread