From: Jarkko Sakkinen <jarkko@kernel.org>
To: Nageswara Sastry <rnsastry@linux.ibm.com>,
Nayna Jain <nayna@linux.ibm.com>,
linux-integrity@vger.kernel.org, keyrings@vger.kernel.org
Cc: dhowells@redhat.com, zohar@linux.ibm.com,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, dimitri.ledkov@canonical.com,
seth@forshee.me, Masahiro Yamada <masahiroy@kernel.org>
Subject: Re: [PATCH v11 0/4] integrity: support including firmware ".platform" keys at build time
Date: Fri, 11 Mar 2022 18:42:33 +0200 [thread overview]
Message-ID: <f78d11fefd13bd17748e36621acee9c2f27a77f6.camel@kernel.org> (raw)
In-Reply-To: <4afae87c-2986-6b0e-07be-954dd4937afd@linux.ibm.com>
On Fri, 2022-03-11 at 10:11 +0530, Nageswara Sastry wrote:
>
>
> On 11/03/22 3:14 am, Nayna Jain wrote:
> > Some firmware support secure boot by embedding static keys to verify the
> > Linux kernel during boot. However, these firmware do not expose an
> > interface for the kernel to load firmware keys onto the ".platform"
> > keyring, preventing the kernel from verifying the kexec kernel image
> > signature.
> >
> > This patchset exports load_certificate_list() and defines a new function
> > load_builtin_platform_cert() to load compiled in certificates onto the
> > ".platform" keyring.
> >
> > Changelog:
> > v11:
> > * Added a new patch to conditionally build extract-cert if
> > PLATFORM_KEYRING is enabled.
> >
>
> Tested the following four patches with and with out setting
> CONFIG_INTEGRITY_PLATFORM_KEYS
>
> Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
OK, I added it:
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git
BR, Jarkko
next prev parent reply other threads:[~2022-03-11 16:43 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-10 21:44 [PATCH v11 0/4] integrity: support including firmware ".platform" keys at build time Nayna Jain
2022-03-10 21:44 ` [PATCH v11 1/4] certs: export load_certificate_list() to be used outside certs/ Nayna Jain
2022-03-10 21:44 ` [PATCH v11 2/4] integrity: make integrity_keyring_from_id() non-static Nayna Jain
2022-03-10 21:44 ` [PATCH v11 3/4] certs: conditionally build extract-cert if platform keyring is enabled Nayna Jain
2022-03-11 4:34 ` Masahiro Yamada
2022-03-10 21:44 ` [PATCH v11 4/4] integrity: support including firmware ".platform" keys at build time Nayna Jain
2022-03-11 4:41 ` [PATCH v11 0/4] " Nageswara Sastry
2022-03-11 16:42 ` Jarkko Sakkinen [this message]
2022-03-11 21:03 ` Nayna
2022-03-17 7:38 ` Jarkko Sakkinen
2022-03-18 21:25 ` Nayna
2022-03-20 21:31 ` Jarkko Sakkinen
2022-03-11 16:39 ` Jarkko Sakkinen
2022-03-14 12:53 ` Mimi Zohar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f78d11fefd13bd17748e36621acee9c2f27a77f6.camel@kernel.org \
--to=jarkko@kernel.org \
--cc=dhowells@redhat.com \
--cc=dimitri.ledkov@canonical.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=nayna@linux.ibm.com \
--cc=rnsastry@linux.ibm.com \
--cc=seth@forshee.me \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox