Re: [PATCH v7 01/17] integrity: Introduce a Linux keyring called machine

Hi Eric,

On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:

Many UEFI Linux distributions boot using shim.  The UEFI shim provides
what is called Machine Owner Keys (MOK). Shim uses both the UEFI Secure
Boot DB and MOK keys to validate the next step in the boot chain.  The
MOK facility can be used to import user generated keys.  These keys can
be used to sign an end-users development kernel build.  When Linux
boots, both UEFI Secure Boot DB and MOK keys get loaded in the Linux
.platform keyring.

, which can be used to verify kexec'ed kernel images.

Define a new Linux keyring called machine.  This keyring shall contain just
MOK CA keys and not the remaining keys in the platform keyring. This new
machine keyring will be used in follow on patches.  Unlike keys in the
platform keyring, keys contained in the machine keyring will be trusted
within the kernel if the end-user has chosen to do so.

 allowing, for example, keys to be loaded onto the trusted IMA keyring.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Thank you for all the work!  Just letting you know I'm slowly making my
through the patch set.  With the previous patch re-organization, we
should be able to test everything up to the introduction of the MOK
variable support.

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>