Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init

[PATCH v7 00/17] Enroll kernel keys thru MOK · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 05/17] KEYS: CA link restriction · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-17
Re: [PATCH v7 03/17] KEYS: Create static version of public_key_verify_signature · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-17
[PATCH v7 04/17] X.509: Parse Basic Constraints for CA · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 04/17] X.509: Parse Basic Constraints for CA · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-18
Re: [PATCH v7 04/17] X.509: Parse Basic Constraints for CA · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-18
[PATCH v7 08/17] integrity: add new keyring handler for mok keys · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 08/17] integrity: add new keyring handler for mok keys · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-19
[PATCH v7 09/17] KEYS: Rename get_builtin_and_secondary_restriction · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 09/17] KEYS: Rename get_builtin_and_secondary_restriction · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-19
[PATCH v7 10/17] KEYS: add a reference to machine keyring · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 11/17] KEYS: Introduce link restriction for machine keys · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 11/17] KEYS: Introduce link restriction for machine keys · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-19
Re: [PATCH v7 11/17] KEYS: Introduce link restriction for machine keys · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-19
[PATCH v7 12/17] KEYS: integrity: change link restriction to trust the machine keyring · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 12/17] KEYS: integrity: change link restriction to trust the machine keyring · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-19
[PATCH v7 02/17] integrity: Do not allow machine keyring updates following init · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 02/17] integrity: Do not allow machine keyring updates following init · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-17
[PATCH v7 13/17] KEYS: link secondary_trusted_keys to machine trusted keys · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 13/17] KEYS: link secondary_trusted_keys to machine trusted keys · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-18
Re: [PATCH v7 13/17] KEYS: link secondary_trusted_keys to machine trusted keys · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-18
[PATCH v7 16/17] integrity: Trust MOK keys if MokListTrustedRT found · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 17/17] integrity: Only use machine keyring when uefi_check_trust_mok_keys is true · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 01/17] integrity: Introduce a Linux keyring called machine · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 01/17] integrity: Introduce a Linux keyring called machine · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-17
[PATCH v7 07/17] integrity: Fix warning about missing prototypes · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 07/17] integrity: Fix warning about missing prototypes · Mimi Zohar <zohar@linux.ibm.com> · 2021-11-17
[PATCH v7 06/17] integrity: restrict INTEGRITY_KEYRING_MACHINE to restrict_link_by_ca · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 15/17] efi/mokvar: move up init order · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
[PATCH v7 14/17] integrity: store reference to machine keyring · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-16
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Jarkko Sakkinen <jarkko@kernel.org> · 2021-11-16
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Konrad Rzeszutek Wilk <hidden> · 2021-11-16
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Jarkko Sakkinen <jarkko@kernel.org> · 2021-11-16
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Konrad Rzeszutek Wilk <hidden> · 2021-11-16
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Jarkko Sakkinen <jarkko@kernel.org> · 2021-11-17
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Jarkko Sakkinen <jarkko@kernel.org> · 2021-11-17
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Konrad Rzeszutek Wilk <hidden> · 2021-11-17
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Eric Snowberg <eric.snowberg@oracle.com> · 2021-11-17
Re: [PATCH v7 00/17] Enroll kernel keys thru MOK · Jarkko Sakkinen <jarkko@kernel.org> · 2021-11-18

From: Mimi Zohar <zohar@linux.ibm.com>
Date: 2021-11-17 13:19:02
Also in: keyrings, linux-crypto, linux-efi, linux-integrity, lkml

On Mon, 2021-11-15 at 19:15 -0500, Eric Snowberg wrote:

The machine keyring is setup during init.  No additional keys should be
allowed to be added afterwards.  Leave the permission as read only.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Reviewed-by:  Mimi Zohar <zohar@linux.ibm.com>

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help