[PATCH 2/3] keys: add KEY_SPEC_FS_VERITY_KEYRING
From: Andrew Halaney <hidden>
Date: 2026-09-14 16:42:05
Also in:
bpf, dm-devel, keyrings, linux-doc, lkml
Subsystem:
filesystems (vfs and infrastructure), fsverity: read-only file-based authenticity protection, keys/keyrings, security subsystem, the rest · Maintainers:
Alexander Viro, Christian Brauner, Eric Biggers, Theodore Y. Ts'o, David Howells, Jarkko Sakkinen, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Same problem as the dm-verity keyring: .fs-verity is allocated unlinked, so the only way for userspace to name it is to scrape /proc/keys. Suggested-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Andrew Halaney <redacted> --- fs/verity/signature.c | 2 ++ include/linux/key.h | 1 + include/uapi/linux/keyctl.h | 1 + security/keys/process_keys.c | 25 +++++++++++++++++++++++++ 4 files changed, 29 insertions(+)
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 0302a4e506ec..07657e913b22 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c@@ -135,4 +135,6 @@ void __init fsverity_init_signature(void) KEY_ALLOC_NOT_IN_QUOTA, NULL, NULL); if (IS_ERR(fsverity_keyring)) panic("failed to allocate \".fs-verity\" keyring"); + + key_register_fs_verity_keyring(fsverity_keyring); }
diff --git a/include/linux/key.h b/include/linux/key.h
index ae8d3314fd93..dd386c56278c 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h@@ -442,6 +442,7 @@ extern int keyring_restrict(key_ref_t keyring, const char *type, extern void key_register_bpf_keyring(struct key *keyring); extern void key_register_dm_verity_keyring(struct key *keyring); +extern void key_register_fs_verity_keyring(struct key *keyring); extern struct key *key_lookup(key_serial_t id);
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
index 75923941f1b3..00cc0942203e 100644
--- a/include/uapi/linux/keyctl.h
+++ b/include/uapi/linux/keyctl.h@@ -26,6 +26,7 @@ #define KEY_SPEC_REQUESTOR_KEYRING -8 /* - key ID for request_key() dest keyring */ #define KEY_SPEC_BPF_KEYRING -9 /* - key ID for the BPF-specific keyring */ #define KEY_SPEC_DM_VERITY_KEYRING -10 /* - key ID for the .dm-verity keyring */ +#define KEY_SPEC_FS_VERITY_KEYRING -11 /* - key ID for the .fs-verity keyring */ /* request-key default keyrings */ #define KEY_REQKEY_DEFL_NO_CHANGE -1
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index dba3df41638b..655c58a96fcb 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c@@ -29,6 +29,9 @@ static struct key *bpf_keyring __ro_after_init; static struct key *dm_verity_keyring; static DEFINE_SPINLOCK(dm_verity_keyring_lock); +/* fs-verity keyring reachable through KEY_SPEC_FS_VERITY_KEYRING */ +static struct key *fs_verity_keyring __ro_after_init; + /* The root user's tracking struct */ struct key_user root_key_user = { .usage = REFCOUNT_INIT(3),
@@ -629,6 +632,20 @@ void key_register_dm_verity_keyring(struct key *keyring) } EXPORT_SYMBOL_GPL(key_register_dm_verity_keyring); +/** + * key_register_fs_verity_keyring - Publish the keyring for KEY_SPEC_FS_VERITY_KEYRING + * @keyring: The keyring to publish + * + * Make @keyring reachable by userspace through the KEY_SPEC_FS_VERITY_KEYRING + * special key ID, so that provisioning it does not require scraping its + * serial out of /proc/keys first. Called once, from an initcall, and never + * undone. + */ +void key_register_fs_verity_keyring(struct key *keyring) +{ + fs_verity_keyring = keyring; +} + /* * Look up a key ID given us by userspace with a given permissions mask to get * the key it refers to.
@@ -799,6 +816,14 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags, key_ref = make_key_ref(key, 0); break; + case KEY_SPEC_FS_VERITY_KEYRING: + key = fs_verity_keyring; + if (!key) + goto error; + __key_get(key); + key_ref = make_key_ref(key, 0); + break; + default: key_ref = ERR_PTR(-EINVAL); if (id < 1)
--
2.55.0