[RFC PATCH 4/6] keys: Add keyring_is_empty() for {fs,dm}-verity
flat view
WARM1d
SUPERSEDED
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2026-10-16 21:54:08
Also in:
dm-devel, keyrings, linux-kselftest, lkml
Subsystem:
device-mapper (lvm), filesystems (vfs and infrastructure), fsverity: read-only file-based authenticity protection, kernel selftest framework, keys/keyrings, security subsystem, the rest · Maintainers:
Alasdair Kergon, Mike Snitzer, Mikulas Patocka, Benjamin Marzinski, Alexander Viro, Christian Brauner, Eric Biggers, Theodore Y. Ts'o, Shuah Khan, Shuah Khan, David Howells, Jarkko Sakkinen, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Revision rfc of 2 in this series.
Revisions (2)
- rfc current
- v2 [diff vs current]
fs-verity and dm-verity read assoc_array's nr_leaves_on_tree directly to check whether a keyring is empty. Add keyring_is_empty() and use it in the both callers. Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> --- drivers/md/dm-verity-verify-sig.c | 2 +- fs/verity/signature.c | 2 +- include/linux/key.h | 1 + security/keys/keyring.c | 10 ++++++++++ .../selftests/dm-verity/test-dm-verity-keyring.sh | 2 +- 5 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
index b2b55c41e2cb..2ccb71bfb3ca 100644
--- a/drivers/md/dm-verity-verify-sig.c
+++ b/drivers/md/dm-verity-verify-sig.c@@ -153,7 +153,7 @@ int verity_verify_root_hash(const void *root_hash, size_t root_hash_len, if (ret != -ENOKEY && ret != -EKEYREJECTED) return ret; - if (dm_verity_keyring->keys.nr_leaves_on_tree && + if (!keyring_is_empty(dm_verity_keyring) && dm_verity_keyring->restrict_link) ret = verify_pkcs7_signature(root_hash, root_hash_len, sig_data, sig_len,
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 0302a4e506ec..890d33b9d812 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c@@ -67,7 +67,7 @@ int fsverity_verify_signature(const struct fsverity_info *vi, return 0; } - if (fsverity_keyring->keys.nr_leaves_on_tree == 0) { + if (keyring_is_empty(fsverity_keyring)) { /* * The ".fs-verity" keyring is empty, due to builtin signatures * being supported by the kernel but not actually being used.
diff --git a/include/linux/key.h b/include/linux/key.h
index 26139c3adf62..d82253b06c54 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h@@ -436,6 +436,7 @@ extern int restrict_link_reject(struct key *keyring, struct key *restriction_key); extern int keyring_clear(struct key *keyring); +bool keyring_is_empty(const struct key *keyring); extern key_ref_t keyring_search(key_ref_t keyring, struct key_type *type,
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 9ccce0db0665..613d1db41611 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c@@ -443,6 +443,16 @@ static void keyring_destroy(struct key *keyring) assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops); } +/** + * keyring_is_empty - Check whether a keyring contains any links + * @keyring: The keyring to check. + */ +bool keyring_is_empty(const struct key *keyring) +{ + return READ_ONCE(keyring->keys.nr_leaves_on_tree) == 0; +} +EXPORT_SYMBOL(keyring_is_empty); + /* * Describe a keyring for /proc. */
diff --git a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
index 1f9601ef22f8..792449d356cf 100755
--- a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
+++ b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh@@ -746,7 +746,7 @@ test_keyring_inactive_when_empty() { log_info "TEST: Verify dm-verity keyring is inactive when sealed empty" # When keyring_unsealed=0, the keyring is sealed immediately while empty - # This means it should NOT be used for verification (nr_leaves_on_tree=0) + # An empty keyring should NOT be used for verification. log_info "Keyring state (should be empty and sealed):" list_keyring_keys
--
2.47.3