Re: [PATCH RFC 4/4] selftests/ipe: test the IPE policy keyring
flat view
From: Fan Wu <wufan@kernel.org>
Date: 2026-10-19 23:28:29
Also in:
bpf, keyrings, linux-doc, linux-kselftest, lkml
On 10/19/2026 2:40 PM, Manuel Huber via B4 Relay wrote:
From: Manuel Huber <redacted> Add an IPE kselftest that validates policy keyring operations for both ipe.keyring_unsealed values 0 and 1. For the default ipe.keyring_unsealed=0, verify that a) the special key ID resolves, b) certificate enrollment is rejected, and c) the keyring is not used for policy verification. For ipe.keyring_unsealed=1, verify that we can a) provision multiple certificates, b) restrict the keyring, then reject unenrolled and corrupted signatures, c) authenticate policy loads and updates with different enrolled certificates. Since IPE is built in, keyring restriction is irreversible, which is why we can only exercise the initially sealed and unsealed scenarios via separate boots. To get full coverage, CI thus needs to spin up separate environments with respective parameter values. Signed-off-by: Manuel Huber <redacted> ---
IPE doesn't use kselftest. Our tests live in the IPE CI [1], which already has keyring tests for policy signatures [2] and an initrd unit that provisions and seals the .fs-verity keyring [3]. Please add the .ipe cases there instead. [1] https://github.com/Integrity-Policy-Enforcement/ci [2] https://github.com/Integrity-Policy-Enforcement/ci/blob/main/suite/cases/policy_signature.py [3] https://github.com/Integrity-Policy-Enforcement/ci/blob/main/image/initrd/anchor-fsverity.service Fan