[PATCH v3 4/6] KEYS: Introduce keyring_is_empty()
flat view
HOTtoday
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2026-10-25 00:12:24
Also in:
dm-devel, keyrings, linux-crypto, linux-kselftest, lkml
Subsystem:
device-mapper (lvm), filesystems (vfs and infrastructure), fsverity: read-only file-based authenticity protection, kernel selftest framework, keys/keyrings, security subsystem, the rest · Maintainers:
Alasdair Kergon, Mike Snitzer, Mikulas Patocka, Benjamin Marzinski, Alexander Viro, Christian Brauner, Eric Biggers, Theodore Y. Ts'o, Shuah Khan, Shuah Khan, David Howells, Jarkko Sakkinen, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Introduce keyring_is_empty() in order to decouple for dm-verity and fs-verity how keyring internally manages the keys. Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> --- drivers/md/dm-verity-verify-sig.c | 2 +- fs/verity/signature.c | 2 +- include/linux/key.h | 1 + security/keys/keyring.c | 10 ++++++++++ .../selftests/dm-verity/test-dm-verity-keyring.sh | 2 +- 5 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c
index b2b55c41e2cb..2ccb71bfb3ca 100644
--- a/drivers/md/dm-verity-verify-sig.c
+++ b/drivers/md/dm-verity-verify-sig.c@@ -153,7 +153,7 @@ int verity_verify_root_hash(const void *root_hash, size_t root_hash_len, if (ret != -ENOKEY && ret != -EKEYREJECTED) return ret; - if (dm_verity_keyring->keys.nr_leaves_on_tree && + if (!keyring_is_empty(dm_verity_keyring) && dm_verity_keyring->restrict_link) ret = verify_pkcs7_signature(root_hash, root_hash_len, sig_data, sig_len,
diff --git a/fs/verity/signature.c b/fs/verity/signature.c
index 0302a4e506ec..890d33b9d812 100644
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c@@ -67,7 +67,7 @@ int fsverity_verify_signature(const struct fsverity_info *vi, return 0; } - if (fsverity_keyring->keys.nr_leaves_on_tree == 0) { + if (keyring_is_empty(fsverity_keyring)) { /* * The ".fs-verity" keyring is empty, due to builtin signatures * being supported by the kernel but not actually being used.
diff --git a/include/linux/key.h b/include/linux/key.h
index 3b8af14fb323..df2034fc5436 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h@@ -439,6 +439,7 @@ extern int restrict_link_reject(struct key *keyring, struct key *restriction_key); extern int keyring_clear(struct key *keyring); +bool keyring_is_empty(const struct key *keyring); extern key_ref_t keyring_search(key_ref_t keyring, struct key_type *type,
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 5281da9d5bf7..4642754db6bf 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c@@ -443,6 +443,16 @@ static void keyring_destroy(struct key *keyring) assoc_array_destroy(&keyring->keys, &keyring_assoc_array_ops); } +/** + * keyring_is_empty - Check whether a keyring contains any links + * @keyring: The keyring to check. + */ +bool keyring_is_empty(const struct key *keyring) +{ + return READ_ONCE(keyring->keys.nr_leaves_on_tree) == 0; +} +EXPORT_SYMBOL(keyring_is_empty); + /* * Describe a keyring for /proc. */
diff --git a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
index 1f9601ef22f8..792449d356cf 100755
--- a/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh
+++ b/tools/testing/selftests/dm-verity/test-dm-verity-keyring.sh@@ -746,7 +746,7 @@ test_keyring_inactive_when_empty() { log_info "TEST: Verify dm-verity keyring is inactive when sealed empty" # When keyring_unsealed=0, the keyring is sealed immediately while empty - # This means it should NOT be used for verification (nr_leaves_on_tree=0) + # An empty keyring should NOT be used for verification. log_info "Keyring state (should be empty and sealed):" list_keyring_keys
--
2.47.3