diff options
| author | Andrew Halaney <andrew@amutable.com> | 2026-10-08 15:57:35 -0500 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-10-12 23:37:41 +0200 |
| commit | 1041fca2ee8a9236255c5819d685ec34e89b4928 (patch) | |
| tree | a593b3ddcda202a34fc24754b87c53d8fe420d90 /include | |
| parent | 592d26f625acef962aa40d1f22f29388bc05de13 (diff) | |
| download | linux-next-1041fca2ee8a9236255c5819d685ec34e89b4928.tar.gz linux-next-1041fca2ee8a9236255c5819d685ec34e89b4928.zip | |
keys: add KEY_SPEC_DM_VERITY_KEYRING
The .dm-verity keyring is not linked into any process keyring, so
request_key() and KEYCTL_SEARCH cannot find it. Userspace has to scrape
/proc/keys for the serial to use.
That's not great, one could put in a bogus description containing
a newline to confuse userspace further. For example, thanks to AI
models, which I run as root but you could show off as any old user:
# DESC=$'.dm-verity: 1\n0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity'
# k=$(echo -n "1234567" | keyctl padd user "$DESC" @s)
# keyctl setperm "$k" 0x3f010001
# cat /proc/keys | grep dm-verity
10402023 I------ 2 perm 082f0000 0 0 keyring .dm-verity: empty
12e0bee6 I--Q--- 1 perm 3f010001 0 0 user .dm-verity: 1
0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity: 7
0x0badf00d is not a keyring, it is the text inside our user's key
description. Telling the two apart needs a KEYCTL_DESCRIBE per row
which is annoying to do. i.e.:
# keyctl rdescribe 0x10402023
keyring;0;0;082f0000;.dm-verity
# keyctl rdescribe 0x0badf00d
keyctl_describe: Required key not available
Let's just give it a well known identifier, i.e.:
# keyctl rdescribe -10
keyring;0;0;082f0000;.dm-verity
This is exactly what
commit 264d8fd2794f ("bpf, keys: Add a bpf keyring for program signature validation")
did, and was the inspiration for this commit minus the spinlock bits
required due to dm-verity being a module.
Suggested-by: Christian Brauner (Amutable) <brauner@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Andrew Halaney <andrew@amutable.com>
Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-1-008456d189cb@amutable.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/key.h | 1 | ||||
| -rw-r--r-- | include/uapi/linux/keyctl.h | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/key.h b/include/linux/key.h index bd10fe45819d..ae8d3314fd93 100644 --- a/include/linux/key.h +++ b/include/linux/key.h @@ -441,6 +441,7 @@ extern int keyring_restrict(key_ref_t keyring, const char *type, const char *restriction); extern void key_register_bpf_keyring(struct key *keyring); +extern void key_register_dm_verity_keyring(struct key *keyring); extern struct key *key_lookup(key_serial_t id); diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h index fa85b9760391..75923941f1b3 100644 --- a/include/uapi/linux/keyctl.h +++ b/include/uapi/linux/keyctl.h @@ -25,6 +25,7 @@ #define KEY_SPEC_REQKEY_AUTH_KEY -7 /* - key ID for assumed request_key auth key */ #define KEY_SPEC_REQUESTOR_KEYRING -8 /* - key ID for request_key() dest keyring */ #define KEY_SPEC_BPF_KEYRING -9 /* - key ID for the BPF-specific keyring */ +#define KEY_SPEC_DM_VERITY_KEYRING -10 /* - key ID for the .dm-verity keyring */ /* request-key default keyrings */ #define KEY_REQKEY_DEFL_NO_CHANGE -1 |