3:03 p.m.
From: Bruno Meneguele on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127
This MR enable specific platform keys to be loaded in the integrity
platform
keyring (`.platform`). In the current state of the kernel the three
arches:
x86_64, aarch64, s390x, ppc, have the ability to pass their platform
(from
UEFI, IPL or PPC secur boot) enrolled keys to the system. With that,
I've
enabled the INTEGRITY_PLATFORM_KEYRING to the four platforms in both
RHEL
and Fedora and also their respective LOAD_*_KEYS.
With that, we are closer to upstream and also allow all platforms to
evolve
equaly during the next RHEL major release with Fedora users feedback.
56eef9231260 (Bruno Meneguele)
redhat: load specific ARCH keys to INTEGRITY_PLATFORM_KEYRING
66ed9a2826ba (Bruno Meneguele)
redhat: enable INTEGRITY_TRUSTED_KEYRING across all variants
b66b54c92054 (Bruno Meneguele)
redhat: enable SYSTEM_BLACKLIST_KEYRING across all variants
9a75ca99c03e (Bruno Meneguele)
redhat: enable INTEGRITY_ASYMMETRIC_KEYS across all variants
3:03 p.m.
New subject: [OS-BUILD PATCH 1/4] redhat: enable INTEGRITY_ASYMMETRIC_KEYS across
all
variants
From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat: enable INTEGRITY_ASYMMETRIC_KEYS across all variants
INTEGRITY_ASYMMETRIC_KEYS was already enabled in Fedora/generic/. This patch
adds it to common/generic because all supported ARK arches supports it.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff a/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
b/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
--- a/redhat/configs/ark/generic/x86/x86_64/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
diff a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
b/redhat/configs/common/generic/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
--- a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
+++ b/redhat/configs/common/generic/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
diff a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
b/redhat/configs/fedora/generic/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
--- a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127
3:03 p.m.
New subject: [OS-BUILD PATCH 2/4] redhat: enable SYSTEM_BLACKLIST_KEYRING across
all
variants
From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat: enable SYSTEM_BLACKLIST_KEYRING across all variants
It was already supported in Fedora/generic. Does the same for all ARK
arches.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff a/redhat/configs/ark/generic/x86/x86_64/CONFIG_SYSTEM_BLACKLIST_KEYRING
b/redhat/configs/common/generic/CONFIG_SYSTEM_BLACKLIST_KEYRING
--- a/redhat/configs/ark/generic/x86/x86_64/CONFIG_SYSTEM_BLACKLIST_KEYRING
+++ b/redhat/configs/common/generic/CONFIG_SYSTEM_BLACKLIST_KEYRING
diff a/redhat/configs/fedora/generic/CONFIG_SYSTEM_BLACKLIST_KEYRING
b/redhat/configs/fedora/generic/CONFIG_SYSTEM_BLACKLIST_KEYRING
--- a/redhat/configs/fedora/generic/CONFIG_SYSTEM_BLACKLIST_KEYRING
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SYSTEM_BLACKLIST_KEYRING=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127
3:03 p.m.
New subject: [OS-BUILD PATCH 3/4] redhat: enable INTEGRITY_TRUSTED_KEYRING across
all
variants
From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat: enable INTEGRITY_TRUSTED_KEYRING across all variants
This CONFIG option deprecates CONFIG_IMA_TRUSTED_KEYRING, however the old
one is still being required by some other options in upstream, that's why we
don't remove it yet.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_TRUSTED_KEYRING
b/redhat/configs/common/generic/CONFIG_INTEGRITY_TRUSTED_KEYRING
--- a/redhat/configs/ark/generic/powerpc/CONFIG_INTEGRITY_TRUSTED_KEYRING
+++ b/redhat/configs/common/generic/CONFIG_INTEGRITY_TRUSTED_KEYRING
diff a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_TRUSTED_KEYRING
b/redhat/configs/fedora/generic/CONFIG_INTEGRITY_TRUSTED_KEYRING
--- a/redhat/configs/fedora/generic/CONFIG_INTEGRITY_TRUSTED_KEYRING
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_INTEGRITY_TRUSTED_KEYRING=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127
3:03 p.m.
New subject: [OS-BUILD PATCH 4/4] redhat: load specific ARCH keys to
INTEGRITY_PLATFORM_KEYRING
From: Bruno Meneguele <bmeneg(a)redhat.com>
redhat: load specific ARCH keys to INTEGRITY_PLATFORM_KEYRING
In the current upstream kernel state all RHEL supported arches (aarch64,
x86_64, s390x and powerpc) supports loading platform keys (coming from the
boot process) to a trusted keyring in the system.
This patch enables CONFIG_INTEGRITY_PLATFORM_KEYRING to all ARK arches and
each CONFIG_LOAD_<arch>_KEYS to their respective architecture folder.
Signed-off-by: Bruno Meneguele <bmeneg(a)redhat.com>
diff a/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
b/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
--- /dev/null
+++ b/redhat/configs/ark/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_UEFI_KEYS=y
diff a/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS
b/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS
--- /dev/null
+++ b/redhat/configs/ark/generic/powerpc/CONFIG_LOAD_PPC_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_PPC_KEYS=y
diff a/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
b/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_IPL_KEYS=y
diff a/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS
b/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS
--- /dev/null
+++ b/redhat/configs/ark/generic/x86/CONFIG_LOAD_UEFI_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_UEFI_KEYS=y
diff a/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING
b/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING
--- a/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING
+++ b/redhat/configs/common/generic/CONFIG_INTEGRITY_PLATFORM_KEYRING
@@ -1 +1 @@
-# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set
+CONFIG_INTEGRITY_PLATFORM_KEYRING=y
diff a/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
--- /dev/null
+++ b/redhat/configs/fedora/generic/arm/aarch64/CONFIG_LOAD_UEFI_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_UEFI_KEYS=y
diff a/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING
b/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING
--- /dev/null
+++ b/redhat/configs/fedora/generic/arm/armv7/CONFIG_INTEGRITY_PLATFORM_KEYRING
@@ -0,0 +1 @@
+# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set
diff a/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS
b/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS
--- /dev/null
+++ b/redhat/configs/fedora/generic/powerpc/CONFIG_LOAD_PPC_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_PPC_KEYS=y
diff a/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
b/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
--- /dev/null
+++ b/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
@@ -0,0 +1 @@
+CONFIG_LOAD_IPL_KEYS=y
diff a/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING
b/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING
--- a/redhat/configs/fedora/generic/x86/CONFIG_INTEGRITY_PLATFORM_KEYRING
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_INTEGRITY_PLATFORM_KEYRING=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127
3:06 p.m.
From: Bruno Meneguele on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127#note_5718...
cc @lszubowi @jsnitsel @sfbest for review.
3:08 p.m.
From: Bruno Meneguele on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127#note_5718...
cc @msalter for review too (aarch64).
2:43 a.m.
From: Patrick Talbert on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1127#note_5746...
@jmflinuxtx This touches some generic and fedora configs. How do you
feel?
1073
days inactive
1076
days old
kernel@lists.fedoraproject.org
7 comments
2 participants
participants (2)
-
Bruno Meneguele (via Email Bridge) -
Patrick Talbert (via Email Bridge)