[RFC PATCH v3 02/13] certs: Introduce ability to link to a system key

[Eric Snowberg]

> On Oct 17, 2024, at 10:16 AM, Jarkko Sakkinen <jarkko at kernel.org> wrote:
> 
> On Thu, 2024-10-17 at 09:55 -0600, Eric Snowberg wrote:
>> Introduce system_key_link(), a new function to allow a keyring to
>> link
>> to a key contained within one of the system keyrings (builtin,
>> secondary,
>> or platform). Depending on how the kernel is built, if the machine
>> keyring is available, it will be checked as well, since it is linked
>> to
>> the secondary keyring. If the asymmetric key id matches a key within
>> one
>> of these system keyrings, the matching key is linked into the passed
>> in
>> keyring.
>> 
>> Signed-off-by: Eric Snowberg <eric.snowberg at oracle.com>
>> ---
>>  certs/system_keyring.c        | 30 ++++++++++++++++++++++++++++++
>>  include/keys/system_keyring.h |  7 ++++++-
>>  2 files changed, 36 insertions(+), 1 deletion(-)
>> 
>> diff --git a/certs/system_keyring.c b/certs/system_keyring.c
>> index e344cee10d28..4abee7514442 100644
>> --- a/certs/system_keyring.c
>> +++ b/certs/system_keyring.c
>> @@ -20,6 +20,9 @@
>>  static struct key *builtin_trusted_keys;
>>  #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING
>>  static struct key *secondary_trusted_keys;
> 
> /*
> * Explain system_trusted_keys (nothing too detailed, only the gist)
> */
> 
>> +#define system_trusted_keys secondary_trusted_keys
>> +#else
>> +#define system_trusted_keys builtin_trusted_keys
>>  #endif
>>  #ifdef CONFIG_INTEGRITY_MACHINE_KEYRING
>>  static struct key *machine_trusted_keys;
> 
> We have enough these to make this quite convoluted so let's put some
> helpful reminders. I would forget this in no time ;-) So if it comes
> down to that, please put something because I have a goldfish memory.

I'll add a comment explaining this in the next round, thanks.