[PATCH] ipe: allow secondary and platform keyrings to install/update policies

[Fan Wu]

On 9/13/2024 4:48 PM, luca.boccassi at gmail.com wrote:
> From: Luca Boccassi <bluca at debian.org>
> 
...
> 
> Signed-off-by: Luca Boccassi <bluca at debian.org>
> ---
>   security/ipe/policy.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/security/ipe/policy.c b/security/ipe/policy.c
> index d8e7db857a2e..cac304dc86c2 100644
> --- a/security/ipe/policy.c
> +++ b/security/ipe/policy.c
> @@ -169,9 +169,15 @@ struct ipe_policy *ipe_new_policy(const char *text, size_t textlen,
>   			goto err;
>   		}
>   
> -		rc = verify_pkcs7_signature(NULL, 0, new->pkcs7, pkcs7len, NULL,
> +		rc = verify_pkcs7_signature(NULL, 0, new->pkcs7, pkcs7len,
> +					    VERIFY_USE_SECONDARY_KEYRING,
>   					    VERIFYING_UNSPECIFIED_SIGNATURE,
>   					    set_pkcs7_data, new);
> +		if (rc == -ENOKEY)
> +			rc = verify_pkcs7_signature(NULL, 0, new->pkcs7, pkcs7len,
> +						    VERIFY_USE_PLATFORM_KEYRING,
> +						    VERIFYING_UNSPECIFIED_SIGNATURE,
> +						    set_pkcs7_data, new);
>   		if (rc)
>   			goto err;
>   	} else {

Hi Luca,

This patch looks good to me. My only thought is, like what we currently 
have for dm-verity, should we also add two kconfigs to enable to use 
these two keyrings respectively?

-Fan