[PATCH RFC 0/4] IPE: add a dedicated policy keyring

[Jarkko Sakkinen]

On Mon, Oct 19, 2026 at 09:40:24PM +0000, Manuel Huber via B4 Relay wrote:
> Add a dedicated ".ipe" keyring for IPE policy-signature verification,
> modeled after the dm-verity keyring, allowing userspace to provision
> IPE-specific policy-signing certificates. Systems that do not provision
> the keyring retain their existing behavior.
> 
> This RFC is based on commit 48f936e302a9 ("ipe: update the project and
> test suite links") from ipe/next so review can begin before the
> prerequisite keyring work reaches that branch. The series will be rebased
> onto a refreshed ipe/next once that work is available there [1].
> 
> The keyring readiness check currently follows the dm-verity and BPF
> implementations. A parallel keys RFC introduces keyring_is_empty() for
> this purpose [2]. A later revision will use the helper if it is available
> in the submission base.
> 
> Testing:
> - Built an x86_64 kernel with GCC 15.2.0 and Clang/LLD 21.1.8.
> - Passed all 33 IPE parser KUnit assertions.
> - Passed all 4 sealed-default keyring selftests under QEMU TCG.
> - Passed all 16 provisioning-mode keyring selftests under QEMU TCG with
>   ipe.keyring_unsealed=1.
> 
> [1] https://lore.kernel.org/r/20261008-ajhalaney-dmverity-key-identifier-v2-0-008456d189cb@amutable.com
> [2] https://lore.kernel.org/r/20261016215326.4110064-5-jarkko@kernel.org
> 
> Signed-off-by: Manuel Huber <manuelh at nvidia.com>
> ---
> Manuel Huber (4):
>       ipe: add the .ipe policy keyring
>       keys: add KEY_SPEC_IPE_KEYRING
>       Documentation: ipe: document the IPE keyring
>       selftests/ipe: test the IPE policy keyring
> 
>  Documentation/admin-guide/LSM/ipe.rst           |  41 ++-
>  Documentation/admin-guide/kernel-parameters.txt |   9 +
>  Documentation/security/ipe.rst                  |  16 +-
>  Documentation/security/keys/core.rst            |   9 +
>  MAINTAINERS                                     |   1 +
>  include/linux/key.h                             |   2 +
>  include/uapi/linux/keyctl.h                     |   1 +
>  security/ipe/Makefile                           |   1 +
>  security/ipe/ipe.c                              |   2 +
>  security/ipe/keyring.c                          |  80 ++++++
>  security/ipe/keyring.h                          |  16 ++
>  security/ipe/policy.c                           |  10 +
>  security/keys/process_keys.c                    |  23 ++
>  tools/testing/selftests/Makefile                |   1 +
>  tools/testing/selftests/ipe/Makefile            |   5 +
>  tools/testing/selftests/ipe/config              |   7 +
>  tools/testing/selftests/ipe/test-ipe-keyring.sh | 357 ++++++++++++++++++++++++
>  17 files changed, 575 insertions(+), 6 deletions(-)
> ---
> base-commit: 48f936e302a9c48cfc032eb5944c3a6246bc9043
> change-id: 20261019-b4-ipe-keyring-rfc-b93b9ae129a2
> 
> Best regards,
> -- 
> Manuel Huber <manuelh at nvidia.com>
> 
> 

We are in the phase of release cycle that it would be hard to find any
time to review this properly so might take a while, or I'll review a
follow-up iteration if other feedback arrives.

Br, Jarkko