From: Mimi Zohar Date: Wed, 27 Nov 2019 19:32:54 +0000 Subject: Re: [PATCH v9 6/6] IMA: Read keyrings= option from the IMA policy Message-Id: <1574883174.4793.318.camel@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="maccentraleurope" Content-Transfer-Encoding: base64 List-Id: References: <20191127015654.3744-1-nramas@linux.microsoft.com> <20191127015654.3744-7-nramas@linux.microsoft.com> In-Reply-To: <20191127015654.3744-7-nramas@linux.microsoft.com> To: Lakshmi Ramasubramanian , linux-integrity@vger.kernel.org Cc: eric.snowberg@oracle.com, dhowells@redhat.com, matthewgarrett@google.com, sashal@kernel.org, jamorris@linux.microsoft.com, linux-kernel@vger.kernel.org, keyrings@vger.kernel.org T24gVHVlLCAyMDE5LTExLTI2IGF0IDE3OjU2IC0wODAwLCBMYWtzaG1pIFJhbWFzdWJyYW1hbmlh biB3cm90ZToKPiBSZWFkICJrZXlyaW5ncz0iIG9wdGlvbiwgaWYgc3BlY2lmaWVkIGluIHRoZSBJ TUEgcG9saWN5LCBhbmQgc3RvcmUgaW4KPiB0aGUgbGlzdCBvZiBJTUEgcnVsZXMgd2hlbiB0aGUg Y29uZmlndXJlZCBJTUEgcG9saWN5IGlzIHJlYWQuCj4gCj4gVGhpcyBwYXRjaCBkZWZpbmVzIGEg bmV3IHBvbGljeSB0b2tlbiBlbnVtIG5hbWVseSBPcHRfa2V5cmluZ3MKPiBhbmQgYW4gb3B0aW9u IGZsYWcgSU1BX0tFWVJJTkdTIGZvciByZWFkaW5nICJrZXlyaW5ncz0iIG9wdGlvbgo+IGZyb20g dGhlIElNQSBwb2xpY3kuCj4gCj4gVXBkYXRlZCBpbWFfcGFyc2VfcnVsZSgpIHRvIHBhcnNlICJr ZXlyaW5ncz0iIG9wdGlvbiBpbiB0aGUgcG9saWN5Lgo+IFVwZGF0ZWQgaW1hX3BvbGljeV9zaG93 KCkgdG8gZGlzcGxheSAia2V5cmluZ3M9IiBvcHRpb24uCj4gCj4gVGhlIGZvbGxvd2luZyBleGFt cGxlIGlsbHVzdHJhdGVzIGhvdyBrZXkgbWVhc3VyZW1lbnQgY2FuIGJlIHZlcmlmaWVkLgoKVGhl IGV4YW1wbGUgaXMgcmVhbGx5IHRvbyBjb2xsb3F1aWFsL3ZlcmJvc2UuIMKgUGxlYXNlIHRydW5j YXRlIGl0LApsZWF2aW5nIGp1c3QgYSBzYW1wbGUgImtleSIgcG9saWN5IHJ1bGUsIHdpdGggZGly ZWN0aW9ucyBmb3IgdmVyaWZ5aW5nCnRoZSB0ZW1wbGF0ZSBkYXRhIGFnYWluc3QgdGhlIGRpZ2Vz dCBpbmNsdWRlZCBpbiB0aGUgbWVhc3VyZW1lbnQgbGlzdC4KCj4gCj4gU2FtcGxlIElNQSBQb2xp Y3kgZW50cnkgdG8gbWVhc3VyZSBrZXlzCj4gKEFkZGVkIGluIHRoZSBmaWxlIC9ldGMvaW1hL2lt YS1wb2xpY3kpOgoKUmVtb3ZlIHRoZSBhYm92ZS4KClNhbXBsZSAia2V5IiBtZWFzdXJlbWVudCBy dWxlOgoKPiBtZWFzdXJlIGZ1bmM9S0VZX0NIRUNLIGtleXJpbmdzPS5pbWF8LmV2bSB0ZW1wbGF0 ZT1pbWEtYnVmCj4gCj4gQnVpbGQgdGhlIGtlcm5lbCB3aXRoIHRoaXMgcGF0Y2ggc2V0IGFwcGxp ZWQgYW5kIHJlYm9vdCB0byB0aGF0IGtlcm5lbC4KPiAKPiBFbnN1cmUgdGhlIElNQSBwb2xpY3kg aXMgYXBwbGllZDoKPiAKPiByb290QG5yYW1hczovaG9tZS9ucmFtYXMjIGNhdCAvc3lzL2tlcm5l bC9zZWN1cml0eS9pbWEvcG9saWN5Cj4gbWVhc3VyZSBmdW5jPUtFWV9DSEVDSyBrZXlyaW5ncz0u aW1hfC5ldm0gdGVtcGxhdGU9aW1hLWJ1Zgo+IAo+IFZpZXcgdGhlIGluaXRpYWwgSU1BIG1lYXN1 cmVtZW50IGxvZzoKPiAKPiByb290QG5yYW1hczovaG9tZS9ucmFtYXMKPiAjIGNhdCAvc3lzL2tl cm5lbC9zZWN1cml0eS9pbWEvYXNjaWlfcnVudGltZV9tZWFzdXJlbWVudHMKPiAxMCA2N2VjLi4u IGltYS1uZyBzaGExOmI1NDY2YzUwODU4M2YwZTYzM2RmODNhYTU4ZmM3YzViNjdjY2Y2NjcgYm9v dF9hZ2dyZWdhdGUKPiAKPiBOb3csIGFkZCBhIGNlcnRpZmljYXRlIChmb3IgZXhhbXBsZSwgeDUw OV9pbWEuZGVyKSB0byB0aGUgLmltYSBrZXlyaW5nCj4gdXNpbmcgZXZtY3RsIChJTUEtRVZNIFV0 aWxpdHkpCj4gCj4gcm9vdEBucmFtYXM6L2hvbWUvbnJhbWFzIyBrZXljdGwgc2hvdyAlOi5pbWEK PiBLZXlyaW5nCj4gIDU0NzUxNTY0MCAtLS1sc3dydiAgICAgIDAgICAgIDAgIGtleXJpbmc6IC5p bWEKPiAKPiByb290QG5yYW1hczovaG9tZS9ucmFtYXMjIGV2bWN0bCBpbXBvcnQgeDUwOV9pbWEu ZGVyIDU0NzUxNTY0MAo+IAo+IHJvb3RAbnJhbWFzOi9ob21lL25yYW1hcyMga2V5Y3RsIHNob3cg JTouaW1hCj4gS2V5cmluZwo+ICA1NDc1MTU2NDAgLS0tbHN3cnYgICAgICAwICAgICAwICBrZXly aW5nOiAuaW1hCj4gIDgwOTY3ODc2NiAtLWFscy0tdiAgICAgIDAgICAgIDAgICBcXyBhc3ltbWV0 cmljOiBob3N0bmFtZTogd2hvYW1pIHNpZ25pbmcga2V5OiAwNTJkZDI0N2RjM2MzNi4uLgo+IAo+ IFZpZXcgdGhlIHVwZGF0ZWQgSU1BIG1lYXN1cmVtZW50IGxvZzoKPiAKPiByb290QG5yYW1hczov aG9tZS9ucmFtYXMjCgpSZW1vdmUgZXZlcnl0aGluZyB1cCB0byBoZXJlIGFuZCBzaW1wbHkgc2F5 IHNvbWV0aGluZyBsaWtlOgoKRGlzcGxheSAia2V5IiBtZWFzdXJlbWVudCBpbiB0aGUgSU1BIG1l YXN1cmVtZW50IGxpc3Q6Cgo+ICMgY2F0IC9zeXMva2VybmVsL3NlY3VyaXR5L2ltYS9hc2NpaV9y dW50aW1lX21lYXN1cmVtZW50cwoKPiAxMCAzYWRmLi4uIGltYS1idWYKPiBzaGEyNTY6MjdjOTE1 YjhkZGI5ZmFlNzIxNGNmMGE4YTcwNDNjYzNlZWVhYTc1MzliY2IxMzZmODQyNzA2N2I1ZjZjMwo+ IGI3YiAuaW1hIDMwODIwMjg2MzA4Mi4uLjRhZWUKCgo+IHJvb3RAbnJhbWFzOi9ob21lL25yYW1h cyMKClJlbW92ZSB0aGlzIHN0cmluZyBmcm9tIGFsbCB0aGUgY29tbWFuZHMuCj4gCj4gRm9yIHRo aXMgc2FtcGxlLCBTSEEyNTYgc2hvdWxkIGJlIHNlbGVjdGVkIGFzIHRoZSBoYXNoIGFsZ29yaXRo bQo+IHVzZWQgYnkgSU1BLgo+IAo+IFRoZSBmb2xsb3dpbmcgY29tbWFuZCB2ZXJpZmllcyBpZiB0 aGUgU0hBMjU2IGhhc2ggZ2VuZXJhdGVkIGZyb20KPiB0aGUgcGF5bG9hZCBpbiB0aGUgSU1BIGxv ZyBlbnRyeSAobGlzdGVkIGFib3ZlKSBmb3IgdGhlIC5pbWEga2V5Cj4gbWF0Y2hlcyB0aGUgU0hB MjU2IGhhc2ggaW4gdGhlIElNQSBsb2cgZW50cnkuIFRoZSBvdXRwdXQgb2YgdGhpcwo+IGNvbW1h bmQgc2hvdWxkIG1hdGNoIHRoZSBTSEEyNTYgaGFzaCBnaXZlbiBpbiB0aGUgSU1BIGxvZyBlbnRy eQo+IChJbiB0aGlzIGNhc2UsIGl0IHNob3VsZCBiZQo+IDI3YzkxNWI4ZGRiOWZhZTcyMTRjZjBh OGE3MDQzY2MzZWVlYWE3NTM5YmNiMTM2Zjg0MjcwNjdiNWY2YzNiN2IpCgpQcmV2aW91c2x5IHlv dSBkaWRuJ3QgdXNlIHRoZSBoYXNoIHZhbHVlLCBidXQgIi5pbWEiIHRvIGxvY2F0ZSB0aGUKImtl eSIgbWVhc3VyZW1lbnQgaW4gdGhlIG1lYXN1cmVtZW50IGxpc3QuIMKgSW4gZWFjaCBvZiB0aGUg Y29tbWFuZHMKYWJvdmUsIGl0IG1pZ2h0IGJlIGNsZWFyZXIuCgo+IAo+IHJvb3RAbnJhbWFzOi9o b21lL25yYW1hcwoKZGl0dG8KCj4gIyBjYXQgL3N5cy9rZXJuZWwvc2VjdXJpdHkvaW50ZWdyaXR5 L2ltYS9hc2NpaV9ydW50aW1lX21lYXN1cmVtZW50cwo+IHwgZ3JlcAo+IDI3YzkxNWI4ZGRiOWZh ZTcyMTRjZjBhOGE3MDQzY2MzZWVlYWE3NTM5YmNiMTM2Zjg0MjcwNjdiNWY2YzNiN2IgfCAKCj4g Y3V0IC1kJyAnIC1mIDYgfCB4eGQgLXIgLXAgfHRlZSBpbWEtY2VydC5kZXIgfCBzaGEyNTZzdW0g fCBjdXQgLWQnICcKPiAtZiAxCj4gCj4gVGhlIGFib3ZlIGNvbW1hbmQgYWxzbyBjcmVhdGVzIGEg YmluYXJ5IGZpbGUgbmFtZWx5IGltYS1jZXJ0LmRlcgo+IHVzaW5nIHRoZSBwYXlsb2FkIGluIHRo ZSBJTUEgbG9nIGVudHJ5LiBUaGlzIGZpbGUgc2hvdWxkIGJlIGEgdmFsaWQKPiB4NTA5IGNlcnRp ZmljYXRlIHdoaWNoIGNhbiBiZSB2ZXJpZmllZCB1c2luZyBvcGVuc3NsIGFzIGdpdmVuIGJlbG93 Ogo+IAo+IHJvb3RAbnJhbWFzOi9ob21lL25yYW1hcwoKZGl0dG8KCgo+ICMgb3BlbnNzbCB4NTA5 IC1pbiBpbWEtY2VydC5kZXIgLWluZm9ybSBERVIgLXRleHQKPiAKPiBUaGUgYWJvdmUgY29tbWFu ZCBzaG91bGQgZGlzcGxheSB0aGUgY29udGVudHMgb2YgdGhlIGZpbGUgaW1hLWNlcnQuZGVyCj4g YXMgYW4geDUwOSBjZXJ0aWZpY2F0ZS4KCkVpdGhlciB0aGUgY29tbWVudHMgc2hvdWxkIGJlIGFi b3ZlIG9yIGJlbG93IHRoZSBjb21tYW5kcywgbm90IGJvdGguCgo+IAo+IFRoZSBJTUEgcG9saWN5 IHVzZWQgaGVyZSBhbGxvd3MgbWVhc3VyZW1lbnQgb2Yga2V5cyBhZGRlZCB0bwo+ICIuaW1hIiBh bmQgIi5ldm0iIGtleXJpbmdzIG9ubHkuIEFkZCBhIGtleSB0byBhbnkgb3RoZXIga2V5cmluZyBh bmQKPiB2ZXJpZnkgdGhhdCB0aGUga2V5IGlzIG5vdCBtZWFzdXJlZC4KClRoaXMgY29tbWVudCB3 b3VsZCBiZSBpbmNsdWRlZCwgaWYgZGVzaXJlZCwgd2hlbiBkZWZpbmluZyB0aGUgcG9saWN5CnJ1 bGUsIG5vdCBoZXJlLgoKTWltaQo=