Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs keyring updates from Christian Brauner:
 "The kernel has two keyrings that userspace fills with X.509
  certificates at boot: .fs-verity for fs-verity built-in signatures
  and .dm-verity for dm-verity root hash signatures.

  Neither is linked into any process keyring. Hence, request_key() and
  KEYCTL_SEARCH can't find them. The only way for userspace to identify
  them is to read their serial number out of /proc/keys. That is not
  just a large file often the names can also be reused and appear
  multiple times which allows forging these keyrings.

  This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
  KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
  went in through bpf-next this merge window.

  lookup_user_key() resolves the fixed key ids to the two keyrings. So
  userspace can add a dm-verity (fixed keyring id: -10) certificate with

	keyctl padd asymmetric "" -10 < cert.der

  and seal the keyring with

	keyctl restrict_keyring -10

  without looking anything up first"

* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
  keys: add KEY_SPEC_FS_VERITY_KEYRING
  keys: add KEY_SPEC_DM_VERITY_KEYRING

1 files changed, 2 insertions, 0 deletions

diff --git a/include/linux/key.h b/include/linux/key.h
index dae5ba255ad1..115db6e60254 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -446,6 +446,8 @@ extern int keyring_restrict(key_ref_t keyring, const char *type,
 			    const char *restriction);
 
 extern void key_register_bpf_keyring(struct key *keyring);
+extern void key_register_dm_verity_keyring(struct key *keyring);
+extern void key_register_fs_verity_keyring(struct key *keyring);
 
 extern struct key *key_lookup(key_serial_t id);