diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-27 08:01:30 -1000 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-10-27 08:01:30 -1000 |
| commit | 62c457528529cdcfa32bc52b331ceca10f3937b6 (patch) | |
| tree | 996f24181b89b02cbc2afcbe74888590877e9639 /include/uapi/linux | |
| parent | c60ebc3208b9ce1d8915318347962f7ce1dbd07d (diff) | |
| parent | 503b65da9a7e5447d91222f62399522f2f62a0fa (diff) | |
Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs keyring updates from Christian Brauner:
"The kernel has two keyrings that userspace fills with X.509
certificates at boot: .fs-verity for fs-verity built-in signatures
and .dm-verity for dm-verity root hash signatures.
Neither is linked into any process keyring. Hence, request_key() and
KEYCTL_SEARCH can't find them. The only way for userspace to identify
them is to read their serial number out of /proc/keys. That is not
just a large file often the names can also be reused and appear
multiple times which allows forging these keyrings.
This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
went in through bpf-next this merge window.
lookup_user_key() resolves the fixed key ids to the two keyrings. So
userspace can add a dm-verity (fixed keyring id: -10) certificate with
keyctl padd asymmetric "" -10 < cert.der
and seal the keyring with
keyctl restrict_keyring -10
without looking anything up first"
* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
keys: add KEY_SPEC_FS_VERITY_KEYRING
keys: add KEY_SPEC_DM_VERITY_KEYRING
Diffstat (limited to 'include/uapi/linux')
| -rw-r--r-- | include/uapi/linux/keyctl.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h index fa85b9760391..00cc0942203e 100644 --- a/include/uapi/linux/keyctl.h +++ b/include/uapi/linux/keyctl.h @@ -25,6 +25,8 @@ #define KEY_SPEC_REQKEY_AUTH_KEY -7 /* - key ID for assumed request_key auth key */ #define KEY_SPEC_REQUESTOR_KEYRING -8 /* - key ID for request_key() dest keyring */ #define KEY_SPEC_BPF_KEYRING -9 /* - key ID for the BPF-specific keyring */ +#define KEY_SPEC_DM_VERITY_KEYRING -10 /* - key ID for the .dm-verity keyring */ +#define KEY_SPEC_FS_VERITY_KEYRING -11 /* - key ID for the .fs-verity keyring */ /* request-key default keyrings */ #define KEY_REQKEY_DEFL_NO_CHANGE -1 |