From 1041fca2ee8a9236255c5819d685ec34e89b4928 Mon Sep 17 00:00:00 2001 From: Andrew Halaney Date: Thu, 8 Oct 2026 15:57:35 -0500 Subject: keys: add KEY_SPEC_DM_VERITY_KEYRING The .dm-verity keyring is not linked into any process keyring, so request_key() and KEYCTL_SEARCH cannot find it. Userspace has to scrape /proc/keys for the serial to use. That's not great, one could put in a bogus description containing a newline to confuse userspace further. For example, thanks to AI models, which I run as root but you could show off as any old user: # DESC=$'.dm-verity: 1\n0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity' # k=$(echo -n "1234567" | keyctl padd user "$DESC" @s) # keyctl setperm "$k" 0x3f010001 # cat /proc/keys | grep dm-verity 10402023 I------ 2 perm 082f0000 0 0 keyring .dm-verity: empty 12e0bee6 I--Q--- 1 perm 3f010001 0 0 user .dm-verity: 1 0badf00d I--Q--- 1 perm 082f0000 0 0 keyring .dm-verity: 7 0x0badf00d is not a keyring, it is the text inside our user's key description. Telling the two apart needs a KEYCTL_DESCRIBE per row which is annoying to do. i.e.: # keyctl rdescribe 0x10402023 keyring;0;0;082f0000;.dm-verity # keyctl rdescribe 0x0badf00d keyctl_describe: Required key not available Let's just give it a well known identifier, i.e.: # keyctl rdescribe -10 keyring;0;0;082f0000;.dm-verity This is exactly what commit 264d8fd2794f ("bpf, keys: Add a bpf keyring for program signature validation") did, and was the inspiration for this commit minus the spinlock bits required due to dm-verity being a module. Suggested-by: Christian Brauner (Amutable) Reviewed-by: Jarkko Sakkinen Reviewed-by: Christian Brauner (Amutable) Signed-off-by: Andrew Halaney Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-1-008456d189cb@amutable.com Signed-off-by: Christian Brauner (Amutable) --- include/linux/key.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/linux') diff --git a/include/linux/key.h b/include/linux/key.h index bd10fe45819d..ae8d3314fd93 100644 --- a/include/linux/key.h +++ b/include/linux/key.h @@ -441,6 +441,7 @@ extern int keyring_restrict(key_ref_t keyring, const char *type, const char *restriction); extern void key_register_bpf_keyring(struct key *keyring); +extern void key_register_dm_verity_keyring(struct key *keyring); extern struct key *key_lookup(key_serial_t id); -- cgit v1.2.3 From 5ab0054676ff947af49855c6daaa1ce3270148c1 Mon Sep 17 00:00:00 2001 From: Andrew Halaney Date: Thu, 8 Oct 2026 15:57:36 -0500 Subject: keys: add KEY_SPEC_FS_VERITY_KEYRING Same problem as the dm-verity keyring: .fs-verity is allocated unlinked, so the only way for userspace to name it is to scrape /proc/keys. Suggested-by: Christian Brauner (Amutable) Reviewed-by: Jarkko Sakkinen Reviewed-by: Christian Brauner (Amutable) Signed-off-by: Andrew Halaney Link: https://patch.msgid.link/20261008-ajhalaney-dmverity-key-identifier-v2-2-008456d189cb@amutable.com Signed-off-by: Christian Brauner (Amutable) --- include/linux/key.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/linux') diff --git a/include/linux/key.h b/include/linux/key.h index ae8d3314fd93..dd386c56278c 100644 --- a/include/linux/key.h +++ b/include/linux/key.h @@ -442,6 +442,7 @@ extern int keyring_restrict(key_ref_t keyring, const char *type, extern void key_register_bpf_keyring(struct key *keyring); extern void key_register_dm_verity_keyring(struct key *keyring); +extern void key_register_fs_verity_keyring(struct key *keyring); extern struct key *key_lookup(key_serial_t id); -- cgit v1.2.3