android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

integrity: Trust MOK keys if MokListTrustedRT found

Browse Source 
A new Machine Owner Key (MOK) variable called MokListTrustedRT has been
introduced in shim. When this UEFI variable is set, it indicates the
end-user has made the decision themselves that they wish to trust MOK keys
within the Linux trust boundary.  It is not an error if this variable
does not exist. If it does not exist, the MOK keys should not be trusted
within the kernel.

Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
Eric Snowberg 2022-01-25 21:58:33 -05:00 committed by Jarkko Sakkinen
parent 847c5336d8
commit 74f5e30051
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
security/integrity/platform_certs/machine_keyring.c
View File

@ -5,6 +5,7 @@
* Copyright (c) 2021, Oracle and/or its affiliates.
*/
#include <linux/efi.h>
#include "../integrity.h"
static __init int machine_keyring_init(void)
@ -40,3 +41,21 @@ void __init add_to_machine_keyring(const char *source, const void *data, size_t
if (rc)
pr_info("Error adding keys to machine keyring %s\n", source);
}
/*
* Try to load the MokListTrustedRT MOK variable to see if we should trust
* the MOK keys within the kernel. It is not an error if this variable
* does not exist. If it does not exist, MOK keys should not be trusted
* within the machine keyring.
*/
static __init bool uefi_check_trust_mok_keys(void)
{
struct efi_mokvar_table_entry *mokvar_entry;
mokvar_entry = efi_mokvar_entry_find("MokListTrustedRT");
if (mokvar_entry)
return true;
return false;
}