Messages in this thread | | | Subject | Re: [RFC PATCH v4 4/4] KEYS: define an owner trusted keyring | From | Mimi Zohar <> | Date | Mon, 02 Jun 2014 07:54:32 -0400 |
| |
On Mon, 2014-06-02 at 14:40 +0300, Dmitry Kasatkin wrote: > On 2 June 2014 14:33, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > > On Mon, 2014-06-02 at 13:48 +0300, Dmitry Kasatkin wrote:
> > Currently only the builtin keys are on the system keyring, but once > > David and Josh's UEFI patches are upstreamed, the UEFI keys will also be > > on the system keyring. At that point, we would want to differentiate > > between the builtin keys and the remaining keys on the system keyring. > > Splitting this patch definitely helps clarify what's happening and, more > > importantly, why. > > > > Mimi > > > > Ok. May be would should focus on patches for existing functionality. > If something new comes from other side, it can be addressed by new > another set of patches.
True, making the IMA keyring a trusted keyring is important by itself, but the real benefit is the ability for the platform owner to create and use their own key without having to rebuild the kernel. The platform owner then controls which keys are to be trusted.
Mimi
| |