Messages in this thread | | | Subject | Re: [RFC PATCH v4 4/4] KEYS: define an owner trusted keyring | From | Mimi Zohar <> | Date | Tue, 03 Jun 2014 11:02:34 -0400 |
| |
On Mon, 2014-06-02 at 07:55 -0400, Josh Boyer wrote: > On Mon, Jun 02, 2014 at 02:40:28PM +0300, Dmitry Kasatkin wrote: > > On 2 June 2014 14:33, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > > > On Mon, 2014-06-02 at 13:48 +0300, Dmitry Kasatkin wrote: > > >> On 1 June 2014 05:14, Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> > > Currently only the builtin keys are on the system keyring, but once > > > David and Josh's UEFI patches are upstreamed, the UEFI keys will also be > > > on the system keyring. At that point, we would want to differentiate > > > between the builtin keys and the remaining keys on the system keyring. > > > Splitting this patch definitely helps clarify what's happening and, more > > > importantly, why. > > > > > > Mimi > > > > > > > Ok. May be would should focus on patches for existing functionality. > > If something new comes from other side, it can be addressed by new > > another set of patches. > > I agree. I appreciate taking the UEFI key patches into account, but > they're held up and won't be hitting mainline in the next release or > two. Focus on the changes you need to make against mainline.
Ok. I've rewritten the patch. Instead of loading the key on the owner keyring at the same time as loading it on the system keyring, it waits until all the keys are on the system keyring, before adding the specified key to the owner keyring. We loose the ability to specify all the builtin keys, but at least for now, this isn't important. For now, we can identify a single builtin key, and when the UEFI patches are upstreamed, we should be able to identify a UEFI key, as well.
thanks,
Mimi
| |