Add a dedicated ".ipe" keyring for IPE policy-signature verification,
modeled after the dm-verity keyring, allowing userspace to provision
IPE-specific policy-signing certificates. Systems that do not provision
the keyring retain their existing behavior.
This RFC is based on commit 48f936e302a9 ("ipe: update the project and
test suite links") from ipe/next so review can begin before the
prerequisite keyring work reaches that branch. The series will be rebased
onto a refreshed ipe/next once that work is available there [1].
The keyring readiness check currently follows the dm-verity and BPF
implementations. A parallel keys RFC introduces keyring_is_empty() for
this purpose [2]. A later revision will use the helper if it is available
in the submission base.
Testing:
- Built an x86_64 kernel with GCC 15.2.0 and Clang/LLD 21.1.8.
- Passed all 33 IPE parser KUnit assertions.
- Passed all 4 sealed-default keyring selftests under QEMU TCG.
- Passed all 16 provisioning-mode keyring selftests under QEMU TCG with
ipe.keyring_unsealed=1.
[1]
https://lore.kernel.org/r/20261008-ajhalaney-dmverity-key-identifier-v2-0-008456d18...@amutable.com
[2] https://lore.kernel.org/r/[email protected]
Signed-off-by: Manuel Huber <[email protected]>
---
Manuel Huber (4):
ipe: add the .ipe policy keyring
keys: add KEY_SPEC_IPE_KEYRING
Documentation: ipe: document the IPE keyring
selftests/ipe: test the IPE policy keyring
Documentation/admin-guide/LSM/ipe.rst | 41 ++-
Documentation/admin-guide/kernel-parameters.txt | 9 +
Documentation/security/ipe.rst | 16 +-
Documentation/security/keys/core.rst | 9 +
MAINTAINERS | 1 +
include/linux/key.h | 2 +
include/uapi/linux/keyctl.h | 1 +
security/ipe/Makefile | 1 +
security/ipe/ipe.c | 2 +
security/ipe/keyring.c | 80 ++++++
security/ipe/keyring.h | 16 ++
security/ipe/policy.c | 10 +
security/keys/process_keys.c | 23 ++
tools/testing/selftests/Makefile | 1 +
tools/testing/selftests/ipe/Makefile | 5 +
tools/testing/selftests/ipe/config | 7 +
tools/testing/selftests/ipe/test-ipe-keyring.sh | 357 ++++++++++++++++++++++++
17 files changed, 575 insertions(+), 6 deletions(-)
---
base-commit: 48f936e302a9c48cfc032eb5944c3a6246bc9043
change-id: 20261019-b4-ipe-keyring-rfc-b93b9ae129a2
Best regards,
--
Manuel Huber <[email protected]>
