[GIT PULL for v7.4] vfs keyring

[Christian Brauner]

Hey Linus,

This is a delayed pull request which was waiting for the bpf merge.
This used a shared branch.

/* Summary */
This adds well-known key ids for the .dm-verity and .fs-verity
keyrings.

Neither keyring is linked into any other keyring so request_key() and
KEYCTL_SEARCH can't find them. Userspace has to scrape the serial out
of /proc/keys before it can add a key to either of them. That's not
great as any user can add a key with a newline in its description and
make /proc/keys show a fake .dm-verity keyring line with whatever
serial they like.

/* Testing */

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline
=============================

No known conflicts.

Merge conflicts with other trees
================================

No known conflicts.

The following changes since commit 1b7415bf70be95b9a1e7e87d544867881065613f:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc2 (2026-09-06 16:17:40 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.keyring

for you to fetch changes up to 503b65da9a7e5447d91222f62399522f2f62a0fa:

  Merge patch series "keys: Add well known IDs for fs-verity/dm-verity keys" (2026-10-12 23:37:42 +0200)

----------------------------------------------------------------
vfs-7.4-rc1.keyring

Please consider pulling these changes from the signed vfs-7.4-rc1.keyring tag.

Thanks!
Christian

----------------------------------------------------------------
Andrew Halaney (3):
      keys: add KEY_SPEC_DM_VERITY_KEYRING
      keys: add KEY_SPEC_FS_VERITY_KEYRING
      Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY

Christian Brauner (2):
      Merge bpf keyring work from of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
      Merge patch series "keys: Add well known IDs for fs-verity/dm-verity keys"

 Documentation/security/keys/core.rst | 13 ++++++++
 drivers/md/dm-verity-verify-sig.c    |  3 ++
 fs/verity/signature.c                |  2 ++
 include/linux/key.h                  |  2 ++
 include/uapi/linux/keyctl.h          |  2 ++
 security/keys/process_keys.c         | 58 ++++++++++++++++++++++++++++++++++++
 6 files changed, 80 insertions(+)