Re: [GIT PULL for v7.4] vfs keyring

[Christian Brauner]

On Sun, Oct 25, 2026 at 04:35:56PM -1000, Linus Torvalds wrote:
> This explanation reads *very* oddly. It doesn't actually explain at
> all what the patches do or why they do it.

Ok, sorry about that.

> The only explanations about what the patches actually do are complete
> and utter nonsense. They claim it adds some kind of "well-known key
> IDs". That's complete BS. There is absolutely nothing "well known"
> about any of that: they are completely new random key IDs that nobody
> has ever heard of before, but that are meant to be used as fixed known
> key IDs.

I meant "well-known" in the sense of "fixed ids" that userspace can rely
on them being fixed. Certainly wasn't meant to mislead. Ok, here's my
rephrased proposal:

---

The kernel has two keyrings that userspace fills with X.509 certificates
at boot: .fs-verity for fs-verity built-in signatures and .dm-verity for
dm-verity root hash signatures.

Neither is linked into any process keyring. Hence, request_key() and
KEYCTL_SEARCH can't find them. The only way for userspace to identify
them is to read their serial number out of /proc/keys. That is not just
a large file often the names can also be reused and appear multiple
times which allows forging these keyrings.

This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter went
in through bpf-next this merge window.

lookup_user_key() resolves the fixed key ids to the two keyrings. So
userspace can add a certificate with

    keyctl padd asymmetric "" -10 < cert.der

and seal the keyring with

    keyctl restrict_keyring <keyring-id>

without looking anything up first.

The following changes since commit 1b7415bf70be95b9a1e7e87d544867881065613f:

  Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.3-rc2 (2026-09-06 16:17:40 -0700)

are available in the Git repository at:

  git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.4-rc1.keyring

for you to fetch changes up to 503b65da9a7e5447d91222f62399522f2f62a0fa:

  Merge patch series "keys: Add well known IDs for fs-verity/dm-verity keys" (2026-10-12 23:37:42 +0200)

----------------------------------------------------------------
vfs-7.4-rc1.keyring

Please consider pulling these changes from the signed vfs-7.4-rc1.keyring tag.

Thanks!
Christian

----------------------------------------------------------------
Andrew Halaney (3):
      keys: add KEY_SPEC_DM_VERITY_KEYRING
      keys: add KEY_SPEC_FS_VERITY_KEYRING
      Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY

Christian Brauner (2):
      Merge bpf keyring work from of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
      Merge patch series "keys: Add well known IDs for fs-verity/dm-verity keys"

 Documentation/security/keys/core.rst | 13 ++++++++
 drivers/md/dm-verity-verify-sig.c    |  3 ++
 fs/verity/signature.c                |  2 ++
 include/linux/key.h                  |  2 ++
 include/uapi/linux/keyctl.h          |  2 ++
 security/keys/process_keys.c         | 58 ++++++++++++++++++++++++++++++++++++
 6 files changed, 80 insertions(+)

--