Linux Security Summit North America 2019

The kernel keyring facility has grown in capability beyond its initial, limited support for x.509 certificate verification. It has been generalized to allow any key type to implement its own checks for allowable keys, and to configure these restrictions from userspace.

Keyrings created by the keyctl API can currently be configured to verify signed x.509 asymmetric keys as they are linked to a keyring. The iNet Wireless Daemon (iwd) and the underlying Embedded Linux Library (ELL) leverage this to validate certificate chains.

This presentation will cover use of the keyring restriction userspace API with asymmetric keys in today's kernel, how to extend kernel key types to support new userspace-configurable restrictions, and ideas for more capable and flexible restrictions in the future.