This more or less follows the bpf keyring approach, allowing userspace to easily find the keys instead of having to parse /proc/keys.
Signed-off-by: Andrew Halaney <[email protected]> --- Changes in v2: - Rebased / target bpf-next/for-next since 264d8fd2794f ("bpf, keys: Add a bpf keyring for program signature validation") only exists there. - Grabbed Reviewed-by trailers. - Link to v1: https://lore.kernel.org/r/20260914-ajhalaney-dmverity-key-identifier-v1-0-01922dc13...@amutable.com --- Andrew Halaney (3): keys: add KEY_SPEC_DM_VERITY_KEYRING keys: add KEY_SPEC_FS_VERITY_KEYRING Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY Documentation/security/keys/core.rst | 13 ++++++++ drivers/md/dm-verity-verify-sig.c | 3 ++ fs/verity/signature.c | 2 ++ include/linux/key.h | 2 ++ include/uapi/linux/keyctl.h | 2 ++ security/keys/process_keys.c | 58 ++++++++++++++++++++++++++++++++++++ 6 files changed, 80 insertions(+) --- base-commit: e1d84a37cba984388988d2f1ddc84561413f0db2 change-id: 20260914-ajhalaney-dmverity-key-identifier-4187b6233be5 Best regards, -- Andrew Halaney <[email protected]>
