Bug 2002669

Currently, Fedora kernels do not enable the CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING option. I'd like to ask you to enable it.

If enabled the logic that is already enabled by CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y is slightly tweaked: instead of checking Verity roothash signature keys only against built-in signing keys they can be checked against keys uploaded from userspace first.

Note that module signing already checks the second keyring, i.e. this just makes DM verity mounting more like kernel module loading in respect to signature verification. 

Doing this would tremendously helpful because it allows making use of the roothash signature logic from userspace without requiring everything to be signed by Fedora: if enabled users can bless their own images with a signature that can be validated by a trusted key uploaded into the kernel.

Or to say it the other way round: not setting this option only really makes sense  if Fedora actually would sign any Verity images with the keys built into the kernel. Given that it does not at the moment the fact that CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y is already enabled is kinda pointless, it only starts to make sense once CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING  is set too.

Or to say it even differently: outside of extremely focussed environments where only a single kernel shall boot only a signle verity image and everything comes from a single vendor I doubt disabling CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG_SECONDARY_KEYRING ever makes sense.