Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1302769

[PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

From David Howells <dhowells@redhat.com>
Newsgroups linux.kernel
Subject [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring
Date 2016-01-06 14:50 +0100
Message-ID <qNWDo-1Oj-35@gated-at.bofh.it> (permalink)
Organization Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw


Partially revert commit 41c89b64d7184a780f12f2cccdabe65cb2408893:

	Author: Petko Manolov <petkan@mip-labs.com>
	Date:   Wed Dec 2 17:47:55 2015 +0200
	IMA: create machine owner and blacklist keyrings

The problem is that prep->trusted is a simple boolean and the additional
x509_validate_trust() call doesn't therefore distinguish levels of
trustedness, but is just OR'd with the result of validation against the
system trusted keyring.

However, setting the trusted flag means that this key may be added to *any*
trusted-only keyring - including the system trusted keyring.

Whilst I appreciate what the patch is trying to do, I don't think this is
quite the right solution.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Petko Manolov <petkan@mip-labs.com>
cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
cc: keyrings@vger.kernel.org
---

 crypto/asymmetric_keys/x509_public_key.c |    2 --
 1 file changed, 2 deletions(-)

diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
index 9e9e5a6a9ed6..2a44b3752471 100644
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -321,8 +321,6 @@ static int x509_key_preparse(struct key_preparsed_payload *prep)
 			goto error_free_cert;
 	} else if (!prep->trusted) {
 		ret = x509_validate_trust(cert, get_system_trusted_keyring());
-		if (ret)
-			ret = x509_validate_trust(cert, get_ima_mok_keyring());
 		if (!ret)
 			prep->trusted = 1;
 	}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | NextNext in thread | Find similar | Unroll thread


Thread

[PATCH] X.509: Partially revert patch to add validation against IMA  MOK keyring David Howells <dhowells@redhat.com> - 2016-01-06 14:50 +0100
  Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-07 01:10 +0100
  Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-07 01:40 +0100
    Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 03:20 +0100
      Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 04:30 +0100
    Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 16:40 +0100
      Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-10 11:40 +0100
        Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-10 14:30 +0100
          Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 18:50 +0100
            Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 21:40 +0100
              Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-11 01:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 01:50 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring  David Howells <dhowells@redhat.com> - 2016-01-12 03:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 04:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 11:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 14:30 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 15:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 16:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 17:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 17:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 15:20 +0100
            Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-10 21:40 +0100
              Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 02:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 17:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 18:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 17:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 19:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-13 19:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 20:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 20:20 +0100

csiph-web