Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2]

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2]
Date	2016-01-06 14:30 +0100
Message-ID	<qNWk2-1HB-13@gated-at.bofh.it> (permalink)
References	<qNVxE-16O-23@gated-at.bofh.it> <qNCll-5bm-37@gated-at.bofh.it> <qNC1Y-4OF-27@gated-at.bofh.it> <qNCOn-5m1-39@gated-at.bofh.it> <qNVxE-16O-23@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> The x509_validate_trust() was originally added for IMA to ensure, on a
> secure boot system, a certificate chain of trust rooted in hardware.
> The IMA MOK keyring extends this certificate chain of trust to the
> running system.

The problem is that because 'trusted' is a boolean, a key in the IMA MOK
keyring will permit addition to the system keyring.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 16:50 +0100
  Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:00 +0100
  Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-05 17:10 +0100
    Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:40 +0100
      Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-06 13:40 +0100
        Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-06 14:30 +0100
          Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-06 15:10 +0100
            Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-06 15:20 +0100
          Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-06 18:10 +0100
    Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] David Howells <dhowells@redhat.com> - 2016-01-05 17:50 +0100
      Re: [RFC PATCH] X.509: Don't check the signature on apparently  self-signed keys [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-05 18:10 +0100

csiph-web