Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring
Date	2016-01-12 04:40 +0100
Message-ID	<qPXYm-3Gv-17@gated-at.bofh.it> (permalink)
References	(6 earlier) <qOkPo-1zT-11@gated-at.bofh.it> <qPlzJ-2US-35@gated-at.bofh.it> <qPuWo-F7-49@gated-at.bofh.it> <qPVjQ-1If-15@gated-at.bofh.it> <qPWzg-2LM-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, 2016-01-12 at 02:03 +0000, David Howells wrote:

> See the patch ensubjected:
> 
>   [RFC PATCH 14/15] KEYS: Move the point of trust determination to  __key_link()
> 
> Search for keyring_alloc and particularly restrict_link_by_ima_mok.
> 
> The restriction function cannot currently be cleared or modified by userspace
> - though I have an idea to make it possible to *impose* a restriction through
> keyctl() on any keyring that doesn't yet have a restriction imposed.
> 
> The restriction function can impose any restrictions it likes, using the key's
> parsed payload, key type, the current keyring contents and any other keyring
> contents as it wishes in evaluating the trustworthiness of a key.

One assumption is that ima-mok is always enabled, which isn't true and
not the default.  Depending on whether it is enabled, the ima keyring
would need to be restricted by "restrict_link_by_ima_mok" or
"restrict_link_by_system_trusted".

The IMA MOK and blacklist are restricted to "public_key_restrict_link".
Does this only allow keys signed by keys on the respective keyring or
also by the system keyring? 

As long as the system keyring is limited to just the builtin keys, then
this looks promising.  Otherwise, perhaps a separate "builtin" keyring
should be defined.

Mimi

Thread

[PATCH] X.509: Partially revert patch to add validation against IMA  MOK keyring David Howells <dhowells@redhat.com> - 2016-01-06 14:50 +0100
  Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-07 01:10 +0100
  Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-07 01:40 +0100
    Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 03:20 +0100
      Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 04:30 +0100
    Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 16:40 +0100
      Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-10 11:40 +0100
        Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-10 14:30 +0100
          Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 18:50 +0100
            Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 21:40 +0100
              Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-11 01:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 01:50 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring  David Howells <dhowells@redhat.com> - 2016-01-12 03:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 04:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 11:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 14:30 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 15:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 16:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 17:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 17:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 15:20 +0100
            Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-10 21:40 +0100
              Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 02:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 17:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 18:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 17:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 19:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:10 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-13 19:20 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:40 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 20:00 +0100
                Re: [PATCH] X.509: Partially revert patch to add validation against  IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 20:20 +0100

csiph-web