Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1307188
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring |
| Date | 2016-01-12 11:10 +0100 |
| Message-ID | <qQ43L-7TO-19@gated-at.bofh.it> (permalink) |
| References | (8 earlier) <qPlzJ-2US-35@gated-at.bofh.it> <qPuWo-F7-49@gated-at.bofh.it> <qPVjQ-1If-15@gated-at.bofh.it> <qPWzg-2LM-3@gated-at.bofh.it> <qPXYm-3Gv-17@gated-at.bofh.it> |
| Organization | Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 |
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> The IMA MOK and blacklist are restricted to "public_key_restrict_link".
> Does this only allow keys signed by keys on the respective keyring or
> also by the system keyring?
As my patches stand, the following are implemented:
(1) public_key_restrict_link() restricts to asymmetric keys that are signed
by a CA in the specified keyring. It returns -ENOKEY if no matching key
is found rather than -EKEYREJECTED, however, so you can call it several
times for different keyrings. -EKEYREJECTED is only returned if a
signature check fails. This is used by the following two functions.
(2) restrict_link_by_system_trusted() restricts to asymmetric keys that are
signed by a CA in the system keyring. This ignores the keyring argument
it is given.
Note that the system_trusted_keyring is then no longer exported because
verify_pkcs7_signature() is also in certs/system_keyring.c and uses that
by default if NULL is passed.
(3) restrict_link_by_ima_mok() restricts to asymmetric keys signed by a CA in
either .system_keyring or .ima_mok.
So the trusted keyrings are then restricted as follows:
(1) .system_keyring uses restrict_link_by_system_trusted() - though it lacks
any sort of write permission, so it's currently moot. It could just as
well be replaced with a function that just returns -EPERM.
(2) .ima_mok should be using restrict_link_by_system_trusted(), but I failed
to update this when I split the public_key_restrict_link() function.
I've updated this in my patch. This would then be correct according to
Petko's commit log:
To successfully import a key into .ima_mok it must be signed by a
key which CA is in .system keyring.
However, from what Petko says, this is wrong and it should instead be
using restrict_link_by_ima_mok().
(3) .ima_blacklist should be using restrict_link_by_system_trusted() also.
I've no idea whether additions to this should be permitted by keys in
.ima_mok also.
(4) .ima uses restrict_link_by_ima_mok(), as per:
On turn any key that needs to go in .ima keyring must be signed by CA
in either .system or .ima_mok keyrings.
(5) .evm is not restricted by my patches. This is a mistake on my part - but
I'm not sure what the restriction actually needs to be as it's not
mentioned in Petko's commit message. Presumably it needs the same as
.ima.
David
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-06 14:50 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-07 01:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-07 01:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 03:20 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 04:30 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-07 16:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring James Morris <jmorris@namei.org> - 2016-01-10 11:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-10 14:30 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 18:50 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-10 21:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-11 01:00 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 01:50 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 03:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 04:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 11:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 14:30 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 15:00 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 16:20 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 17:00 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-12 17:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 15:20 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-10 21:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 02:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-12 17:20 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-12 18:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 17:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 19:00 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:10 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring David Howells <dhowells@redhat.com> - 2016-01-13 19:20 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 19:40 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-13 20:00 +0100
Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring Petko Manolov <petkan@mip-labs.com> - 2016-01-13 20:20 +0100
csiph-web