Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1313470

Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]

Show all headers | View raw

On Tue, 2016-01-19 at 11:30 +0000, David Howells wrote:
> Add the following:
> 
>  (1) A new system keyring that is used to store information about
>      blacklisted certificates and signatures.
> 
>  (2) A new key type (called 'blacklist') that is used to store a
>      blacklisted hash in its description as a hex string.  The key accepts
>      no payload.

>  (3) The ability to configure a list of blacklisted hashes into the kernel
>      at build time.  This is done by setting
>      CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
>      that are in the form:
> 
> 	"<hash>", "<hash>", ..., "<hash>"
> 
>      where each <hash> is a hex string representation of the hash and must
>      include all necessary leading zeros to pad the hash to the right size.

Is the output of "keyctl print" the hex string representation?  Update
keys documentation?

> The above are enabled with CONFIG_SYSTEM_BLACKLIST_KEYRING.
> 
> Once the kernel is booted, the blacklist keyring can be listed:
> 
> 	root@andromeda ~]# keyctl show %:.blacklist
> 	Keyring
> 	 723359729 ---lswrv      0     0  keyring: .blacklist
> 	 676257228 ---lswrv      0     0   \_ blacklist: 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
> 
> The blacklist cannot currently be modified by userspace, but it will be
> possible to load it, for example, from the UEFI blacklist database.

When loading the UEFI blacklist database is enabled, it should be
configurable.

> In the future, it should also be made possible to load blacklisted
> asymmetric keys in here too.

Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be
blacklisted" adds this support.

Mimi

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings  [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 10/20] X.509: Retain the key verification data [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the builtinness  of a key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 01/20] KEYS: Add an alloc flag to convey the  builtinness of a key [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100
  [RFC PATCH 06/20] PKCS#7: Make trust determination dependent on  contents of trust keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver  #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted  [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:40 +0100
  [RFC PATCH 14/20] KEYS: Generalise x509_request_asymmetric_key()  [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 08/20] KEYS: Allow authentication data to be stored in  an asymmetric key [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 15/20] KEYS: Move the point of trust determination to  __key_link() [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 13/20] X.509: Move the trust validation code out to its  own file [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 19/20] certs: Add a secondary system keyring that can be  added to dynamically [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 21:30 +0100
  [RFC PATCH 11/20] X.509: Extract signature digest and make  self-signed cert checks earlier [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  [RFC PATCH 09/20] KEYS: Add identifier pointers to  public_key_signature struct [ver #2] David Howells <dhowells@redhat.com> - 2016-01-19 12:40 +0100
  Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted' keyrings  [ver #2] Petko Manolov <petkan@mip-labs.com> - 2016-01-20 18:30 +0100
  Re: [RFC PATCH 00/20] KEYS: Restrict additions to 'trusted'  keyrings [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-01-20 20:00 +0100

csiph-web