Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]
Date	2016-02-03 16:30 +0100
Message-ID	<qY7xw-3G4-7@gated-at.bofh.it> (permalink)
References	<qT6LN-2E2-47@gated-at.bofh.it> <qSCNI-78i-3@gated-at.bofh.it> <qSCNK-78i-57@gated-at.bofh.it> <qT6LN-2E2-47@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> >  (3) The ability to configure a list of blacklisted hashes into the kernel
> >      at build time.  This is done by setting
> >      CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
> >      that are in the form:
> > 
> > 	"<hash>", "<hash>", ..., "<hash>"
> > 
> >      where each <hash> is a hex string representation of the hash and must
> >      include all necessary leading zeros to pad the hash to the right size.
> 
> Is the output of "keyctl print" the hex string representation?

No, there is no payload and no read method.  "keyctl desc" will return the hex
string representation.

>  Update keys documentation?

Not a bad idea, but it should probably go in a separate document, along with
info about asymmetric keys.

> > The blacklist cannot currently be modified by userspace, but it will be
> > possible to load it, for example, from the UEFI blacklist database.
> 
> When loading the UEFI blacklist database is enabled, it should be
> configurable.

Probably.  That patch isn't added yet though.

> > In the future, it should also be made possible to load blacklisted
> > asymmetric keys in here too.
> 
> Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be
> blacklisted" adds this support.

Changed to:

	A later commit will make it possible to load blacklisted asymmetric
	keys in here too.
 
David

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-03 16:30 +0100
  Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 14:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 15:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 16:10 +0100
        How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:00 +0100
          Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:40 +0100
            Re: How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:50 +0100
              Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 20:30 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 16:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:50 +0100

csiph-web