Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]
Date	2016-02-08 16:10 +0100
Message-ID	<qZVBT-70K-3@gated-at.bofh.it> (permalink)
References	(1 earlier) <qT6LN-2E2-47@gated-at.bofh.it> <qSCNI-78i-3@gated-at.bofh.it> <qSCNK-78i-57@gated-at.bofh.it> <qY7xw-3G4-7@gated-at.bofh.it> <qZUwa-63L-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, 2016-02-08 at 13:55 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> 
> > In addition, this patch set removes the IMA blacklist without any method for
> > adding blacklisted IMA keys to the system blacklist keyring.
> 
> That's not true.
> 
> Patch 18 enables userspace to add keys to the system blacklist keyring,
> provided those keys are validly signed:
> 
> -			      KEY_USR_SEARCH,
> +			      KEY_USR_SEARCH | KEY_USR_WRITE,
>  			      KEY_ALLOC_NOT_IN_QUOTA |
>  			      KEY_FLAG_KEEP,
> -			      NULL, NULL);
> +			      restrict_link_by_system_trusted, NULL);
> 
> After this commit, you can do everything with the system blacklist keyring
> that you can currently do with the IMA blacklist keyring.

Right, this patch makes the system blacklist keyring writable by
userspace and removes the IMA blacklist.  What I don't understand is how
to add a key that is currently on the IMA keyring to the system
blacklist? 

With the IMA blacklist, the same certificate that was added to the IMA
keyring could be added to the blacklist. (Probably not the best idea.)

The system black list currently only supports the  TBSCertificate hash,
not the key-id.   I have the signed certificate being added to the IMA
keyring.  I'm missing the step of getting the TBSCertificate hash based
on the certificate.

Mimi

Thread

Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-03 16:30 +0100
  Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 14:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 15:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 16:10 +0100
        How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:00 +0100
          Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:40 +0100
            Re: How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:50 +0100
              Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 20:30 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 16:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:50 +0100

csiph-web