Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2]

From	Mimi Zohar <zohar@linux.vnet.ibm.com>
Newsgroups	linux.kernel
Subject	Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2]
Date	2016-02-10 20:20 +0100
Message-ID	<r0IsV-6rW-3@gated-at.bofh.it> (permalink)
References	<qSCNI-78i-3@gated-at.bofh.it> <qSCNI-78i-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi David,

On Tue, 2016-01-19 at 11:32 +0000, David Howells wrote:

> @@ -145,10 +165,10 @@ static int __init blacklist_init(void)
>  			      current_cred(),
>  			      (KEY_POS_ALL & ~KEY_POS_SETATTR) |
>  			      KEY_USR_VIEW | KEY_USR_READ |
> -			      KEY_USR_SEARCH,
> +			      KEY_USR_SEARCH | KEY_USR_WRITE,
>  			      KEY_ALLOC_NOT_IN_QUOTA |
>  			      KEY_FLAG_KEEP,
> -			      NULL, NULL);
> +			      restrict_link_by_system_trusted, NULL);

As discussed, "restrict_link_by_system_trusted" is not enough.  The
certificate being added should be in a revoked list as well.  We should
defer this patch until that is possible or at least add a Kconfig option
to permit black listing x509 certificates.

Mimi

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-10 20:20 +0100
  Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-19 13:00 +0100
    Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-19 13:20 +0100

csiph-web