Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1330072 > unrolled thread

Re: How to add additional blacklist entries?

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-09 11:50 +0100
    Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-10 15:10 +0100

#1330072 — Re: How to add additional blacklist entries?

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> > You can link from any key you have LINK permission on.  Further, add_key()
> > can add directly.
> 
> Oh, for some reason I thought the system blacklist keyring was limited
> to the new key type with just a description.   I was able to add, but
> also remove a key from the system blacklist.   I guess the KEY_FLAG_KEEP
> is not set on the system blacklist.

With patch 18 you can.  Prior to that it's not possible to modify it from
userspace at all.

> The keys being added to the IMA keyring are signed x509 certs (eg.
> openssl ca -ss_cert).  It would be nice to be able to include the skid
> in the description, without a payload, and sign that.  I have no idea if
> that Is possible or if it makes sense.  I'm open to suggestions.

I think we need a new keyctl or syscall for this.

We need to run through the X.509 parser, but we don't actually want to keep
any of the payload - and, in fact, we don't even necessarily want to create an
asymmetric-type key, though it's not a complete loss if we do that and create
one with a blacklist subtype.  The blacklist subtype would just return an
error from all operation points, but would otherwise be handled as normal.

David

[toc] | [next] | [standalone]

#1331185

Hi David,

Sorry, for the delay in responding...

On Tue, 2016-02-09 at 10:42 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> > The keys being added to the IMA keyring are signed x509 certs (eg.
> > openssl ca -ss_cert).  It would be nice to be able to include the skid
> > in the description, without a payload, and sign that.  I have no idea if
> > that Is possible or if it makes sense.  I'm open to suggestions.

I'm back tracking here a bit.  Problem statement: we need a safe method
for revoking an x509 certificate. The RFCs describe x509 certificate
revocation lists(CRL).  Perhaps in addition to the x509 cert, require a
CRL, containing the revoked x509 certificate, to load the cert on the
blacklist?  That way having just a cert, already signed by a trusted
key, would not be enough for it to be added to the blacklist.  The CRL
itself could be verified against a key on the trusted keyring.

> I think we need a new keyctl or syscall for this.
> 
> We need to run through the X.509 parser, but we don't actually want to keep
> any of the payload - and, in fact, we don't even necessarily want to create an
> asymmetric-type key, though it's not a complete loss if we do that and create
> one with a blacklist subtype.  The blacklist subtype would just return an
> error from all operation points, but would otherwise be handled as normal.

Having back tracked,  a new version of the "key add" syscall might be
needed to include the CRL.  The kernel could extract what it needs from
the revoked certificates (and CRL) to be stored on the blacklist
keyring.

Mimi

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web