Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1331449 > unrolled thread

Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2]

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-10 20:20 +0100
    Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-19 13:00 +0100
      Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-19 13:20 +0100

#1331449 — Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2]

Hi David,

On Tue, 2016-01-19 at 11:32 +0000, David Howells wrote:

> @@ -145,10 +165,10 @@ static int __init blacklist_init(void)
>  			      current_cred(),
>  			      (KEY_POS_ALL & ~KEY_POS_SETATTR) |
>  			      KEY_USR_VIEW | KEY_USR_READ |
> -			      KEY_USR_SEARCH,
> +			      KEY_USR_SEARCH | KEY_USR_WRITE,
>  			      KEY_ALLOC_NOT_IN_QUOTA |
>  			      KEY_FLAG_KEEP,
> -			      NULL, NULL);
> +			      restrict_link_by_system_trusted, NULL);

As discussed, "restrict_link_by_system_trusted" is not enough.  The
certificate being added should be in a revoked list as well.  We should
defer this patch until that is possible or at least add a Kconfig option
to permit black listing x509 certificates.

Mimi

[toc] | [next] | [standalone]

#1338104

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> As discussed, "restrict_link_by_system_trusted" is not enough.  The
> certificate being added should be in a revoked list as well.

What do you mean be a "revoked list"?  There currently isn't such a beast in
IMA.  The patches I've proposed should make the functionality available
approximately the same as exists now.

David

[toc] | [prev] | [next] | [standalone]

#1338155

On Fri, 2016-02-19 at 11:58 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> 
> > As discussed, "restrict_link_by_system_trusted" is not enough.  The
> > certificate being added should be in a revoked list as well.
> 
> What do you mean be a "revoked list"?  There currently isn't such a beast in
> IMA.  The patches I've proposed should make the functionality available
> approximately the same as exists now.

Support for the IMA mok and blacklist keyrings are disabled by default.
Please don't make this the default, at least until we add the equivalent
of revoked certificates.  Refer to the "Re: How to add additional
blacklist entries?"  thread.

Mimi

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web