How to add additional blacklist entries?

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	How to add additional blacklist entries?
Date	2016-02-08 17:00 +0100
Message-ID	<qZWok-7it-59@gated-at.bofh.it> (permalink)
References	(3 earlier) <qSCNI-78i-3@gated-at.bofh.it> <qSCNK-78i-57@gated-at.bofh.it> <qY7xw-3G4-7@gated-at.bofh.it> <qZUwa-63L-17@gated-at.bofh.it> <qZVBT-70K-3@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> Right, this patch makes the system blacklist keyring writable by
> userspace and removes the IMA blacklist.  What I don't understand is how
> to add a key that is currently on the IMA keyring to the system
> blacklist? 

You can do this from userspace with "keyctl link".  Admittedly, this attaches
the entire key to the blacklist keyring, not just the ID.  But that's
basically what you're doing at the moment, right.

To simply list the SKID of the key you want to blacklist, another patch will
be required, but the question is as to what the interface should look like.

Let's start at the beginning.  First of all, let me ask the following:

 (1) How is the key-to-be-blacklisted specified?  A copy of the X.509 cert to
     be blocked?  A signed list of SKIDs to be blocked?  A CRL?

 (2) How is the blacklist addition to be verified?

David

Thread

Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-03 16:30 +0100
  Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 14:40 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 15:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 16:10 +0100
        How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:00 +0100
          Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:40 +0100
            Re: How to add additional blacklist entries? David Howells <dhowells@redhat.com> - 2016-02-08 17:50 +0100
              Re: How to add additional blacklist entries? Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 20:30 +0100
    Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] David Howells <dhowells@redhat.com> - 2016-02-08 16:00 +0100
      Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2016-02-08 17:50 +0100

csiph-web