From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964891AbcATTbr (ORCPT ); Wed, 20 Jan 2016 14:31:47 -0500 Received: from e28smtp01.in.ibm.com ([125.16.236.1]:46731 "EHLO e28smtp01.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754678AbcATTbn (ORCPT ); Wed, 20 Jan 2016 14:31:43 -0500 X-IBM-Helo: d28relay05.in.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;keyrings@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1453318283.2858.27.camel@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2] From: Mimi Zohar To: David Howells Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, petkan@mip-labs.com, linux-kernel@vger.kernel.org Date: Wed, 20 Jan 2016 14:31:23 -0500 In-Reply-To: <20160119113041.23238.44728.stgit@warthog.procyon.org.uk> References: <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> <20160119113041.23238.44728.stgit@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable x-cbid: 16012019-4790-0000-0000-00000CD3DA06 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2016-01-19 at 11:30 +0000, David Howells wrote: > Add the following: > > (1) A new system keyring that is used to store information about > blacklisted certificates and signatures. > > (2) A new key type (called 'blacklist') that is used to store a > blacklisted hash in its description as a hex string. The key accepts > no payload. > (3) The ability to configure a list of blacklisted hashes into the kernel > at build time. This is done by setting > CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes > that are in the form: > > "", "", ..., "" > > where each is a hex string representation of the hash and must > include all necessary leading zeros to pad the hash to the right size. Is the output of "keyctl print" the hex string representation? Update keys documentation? > The above are enabled with CONFIG_SYSTEM_BLACKLIST_KEYRING. > > Once the kernel is booted, the blacklist keyring can be listed: > > root@andromeda ~]# keyctl show %:.blacklist > Keyring > 723359729 ---lswrv 0 0 keyring: .blacklist > 676257228 ---lswrv 0 0 \_ blacklist: 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 > > The blacklist cannot currently be modified by userspace, but it will be > possible to load it, for example, from the UEFI blacklist database. When loading the UEFI blacklist database is enabled, it should be configurable. > In the future, it should also be made possible to load blacklisted > asymmetric keys in here too. Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be blacklisted" adds this support. Mimi