From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758007AbcATUhm (ORCPT ); Wed, 20 Jan 2016 15:37:42 -0500 Received: from e28smtp03.in.ibm.com ([125.16.236.3]:54152 "EHLO e28smtp03.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750781AbcATUhj (ORCPT ); Wed, 20 Jan 2016 15:37:39 -0500 X-IBM-Helo: d28relay04.in.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;keyrings@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1453322001.9549.7.camel@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 03/20] X.509: Allow X.509 certs to be blacklisted [ver #2] From: Mimi Zohar To: David Howells Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, petkan@mip-labs.com, linux-kernel@vger.kernel.org Date: Wed, 20 Jan 2016 15:33:21 -0500 In-Reply-To: <20160119113049.23238.92240.stgit@warthog.procyon.org.uk> References: <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> <20160119113049.23238.92240.stgit@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable x-cbid: 16012020-0009-0000-0000-00000A1302E0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 2016-01-19 at 11:30 +0000, David Howells wrote: > Allow X.509 certs to be blacklisted based on their TBS hash. What is the TBS hash? This doesn't seem to be the key identifier. The cert associated with this key identifier is loaded onto the .ima keyring. eg: openssl x509 -in -inform DER -notext -out X509v3 extensions: X509v3 Subject Key Identifier: 71:12:39:B3:AB:E6:8D:BF:70:E7:26:DE:C8:4A:3F:5F:17:EF:00:6C # keyctl show %keyring:.blacklist Keyring 466574863 ---lswrv 0 0 keyring: .blacklist 433453563 ---lswrv 0 0 \_ blacklist: 711239b3abe68dbf70e726dec84a3f5f17ef006c Mimi > This is > convenient since we have to determine this anyway to be able to check the > signature on an X.509 certificate. > > If a certificate built into the kernel is blacklisted, something like the > following might then be seen during boot: > > X.509: Cert 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46 is blacklisted > Problem loading in-kernel X.509 certificate (-129) > > where the hex string shown is the blacklisted hash. > > Signed-off-by: David Howells