From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161932AbcBSMR7 (ORCPT ); Fri, 19 Feb 2016 07:17:59 -0500 Received: from e28smtp06.in.ibm.com ([125.16.236.6]:50885 "EHLO e28smtp06.in.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933071AbcBSMR5 (ORCPT ); Fri, 19 Feb 2016 07:17:57 -0500 X-IBM-Helo: d28relay03.in.ibm.com X-IBM-MailFrom: zohar@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;keyrings@vger.kernel.org;linux-security-module@vger.kernel.org Message-ID: <1455884186.2906.104.camel@linux.vnet.ibm.com> Subject: Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] From: Mimi Zohar To: David Howells Cc: linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, petkan@mip-labs.com, linux-kernel@vger.kernel.org Date: Fri, 19 Feb 2016 07:16:26 -0500 In-Reply-To: <30312.1455883121@warthog.procyon.org.uk> References: <1455131523.2538.170.camel@linux.vnet.ibm.com> <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> <20160119113240.23238.31018.stgit@warthog.procyon.org.uk> <30312.1455883121@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable x-cbid: 16021912-0021-0000-0000-00000A3118A2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2016-02-19 at 11:58 +0000, David Howells wrote: > Mimi Zohar wrote: > > > As discussed, "restrict_link_by_system_trusted" is not enough. The > > certificate being added should be in a revoked list as well. > > What do you mean be a "revoked list"? There currently isn't such a beast in > IMA. The patches I've proposed should make the functionality available > approximately the same as exists now. Support for the IMA mok and blacklist keyrings are disabled by default. Please don't make this the default, at least until we add the equivalent of revoked certificates. Refer to the "Re: How to add additional blacklist entries?" thread. Mimi