From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755159AbdK2OMG (ORCPT ); Wed, 29 Nov 2017 09:12:06 -0500 Received: from mail-pl0-f68.google.com ([209.85.160.68]:36840 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754223AbdK2OMD (ORCPT ); Wed, 29 Nov 2017 09:12:03 -0500 X-Google-Smtp-Source: AGs4zMblqNlR2KqVQkGJjjhKuqttqUj7ejMXrwmeNTP777iVCWR0/rbEKfOWOq6mBHfsP/h6cjvIBg== From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: David Howells Cc: linux-fs@vger.kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, "Lee, Chun-Yi" Subject: [PATCH 0/4] Using the hash in MOKx to blacklist kernel module Date: Wed, 29 Nov 2017 22:11:35 +0800 Message-Id: <20171129141139.20088-1-jlee@suse.com> X-Mailer: git-send-email 2.12.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch set is base on the efi-lock-down and keys-uefi branchs in David Howells's linux-fs git tree. The main purpose is using the MOKx to blacklist kernel module. As the MOK (Machine Owner Key), MOKx is a EFI boot time variable which is maintained by shim boot loader. We can enroll the hash of blacklisted kernel module (with or without signature) to MOKx by mokutil. Kernel loads the hash from MOKx to blacklist keyring when booting. Kernel will prevent to load the kernel module when its hash be found in blacklist. This function is useful to revoke a kernel module that it has exploit. Or revoking a kernel module that it was signed by a unsecure key. Except MOKx, this patch set fixs another two issues: The MOK/MOKx should not be loaded when secure boot is disabled. And, modified error message prints out appropriate status string for reading by human being. Lee, Chun-Yi (4): MODSIGN: do not load mok when secure boot disabled MODSIGN: print appropriate status message when getting UEFI certificates list MODSIGN: load blacklist from MOKx MODSIGN: checking the blacklisted hash before loading a kernel module certs/load_uefi.c | 71 +++++++++++++++++++++++++++++++++++-------------- include/linux/efi.h | 25 +++++++++++++++++ kernel/module_signing.c | 62 ++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 136 insertions(+), 22 deletions(-) -- 2.10.2