From: "Mickaël Salaün" <mic@digikod.net>
To: Jarkko Sakkinen <jarkko@kernel.org>
Cc: "David Howells" <dhowells@redhat.com>,
"David Woodhouse" <dwmw2@infradead.org>,
"David S . Miller" <davem@davemloft.net>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"James Morris" <jmorris@namei.org>,
"Mickaël Salaün" <mic@linux.microsoft.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Serge E . Hallyn" <serge@hallyn.com>,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v3 09/10] certs: Allow root user to append signed hashes to the blacklist keyring
Date: Wed, 20 Jan 2021 12:24:36 +0100 [thread overview]
Message-ID: <958b2ea4-7b31-da90-2efd-019166a6029b@digikod.net> (raw)
In-Reply-To: <YAe+PZHadpJcR0oc@kernel.org>
On 20/01/2021 06:23, Jarkko Sakkinen wrote:
> On Thu, Jan 14, 2021 at 04:19:08PM +0100, Mickaël Salaün wrote:
>> From: Mickaël Salaün <mic@linux.microsoft.com>
>>
>> Add a kernel option SYSTEM_BLACKLIST_AUTH_UPDATE to enable the root user
>> to dynamically add new keys to the blacklist keyring. This enables to
>> invalidate new certificates, either from being loaded in a keyring, or
>> from being trusted in a PKCS#7 certificate chain. This also enables to
>> add new file hashes to be denied by the integrity infrastructure.
>>
>> Being able to untrust a certificate which could have normaly been
>> trusted is a sensitive operation. This is why adding new hashes to the
>> blacklist keyring is only allowed when these hashes are signed and
>> vouched by the builtin trusted keyring. A blacklist hash is stored as a
>> key description. The PKCS#7 signature of this description must be
>> provided as the key payload.
>>
>> Marking a certificate as untrusted should be enforced while the system
>> is running. It is then forbiden to remove such blacklist keys.
>>
>> Update blacklist keyring and blacklist key access rights:
>> * allows the root user to search for a specific blacklisted hash, which
>> make sense because the descriptions are already viewable;
>> * forbids key update;
>> * restricts kernel rights on the blacklist keyring to align with the
>> root user rights.
>>
>> See the help in tools/certs/print-cert-tbs-hash.sh provided by a
>> following commit.
>
> Please re-order patches in a way that print-cert-tbs-hash.sh is
> available before this. That way we get rid of this useless remark.
OK
>
>> Cc: David Howells <dhowells@redhat.com>
>> Cc: David Woodhouse <dwmw2@infradead.org>
>> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
>
> /Jarkko
>
next prev parent reply other threads:[~2021-01-20 13:45 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-14 15:18 [PATCH v3 00/10] Enable root to update the blacklist keyring Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 01/10] certs/blacklist: fix kernel doc interface issue Mickaël Salaün
2021-01-20 3:39 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check Mickaël Salaün
2021-01-20 3:43 ` Jarkko Sakkinen
2021-01-20 11:12 ` Mickaël Salaün
2021-01-20 23:44 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 03/10] PKCS#7: Fix missing include Mickaël Salaün
2021-01-20 3:44 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 04/10] certs: Fix blacklist flag type confusion Mickaël Salaün
2021-01-20 3:55 ` Jarkko Sakkinen
2021-01-20 11:15 ` Mickaël Salaün
2021-01-20 23:45 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 05/10] certs: Replace K{U,G}IDT_INIT() with GLOBAL_ROOT_{U,G}ID Mickaël Salaün
2021-01-20 5:15 ` Jarkko Sakkinen
2021-01-20 11:17 ` Mickaël Salaün
2021-01-20 23:48 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 06/10] certs: Make blacklist_vet_description() more strict Mickaël Salaün
2021-01-20 4:16 ` Jarkko Sakkinen
2021-01-20 11:23 ` Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 07/10] certs: Factor out the blacklist hash creation Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 08/10] certs: Check that builtin blacklist hashes are valid Mickaël Salaün
2021-01-20 5:19 ` Jarkko Sakkinen
2021-01-20 11:57 ` Mickaël Salaün
2021-01-20 23:53 ` Jarkko Sakkinen
2021-01-21 9:18 ` Mickaël Salaün
2021-01-21 15:21 ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 09/10] certs: Allow root user to append signed hashes to the blacklist keyring Mickaël Salaün
2021-01-15 13:06 ` Mimi Zohar
2021-01-20 5:23 ` Jarkko Sakkinen
2021-01-20 11:24 ` Mickaël Salaün [this message]
2021-01-14 15:19 ` [PATCH v3 10/10] tools/certs: Add print-cert-tbs-hash.sh Mickaël Salaün
2021-01-15 9:28 ` [PATCH v3 00/10] Enable root to update the blacklist keyring Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=958b2ea4-7b31-da90-2efd-019166a6029b@digikod.net \
--to=mic@digikod.net \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=herbert@gondor.apana.org.au \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@linux.microsoft.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.