All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko@kernel.org>
To: "Mickaël Salaün" <mic@digikod.net>
Cc: "David Howells" <dhowells@redhat.com>,
	"David Woodhouse" <dwmw2@infradead.org>,
	"David S . Miller" <davem@davemloft.net>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"James Morris" <jmorris@namei.org>,
	"Mickaël Salaün" <mic@linux.microsoft.com>,
	"Mimi Zohar" <zohar@linux.ibm.com>,
	"Serge E . Hallyn" <serge@hallyn.com>,
	keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
	linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	"Mimi Zohar" <zohar@linux.vnet.ibm.com>
Subject: Re: [PATCH v3 04/10] certs: Fix blacklist flag type confusion
Date: Thu, 21 Jan 2021 01:45:55 +0200	[thread overview]
Message-ID: <YAjAswPAr3tcuDhd@kernel.org> (raw)
In-Reply-To: <fc4d5812-238c-baf7-d7f6-cc123bdb855d@digikod.net>

On Wed, Jan 20, 2021 at 12:15:10PM +0100, Mickaël Salaün wrote:
> 
> On 20/01/2021 04:55, Jarkko Sakkinen wrote:
> > On Thu, Jan 14, 2021 at 04:19:03PM +0100, Mickaël Salaün wrote:
> >> From: David Howells <dhowells@redhat.com>
> >>
> >> KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(),
> >> as these only take KEY_ALLOC_* flags.  KEY_FLAG_KEEP has the same value as
> >> KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update()
> >> uses it.  LSMs using the key_alloc hook don't check that flag.
> >>
> >> KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot
> >> write to the blacklist keyring, so it is not possible to remove a key/hash
> >> from it.
> >>
> >> Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set
> >> KEY_FLAG_KEEP on the new key.  blacklist_init() can then, correctly, pass
> >> this to keyring_alloc().
> > 
> > OK, so thing work by luck now, but given the new patches which allow
> > to append new keys they would break, right?
> 
> Without this fix, patch 9/10 would allow to remove and modify keys from
> the blacklist keyring.
> 
> > 
> >> We can also use this in ima_mok_init() rather than setting the flag
> >> manually.
> > 
> > What does ima_mok_init() do?
> 
> This was initially an addition from David Howells, I only fixed the
> argument bit-ORing. ima_mok_init() allocates a blacklist keyring (with
> different properties) dedicated to IMA.
 
Please add this to the commit message.

/Jarkko

  reply	other threads:[~2021-01-21  6:33 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-14 15:18 [PATCH v3 00/10] Enable root to update the blacklist keyring Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 01/10] certs/blacklist: fix kernel doc interface issue Mickaël Salaün
2021-01-20  3:39   ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 02/10] certs: Fix blacklisted hexadecimal hash string check Mickaël Salaün
2021-01-20  3:43   ` Jarkko Sakkinen
2021-01-20 11:12     ` Mickaël Salaün
2021-01-20 23:44       ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 03/10] PKCS#7: Fix missing include Mickaël Salaün
2021-01-20  3:44   ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 04/10] certs: Fix blacklist flag type confusion Mickaël Salaün
2021-01-20  3:55   ` Jarkko Sakkinen
2021-01-20 11:15     ` Mickaël Salaün
2021-01-20 23:45       ` Jarkko Sakkinen [this message]
2021-01-14 15:19 ` [PATCH v3 05/10] certs: Replace K{U,G}IDT_INIT() with GLOBAL_ROOT_{U,G}ID Mickaël Salaün
2021-01-20  5:15   ` Jarkko Sakkinen
2021-01-20 11:17     ` Mickaël Salaün
2021-01-20 23:48       ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 06/10] certs: Make blacklist_vet_description() more strict Mickaël Salaün
2021-01-20  4:16   ` Jarkko Sakkinen
2021-01-20 11:23     ` Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 07/10] certs: Factor out the blacklist hash creation Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 08/10] certs: Check that builtin blacklist hashes are valid Mickaël Salaün
2021-01-20  5:19   ` Jarkko Sakkinen
2021-01-20 11:57     ` Mickaël Salaün
2021-01-20 23:53       ` Jarkko Sakkinen
2021-01-21  9:18         ` Mickaël Salaün
2021-01-21 15:21           ` Jarkko Sakkinen
2021-01-14 15:19 ` [PATCH v3 09/10] certs: Allow root user to append signed hashes to the blacklist keyring Mickaël Salaün
2021-01-15 13:06   ` Mimi Zohar
2021-01-20  5:23   ` Jarkko Sakkinen
2021-01-20 11:24     ` Mickaël Salaün
2021-01-14 15:19 ` [PATCH v3 10/10] tools/certs: Add print-cert-tbs-hash.sh Mickaël Salaün
2021-01-15  9:28 ` [PATCH v3 00/10] Enable root to update the blacklist keyring Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YAjAswPAr3tcuDhd@kernel.org \
    --to=jarkko@kernel.org \
    --cc=davem@davemloft.net \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=herbert@gondor.apana.org.au \
    --cc=jmorris@namei.org \
    --cc=keyrings@vger.kernel.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mic@digikod.net \
    --cc=mic@linux.microsoft.com \
    --cc=serge@hallyn.com \
    --cc=zohar@linux.ibm.com \
    --cc=zohar@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.