From: "Mickaël Salaün" <mic@digikod.net>
To: David Howells <dhowells@redhat.com>
Cc: "David Woodhouse" <dwmw2@infradead.org>,
"David S . Miller" <davem@davemloft.net>,
"Herbert Xu" <herbert@gondor.apana.org.au>,
"James Morris" <jmorris@namei.org>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Mickaël Salaün" <mic@linux.microsoft.com>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Serge E . Hallyn" <serge@hallyn.com>,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v1 1/9] certs: Fix blacklisted hexadecimal hash string check
Date: Fri, 4 Dec 2020 15:48:45 +0100 [thread overview]
Message-ID: <c9664a67-61b7-6b4a-86d7-5aca9ff06fa5@digikod.net> (raw)
In-Reply-To: <113785.1607090759@warthog.procyon.org.uk>
On 04/12/2020 15:05, David Howells wrote:
> Mickaël Salaün <mic@digikod.net> wrote:
>
>> When looking for a blacklisted hash, bin2hex() is used to transform a
>> binary hash to an ascii (lowercase) hexadecimal string. This string is
>> then search for in the description of the keys from the blacklist
>> keyring. When adding a key to the blacklist keyring,
>> blacklist_vet_description() checks the hash prefix and the hexadecimal
>> string, but not that this string is lowercase. It is then valid to set
>> hashes with uppercase hexadecimal, which will be silently ignored by the
>> kernel.
>>
>> Add an additional check to blacklist_vet_description() to check that
>> hexadecimal strings are in lowercase.
>
> I wonder if it would be a better idea to allow the keyring type to adjust the
> description string - in this instance to change it to all lowercase.
Right now, this patch helps user space identifies which hashes where
ignored. I think it is an interesting information on its own because it
enables to remove a false sense of security and warns about
mis-blacklisted certificates or binaries.
When authenticity/signature of such hash is taken into account, I also
prefer to not change the data that user space signed and pushed to the
kernel, but to teach user space what is correct.
Moreover, modifying the description cannot be done with the
vet_description-type function and would be a more invasive keyring
modification because, AFAIK, no current key type already does such change.
>
> David
>
next prev parent reply other threads:[~2020-12-04 14:50 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-20 18:04 [PATCH v1 0/9] Enable root to update the blacklist keyring Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 1/9] certs: Fix blacklisted hexadecimal hash string check Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 2/9] certs: Make blacklist_vet_description() more strict Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 3/9] certs: Factor out the blacklist hash creation Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 4/9] certs: Check that builtin blacklist hashes are valid Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 5/9] PKCS#7: Fix missing include Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 6/9] certs: Fix blacklist flag type confusion Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 7/9] certs: Allow root user to append signed hashes to the blacklist keyring Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 8/9] certs: Replace K{U,G}IDT_INIT() with GLOBAL_ROOT_{U,G}ID Mickaël Salaün
2020-11-20 18:04 ` [PATCH v1 9/9] tools/certs: Add print-cert-tbs-hash.sh Mickaël Salaün
2020-11-30 2:40 ` [PATCH v1 0/9] Enable root to update the blacklist keyring Jarkko Sakkinen
2020-11-30 8:23 ` Mickaël Salaün
2020-12-02 16:44 ` Jarkko Sakkinen
2020-12-04 14:01 ` David Howells
2020-12-04 15:38 ` Jarkko Sakkinen
2020-12-04 14:05 ` [PATCH v1 1/9] certs: Fix blacklisted hexadecimal hash string check David Howells
2020-12-04 14:48 ` Mickaël Salaün [this message]
2020-12-04 14:06 ` [PATCH v1 5/9] PKCS#7: Fix missing include David Howells
2020-12-04 14:58 ` Mickaël Salaün
2020-12-04 14:09 ` [PATCH v1 2/9] certs: Make blacklist_vet_description() more strict David Howells
2020-12-04 14:59 ` Mickaël Salaün
2020-12-11 18:35 ` Mickaël Salaün
2020-12-04 14:11 ` [PATCH v1 8/9] certs: Replace K{U,G}IDT_INIT() with GLOBAL_ROOT_{U,G}ID David Howells
2020-12-09 11:58 ` [PATCH v1 4/9] certs: Check that builtin blacklist hashes are valid David Howells
2020-12-11 18:32 ` Mickaël Salaün
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c9664a67-61b7-6b4a-86d7-5aca9ff06fa5@digikod.net \
--to=mic@digikod.net \
--cc=davem@davemloft.net \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=herbert@gondor.apana.org.au \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mic@linux.microsoft.com \
--cc=serge@hallyn.com \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.