All of lore.kernel.org
 help / color / mirror / Atom feed
From: Mimi Zohar <zohar@linux.ibm.com>
To: Eric Snowberg <eric.snowberg@oracle.com>,
	dhowells@redhat.com, jarkko@kernel.org, dwmw2@infradead.org
Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
	kanth.ghatraju@oracle.com, konrad.wilk@oracle.com
Subject: Re: [PATCH] certs: Reference revocation list for all keyrings
Date: Fri, 14 Jul 2023 18:11:12 -0400	[thread overview]
Message-ID: <d622f47e5446f71571170ef72be43ea0a89e5d48.camel@linux.ibm.com> (raw)
In-Reply-To: <20230117171506.3888602-1-eric.snowberg@oracle.com>

On Tue, 2023-01-17 at 12:15 -0500, Eric Snowberg wrote:
> Systems booted with shim have a Forbidden Signature Database called mokx.
> During boot, hashes and certs contained within the mokx are loaded into the
> blacklist keyring.  When calling verify_pkcs7_message_sig the contents of
> the blacklist keyring (or revocation list) are referenced when validating
> keys on the platform keyring. Currently, when validating against the
> secondary or builtin keyrings, the revocation list is not referenced.  Move
> up the check to allow the revocation list to be used with all keyrings,
> including the secondary and builtin, allowing the system owner to take
> corrective action should a vulnerability be found within keys contained
> within either keyring.
> 
> Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>

Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>


      parent reply	other threads:[~2023-07-14 22:11 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-01-17 17:15 [PATCH] certs: Reference revocation list for all keyrings Eric Snowberg
2023-01-21  3:20 ` Jarkko Sakkinen
2023-01-21  3:21   ` Jarkko Sakkinen
2023-07-14 22:11 ` Mimi Zohar [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d622f47e5446f71571170ef72be43ea0a89e5d48.camel@linux.ibm.com \
    --to=zohar@linux.ibm.com \
    --cc=dhowells@redhat.com \
    --cc=dwmw2@infradead.org \
    --cc=eric.snowberg@oracle.com \
    --cc=jarkko@kernel.org \
    --cc=kanth.ghatraju@oracle.com \
    --cc=keyrings@vger.kernel.org \
    --cc=konrad.wilk@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.