From: Mimi Zohar <zohar@linux.vnet.ibm.com>
To: David Howells <dhowells@redhat.com>
Cc: Petko Manolov <petkan@mip-labs.com>,
keyrings@vger.kernel.org, matthew.garrett@nebula.com,
linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-ima-devel <linux-ima-devel@lists.sourceforge.net>
Subject: Re: [PATCH 4/9] KEYS: Allow unrestricted boot-time addition of keys to secondary keyring
Date: Mon, 21 Nov 2016 11:24:28 -0500 [thread overview]
Message-ID: <1479745468.2487.60.camel@linux.vnet.ibm.com> (raw)
In-Reply-To: <18864.1479741430@warthog.procyon.org.uk>
On Mon, 2016-11-21 at 15:17 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> > > > > This allows keys in the UEFI database to be added in secure boot mode
> > > > > for the purposes of module signing.
> > > >
> > > > The key import should not be automatic, it should be optional.
> > >
> > > You can argue this either way. There's a config option to allow you to
> > > turn this on or off. Arguably, this should be split in two: one for the
> > > whitelist (db, MokListRT) and one for the blacklist (dbx).
> >
> > By "config", you're not referring to a Kconfig option, but a UEFI db
> > option, making it hidden/unknown to someone building a kernel. If you
> > really want to add this support, make it clear and easily seen by
> > defining a "restrict_link_by_builtin_or_uefi" function.
>
> No: by "config" I *am* referring to Kconfig.
Good, I found the Kconfig LOAD_UEFI_KEYS option for loading the keys on
the keyring. Lets say that someone does want to use those keys for
kernel modules, but only for kernel modules, not for any other types of
files (eg. kexec kernel image/initramfs)?
Mimi
next prev parent reply other threads:[~2016-11-21 16:24 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-16 18:10 [PATCH 0/9] KEYS: Blacklisting & UEFI database load David Howells
2016-11-16 18:10 ` [PATCH 1/9] KEYS: Add a system blacklist keyring David Howells
2016-11-16 18:10 ` [PATCH 2/9] X.509: Allow X.509 certs to be blacklisted David Howells
2016-11-16 18:11 ` [PATCH 3/9] PKCS#7: Handle blacklisted certificates David Howells
2016-11-16 18:11 ` [PATCH 4/9] KEYS: Allow unrestricted boot-time addition of keys to secondary keyring David Howells
2016-11-17 6:41 ` Petko Manolov
2016-11-17 9:56 ` David Howells
2016-11-17 11:18 ` David Howells
[not found] ` <26349.1479376560-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org>
2016-11-17 10:22 ` Petko Manolov
2016-11-21 14:04 ` Mimi Zohar
2016-11-21 15:17 ` David Howells
2016-11-21 16:24 ` Mimi Zohar [this message]
2016-11-16 18:11 ` [PATCH 5/9] efi: Add SHIM and image security database GUID definitions David Howells
2016-11-21 16:07 ` Ard Biesheuvel
2016-11-16 18:11 ` [PATCH 6/9] efi: Add EFI signature data types David Howells
2016-11-16 23:43 ` Mat Martineau
[not found] ` <alpine.OSX.2.20.1611161535590.67352-zaFMaa3cLiZe6KzckbbZvYT4S9po1h25@public.gmane.org>
2016-11-17 9:44 ` David Howells
[not found] ` <26198.1479375840-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org>
2016-11-21 16:08 ` Ard Biesheuvel
2016-11-16 18:11 ` [PATCH 7/9] efi: Add an EFI signature blob parser David Howells
2016-11-16 18:11 ` [PATCH 8/9] MODSIGN: Import certificates from UEFI Secure Boot David Howells
2016-11-21 16:16 ` Ard Biesheuvel
[not found] ` <CAKv+Gu_QVyd1Jx7ZdnBzYmZzUnH4ZuhQgiGO-zx-JPViWosjXQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-21 16:25 ` Josh Boyer
[not found] ` <CA+5PVA6dWw-p3q9SBmJwQvuru4k7JZAraRZeb2=VDf8E=c=SmA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-24 19:22 ` James Bottomley
2016-11-24 19:17 ` James Bottomley
2016-12-02 18:57 ` James Bottomley
2016-12-02 20:18 ` Mimi Zohar
2016-11-16 18:11 ` [PATCH 9/9] MODSIGN: Allow the "db" UEFI variable to be suppressed David Howells
[not found] ` <147931990959.16460.3038875071067540418.stgit-S6HVgzuS8uM4Awkfq6JHfwNdhmdF6hFW@public.gmane.org>
2016-11-21 16:18 ` Ard Biesheuvel
[not found] ` <CAKv+Gu96ihE7pHrCCeCpy78man-r821b3Vs4Tn_RsYyzY4HV2Q-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-21 16:26 ` Josh Boyer
[not found] ` <CA+5PVA7SivAegwxdxuiAFL41Apie4JLK5KbtGGHLr1fP0p3MsQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-21 16:42 ` Ard Biesheuvel
[not found] ` <CAKv+Gu__wAnOawWZWVF6NF3En0suuFTBrFwwZ5KosqBU8LVHMA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-11-21 19:05 ` Peter Jones
2016-11-21 19:06 ` Ard Biesheuvel
2016-11-21 19:18 ` Peter Jones
2016-11-21 19:33 ` Ard Biesheuvel
2018-03-06 14:05 ` [PATCH 0/9] KEYS: Blacklisting & UEFI database load Jiri Slaby
2018-03-07 13:18 ` Mimi Zohar
2018-03-07 15:28 ` James Bottomley
2018-03-11 3:20 ` joeyli
2018-03-19 14:12 ` Mimi Zohar
2018-03-27 11:08 ` joeyli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1479745468.2487.60.camel@linux.vnet.ibm.com \
--to=zohar@linux.vnet.ibm.com \
--cc=dhowells@redhat.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-ima-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=matthew.garrett@nebula.com \
--cc=petkan@mip-labs.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).