* Re: [PATCH v5 0/5] Enable root to update the blacklist keyring [not found] <20210128191705.3568820-1-mic@digikod.net> @ 2021-01-30 20:41 ` Jarkko Sakkinen 2021-02-01 13:07 ` David Howells 1 sibling, 0 replies; 5+ messages in thread From: Jarkko Sakkinen @ 2021-01-30 20:41 UTC (permalink / raw) To: Mickaël Salaün, David Howells, David Woodhouse Cc: David S . Miller, Herbert Xu, James Morris, Mickaël Salaün, Mimi Zohar, Serge E . Hallyn, Tyler Hicks, keyrings, linux-crypto, linux-integrity, linux-kernel, linux-security-module On Thu, 2021-01-28 at 20:17 +0100, Mickaël Salaün wrote: > This fifth patch series is a rebase on David Howells's keys-misc branch. > The fix patches are already in this branch and then removed from this > series, other patches are unchanged. > > The goal of these patches is to add a new configuration option to enable the > root user to load signed keys in the blacklist keyring. This keyring is useful > to "untrust" certificates or files. Enabling to safely update this keyring > without recompiling the kernel makes it more usable. > > Previous patch series: > https://lore.kernel.org/lkml/20210121155513.539519-1-mic@digikod.net/ > > Regards, > > Mickaël Salaün (5): > tools/certs: Add print-cert-tbs-hash.sh > certs: Check that builtin blacklist hashes are valid > certs: Make blacklist_vet_description() more strict > certs: Factor out the blacklist hash creation > certs: Allow root user to append signed hashes to the blacklist > keyring > > MAINTAINERS | 2 + > certs/.gitignore | 1 + > certs/Kconfig | 17 +- > certs/Makefile | 15 +- > certs/blacklist.c | 207 ++++++++++++++---- > crypto/asymmetric_keys/x509_public_key.c | 3 +- > include/keys/system_keyring.h | 14 +- > scripts/check-blacklist-hashes.awk | 37 ++++ > .../platform_certs/keyring_handler.c | 26 +-- > tools/certs/print-cert-tbs-hash.sh | 91 ++++++++ > 10 files changed, 336 insertions(+), 77 deletions(-) > create mode 100755 scripts/check-blacklist-hashes.awk > create mode 100755 tools/certs/print-cert-tbs-hash.sh > > > base-commit: 8f0bfc25c907f38e7f9dc498e8f43000d77327ef I tested these, so you both reviewed-by and tested-by from side to all. /Jarkko ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v5 0/5] Enable root to update the blacklist keyring [not found] <20210128191705.3568820-1-mic@digikod.net> 2021-01-30 20:41 ` [PATCH v5 0/5] Enable root to update the blacklist keyring Jarkko Sakkinen @ 2021-02-01 13:07 ` David Howells 2021-02-01 16:48 ` Mickaël Salaün 1 sibling, 1 reply; 5+ messages in thread From: David Howells @ 2021-02-01 13:07 UTC (permalink / raw) To: =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?= Cc: dhowells, David Woodhouse, Jarkko Sakkinen, David S . Miller, Herbert Xu, James Morris, =?UTF-8?q?Micka=C3=ABl=20Sala=C3=BCn?=, Mimi Zohar, Serge E . Hallyn, Tyler Hicks, keyrings, linux-crypto, linux-integrity, linux-kernel, linux-security-module Hi Mickaël, Do you have a public branch somewhere I can pull from? David ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v5 0/5] Enable root to update the blacklist keyring 2021-02-01 13:07 ` David Howells @ 2021-02-01 16:48 ` Mickaël Salaün 2021-02-01 16:51 ` Mickaël Salaün 2021-02-01 17:08 ` David Howells 0 siblings, 2 replies; 5+ messages in thread From: Mickaël Salaün @ 2021-02-01 16:48 UTC (permalink / raw) To: David Howells Cc: David Woodhouse, Jarkko Sakkinen, David S . Miller, Herbert Xu, James Morris, Mickaël Salaün, Mimi Zohar, Serge E . Hallyn, Tyler Hicks, keyrings, linux-crypto, linux-integrity, linux-kernel, linux-security-module Hi, Yes, you can pull this patchset from here: https://github.com/l0kod/linux branch dyn-auth-blacklist-v5 (commit 33b94bcd56843b4235c6ba4a44157b3c5a8792f1). Mickaël On 01/02/2021 14:07, David Howells wrote: > > Hi Mickaël, > > Do you have a public branch somewhere I can pull from? > > David > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v5 0/5] Enable root to update the blacklist keyring 2021-02-01 16:48 ` Mickaël Salaün @ 2021-02-01 16:51 ` Mickaël Salaün 2021-02-01 17:08 ` David Howells 1 sibling, 0 replies; 5+ messages in thread From: Mickaël Salaün @ 2021-02-01 16:51 UTC (permalink / raw) To: David Howells Cc: David Woodhouse, Jarkko Sakkinen, David S . Miller, Herbert Xu, James Morris, Mickaël Salaün, Mimi Zohar, Serge E . Hallyn, Tyler Hicks, keyrings, linux-crypto, linux-integrity, linux-kernel, linux-security-module It doesn't contain Jarkko's Tested-by and Reviewed-by tags though. On 01/02/2021 17:48, Mickaël Salaün wrote: > Hi, > > Yes, you can pull this patchset from here: > https://github.com/l0kod/linux branch dyn-auth-blacklist-v5 (commit > 33b94bcd56843b4235c6ba4a44157b3c5a8792f1). > > Mickaël > > > On 01/02/2021 14:07, David Howells wrote: >> >> Hi Mickaël, >> >> Do you have a public branch somewhere I can pull from? >> >> David >> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v5 0/5] Enable root to update the blacklist keyring 2021-02-01 16:48 ` Mickaël Salaün 2021-02-01 16:51 ` Mickaël Salaün @ 2021-02-01 17:08 ` David Howells 1 sibling, 0 replies; 5+ messages in thread From: David Howells @ 2021-02-01 17:08 UTC (permalink / raw) To: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Cc: dhowells, David Woodhouse, Jarkko Sakkinen, David S . Miller, Herbert Xu, James Morris, =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?=, Mimi Zohar, Serge E . Hallyn, Tyler Hicks, keyrings, linux-crypto, linux-integrity, linux-kernel, linux-security-module Mickaël Salaün <mic@digikod.net> wrote: > It doesn't contain Jarkko's Tested-by and Reviewed-by tags though. I can add that in the merge. David ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-01 17:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20210128191705.3568820-1-mic@digikod.net>
2021-01-30 20:41 ` [PATCH v5 0/5] Enable root to update the blacklist keyring Jarkko Sakkinen
2021-02-01 13:07 ` David Howells
2021-02-01 16:48 ` Mickaël Salaün
2021-02-01 16:51 ` Mickaël Salaün
2021-02-01 17:08 ` David Howells
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).