From: Jarkko Sakkinen <jarkko@kernel.org>
To: "Thomas Weißschuh" <linux@weissschuh.net>
Cc: "Mickaël Salaün" <mic@digikod.net>,
"David Howells" <dhowells@redhat.com>,
"David Woodhouse" <dwmw2@infradead.org>,
"Eric Snowberg" <eric.snowberg@oracle.com>,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
"Mark Pearson" <markpearson@lenovo.com>,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v3 1/3] certs: log hash value on blacklist error
Date: Sun, 4 Dec 2022 16:53:01 +0000 [thread overview]
Message-ID: <Y4zQbWJZpJV7KTTJ@kernel.org> (raw)
In-Reply-To: <8b9e9bf8-ae44-485a-9b30-85a71a236f06@t-8ch.de>
On Mon, Nov 28, 2022 at 02:59:20AM +0100, Thomas Weißschuh wrote:
> On 2022-11-28 03:11+0200, Jarkko Sakkinen wrote:
> > "Make blacklisted hash available in klog"
> >
> > On Fri, Nov 18, 2022 at 05:03:41AM +0100, Thomas Weißschuh wrote:
> > > Without this information these logs are not actionable.
> >
> > Without blacklisted hash?
> >
> > > For example on duplicate blacklisted hashes reported by the system
> > > firmware users should be able to report the erroneous hashes to their
> > > system vendors.
> > >
> > > While we are at it use the dedicated format string for ERR_PTR.
> >
> > Lacks the beef so saying "while we are at it" makes no sense.
>
> What about this:
>
> [PATCH] certs: make blacklisted hash available in klog
>
> One common situation triggering this log statement are duplicate hashes
> reported by the system firmware.
>
> These duplicates should be removed from the firmware.
>
> Without logging the blacklisted hash triggering the issue however the users
> can not report it properly to the firmware vendors and the firmware vendors
> can not easily see which specific hash is duplicated.
>
> While changing the log message also use the dedicated ERR_PTR format
> placeholder for the returned error value.
Looks looks a lot better thank you!
> > > Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring")
> >
> > Why does this count as a bug?
>
> These error logs are confusing to users, prompting them to waste time
> investigating them and even mess with their firmware settings.
> (As indicated in the threads linked from the cover letter)
>
> The most correct fix would be patches 2 and 3 from this series.
>
> I was not sure if patch 2 would be acceptable for stable as it introduces new
> infrastructure code.
> So patch 1 enables users to report the issue to their firmware vendors and get
> the spurious logs resolved that way.
>
> If these assumptions are incorrect I can fold patch 1 into patch 3.
>
> But are patch 2 and 3 material for stable?
I cannot say anything conclusive to this before seeing updated version of
the patch set.
BR, Jarkko
next prev parent reply other threads:[~2022-12-04 16:53 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-18 4:03 [PATCH v3 0/3] certs: Prevent spurious errors on repeated blacklisting Thomas Weißschuh
2022-11-18 4:03 ` [PATCH v3 1/3] certs: log hash value on blacklist error Thomas Weißschuh
2022-11-28 1:11 ` Jarkko Sakkinen
2022-11-28 1:59 ` Thomas Weißschuh
2022-12-04 16:53 ` Jarkko Sakkinen [this message]
2022-11-18 4:03 ` [PATCH v3 2/3] KEYS: Add key_create() Thomas Weißschuh
2022-11-28 1:12 ` Jarkko Sakkinen
2022-11-18 4:03 ` [PATCH v3 3/3] certs: don't try to update blacklist keys Thomas Weißschuh
2022-12-12 12:29 ` [PATCH v3 0/3] certs: Prevent spurious errors on repeated blacklisting Paul Menzel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y4zQbWJZpJV7KTTJ@kernel.org \
--to=jarkko@kernel.org \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=eric.snowberg@oracle.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux@weissschuh.net \
--cc=markpearson@lenovo.com \
--cc=mic@digikod.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).