From: David Howells <dhowells@redhat.com>
To: Eric Snowberg <eric.snowberg@oracle.com>
Cc: dhowells@redhat.com, "Jarkko Sakkinen" <jarkko@kernel.org>,
=?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= <mic@linux.microsoft.com>,
"David Woodhouse" <dwmw2@infradead.org>,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] cert: Add kconfig dependency for validate_trust
Date: Thu, 25 Feb 2021 14:43:31 +0000 [thread overview]
Message-ID: <506021.1614264211@warthog.procyon.org.uk> (raw)
In-Reply-To: <B7E35D95-1A22-4277-B41B-B3FCC2E93743@oracle.com>
Eric Snowberg <eric.snowberg@oracle.com> wrote:
> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST support.
>
> I believe this is ok. However currently, whenever the kernel finds either a
> EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it loads
> it into the blacklist keyring. Then anytime signature validation takes
> place, these entries are referenced. If there is a match, the signature
> check fails. Now with the inclusion of EFI_CERT_X509_GUID, I question why
> we want to enable it thru a Kconfig option, when we don’t for the other two
> types.
But we do.
mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() do
nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=n.
David
prev parent reply other threads:[~2021-02-25 14:45 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-17 16:50 [PATCH] cert: Add kconfig dependency for validate_trust Eric Snowberg
2021-02-23 23:47 ` David Howells
2021-02-24 1:26 ` Eric Snowberg
2021-02-24 10:51 ` David Howells
2021-02-24 11:56 ` Mickaël Salaün
2021-02-24 12:40 ` David Howells
2021-02-25 4:03 ` Eric Snowberg
2021-02-25 14:43 ` David Howells [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=506021.1614264211@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=eric.snowberg@oracle.com \
--cc=jarkko@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mic@linux.microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).