From: "Thomas Weißschuh" <linux@weissschuh.net>
To: "Mickaël Salaün" <mic@digikod.net>,
"David Howells" <dhowells@redhat.com>,
"David Woodhouse" <dwmw2@infradead.org>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Eric Snowberg" <eric.snowberg@oracle.com>
Cc: "Thomas Weißschuh" <linux@weissschuh.net>,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
"Mark Pearson" <markpearson@lenovo.com>,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: [PATCH v3 0/3] certs: Prevent spurious errors on repeated blacklisting
Date: Fri, 18 Nov 2022 05:03:40 +0100 [thread overview]
Message-ID: <20221118040343.2958-1-linux@weissschuh.net> (raw)
When the blacklist keyring was changed to allow updates from the root
user it gained an ->update() function that disallows all updates.
When the a hash is blacklisted multiple times from the builtin or
firmware-provided blacklist this spams prominent logs during boot:
[ 0.890814] blacklist: Problem blacklisting hash (-13)
This affects the firmware of various vendors. Reported have been at least:
* Samsung: https://askubuntu.com/questions/1436856/
* Acer: https://ubuntuforums.org/showthread.php?t=2478840
* MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7
* Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860
* Lenovo: https://lore.kernel.org/lkml/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/
Changelog:
v1: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/
v1 -> v2:
* Improve logging message to include the failed hash
* Add key_create() function without update semantics
* Use key_create() from mark_raw_hash_blacklisted() and log specific message
on -EEXIST
v2: https://lore.kernel.org/lkml/20221109025019.1855-1-linux@weissschuh.net/
v2 -> v3:
* Clarify commit titles and messages
* Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact
of some obsolete version of the patch and not needed
Only the first patch has been marked for stable as otherwise the whole of
key_create() would need to be applied to stable.
Thomas Weißschuh (3):
certs: log hash value on blacklist error
KEYS: Add key_create()
certs: don't try to update blacklist keys
certs/blacklist.c | 21 ++++---
include/linux/key.h | 8 +++
security/keys/key.c | 149 +++++++++++++++++++++++++++++++++-----------
3 files changed, 132 insertions(+), 46 deletions(-)
base-commit: 84368d882b9688bfac77ce48d33b1e20a4e4a787
--
2.38.1
next reply other threads:[~2022-11-18 4:05 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-18 4:03 Thomas Weißschuh [this message]
2022-11-18 4:03 ` [PATCH v3 1/3] certs: log hash value on blacklist error Thomas Weißschuh
2022-11-28 1:11 ` Jarkko Sakkinen
2022-11-28 1:59 ` Thomas Weißschuh
2022-12-04 16:53 ` Jarkko Sakkinen
2022-11-18 4:03 ` [PATCH v3 2/3] KEYS: Add key_create() Thomas Weißschuh
2022-11-28 1:12 ` Jarkko Sakkinen
2022-11-18 4:03 ` [PATCH v3 3/3] certs: don't try to update blacklist keys Thomas Weißschuh
2022-12-12 12:29 ` [PATCH v3 0/3] certs: Prevent spurious errors on repeated blacklisting Paul Menzel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221118040343.2958-1-linux@weissschuh.net \
--to=linux@weissschuh.net \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=eric.snowberg@oracle.com \
--cc=jarkko@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=markpearson@lenovo.com \
--cc=mic@digikod.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.