linux-kernel - Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <27007.1452559481@warthog.procyon.org.uk>
Date:	Tue, 12 Jan 2016 00:44:41 +0000
From:	David Howells <dhowells@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	dhowells@...hat.com, James Morris <jmorris@...ei.org>,
	Marcel Holtmann <marcel@...tmann.org>, petkan@...-labs.com,
	linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:

> Is this the primary use case scenario for your patches?   Unfortunately,
> your posted patches would break the existing IMA trust model.

Why so?

The patches give you per-keyring control over restricting what is permitted in
a keyring, allows you to use any criteria you like, whether it be just the
contents of that keyring or CA certs in some other keyring(s) and a blacklist.

In other words, it should be able to do everything one can do now - except
that it controls linkage between trusted keyrings with the same restrictions
as adding new keys.

So if it breaks the IMA trust model, then doesn't that suggest that the trust
model is broken anyway?

David