linux-kernel - Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Jan 2016 11:02:06 -0500
From:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
To:	David Howells <dhowells@...hat.com>
Cc:	"Mark D. Baushke" <mdb@...iper.net>,
	James Morris <jmorris@...ei.org>,
	Marcel Holtmann <marcel@...tmann.org>, petkan@...-labs.com,
	linux-security-module@...r.kernel.org, keyrings@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] X.509: Partially revert patch to add validation against
 IMA MOK keyring

On Tue, 2016-01-12 at 15:56 +0000, David Howells wrote:
> Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:
> 
> > > > The name "restrict_link_by_ima_mok()" doesn't reflect that it is either
> > > > the system keyring or the IMA MOK keyring.
> > > 
> > > How about restrict_link_by_ima_trusted()?
> > 
> > Good.  restrict_link_by_ima_trusted would only check the IMA MOK keyring
> > if it was configured.
> 
> And the system keyring?

Only keys signed by the system keyring can be added to the .ima keyring,
unless IMA MOK is enabled.  In that case, keys signed by either the
system or IMA MOK keyring can be added to the .ima keyring.

Mimi