linux-kernel - Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <24522.1454513272@warthog.procyon.org.uk>
Date:	Wed, 03 Feb 2016 15:27:52 +0000
From:	David Howells <dhowells@...hat.com>
To:	Mimi Zohar <zohar@...ux.vnet.ibm.com>
Cc:	dhowells@...hat.com, linux-security-module@...r.kernel.org,
	keyrings@...r.kernel.org, petkan@...-labs.com,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]

Mimi Zohar <zohar@...ux.vnet.ibm.com> wrote:

> >  (3) The ability to configure a list of blacklisted hashes into the kernel
> >      at build time.  This is done by setting
> >      CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
> >      that are in the form:
> > 
> > 	"<hash>", "<hash>", ..., "<hash>"
> > 
> >      where each <hash> is a hex string representation of the hash and must
> >      include all necessary leading zeros to pad the hash to the right size.
> 
> Is the output of "keyctl print" the hex string representation?

No, there is no payload and no read method.  "keyctl desc" will return the hex
string representation.

>  Update keys documentation?

Not a bad idea, but it should probably go in a separate document, along with
info about asymmetric keys.

> > The blacklist cannot currently be modified by userspace, but it will be
> > possible to load it, for example, from the UEFI blacklist database.
> 
> When loading the UEFI blacklist database is enabled, it should be
> configurable.

Probably.  That patch isn't added yet though.

> > In the future, it should also be made possible to load blacklisted
> > asymmetric keys in here too.
> 
> Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be
> blacklisted" adds this support.

Changed to:

	A later commit will make it possible to load blacklisted asymmetric
	keys in here too.
 
David