lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 10 Dec 2020 11:56:58 -0700
From:   Eric Snowberg <eric.snowberg@...cle.com>
To:     David Howells <dhowells@...hat.com>
Cc:     dwmw2@...radead.org,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        herbert@...dor.apana.org.au, davem@...emloft.net,
        jmorris@...ei.org, serge@...lyn.com, nayna@...ux.ibm.com,
        Mimi Zohar <zohar@...ux.ibm.com>, erichte@...ux.ibm.com,
        mpe@...erman.id.au, keyrings@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        Eric Snowberg <eric.snowberg@...cle.com>
Subject: Re: [PATCH v4] certs: Add EFI_CERT_X509_GUID support for dbx entries


> On Dec 10, 2020, at 2:49 AM, David Howells <dhowells@...hat.com> wrote:
> 
> Eric Snowberg <eric.snowberg@...cle.com> wrote:
> 
>> Add support for EFI_CERT_X509_GUID dbx entries. When a EFI_CERT_X509_GUID
>> is found, it is added as an asymmetrical key to the .blacklist keyring.
>> Anytime the .platform keyring is used, the keys in the .blacklist keyring
>> are referenced, if a matching key is found, the key will be rejected.
> 
> Ummm...  Why this way and not as a blacklist key which takes up less space?
> I'm guessing that you're using the key chain matching logic.  We really only
> need to blacklist the key IDs.

I implemented it this way so that certs in the dbx would only impact 
the .platform keyring. I was under the impression we didn’t want to have 
Secure Boot UEFI db/dbx certs dictate keyring functionality within the kernel
itself. Meaning if we have a matching dbx cert in any other keyring (builtin,
secondary, ima, etc.), it would be allowed. If that is not how you’d like to 
see it done, let me know and I’ll make the change.

> Also, what should happen if a revocation cert rejected by the blacklist?

I’m not sure I understand the question. How would it be rejected?

>> +int mark_key_revocationlisted(const char *data, size_t size)
> 
> Hmmm...  The name looks wrong, but I can see the potential issue that kernel
> keys can actually be marked revoked as a separate concept.  How about
> add_key_to_revocation_list() and is_key_on_revocation_list().

I'll update the names in the next version.

Thanks.

Powered by blists - more mailing lists