linux-kernel - Re: [PATCH] cert: Add kconfig dependency for validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <506021.1614264211@warthog.procyon.org.uk>
Date:   Thu, 25 Feb 2021 14:43:31 +0000
From:   David Howells <dhowells@...hat.com>
To:     Eric Snowberg <eric.snowberg@...cle.com>
Cc:     dhowells@...hat.com, Jarkko Sakkinen <jarkko@...nel.org>,
        =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= <mic@...ux.microsoft.com>,
        David Woodhouse <dwmw2@...radead.org>,
        keyrings@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cert: Add kconfig dependency for validate_trust

Eric Snowberg <eric.snowberg@...cle.com> wrote:

> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST support.
> 
> I believe this is ok.  However currently, whenever the kernel finds either a
> EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it loads
> it into the blacklist keyring.  Then anytime signature validation takes
> place, these entries are referenced.  If there is a match, the signature
> check fails.  Now with the inclusion of EFI_CERT_X509_GUID, I question why
> we want to enable it thru a Kconfig option, when we don’t for the other two
> types.

But we do.

mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() do
nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=n.

David