linux-kernel - Re: [PATCH v3 1/3] certs: log hash value on blacklist error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 4 Dec 2022 16:53:01 +0000
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Thomas Weißschuh <linux@...ssschuh.net>
Cc:     Mickaël Salaün <mic@...ikod.net>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        Eric Snowberg <eric.snowberg@...cle.com>,
        keyrings@...r.kernel.org, linux-kernel@...r.kernel.org,
        Mark Pearson <markpearson@...ovo.com>,
        linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org
Subject: Re: [PATCH v3 1/3] certs: log hash value on blacklist error

On Mon, Nov 28, 2022 at 02:59:20AM +0100, Thomas Weißschuh wrote:
> On 2022-11-28 03:11+0200, Jarkko Sakkinen wrote:
> > "Make blacklisted hash available in klog"
> > 
> > On Fri, Nov 18, 2022 at 05:03:41AM +0100, Thomas Weißschuh wrote:
> > > Without this information these logs are not actionable.
> > 
> > Without blacklisted hash?
> > 
> > > For example on duplicate blacklisted hashes reported by the system
> > > firmware users should be able to report the erroneous hashes to their
> > > system vendors.
> > > 
> > > While we are at it use the dedicated format string for ERR_PTR.
> > 
> > Lacks the beef so saying "while we are at it" makes no sense.
> 
> What about this:
> 
>   [PATCH] certs: make blacklisted hash available in klog
> 
>   One common situation triggering this log statement are duplicate hashes
>   reported by the system firmware.
> 
>   These duplicates should be removed from the firmware.
> 
>   Without logging the blacklisted hash triggering the issue however the users
>   can not report it properly to the firmware vendors and the firmware vendors
>   can not easily see which specific hash is duplicated.
> 
>   While changing the log message also use the dedicated ERR_PTR format
>   placeholder for the returned error value.

Looks looks a lot better thank you!

> > > Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring")
> > 
> > Why does this count as a bug?
> 
> These error logs are confusing to users, prompting them to waste time
> investigating them and even mess with their firmware settings.
> (As indicated in the threads linked from the cover letter)
> 
> The most correct fix would be patches 2 and 3 from this series.
> 
> I was not sure if patch 2 would be acceptable for stable as it introduces new
> infrastructure code.
> So patch 1 enables users to report the issue to their firmware vendors and get
> the spurious logs resolved that way.
> 
> If these assumptions are incorrect I can fold patch 1 into patch 3.
> 
> But are patch 2 and 3 material for stable?

I cannot say anything conclusive to this before seeing updated version of
the patch set.

BR, Jarkko