linux-kernel - Re: [PATCH 0/3] Add digitalSignature enforcement keyring restrictions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 May 2023 01:31:45 +0300
From:   "Jarkko Sakkinen" <jarkko@...nel.org>
To:     "Eric Snowberg" <eric.snowberg@...cle.com>, <zohar@...ux.ibm.com>,
        <dhowells@...hat.com>, <dwmw2@...radead.org>
Cc:     <herbert@...dor.apana.org.au>, <davem@...emloft.net>,
        <dmitry.kasatkin@...il.com>, <paul@...l-moore.com>,
        <jmorris@...ei.org>, <serge@...lyn.com>, <jlee@...e.com>,
        <kanth.ghatraju@...cle.com>, <konrad.wilk@...cle.com>,
        <keyrings@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linux-crypto@...r.kernel.org>, <linux-integrity@...r.kernel.org>,
        <linux-security-module@...r.kernel.org>
Subject: Re: [PATCH 0/3] Add digitalSignature enforcement keyring
 restrictions

On Tue May 9, 2023 at 1:07 AM EEST, Eric Snowberg wrote:
> X.509 certificates may contain a key usage extension [1]. The key usage
> extension defines the purpose of the certificate. One area of
> interest is the digitalSignature. The digitalSignature usage is
> typically used for code signing (integrity). 
>
> Within the "Add CA enforcement key restrictions" [2] series, the
> digitalSignature is being saved.  This series builds upon the previous
> one and adds restrictions based on the digitalSignature usage.  
>
> A new keyring restriction called restrict_link_by_digsig is added. The new
> restriction only allows keys that contain digitalSignature usage within
> it.
>
> The first two keyrings to use this restriction are the .ima and .evm
> keyrings.  With this update, only keys containing a digitalSignature 
> will be allowed in either keyring.

... and disallowed if not (for completeness)?

Maybe you want to say that "With this update, keys can be filtered based
on digitalSignature"?

I know, it is only cover letter, not a big deal...

>
> 1. https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3
> 2. https://lore.kernel.org/all/20230329220231.h6afgarrvdlwwdjc@kernel.org/T/
>
> Eric Snowberg (3):
>   KEYS: DigitalSignature link restriction
>   integrity: Enforce digitalSignature usage in the ima and evm keyrings
>   integrity: Remove EXPERIMENTAL from Kconfig
>
>  certs/system_keyring.c            | 52 +++++++++++++++++++++++++++++++
>  crypto/asymmetric_keys/restrict.c | 44 ++++++++++++++++++++++++++
>  include/crypto/public_key.h       | 11 +++++++
>  include/keys/system_keyring.h     | 11 +++++++
>  security/integrity/digsig.c       |  4 +--
>  security/integrity/evm/Kconfig    |  3 +-
>  security/integrity/ima/Kconfig    |  5 +--
>  7 files changed, 125 insertions(+), 5 deletions(-)
>
>
> base-commit: ac9a78681b921877518763ba0e89202254349d1b
> -- 
> 2.27.0


BR, Jarkko