Re: [RFC PATCH 02/20] KEYS: Add a system blacklist keyring [ver #2]
From: Mimi Zohar
Date: Wed Jan 20 2016 - 14:31:50 EST
On Tue, 2016-01-19 at 11:30 +0000, David Howells wrote:
> Add the following:
> (1) A new system keyring that is used to store information about
> blacklisted certificates and signatures.
> (2) A new key type (called 'blacklist') that is used to store a
> blacklisted hash in its description as a hex string. The key accepts
> no payload.
> (3) The ability to configure a list of blacklisted hashes into the kernel
> at build time. This is done by setting
> CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
> that are in the form:
> "<hash>", "<hash>", ..., "<hash>"
> where each <hash> is a hex string representation of the hash and must
> include all necessary leading zeros to pad the hash to the right size.
Is the output of "keyctl print" the hex string representation? Update
> The above are enabled with CONFIG_SYSTEM_BLACKLIST_KEYRING.
> Once the kernel is booted, the blacklist keyring can be listed:
> root@andromeda ~]# keyctl show %:.blacklist
> 723359729 ---lswrv 0 0 keyring: .blacklist
> 676257228 ---lswrv 0 0 \_ blacklist: 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
> The blacklist cannot currently be modified by userspace, but it will be
> possible to load it, for example, from the UEFI blacklist database.
When loading the UEFI blacklist database is enabled, it should be
> In the future, it should also be made possible to load blacklisted
> asymmetric keys in here too.
Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be
blacklisted" adds this support.