Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring

[David Howells]

Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:

> Is this the primary use case scenario for your patches?   Unfortunately,
> your posted patches would break the existing IMA trust model.

Why so?

The patches give you per-keyring control over restricting what is permitted in
a keyring, allows you to use any criteria you like, whether it be just the
contents of that keyring or CA certs in some other keyring(s) and a blacklist.

In other words, it should be able to do everything one can do now - except
that it controls linkage between trusted keyrings with the same restrictions
as adding new keys.

So if it breaks the IMA trust model, then doesn't that suggest that the trust
model is broken anyway?

David