[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-keyrings
Subject:    Re: [PATCH] cert: Add kconfig dependency for validate_trust
From:       David Howells <dhowells () redhat ! com>
Date:       2021-02-25 14:43:31
Message-ID: 506021.1614264211 () warthog ! procyon ! org ! uk
[Download RAW message or body]

Eric Snowberg <eric.snowberg@oracle.com> wrote:

> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST support.
> 
> I believe this is ok.  However currently, whenever the kernel finds either a
> EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it loads
> it into the blacklist keyring.  Then anytime signature validation takes
> place, these entries are referenced.  If there is a match, the signature
> check fails.  Now with the inclusion of EFI_CERT_X509_GUID, I question why
> we want to enable it thru a Kconfig option, when we don't for the other two
> types.

But we do.

mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() do
nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=n.

David

[prev in list] [next in list] [prev in thread] [next in thread]