lkml.org 
[lkml]   [2016]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring
    Date
    Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

    > The IMA MOK and blacklist are restricted to "public_key_restrict_link".
    > Does this only allow keys signed by keys on the respective keyring or
    > also by the system keyring?

    As my patches stand, the following are implemented:

    (1) public_key_restrict_link() restricts to asymmetric keys that are signed
    by a CA in the specified keyring. It returns -ENOKEY if no matching key
    is found rather than -EKEYREJECTED, however, so you can call it several
    times for different keyrings. -EKEYREJECTED is only returned if a
    signature check fails. This is used by the following two functions.

    (2) restrict_link_by_system_trusted() restricts to asymmetric keys that are
    signed by a CA in the system keyring. This ignores the keyring argument
    it is given.

    Note that the system_trusted_keyring is then no longer exported because
    verify_pkcs7_signature() is also in certs/system_keyring.c and uses that
    by default if NULL is passed.

    (3) restrict_link_by_ima_mok() restricts to asymmetric keys signed by a CA in
    either .system_keyring or .ima_mok.

    So the trusted keyrings are then restricted as follows:

    (1) .system_keyring uses restrict_link_by_system_trusted() - though it lacks
    any sort of write permission, so it's currently moot. It could just as
    well be replaced with a function that just returns -EPERM.

    (2) .ima_mok should be using restrict_link_by_system_trusted(), but I failed
    to update this when I split the public_key_restrict_link() function.
    I've updated this in my patch. This would then be correct according to
    Petko's commit log:

    To successfully import a key into .ima_mok it must be signed by a
    key which CA is in .system keyring.

    However, from what Petko says, this is wrong and it should instead be
    using restrict_link_by_ima_mok().

    (3) .ima_blacklist should be using restrict_link_by_system_trusted() also.
    I've no idea whether additions to this should be permitted by keys in
    .ima_mok also.

    (4) .ima uses restrict_link_by_ima_mok(), as per:

    On turn any key that needs to go in .ima keyring must be signed by CA
    in either .system or .ima_mok keyrings.

    (5) .evm is not restricted by my patches. This is a mistake on my part - but
    I'm not sure what the restriction actually needs to be as it's not
    mentioned in Petko's commit message. Presumably it needs the same as
    .ima.

    David

    \
     
     \ /
      Last update: 2016-01-12 11:41    [W:4.136 / U:0.488 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site