Messages in this thread | | | From | David Howells <> | Subject | Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] | Date | Wed, 06 Jan 2016 13:21:27 +0000 |
| |
Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
> The x509_validate_trust() was originally added for IMA to ensure, on a > secure boot system, a certificate chain of trust rooted in hardware. > The IMA MOK keyring extends this certificate chain of trust to the > running system.
The problem is that because 'trusted' is a boolean, a key in the IMA MOK keyring will permit addition to the system keyring.
David
| |