Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH] cert: Add kconfig dependency for validate_trust | Date | Thu, 25 Feb 2021 14:43:31 +0000 |
| |
Eric Snowberg <eric.snowberg@oracle.com> wrote:
> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST support. > > I believe this is ok. However currently, whenever the kernel finds either a > EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it loads > it into the blacklist keyring. Then anytime signature validation takes > place, these entries are referenced. If there is a match, the signature > check fails. Now with the inclusion of EFI_CERT_X509_GUID, I question why > we want to enable it thru a Kconfig option, when we don’t for the other two > types.
But we do.
mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() do nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=n.
David
| |