Messages in this thread | | | From | Thomas Weißschuh <> | Subject | [PATCH RESEND v6 0/3] certs: Prevent spurious errors on repeated blacklisting | Date | Mon, 09 Jan 2023 23:59:41 +0000 |
| |
When the blacklist keyring was changed to allow updates from the root user it gained an ->update() function that disallows all updates. When the a hash is blacklisted multiple times from the builtin or firmware-provided blacklist this spams prominent logs during boot:
[ 0.890814] blacklist: Problem blacklisting hash (-13)
This affects the firmware of various vendors. Reported have been at least: * Samsung: https://askubuntu.com/questions/1436856/ * Acer: https://ubuntuforums.org/showthread.php?t=2478840 * MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7 * Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860 * Lenovo: https://lore.kernel.org/lkml/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/
Note: In the meantime I lost access to the machine exhibiting the problematic behavior. If larger changes are required to this series somebody else would have to validate them or take over the series.
Changelog:
v1: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/ v1 -> v2: * Improve logging message to include the failed hash * Add key_create() function without update semantics * Use key_create() from mark_raw_hash_blacklisted() and log specific message on -EEXIST
v2: https://lore.kernel.org/lkml/20221109025019.1855-1-linux@weissschuh.net/ v2 -> v3: * Clarify commit titles and messages * Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact of some obsolete version of the patch and not needed
v3: https://lore.kernel.org/lkml/20221118040343.2958-1-linux@weissschuh.net/ v3 -> v4: * Drop Fixes-tag from first patch * Flesh out commit descriptions and messages
v4: https://lore.kernel.org/r/20221212-keys-blacklist-v4-0-00afeb3137fb@weissschuh.net v4 -> v5: * Reduce lines needed by function calls in key.c * Add Reviewed-by from Jarkko
v5: https://lore.kernel.org/r/20221212-keys-blacklist-v5-0-52e9eb5a8827@weissschuh.net v5 -> v6: * Correct Jarkkos email in Reviewed-by tags * Resend to hopefully reach @kernel.org recipients
Thomas Weißschuh (3): certs: log hash value on blacklist error KEYS: Add key_create() certs: don't try to update blacklist keys
certs/blacklist.c | 21 ++++--- include/linux/key.h | 8 +++ security/keys/key.c | 149 +++++++++++++++++++++++++++++++++----------- 3 files changed, 132 insertions(+), 46 deletions(-)
-- 2.38.1
To: David Howells <dhowells@redhat.com> To: David Woodhouse <dwmw2@infradead.org> To: Jarkko Sakkinen <jarkko@kernel.org> To: Paul Moore <paul@paul-moore.com> To: James Morris <jmorris@namei.org> To: "Serge E. Hallyn" <serge@hallyn.com> To: "Mickaël Salaün" <mic@digikod.net> Cc: keyrings@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: Paul Menzel <pmenzel@molgen.mpg.de> Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Cc: Mark Pearson <markpearson@lenovo.com>
--- Thomas Weißschuh (3): certs: make blacklisted hash available in klog KEYS: Add new function key_create() certs: don't try to update blacklist keys
certs/blacklist.c | 21 ++++---- include/linux/key.h | 8 +++ security/keys/key.c | 137 ++++++++++++++++++++++++++++++++++++++-------------- 3 files changed, 120 insertions(+), 46 deletions(-) --- base-commit: 512dee0c00ad9e9c7ae9f11fc6743702ea40caff change-id: 20221212-keys-blacklist-2c79a64667c9
Best regards, -- Thomas Weißschuh <linux@weissschuh.net>
| |