Messages in this thread | | | Date | Wed, 6 Jan 2016 19:00:08 +0200 | From | Petko Manolov <> | Subject | Re: [RFC PATCH] X.509: Don't check the signature on apparently self-signed keys [ver #2] |
| |
On 16-01-06 13:21:27, David Howells wrote: > Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > > > The x509_validate_trust() was originally added for IMA to ensure, on a > > secure boot system, a certificate chain of trust rooted in hardware. The IMA > > MOK keyring extends this certificate chain of trust to the running system. > > The problem is that because 'trusted' is a boolean, a key in the IMA MOK > keyring will permit addition to the system keyring.
If this is true the i am clearly doing the wrong thing. The CA hierarchy should run top-bottom, not the other way around.
IMA MOK was introduced mainly because .system keyring was static at the time. Assuming i have my root certificate in .system how can i add more keys to this keyring? The new keys have been signed by my root CA? Is this possible since your October patch-set or i've been missing something this whole time?
Petko
| |