lkml.org 
[lkml]   [2023]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH RESEND v6 0/3] certs: Prevent spurious errors on repeated blacklisting
    On Mon, Jan 09, 2023 at 11:59:41PM +0000, Thomas Weißschuh wrote:
    > When the blacklist keyring was changed to allow updates from the root
    > user it gained an ->update() function that disallows all updates.
    > When the a hash is blacklisted multiple times from the builtin or
    > firmware-provided blacklist this spams prominent logs during boot:
    >
    > [ 0.890814] blacklist: Problem blacklisting hash (-13)
    >
    > This affects the firmware of various vendors. Reported have been at least:
    > * Samsung: https://askubuntu.com/questions/1436856/
    > * Acer: https://ubuntuforums.org/showthread.php?t=2478840
    > * MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7
    > * Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860
    > * Lenovo: https://lore.kernel.org/lkml/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/
    >
    > Note: In the meantime I lost access to the machine exhibiting the
    > problematic behavior. If larger changes are required to this series
    > somebody else would have to validate them or take over the series.
    >
    > Changelog:
    >
    > v1: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/
    > v1 -> v2:
    > * Improve logging message to include the failed hash
    > * Add key_create() function without update semantics
    > * Use key_create() from mark_raw_hash_blacklisted() and log specific message
    > on -EEXIST
    >
    > v2: https://lore.kernel.org/lkml/20221109025019.1855-1-linux@weissschuh.net/
    > v2 -> v3:
    > * Clarify commit titles and messages
    > * Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact
    > of some obsolete version of the patch and not needed
    >
    > v3: https://lore.kernel.org/lkml/20221118040343.2958-1-linux@weissschuh.net/
    > v3 -> v4:
    > * Drop Fixes-tag from first patch
    > * Flesh out commit descriptions and messages
    >
    > v4: https://lore.kernel.org/r/20221212-keys-blacklist-v4-0-00afeb3137fb@weissschuh.net
    > v4 -> v5:
    > * Reduce lines needed by function calls in key.c
    > * Add Reviewed-by from Jarkko
    >
    > v5: https://lore.kernel.org/r/20221212-keys-blacklist-v5-0-52e9eb5a8827@weissschuh.net
    > v5 -> v6:
    > * Correct Jarkkos email in Reviewed-by tags
    > * Resend to hopefully reach @kernel.org recipients
    >
    > Thomas Weißschuh (3):
    > certs: log hash value on blacklist error
    > KEYS: Add key_create()
    > certs: don't try to update blacklist keys
    >
    > certs/blacklist.c | 21 ++++---
    > include/linux/key.h | 8 +++
    > security/keys/key.c | 149 +++++++++++++++++++++++++++++++++-----------
    > 3 files changed, 132 insertions(+), 46 deletions(-)
    >
    > --
    > 2.38.1
    >
    > To: David Howells <dhowells@redhat.com>
    > To: David Woodhouse <dwmw2@infradead.org>
    > To: Jarkko Sakkinen <jarkko@kernel.org>
    > To: Paul Moore <paul@paul-moore.com>
    > To: James Morris <jmorris@namei.org>
    > To: "Serge E. Hallyn" <serge@hallyn.com>
    > To: "Mickaël Salaün" <mic@digikod.net>
    > Cc: keyrings@vger.kernel.org
    > Cc: linux-kernel@vger.kernel.org
    > Cc: linux-security-module@vger.kernel.org
    > Cc: Paul Menzel <pmenzel@molgen.mpg.de>
    > Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
    > Cc: Mark Pearson <markpearson@lenovo.com>
    >
    > ---
    > Thomas Weißschuh (3):
    > certs: make blacklisted hash available in klog
    > KEYS: Add new function key_create()
    > certs: don't try to update blacklist keys
    >
    > certs/blacklist.c | 21 ++++----
    > include/linux/key.h | 8 +++
    > security/keys/key.c | 137 ++++++++++++++++++++++++++++++++++++++--------------
    > 3 files changed, 120 insertions(+), 46 deletions(-)
    > ---
    > base-commit: 512dee0c00ad9e9c7ae9f11fc6743702ea40caff
    > change-id: 20221212-keys-blacklist-2c79a64667c9
    >
    > Best regards,
    > --
    > Thomas Weißschuh <linux@weissschuh.net>

    Hi, I'e applied and pushed this now. Thank you.

    BR, Jarkko

    \
     
     \ /
      Last update: 2023-03-26 23:50    [W:4.764 / U:0.300 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site