| Subject | Re: [RFC PATCH 18/20] IMA: Use the system blacklist keyring [ver #2] | From | Mimi Zohar <> | Date | Wed, 10 Feb 2016 14:12:03 -0500 |
| |
Hi David,
On Tue, 2016-01-19 at 11:32 +0000, David Howells wrote:
> @@ -145,10 +165,10 @@ static int __init blacklist_init(void) > current_cred(), > (KEY_POS_ALL & ~KEY_POS_SETATTR) | > KEY_USR_VIEW | KEY_USR_READ | > - KEY_USR_SEARCH, > + KEY_USR_SEARCH | KEY_USR_WRITE, > KEY_ALLOC_NOT_IN_QUOTA | > KEY_FLAG_KEEP, > - NULL, NULL); > + restrict_link_by_system_trusted, NULL);
As discussed, "restrict_link_by_system_trusted" is not enough. The certificate being added should be in a revoked list as well. We should defer this patch until that is possible or at least add a Kconfig option to permit black listing x509 certificates.
Mimi
|