lkml.org 
[lkml]   [2021]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH] cert: Add kconfig dependency for validate_trust
Date
Eric Snowberg <eric.snowberg@oracle.com> wrote:

> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST support.
>
> I believe this is ok. However currently, whenever the kernel finds either a
> EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it loads
> it into the blacklist keyring. Then anytime signature validation takes
> place, these entries are referenced. If there is a match, the signature
> check fails. Now with the inclusion of EFI_CERT_X509_GUID, I question why
> we want to enable it thru a Kconfig option, when we don’t for the other two
> types.

But we do.

mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() do
nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=n.

David

\
 
 \ /
  Last update: 2021-02-25 15:46    [W:0.070 / U:2.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site