Messages in this thread | | | Subject | Re: [PATCH] certs: Reference revocation list for all keyrings | From | Mimi Zohar <> | Date | Fri, 14 Jul 2023 18:11:12 -0400 |
| |
On Tue, 2023-01-17 at 12:15 -0500, Eric Snowberg wrote: > Systems booted with shim have a Forbidden Signature Database called mokx. > During boot, hashes and certs contained within the mokx are loaded into the > blacklist keyring. When calling verify_pkcs7_message_sig the contents of > the blacklist keyring (or revocation list) are referenced when validating > keys on the platform keyring. Currently, when validating against the > secondary or builtin keyrings, the revocation list is not referenced. Move > up the check to allow the revocation list to be used with all keyrings, > including the secondary and builtin, allowing the system owner to take > corrective action should a vulnerability be found within keys contained > within either keyring. > > Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
| |