Messages in this thread | | | Date | Thu, 17 Aug 2023 18:54:23 +0000 | Subject | Re: [PATCH v2] certs: Reference revocation list for all keyrings | From | "Jarkko Sakkinen" <> |
| |
On Thu Aug 17, 2023 at 2:04 PM UTC, Eric Snowberg wrote: > Systems booted with shim have a Forbidden Signature Database called mokx. > During boot, hashes and certs contained within the mokx are loaded into the > blacklist keyring. When calling verify_pkcs7_message_sig the contents of > the blacklist keyring (or revocation list) are referenced when validating > keys on the platform keyring. Currently, when validating against the > secondary or builtin keyrings, the revocation list is not referenced. Move > up the check to allow the revocation list to be used with all keyrings, > including the secondary and builtin, allowing the system owner to take > corrective action should a vulnerability be found within keys contained > within either keyring. > > Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> > Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> > --- > v2 changes: > Since this one seems to have been forgotten, added the two Reviewed-by tags. > Unless there are any objections, could this be picked up?
Applied to -next.
BR, Jarkko
| |