Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <B7E35D95-1A22-4277-B41B-B3FCC2E93743@oracle.com>
References: <B7E35D95-1A22-4277-B41B-B3FCC2E93743@oracle.com> <F6980CA4-737D-416A-BBE3-390CEBA8B192@oracle.com> <20210217165058.1336155-1-eric.snowberg@oracle.com> <3524595.1614124044@warthog.procyon.org.uk> <3731128.1614163916@warthog.procyon.org.uk>
To:     Eric Snowberg <eric.snowberg@oracle.com>
Cc:     dhowells@redhat.com, Jarkko Sakkinen <jarkko@kernel.org>,
        =?us-ascii?Q?=3D=3Futf-8=3FQ=3FMicka=3DC3=3DABl?=
         =?us-ascii?Q?=5FSala=3DC3=3DBCn=3F=3D?= <mic@linux.microsoft.com>,
        David Woodhouse <dwmw2@infradead.org>,
        keyrings@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] cert: Add kconfig dependency for validate_trust
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date:   Thu, 25 Feb 2021 14:43:31 +0000
Message-ID: <506021.1614264211@warthog.procyon.org.uk>
Precedence: bulk

Eric Snowberg <eric.snowberg@oracle.com> wrote:

> > I've added an extra config option to turn on SYSTEM_REVOCATION_LIST sup=
port.
>=20
> I believe this is ok.  However currently, whenever the kernel finds eithe=
r a
> EFI_CERT_SHA256_GUID or EFI_CERT_X509_SHA256_GUID entry in the dbx, it lo=
ads
> it into the blacklist keyring.  Then anytime signature validation takes
> place, these entries are referenced.  If there is a match, the signature
> check fails.  Now with the inclusion of EFI_CERT_X509_GUID, I question why
> we want to enable it thru a Kconfig option, when we don=E2=80=99t for the=
 other two
> types.

But we do.

mark_hash_blacklisted(), is_hash_blacklisted() and is_binary_blacklisted() =
do
nothing if CONFIG_SYSTEM_BLACKLIST_KEYRING=3Dn.

David