Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Subject: Re: [PATCH v7 5/5] certs: Allow root user to append signed hashes to
 the blacklist keyring
From:   Eric Snowberg <eric.snowberg@oracle.com>
In-Reply-To: <20210312171232.2681989-6-mic@digikod.net>
Date:   Mon, 15 Mar 2021 10:59:16 -0600
Cc:     David Howells <dhowells@redhat.com>,
        David Woodhouse <dwmw2@infradead.org>,
        Jarkko Sakkinen <jarkko@kernel.org>,
        "David S . Miller" <davem@davemloft.net>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        James Morris <jmorris@namei.org>,
        =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= <mic@linux.microsoft.com>,
        Mimi Zohar <zohar@linux.ibm.com>,
        "Serge E . Hallyn" <serge@hallyn.com>,
        Tyler Hicks <tyhicks@linux.microsoft.com>,
        keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
        linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-security-module@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <A4CD568A-6D8E-4043-971B-8E79FFB58709@oracle.com>
References: <20210312171232.2681989-1-mic@digikod.net>
 <20210312171232.2681989-6-mic@digikod.net>
To:     =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= <mic@digikod.net>
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from [172.16.177.128] (24.52.35.144) by BYAPR11CA0057.namprd11.prod.outlook.com (2603:10b6:a03:80::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3933.32 via Frontend Transport; Mon, 15 Mar 2021 16:59:20 +0000
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: ad5ca2ae-001e-4b88-c8e2-08d8e7d3ae5b
X-MS-TrafficTypeDiagnostic: CH0PR10MB5180:
X-Microsoft-Antispam-PRVS: <CH0PR10MB518054AD41DE6A57250FD93D876C9@CH0PR10MB5180.namprd10.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:7691;
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: pizUSCGWW9L8uCzxOXde3zySb3nMvxc2l5GU9ur0JyEf0YX1JjdzPLn4qXv8e01HJtxSsEi1ob4MhvPuevig0KNuwMgU7evWambBnK8Jq4s4Aat+G/iF4DjhCl7LEOjsaEUVnx2SN7kyxNcorBqcI/BHQdbS1v4wNHPJOJNC3CLXjs3cQYFMrk8cArIX/hPFkfhGJZJn1V9nEyJjMMLlkNAlG3y4eFT+2JD0eR+TbWd0TvCnbKY5Ub5NUwruEGXpFzkeUhxyDpNF463pxBKKGahQkEEiGj293qGGs9N9uKkMdFTlMgl1MTyulS3m1GRVQanJKea6FSpMIBI7rDhpq4KdjYMWxhGjRc0mQe5oK/FRA4CNKWqbOHtfH5GoDPBwSMLNYfQnfV5b5o4U3eAkbAPSTHc+vF9quNNvAUHMIQCtFBr8LY84E6voiMOA7kV0CIpYErlwdfrSt7Ds+AsL+B98ard7V3ORhW4lNRctjPzP5/acTQb/rm0EOaVOJdpEz/yi1kfSQS2GaC9avdTFYeDZ4rCG2FLVuY682QD8/3qM8xO3V2UCr0yBbayEwVtZrBXhOH0AHHAQtwAVQabxr3TL/mGPdB2vx1Gd1zammyeuWtWbFC7f3zzuIymUHaj8GH1hXVuzoZjx1DmuEricXetZ2QFrb+jkNCPLQU9dXYQDAeuNUtGHmJtmbxpRWrQJ5BwZqYZHwzHNSD58dXrVMA==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH2PR10MB4150.namprd10.prod.outlook.com;PTR:;CAT:NONE;SFS:(39860400002)(136003)(376002)(346002)(366004)(396003)(86362001)(26005)(6916009)(36756003)(44832011)(966005)(53546011)(66946007)(6666004)(316002)(83380400001)(7416002)(52116002)(956004)(2906002)(66574015)(186003)(66556008)(478600001)(54906003)(33656002)(66476007)(2616005)(5660300002)(4326008)(16576012)(8676002)(6486002)(16526019)(8936002)(45980500001);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: =?utf-8?B?WnFndnUxQlJlclQ5ejB0YnlMbEVhaU5LNHFlemlMOXhvd2hhdllMQ1BmS0ZC?=
 =?utf-8?B?TmlKcU1OOHBORll0cEhBSFR2QVNyaGQvVkJQbzdBdURaK2JJRmxQdGYzT3Jz?=
 =?utf-8?B?Q1ZRT2tCdno2MEFld2pub09HYysvSW50UjczUXJxMCt0WjRENTd2bWllK2da?=
 =?utf-8?B?ZjJsbTdJM2ZQYTR6ZWFsNTJWc1ZJRWhQd2svdDZyQmxYWkNYQlVDV3hHdHNy?=
 =?utf-8?B?ZGZ2T3IzczlMWVZPYW0yQ3duS3RNamJCNXpJSXZoTUpjUUFNeEFXRUFGb2V2?=
 =?utf-8?B?ZzkveHVSWng3SzIyci91OFA4U2hmUmdDbFJGSVVyVzVWSnNxOGdFZFdRS2J6?=
 =?utf-8?B?NzcwOSswbW9URlN6cFpIbVFFUDFIektSdENTRzRKY3lWWFFUb2ZldkpFQlhp?=
 =?utf-8?B?S1hYeUw3TUFhMTUwUFI0YVA3b24yQTV2TENyR0ttSGV5NEQ3VEJjR2N2WTN6?=
 =?utf-8?B?WjFjODVQbUtzZXhvcDFlVUorWHIybGNJWmU2cUZkcDVQWi94TCtLS2FLbVVL?=
 =?utf-8?B?M1JEalhITmdSNVptc0dyZzFCQkVkaVZwd1JhV1BVVUNVWFhlYXVXeGgzMHQ4?=
 =?utf-8?B?c0NZUStPVWthQUp0M3Arcy9pb0FIQXJwMXYvc3U3S1ZHYStTWmpzTW1uNytj?=
 =?utf-8?B?UE4ra3FSQnJhdDJROGlNUHZzeEQyRmNrdVB0NVdPcVRrMDhTenNBOXF2RU5o?=
 =?utf-8?B?YTdkUE0wODc3YlNKTU9neGxTaFhsSlVTMGh1aWltOHR6K1hPeStKdy9mYkdZ?=
 =?utf-8?B?YW5jUnc3WldySDdEOGl1c2ZKN0xkWE1iTlVIdXlKV2lqSzBlMk9QNHNvTUlh?=
 =?utf-8?B?WCtHM0JMYk1PQW1GL3lBVVZhYUlmcmpOMWlZcXJRQ2M0U0NuK1A1UUZ2SWVN?=
 =?utf-8?B?MW0xWFBNd3VuSklnQmxvcUFnR2tzc1IrKzJyc2JEVkl0RWcwdEdKU2dNUVAr?=
 =?utf-8?B?dEhXa3Irc1RPejFXWDliN1p1S3IxaVV5VDcyT2VPbHRBUGtabDJQeEhlelo3?=
 =?utf-8?B?SmJLdW5uU3doUjFxUVg5SEQvOTBKUlR5aGFMS09XWUg0UVlPT3FvNGY0MTlH?=
 =?utf-8?B?dWtpMTdYb2JDcC9jTzRoRWdXY1NlRkRtU2FjRXRjM3FFamRkMXpPa1R1V2hp?=
 =?utf-8?B?S2VDWTBReEtoejcyRDFRRUtxVnJIWkxaQzZzeTM5a1VQWTdZajlaQWtwa3M2?=
 =?utf-8?B?ZmxaZ3hSN2lEbmJGeEt5K3hEeGNoWkhSSzkzRXI4T3IxS0NCSCtKZ2Zkbzht?=
 =?utf-8?B?WUJ5SGhrUk5BUDJCY3ovZkk1d29vYUp0c2Mza3B4WE43WWNJVVlmUzgwTlUw?=
 =?utf-8?B?WHYrNTdtaXNsdFdpTjFpelRZMkp1OHJwcjdpdkdsWURhem5LNCtYMWNtZkoy?=
 =?utf-8?B?S3VNeFV5dW05NmRWcVlxZVI2YVFRcW1oZmR3TC9NaFcrYXlsK1YzVUEzNi9E?=
 =?utf-8?B?V0l5VVA5Slk0OGVoTko1RVZZTmIwaHVDYnA0cFM1V1d0YjB5TERKUmhNZE9y?=
 =?utf-8?B?ckF0UDNsNVdUZktPUzAvVUp2L2J1OU1Od0VqNXg1b0lUbzR4Zjd2Y29qVk9O?=
 =?utf-8?B?Tk5sQ0N4RFNPWVpWb2dDMGo5MGpJb0hyUEwrWGluc1BJTytHUWhhaGRZNWs5?=
 =?utf-8?B?RHlsZXhZUnpQVE5Pb1dXeE1QWnM2UkNZWDkrWVA5Q2E0ZU4vNncyWTF5VTRw?=
 =?utf-8?B?QWQvVnhsc3U2SE1hdWlkZ28vNmxwMnpUTmhDdXRwdkRFQnVSbXRtMFNPODZK?=
 =?utf-8?Q?5+E/Owl587opVPVMw1jN8D5ctaAEh+FZSFyIipC?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ad5ca2ae-001e-4b88-c8e2-08d8e7d3ae5b
X-MS-Exchange-CrossTenant-AuthSource: CH2PR10MB4150.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Mar 2021 16:59:22.3586
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: M78N0nafXUSRtzXqCwNBW8hgqIcp9aDXunIZDuRc+h8Os4YYUH4g5OT3a82viLBJE6dM9vZ4FsgW0YMvNhRu4OdM6YxgsfJsWbcw50G2CUU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5180
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9923 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0 spamscore=0
 mlxlogscore=999 bulkscore=0 malwarescore=0 phishscore=0 mlxscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000
 definitions=main-2103150114
X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=9923 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 impostorscore=0
 malwarescore=0 adultscore=0 mlxscore=0 clxscore=1015 mlxlogscore=999
 lowpriorityscore=0 phishscore=0 priorityscore=1501 spamscore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000
 definitions=main-2103150114
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


> On Mar 12, 2021, at 10:12 AM, Micka=C3=ABl Sala=C3=BCn <mic@digikod.net> =
wrote:
>=20
> From: Micka=C3=ABl Sala=C3=BCn <mic@linux.microsoft.com>
>=20
> Add a kernel option SYSTEM_BLACKLIST_AUTH_UPDATE to enable the root user
> to dynamically add new keys to the blacklist keyring.  This enables to
> invalidate new certificates, either from being loaded in a keyring, or
> from being trusted in a PKCS#7 certificate chain.  This also enables to
> add new file hashes to be denied by the integrity infrastructure.
>=20
> Being able to untrust a certificate which could have normaly been
> trusted is a sensitive operation.  This is why adding new hashes to the
> blacklist keyring is only allowed when these hashes are signed and
> vouched by the builtin trusted keyring.  A blacklist hash is stored as a
> key description.  The PKCS#7 signature of this description must be
> provided as the key payload.
>=20
> Marking a certificate as untrusted should be enforced while the system
> is running.  It is then forbiden to remove such blacklist keys.
>=20
> Update blacklist keyring, blacklist key and revoked certificate access ri=
ghts:
> * allows the root user to search for a specific blacklisted hash, which
>  make sense because the descriptions are already viewable;
> * forbids key update (blacklist and asymmetric ones);
> * restricts kernel rights on the blacklist keyring to align with the
>  root user rights.
>=20
> See help in tools/certs/print-cert-tbs-hash.sh .
>=20
> Cc: David Howells <dhowells@redhat.com>
> Cc: David Woodhouse <dwmw2@infradead.org>
> Cc: Eric Snowberg <eric.snowberg@oracle.com>
> Cc: Jarkko Sakkinen <jarkko@kernel.org>
> Signed-off-by: Micka=C3=ABl Sala=C3=BCn <mic@linux.microsoft.com>
> Link: https://lore.kernel.org/r/20210312171232.2681989-6-mic@digikod.net

I tried testing this, it doesn=E2=80=99t work as I would expect. =20
Here is my test setup:

Kernel built with two keys compiled into the builtin_trusted_keys keyring

Generated a tbs cert from one of the keys and signed it with the other key

As root, added the tbs cert hash to the blacklist keyring

Verified the tbs hash is in the blacklist keyring

Enabled lockdown to enforce kernel module signature checking

Signed a kernel module with the key I just blacklisted

Load the kernel module=20

I=E2=80=99m seeing the kernel module load, I would expect this to fail, sin=
ce the=20
key is now blacklisted.  Or is this change just supposed to prevent new key=
s=20
from being added in the future?