From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755229AbcBHPx4 (ORCPT ); Mon, 8 Feb 2016 10:53:56 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38336 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754257AbcBHPxz (ORCPT ); Mon, 8 Feb 2016 10:53:55 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <1454943785.2648.195.camel@linux.vnet.ibm.com> References: <1454943785.2648.195.camel@linux.vnet.ibm.com> <1454938472.2648.173.camel@linux.vnet.ibm.com> <1453318283.2858.27.camel@linux.vnet.ibm.com> <20160119113026.23238.4498.stgit@warthog.procyon.org.uk> <20160119113041.23238.44728.stgit@warthog.procyon.org.uk> <24522.1454513272@warthog.procyon.org.uk> <25433.1454939711@warthog.procyon.org.uk> To: Mimi Zohar Cc: dhowells@redhat.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, petkan@mip-labs.com, linux-kernel@vger.kernel.org Subject: How to add additional blacklist entries? MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <14857.1454946832.1@warthog.procyon.org.uk> Date: Mon, 08 Feb 2016 15:53:52 +0000 Message-ID: <14858.1454946832@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Mimi Zohar wrote: > Right, this patch makes the system blacklist keyring writable by > userspace and removes the IMA blacklist. What I don't understand is how > to add a key that is currently on the IMA keyring to the system > blacklist? You can do this from userspace with "keyctl link". Admittedly, this attaches the entire key to the blacklist keyring, not just the ID. But that's basically what you're doing at the moment, right. To simply list the SKID of the key you want to blacklist, another patch will be required, but the question is as to what the interface should look like. Let's start at the beginning. First of all, let me ask the following: (1) How is the key-to-be-blacklisted specified? A copy of the X.509 cert to be blocked? A signed list of SKIDs to be blocked? A CRL? (2) How is the blacklist addition to be verified? David