From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762375AbcALAor (ORCPT ); Mon, 11 Jan 2016 19:44:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58849 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760244AbcALAoq (ORCPT ); Mon, 11 Jan 2016 19:44:46 -0500 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <1452470153.2651.60.camel@linux.vnet.ibm.com> References: <1452470153.2651.60.camel@linux.vnet.ibm.com> <2033.1452447990@warthog.procyon.org.uk> <1452432410.2651.40.camel@linux.vnet.ibm.com> <20160106134525.15633.73582.stgit@warthog.procyon.org.uk> <24185.1452126854@warthog.procyon.org.uk> <1452180676.2890.21.camel@linux.vnet.ibm.com> <3384.1452458018@warthog.procyon.org.uk> To: Mimi Zohar Cc: dhowells@redhat.com, James Morris , Marcel Holtmann , petkan@mip-labs.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] X.509: Partially revert patch to add validation against IMA MOK keyring MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <27006.1452559481.1@warthog.procyon.org.uk> Date: Tue, 12 Jan 2016 00:44:41 +0000 Message-ID: <27007.1452559481@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Mimi Zohar wrote: > Is this the primary use case scenario for your patches? Unfortunately, > your posted patches would break the existing IMA trust model. Why so? The patches give you per-keyring control over restricting what is permitted in a keyring, allows you to use any criteria you like, whether it be just the contents of that keyring or CA certs in some other keyring(s) and a blacklist. In other words, it should be able to do everything one can do now - except that it controls linkage between trusted keyrings with the same restrictions as adding new keys. So if it breaks the IMA trust model, then doesn't that suggest that the trust model is broken anyway? David