1. 09 May, 2017 1 commit
  2. 03 Apr, 2017 1 commit
    • David Howells's avatar
      KEYS: Add a system blacklist keyring · 734114f8
      David Howells authored
      Add the following:
      
       (1) A new system keyring that is used to store information about
           blacklisted certificates and signatures.
      
       (2) A new key type (called 'blacklist') that is used to store a
           blacklisted hash in its description as a hex string.  The key accepts
           no payload.
      
       (3) The ability to configure a list of blacklisted hashes into the kernel
           at build time.  This is done by setting
           CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
           that are in the form:
      
      	"<hash>", "<hash>", ..., "<hash>"
      
           where each <hash> is a hex string representation of the hash and must
           include all necessary leading zeros to pad the hash to the right size.
      
      The above are enabled with CONFIG_SYSTEM_BLACKLIST_KEYRING.
      
      Once the kernel is booted, the blacklist keyring can be listed:
      
      	root@andromeda ~]# keyctl show %:.blacklist
      	Keyring
      	 723359729 ---lswrv      0     0  keyring: .blacklist
      	 676257228 ---lswrv      0     0   \_ blacklist: 123412341234c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
      
      The blacklist cannot currently be modified by userspace, but it will be
      possible to load it, for example, from the UEFI blacklist database.
      
      A later commit will make it possible to load blacklisted asymmetric keys in
      here too.
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      734114f8