Re: [PATCH v3 08/10] certs: Check that builtin blacklist hashes are valid
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2021-01-21 15:23:13
Also in:
keyrings, linux-crypto, linux-security-module, lkml
On Thu, Jan 21, 2021 at 10:18:20AM +0100, Mickaël Salaün wrote:
On 21/01/2021 00:53, Jarkko Sakkinen wrote:quoted
On Wed, Jan 20, 2021 at 12:57:55PM +0100, Mickaël Salaün wrote:quoted
On 20/01/2021 06:19, Jarkko Sakkinen wrote:quoted
On Thu, Jan 14, 2021 at 04:19:07PM +0100, Mickaël Salaün wrote:quoted
From: Mickaël Salaün <redacted> Add and use a check-blacklist-hashes.awk script to make sure that the builtin blacklist hashes will be approved by the run time blacklist description checks. This is useful to debug invalid hash formats, and it make sure that previous hashes which could have been loaded in the kernel (but ignored) are now noticed and deal with by the user. Cc: David Howells <dhowells@redhat.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Mickaël Salaün <redacted> Acked-by: Jarkko Sakkinen <jarkko@kernel.org>I get this with a self-signed cert: certs/Makefile:18: *** target pattern contains no '%'. Stop. CONFIG_SYSTEM_BLACKLIST_HASH_LIST="tbs:8eed1340eef37c1dc84d996406ad05c7dbb3eade19132d688408ca2f63904869"As said in the Kconfig documentation for CONFIG_SYSTEM_BLACKLIST_HASH_LIST, you need to provide a file with the list, not to set the string directly in the configuration variable. This patch series didn't change this behavior. The same kind of macros are used for CONFIG_MODULE_SIG_KEY.OK, the documentation just states that: "Hashes to be preloaded into the system blacklist keyring" No mention about a file. I'd add a patch to update this documentation.I was referring to the full description: config SYSTEM_BLACKLIST_HASH_LIST string "Hashes to be preloaded into the system blacklist keyring" depends on SYSTEM_BLACKLIST_KEYRING help If set, this option should be the filename of a list of hashes in the form "<hash>", "<hash>", ... . This will be included into a C wrapper to incorporate the list into the kernel. Each <hash> should be a string of hex digits. …but the short description doesn't mention filename.
Aah. Anyway, I'll test the next version. Now all should be clear how to approach that. Thanks. /Jarkko