Re: [PATCH v3 08/10] certs: Check that builtin blacklist hashes are valid
From: Jarkko Sakkinen <jarkko@kernel.org>
Date: 2021-01-20 05:30:33
Also in:
keyrings, linux-crypto, linux-integrity, lkml
On Thu, Jan 14, 2021 at 04:19:07PM +0100, Mickaël Salaün wrote:
From: Mickaël Salaün <redacted> Add and use a check-blacklist-hashes.awk script to make sure that the builtin blacklist hashes will be approved by the run time blacklist description checks. This is useful to debug invalid hash formats, and it make sure that previous hashes which could have been loaded in the kernel (but ignored) are now noticed and deal with by the user. Cc: David Howells <dhowells@redhat.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Mickaël Salaün <redacted> Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
I get this with a self-signed cert: certs/Makefile:18: *** target pattern contains no '%'. Stop. CONFIG_SYSTEM_BLACKLIST_HASH_LIST="tbs:8eed1340eef37c1dc84d996406ad05c7dbb3eade19132d688408ca2f63904869" I used the script in 10/10 to test this, which is another reamark: the patches are in invalid order, as you need to apply 10/10 before you can test 8/10. /Jarkko