Re: [PATCH v3 04/10] certs: Fix blacklist flag type confusion

On Wed, Jan 20, 2021 at 12:15:10PM +0100, Mickaël Salaün wrote:

On 20/01/2021 04:55, Jarkko Sakkinen wrote:

quoted

On Thu, Jan 14, 2021 at 04:19:03PM +0100, Mickaël Salaün wrote:

quoted

From: David Howells <dhowells@redhat.com>

KEY_FLAG_KEEP is not meant to be passed to keyring_alloc() or key_alloc(),
as these only take KEY_ALLOC_* flags.  KEY_FLAG_KEEP has the same value as
KEY_ALLOC_BYPASS_RESTRICTION, but fortunately only key_create_or_update()
uses it.  LSMs using the key_alloc hook don't check that flag.

KEY_FLAG_KEEP is then ignored but fortunately (again) the root user cannot
write to the blacklist keyring, so it is not possible to remove a key/hash
from it.

Fix this by adding a KEY_ALLOC_SET_KEEP flag that tells key_alloc() to set
KEY_FLAG_KEEP on the new key.  blacklist_init() can then, correctly, pass
this to keyring_alloc().

OK, so thing work by luck now, but given the new patches which allow
to append new keys they would break, right?

Without this fix, patch 9/10 would allow to remove and modify keys from
the blacklist keyring.

quoted

quoted

We can also use this in ima_mok_init() rather than setting the flag
manually.

What does ima_mok_init() do?

This was initially an addition from David Howells, I only fixed the
argument bit-ORing. ima_mok_init() allocates a blacklist keyring (with
different properties) dedicated to IMA.

 
Please add this to the commit message.

/Jarkko