Here are two sets of patches. Firstly, the first three patches provide a
blacklist, making the following changes:
(1) Add a new key type, blacklist, that is a slimline key that just
contains a blacklisted hash and a note saying what it applies to.
(2) Add a system keyring, .blacklist, that holds blacklisted hashes.
(3) Add a pair of functions, one that blacklists a hash and the other that
queries as to whether a hash is blacklisted.
(4) Check the TBS hash of an X.509 cert against the blacklist.
(5) Check the PKCS#7 content hash against the blacklist.
(6) Allow a file of blacklisted hashes to be included in the build.
Secondly, the remaining patches allow the UEFI database to be used to load
the system keyrings:
(1) Kernel initialisation is permitted to add keys to the
.secondary_trusted_keys keyring.
(2) A parser is added to parse the contents of the UEFI variables that
contain keys and hashes.
(3) The UEFI db and MokListRT variables are parsed for keys which are
loaded into the secondary keyring.
(4) The UEFI dbx variable is parsed for hashes to be blacklisted.
(5) Use of the UEFI db variable can be suppressed by another UEFI variable.
The patches can be found here also:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-blacklist
and:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-uefi
David
---
Dave Howells (2):
efi: Add EFI signature data types
efi: Add an EFI signature blob parser
David Howells (5):
KEYS: Add a system blacklist keyring
X.509: Allow X.509 certs to be blacklisted
PKCS#7: Handle blacklisted certificates
KEYS: Allow unrestricted boot-time addition of keys to secondary keyring
efi: Add SHIM and image security database GUID definitions
Josh Boyer (2):
MODSIGN: Import certificates from UEFI Secure Boot
MODSIGN: Allow the "db" UEFI variable to be suppressed
certs/Kconfig | 42 +++++++
certs/Makefile | 11 ++
certs/blacklist.c | 174 +++++++++++++++++++++++++++
certs/blacklist.h | 3
certs/blacklist_hashes.c | 6 +
certs/blacklist_nohashes.c | 5 +
certs/efi_parser.c | 112 ++++++++++++++++++
certs/internal.h | 18 +++
certs/load_uefi.c | 192 ++++++++++++++++++++++++++++++
certs/system_keyring.c | 33 +++++
crypto/asymmetric_keys/pkcs7_parser.h | 1
crypto/asymmetric_keys/pkcs7_verify.c | 32 ++++-
crypto/asymmetric_keys/x509_parser.h | 1
crypto/asymmetric_keys/x509_public_key.c | 15 ++
include/keys/system_keyring.h | 12 ++
include/linux/efi.h | 36 ++++++
16 files changed, 685 insertions(+), 8 deletions(-)
create mode 100644 certs/blacklist.c
create mode 100644 certs/blacklist.h
create mode 100644 certs/blacklist_hashes.c
create mode 100644 certs/blacklist_nohashes.c
create mode 100644 certs/efi_parser.c
create mode 100644 certs/internal.h
create mode 100644 certs/load_uefi.c
--
To unsubscribe from this list: send the line "unsubscribe linux-efi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
