On Friday 18 December 2015 00:02:09 David Howells wrote:
> The format of ASN.1 GeneralizedTime seems to be specified by ISO 8601
> [X.680 46.3] and this apparently supports leap seconds (ie. the seconds
> field is 60).  It's not entirely clear that ASN.1 expects it, but we can
> relax the seconds check slightly for GeneralizedTime.
> This, however, results in us passing a time with sec as 60 to mktime64()
> which, unpatched, doesn't really handle such things.  What it will do is
> equate the 60th second of a minute to the 0th second of the next minute.
> We can't really do otherwise without giving the kernel much greater
> knowledge of where all the leap seconds are.  Unfortunately, this would
> require change the mapping of the kernel's current-time-in-seconds.
> UTCTime, however, only supports a seconds value in the range 00-59.
> Without this patch, certain X.509 certificates will be rejected,
> potentially making a kernel unbootable.
> Reported-by: Rudolf Polzer <rpol...@google.com>
> Signed-off-by: David Howells <dhowe...@redhat.com>
> cc: David Woodhouse <david.woodho...@intel.com>
> cc: John Stultz <john.stu...@linaro.org>
> cc: Arnd Bergmann <a...@arndb.de>
> cc: sta...@vger.kernel.org

Acked-by: Arnd Bergmann <a...@arndb.de>
To unsubscribe from this list: send the line "unsubscribe 
linux-security-module" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to