Re: [PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-13 Thread James Bottomley
On Wed, 2021-01-13 at 13:40 +, David Howells wrote: > Hi Linus, > > Are you willing to take this between merge windows - or does it need > to wait for the next merge window? It's not technically a bug fix to > the kernel, but it does have a CVE attached to it. > > Note that I've also updated

Re: [PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-13 Thread David Howells
David Howells wrote: > This fixes CVE-2020-26541. Note that I added the CVE number, not Eric. David

[PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries

2021-01-13 Thread David Howells
Hi Linus, Are you willing to take this between merge windows - or does it need to wait for the next merge window? It's not technically a bug fix to the kernel, but it does have a CVE attached to it. Note that I've also updated Jarkko's address in his Reviewed-by since his Intel address no longer

Re: [RFC PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries]

2020-09-04 Thread Eric Snowberg
> On Sep 4, 2020, at 6:59 AM, Jarkko Sakkinen > wrote: > > On Tue, Sep 01, 2020 at 12:51:43PM -0400, Eric Snowberg wrote: >> The Secure Boot Forbidden Signature Database, dbx, contains a list of now >> revoked signatures and keys previously approved to boot with UEFI Secure >> Boot enabled. T

Re: [RFC PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries]

2020-09-04 Thread Jarkko Sakkinen
On Tue, Sep 01, 2020 at 12:51:43PM -0400, Eric Snowberg wrote: > The Secure Boot Forbidden Signature Database, dbx, contains a list of now > revoked signatures and keys previously approved to boot with UEFI Secure > Boot enabled. The dbx is capable of containing any number of > EFI_CERT_X509_SHA25

[RFC PATCH] certs: Add EFI_CERT_X509_GUID support for dbx entries

2020-09-01 Thread Eric Snowberg
The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currentl