Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-12 Thread Eric Snowberg
> On Sep 12, 2023, at 4:47 PM, Mimi Zohar wrote: > > On Tue, 2023-09-12 at 17:11 +, Eric Snowberg wrote: >> >>> On Sep 12, 2023, at 5:54 AM, Mimi Zohar wrote: >>> >>> On Tue, 2023-09-12 at 02:00 +, Eric Snowberg wrote: > On Sep 11, 2023, at 5:08 PM, Mimi Zohar wrote:

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-12 Thread Mimi Zohar
On Tue, 2023-09-12 at 17:11 +, Eric Snowberg wrote: > > > On Sep 12, 2023, at 5:54 AM, Mimi Zohar wrote: > > > > On Tue, 2023-09-12 at 02:00 +, Eric Snowberg wrote: > >> > >>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar wrote: > >>> > >>> On Mon, 2023-09-11 at 22:17 +, Eric Snowberg

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-12 Thread Eric Snowberg
> On Sep 12, 2023, at 5:54 AM, Mimi Zohar wrote: > > On Tue, 2023-09-12 at 02:00 +, Eric Snowberg wrote: >> >>> On Sep 11, 2023, at 5:08 PM, Mimi Zohar wrote: >>> >>> On Mon, 2023-09-11 at 22:17 +, Eric Snowberg wrote: > On Sep 11, 2023, at 10:51 AM, Mickaël Salaün wrote:

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-12 Thread Mimi Zohar
On Tue, 2023-09-12 at 02:00 +, Eric Snowberg wrote: > > > On Sep 11, 2023, at 5:08 PM, Mimi Zohar wrote: > > > > On Mon, 2023-09-11 at 22:17 +, Eric Snowberg wrote: > >> > >>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün wrote: > >>> > >>> On Mon, Sep 11, 2023 at 09:29:07AM -0400,

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Jarkko Sakkinen
On Sat Sep 9, 2023 at 12:34 AM EEST, Eric Snowberg wrote: > Currently root can dynamically update the blacklist keyring if the hash > being added is signed and vouched for by the builtin trusted keyring. > Currently keys in the secondary trusted keyring can not be used. > > Keys within the

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Jarkko Sakkinen
On Mon Sep 11, 2023 at 4:29 PM EEST, Mimi Zohar wrote: > Hi Eric, > > On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: > > Currently root can dynamically update the blacklist keyring if the hash > > being added is signed and vouched for by the builtin trusted keyring. > > Currently keys in

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Eric Snowberg
> On Sep 11, 2023, at 5:08 PM, Mimi Zohar wrote: > > On Mon, 2023-09-11 at 22:17 +, Eric Snowberg wrote: >> >>> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün wrote: >>> >>> On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote: Hi Eric, On Fri, 2023-09-08 at 17:34

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Mimi Zohar
On Mon, 2023-09-11 at 22:17 +, Eric Snowberg wrote: > > > On Sep 11, 2023, at 10:51 AM, Mickaël Salaün wrote: > > > > On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote: > >> Hi Eric, > >> > >> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: > >>> Currently root can

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Eric Snowberg
> On Sep 11, 2023, at 4:04 PM, Jarkko Sakkinen wrote: > > On Mon Sep 11, 2023 at 4:29 PM EEST, Mimi Zohar wrote: >> Hi Eric, >> >> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: >>> Currently root can dynamically update the blacklist keyring if the hash >>> being added is signed and

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Eric Snowberg
> On Sep 11, 2023, at 10:51 AM, Mickaël Salaün wrote: > > On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote: >> Hi Eric, >> >> On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: >>> Currently root can dynamically update the blacklist keyring if the hash >>> being added is signed

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Mimi Zohar
Hi Eric, On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: > Currently root can dynamically update the blacklist keyring if the hash > being added is signed and vouched for by the builtin trusted keyring. > Currently keys in the secondary trusted keyring can not be used. > > Keys within

Re: [PATCH] certs: Restrict blacklist updates to the secondary trusted keyring

2023-09-11 Thread Mickaël Salaün
On Mon, Sep 11, 2023 at 09:29:07AM -0400, Mimi Zohar wrote: > Hi Eric, > > On Fri, 2023-09-08 at 17:34 -0400, Eric Snowberg wrote: > > Currently root can dynamically update the blacklist keyring if the hash > > being added is signed and vouched for by the builtin trusted keyring. > > Currently