Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
Hi Mimi, On Mon, Mar 19, 2018 at 10:12:03AM -0400, Mimi Zohar wrote: > On Sun, 2018-03-11 at 11:20 +0800, joeyli wrote: > > On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > > > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > > > what's the status of this please? Distributors (I checked SUSE, > > > > > RedHat and Ubuntu) have to carry these patches and every of them > > > > > have to forward-port the patches to new kernels. So are you going > > > > > to resend the PR to have this merged? > > > [...] > > > > Just because I trust the platform keys prior to booting the kernel, > > > > doesn't mean that I *want* to trust those keys once booted. There > > > > are, however, places where we need access to those keys to verify a > > > > signature (eg. kexec kernel image). > > > > > > Which is essentially the reason I always give when these patches come > > > back > > > > > > > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" > > patch checks MokIgnoreDB variable to ignore db: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a > > > > I think that we can consider to use MokAllowDB. Which means that kernel > > ignores DB by default. > > Not all systems have a shim layer. This design is really x86 > specific. Allowing shim keys, but ignoring DB, does not address those > systems. > Actually shim is EFI specific but not x86 specific. I agree with you that not all system has shim. But at least shim provides a way to interact with user to detect the physical accessing. For the system doesn't have shim, kernel can provide a boot option for user to trust the keys in DB. But it also means that the boot option can be enabled without physical accessing. > > > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > > > introduces a new, separate keyring for these platform keys. > > > > > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > > > the distros want these keys to be trusted. Apart from the Microsoft > > > key, it will also give you an OEM key in your trusted keyring. Is it > > > something to do with OEM supplied modules? > > > > > > > As I remember that some manufacturers uses certificate in db to > > sign their kernel module. We need to discuss with them for switching > > to mok. Currently I do not know all use cases for using db. > > > > There have some benefits for using db: > > > > - User does not need to deal with shim-mokmanager to enroll mok. > >Target machine doesn't need to reboot and user doesn't need to > >face to mokmanager UI. > > The reason for trusting enrolled shim keys is because it requires > physical presence. (I kind of remember hearing that this changed. > There is some method of accepting enrolled keys that does not require > physical presence.) > Could you please provide more detail for those methods? Thanks! > > - The db is a authenticated variable, it's still secure when secure > >boot is disabled. > >The db is a authenticated variable that it can only be modified > >by manufacturer's key. Kernel can trust it when secure boot > >is disabled. It's useful for we do not need to taint kernel > >for loading a manufacturer's kernel module even secure boot is > >disabled. > > > > - Do not need to worry about the space of NVRAM and the EFI firmware > >implementation for writing a boot time variable. > > > > But I also agree that we should not trust all keys (like Microsoft key) > > in db by default. > > Between requiring a shim layer and relying on physical presence, I'm > not convinced this is the best solution. Do we really want to support > different methods for different architectures? > It's not the best solution because it relies on other layers. But it's currently the only solution for general EFI firmware. Or you have other solution can be used for all architectures? Thanks a lot! Joey Lee
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
Hi Mimi, On Mon, Mar 19, 2018 at 10:12:03AM -0400, Mimi Zohar wrote: > On Sun, 2018-03-11 at 11:20 +0800, joeyli wrote: > > On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > > > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > > > what's the status of this please? Distributors (I checked SUSE, > > > > > RedHat and Ubuntu) have to carry these patches and every of them > > > > > have to forward-port the patches to new kernels. So are you going > > > > > to resend the PR to have this merged? > > > [...] > > > > Just because I trust the platform keys prior to booting the kernel, > > > > doesn't mean that I *want* to trust those keys once booted. There > > > > are, however, places where we need access to those keys to verify a > > > > signature (eg. kexec kernel image). > > > > > > Which is essentially the reason I always give when these patches come > > > back > > > > > > > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" > > patch checks MokIgnoreDB variable to ignore db: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a > > > > I think that we can consider to use MokAllowDB. Which means that kernel > > ignores DB by default. > > Not all systems have a shim layer. This design is really x86 > specific. Allowing shim keys, but ignoring DB, does not address those > systems. > Actually shim is EFI specific but not x86 specific. I agree with you that not all system has shim. But at least shim provides a way to interact with user to detect the physical accessing. For the system doesn't have shim, kernel can provide a boot option for user to trust the keys in DB. But it also means that the boot option can be enabled without physical accessing. > > > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > > > introduces a new, separate keyring for these platform keys. > > > > > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > > > the distros want these keys to be trusted. Apart from the Microsoft > > > key, it will also give you an OEM key in your trusted keyring. Is it > > > something to do with OEM supplied modules? > > > > > > > As I remember that some manufacturers uses certificate in db to > > sign their kernel module. We need to discuss with them for switching > > to mok. Currently I do not know all use cases for using db. > > > > There have some benefits for using db: > > > > - User does not need to deal with shim-mokmanager to enroll mok. > >Target machine doesn't need to reboot and user doesn't need to > >face to mokmanager UI. > > The reason for trusting enrolled shim keys is because it requires > physical presence. (I kind of remember hearing that this changed. > There is some method of accepting enrolled keys that does not require > physical presence.) > Could you please provide more detail for those methods? Thanks! > > - The db is a authenticated variable, it's still secure when secure > >boot is disabled. > >The db is a authenticated variable that it can only be modified > >by manufacturer's key. Kernel can trust it when secure boot > >is disabled. It's useful for we do not need to taint kernel > >for loading a manufacturer's kernel module even secure boot is > >disabled. > > > > - Do not need to worry about the space of NVRAM and the EFI firmware > >implementation for writing a boot time variable. > > > > But I also agree that we should not trust all keys (like Microsoft key) > > in db by default. > > Between requiring a shim layer and relying on physical presence, I'm > not convinced this is the best solution. Do we really want to support > different methods for different architectures? > It's not the best solution because it relies on other layers. But it's currently the only solution for general EFI firmware. Or you have other solution can be used for all architectures? Thanks a lot! Joey Lee
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Sun, 2018-03-11 at 11:20 +0800, joeyli wrote: > On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > > what's the status of this please? Distributors (I checked SUSE, > > > > RedHat and Ubuntu) have to carry these patches and every of them > > > > have to forward-port the patches to new kernels. So are you going > > > > to resend the PR to have this merged? > > [...] > > > Just because I trust the platform keys prior to booting the kernel, > > > doesn't mean that I *want* to trust those keys once booted. There > > > are, however, places where we need access to those keys to verify a > > > signature (eg. kexec kernel image). > > > > Which is essentially the reason I always give when these patches come > > back > > > > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" > patch checks MokIgnoreDB variable to ignore db: > > https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a > > I think that we can consider to use MokAllowDB. Which means that kernel > ignores DB by default. Not all systems have a shim layer. This design is really x86 specific. Allowing shim keys, but ignoring DB, does not address those systems. > > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > > introduces a new, separate keyring for these platform keys. > > > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > > the distros want these keys to be trusted. Apart from the Microsoft > > key, it will also give you an OEM key in your trusted keyring. Is it > > something to do with OEM supplied modules? > > > > As I remember that some manufacturers uses certificate in db to > sign their kernel module. We need to discuss with them for switching > to mok. Currently I do not know all use cases for using db. > > There have some benefits for using db: > > - User does not need to deal with shim-mokmanager to enroll mok. >Target machine doesn't need to reboot and user doesn't need to >face to mokmanager UI. The reason for trusting enrolled shim keys is because it requires physical presence. (I kind of remember hearing that this changed. There is some method of accepting enrolled keys that does not require physical presence.) > - The db is a authenticated variable, it's still secure when secure >boot is disabled. >The db is a authenticated variable that it can only be modified >by manufacturer's key. Kernel can trust it when secure boot >is disabled. It's useful for we do not need to taint kernel >for loading a manufacturer's kernel module even secure boot is >disabled. > > - Do not need to worry about the space of NVRAM and the EFI firmware >implementation for writing a boot time variable. > > But I also agree that we should not trust all keys (like Microsoft key) > in db by default. Between requiring a shim layer and relying on physical presence, I'm not convinced this is the best solution. Do we really want to support different methods for different architectures? Mimi
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Sun, 2018-03-11 at 11:20 +0800, joeyli wrote: > On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > > what's the status of this please? Distributors (I checked SUSE, > > > > RedHat and Ubuntu) have to carry these patches and every of them > > > > have to forward-port the patches to new kernels. So are you going > > > > to resend the PR to have this merged? > > [...] > > > Just because I trust the platform keys prior to booting the kernel, > > > doesn't mean that I *want* to trust those keys once booted. There > > > are, however, places where we need access to those keys to verify a > > > signature (eg. kexec kernel image). > > > > Which is essentially the reason I always give when these patches come > > back > > > > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" > patch checks MokIgnoreDB variable to ignore db: > > https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a > > I think that we can consider to use MokAllowDB. Which means that kernel > ignores DB by default. Not all systems have a shim layer. This design is really x86 specific. Allowing shim keys, but ignoring DB, does not address those systems. > > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > > introduces a new, separate keyring for these platform keys. > > > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > > the distros want these keys to be trusted. Apart from the Microsoft > > key, it will also give you an OEM key in your trusted keyring. Is it > > something to do with OEM supplied modules? > > > > As I remember that some manufacturers uses certificate in db to > sign their kernel module. We need to discuss with them for switching > to mok. Currently I do not know all use cases for using db. > > There have some benefits for using db: > > - User does not need to deal with shim-mokmanager to enroll mok. >Target machine doesn't need to reboot and user doesn't need to >face to mokmanager UI. The reason for trusting enrolled shim keys is because it requires physical presence. (I kind of remember hearing that this changed. There is some method of accepting enrolled keys that does not require physical presence.) > - The db is a authenticated variable, it's still secure when secure >boot is disabled. >The db is a authenticated variable that it can only be modified >by manufacturer's key. Kernel can trust it when secure boot >is disabled. It's useful for we do not need to taint kernel >for loading a manufacturer's kernel module even secure boot is >disabled. > > - Do not need to worry about the space of NVRAM and the EFI firmware >implementation for writing a boot time variable. > > But I also agree that we should not trust all keys (like Microsoft key) > in db by default. Between requiring a shim layer and relying on physical presence, I'm not convinced this is the best solution. Do we really want to support different methods for different architectures? Mimi
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > what's the status of this please? Distributors (I checked SUSE, > > > RedHat and Ubuntu) have to carry these patches and every of them > > > have to forward-port the patches to new kernels. So are you going > > > to resend the PR to have this merged? > [...] > > Just because I trust the platform keys prior to booting the kernel, > > doesn't mean that I *want* to trust those keys once booted. There > > are, however, places where we need access to those keys to verify a > > signature (eg. kexec kernel image). > > Which is essentially the reason I always give when these patches come > back > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" patch checks MokIgnoreDB variable to ignore db: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a I think that we can consider to use MokAllowDB. Which means that kernel ignores DB by default. > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > introduces a new, separate keyring for these platform keys. > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > the distros want these keys to be trusted. Apart from the Microsoft > key, it will also give you an OEM key in your trusted keyring. Is it > something to do with OEM supplied modules? > As I remember that some manufacturers uses certificate in db to sign their kernel module. We need to discuss with them for switching to mok. Currently I do not know all use cases for using db. There have some benefits for using db: - User does not need to deal with shim-mokmanager to enroll mok. Target machine doesn't need to reboot and user doesn't need to face to mokmanager UI. - The db is a authenticated variable, it's still secure when secure boot is disabled. The db is a authenticated variable that it can only be modified by manufacturer's key. Kernel can trust it when secure boot is disabled. It's useful for we do not need to taint kernel for loading a manufacturer's kernel module even secure boot is disabled. - Do not need to worry about the space of NVRAM and the EFI firmware implementation for writing a boot time variable. But I also agree that we should not trust all keys (like Microsoft key) in db by default. Thanks a lot! Joey Lee
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Wed, Mar 07, 2018 at 07:28:37AM -0800, James Bottomley wrote: > On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > > what's the status of this please? Distributors (I checked SUSE, > > > RedHat and Ubuntu) have to carry these patches and every of them > > > have to forward-port the patches to new kernels. So are you going > > > to resend the PR to have this merged? > [...] > > Just because I trust the platform keys prior to booting the kernel, > > doesn't mean that I *want* to trust those keys once booted. There > > are, however, places where we need access to those keys to verify a > > signature (eg. kexec kernel image). > > Which is essentially the reason I always give when these patches come > back > Josh Boyer's "MODSIGN: Allow the "db" UEFI variable to be suppressed" patch checks MokIgnoreDB variable to ignore db: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/commit/?h=keys-uefi=7c395b30a33a617c5cc2cdd419300af71277b79a I think that we can consider to use MokAllowDB. Which means that kernel ignores DB by default. > > Nayna Jain's "certs: define a trusted platform keyring" patch set > > introduces a new, separate keyring for these platform keys. > > Perhaps, to break the deadlock, we should ask Jiří what the reason is > the distros want these keys to be trusted. Apart from the Microsoft > key, it will also give you an OEM key in your trusted keyring. Is it > something to do with OEM supplied modules? > As I remember that some manufacturers uses certificate in db to sign their kernel module. We need to discuss with them for switching to mok. Currently I do not know all use cases for using db. There have some benefits for using db: - User does not need to deal with shim-mokmanager to enroll mok. Target machine doesn't need to reboot and user doesn't need to face to mokmanager UI. - The db is a authenticated variable, it's still secure when secure boot is disabled. The db is a authenticated variable that it can only be modified by manufacturer's key. Kernel can trust it when secure boot is disabled. It's useful for we do not need to taint kernel for loading a manufacturer's kernel module even secure boot is disabled. - Do not need to worry about the space of NVRAM and the EFI firmware implementation for writing a boot time variable. But I also agree that we should not trust all keys (like Microsoft key) in db by default. Thanks a lot! Joey Lee
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > what's the status of this please? Distributors (I checked SUSE, > > RedHat and Ubuntu) have to carry these patches and every of them > > have to forward-port the patches to new kernels. So are you going > > to resend the PR to have this merged? [...] > Just because I trust the platform keys prior to booting the kernel, > doesn't mean that I *want* to trust those keys once booted. There > are, however, places where we need access to those keys to verify a > signature (eg. kexec kernel image). Which is essentially the reason I always give when these patches come back > Nayna Jain's "certs: define a trusted platform keyring" patch set > introduces a new, separate keyring for these platform keys. Perhaps, to break the deadlock, we should ask Jiří what the reason is the distros want these keys to be trusted. Apart from the Microsoft key, it will also give you an OEM key in your trusted keyring. Is it something to do with OEM supplied modules? James
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Wed, 2018-03-07 at 08:18 -0500, Mimi Zohar wrote: > On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > > what's the status of this please? Distributors (I checked SUSE, > > RedHat and Ubuntu) have to carry these patches and every of them > > have to forward-port the patches to new kernels. So are you going > > to resend the PR to have this merged? [...] > Just because I trust the platform keys prior to booting the kernel, > doesn't mean that I *want* to trust those keys once booted. There > are, however, places where we need access to those keys to verify a > signature (eg. kexec kernel image). Which is essentially the reason I always give when these patches come back > Nayna Jain's "certs: define a trusted platform keyring" patch set > introduces a new, separate keyring for these platform keys. Perhaps, to break the deadlock, we should ask Jiří what the reason is the distros want these keys to be trusted. Apart from the Microsoft key, it will also give you an OEM key in your trusted keyring. Is it something to do with OEM supplied modules? James
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > On 11/16/2016, 07:10 PM, David Howells wrote: > > Here are two sets of patches. Firstly, the first three patches provide a > > blacklist, making the following changes: > ... > > Secondly, the remaining patches allow the UEFI database to be used to load > > the system keyrings: > ... > > Dave Howells (2): > > efi: Add EFI signature data types > > efi: Add an EFI signature blob parser > > > > David Howells (5): > > KEYS: Add a system blacklist keyring > > X.509: Allow X.509 certs to be blacklisted > > PKCS#7: Handle blacklisted certificates > > KEYS: Allow unrestricted boot-time addition of keys to secondary > > keyring > > efi: Add SHIM and image security database GUID definitions > > > > Josh Boyer (2): > > MODSIGN: Import certificates from UEFI Secure Boot > > MODSIGN: Allow the "db" UEFI variable to be suppressed > > Hi, > > what's the status of this please? Distributors (I checked SUSE, RedHat > and Ubuntu) have to carry these patches and every of them have to > forward-port the patches to new kernels. So are you going to resend the > PR to have this merged? With secure boot enabled, we establish a signature chain of trust, rooted in HW, up to the kernel and then transition from those keys to a new set of keys builtin the kernel and loaded onto the builtin_trusted_keys (builtin). Enabling the secondary_builtin_keys (secondary) allows keys signed by a key on the builtin keyring to be added to the secondary keyring. Any key, signed by a key on either the builtin or secondary keyring, can be added to the IMA trusted keyring. The "KEYS: Allow unrestricted boot-time addition of keys to secondary keyring" patch loads the platform keys directly onto the secondary keyring, without requiring them to be signed by a key on the builtin or secondary keyring. With this change, any key signed by a platfrom key on the secondary, can be loaded onto the .ima trusted keyring. Just because I trust the platform keys prior to booting the kernel, doesn't mean that I *want* to trust those keys once booted. There are, however, places where we need access to those keys to verify a signature (eg. kexec kernel image). Nayna Jain's "certs: define a trusted platform keyring" patch set introduces a new, separate keyring for these platform keys. Mimi
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On Tue, 2018-03-06 at 15:05 +0100, Jiri Slaby wrote: > On 11/16/2016, 07:10 PM, David Howells wrote: > > Here are two sets of patches. Firstly, the first three patches provide a > > blacklist, making the following changes: > ... > > Secondly, the remaining patches allow the UEFI database to be used to load > > the system keyrings: > ... > > Dave Howells (2): > > efi: Add EFI signature data types > > efi: Add an EFI signature blob parser > > > > David Howells (5): > > KEYS: Add a system blacklist keyring > > X.509: Allow X.509 certs to be blacklisted > > PKCS#7: Handle blacklisted certificates > > KEYS: Allow unrestricted boot-time addition of keys to secondary > > keyring > > efi: Add SHIM and image security database GUID definitions > > > > Josh Boyer (2): > > MODSIGN: Import certificates from UEFI Secure Boot > > MODSIGN: Allow the "db" UEFI variable to be suppressed > > Hi, > > what's the status of this please? Distributors (I checked SUSE, RedHat > and Ubuntu) have to carry these patches and every of them have to > forward-port the patches to new kernels. So are you going to resend the > PR to have this merged? With secure boot enabled, we establish a signature chain of trust, rooted in HW, up to the kernel and then transition from those keys to a new set of keys builtin the kernel and loaded onto the builtin_trusted_keys (builtin). Enabling the secondary_builtin_keys (secondary) allows keys signed by a key on the builtin keyring to be added to the secondary keyring. Any key, signed by a key on either the builtin or secondary keyring, can be added to the IMA trusted keyring. The "KEYS: Allow unrestricted boot-time addition of keys to secondary keyring" patch loads the platform keys directly onto the secondary keyring, without requiring them to be signed by a key on the builtin or secondary keyring. With this change, any key signed by a platfrom key on the secondary, can be loaded onto the .ima trusted keyring. Just because I trust the platform keys prior to booting the kernel, doesn't mean that I *want* to trust those keys once booted. There are, however, places where we need access to those keys to verify a signature (eg. kexec kernel image). Nayna Jain's "certs: define a trusted platform keyring" patch set introduces a new, separate keyring for these platform keys. Mimi
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On 11/16/2016, 07:10 PM, David Howells wrote: > Here are two sets of patches. Firstly, the first three patches provide a > blacklist, making the following changes: ... > Secondly, the remaining patches allow the UEFI database to be used to load > the system keyrings: ... > Dave Howells (2): > efi: Add EFI signature data types > efi: Add an EFI signature blob parser > > David Howells (5): > KEYS: Add a system blacklist keyring > X.509: Allow X.509 certs to be blacklisted > PKCS#7: Handle blacklisted certificates > KEYS: Allow unrestricted boot-time addition of keys to secondary keyring > efi: Add SHIM and image security database GUID definitions > > Josh Boyer (2): > MODSIGN: Import certificates from UEFI Secure Boot > MODSIGN: Allow the "db" UEFI variable to be suppressed Hi, what's the status of this please? Distributors (I checked SUSE, RedHat and Ubuntu) have to carry these patches and every of them have to forward-port the patches to new kernels. So are you going to resend the PR to have this merged? thanks, -- js suse labs
Re: [PATCH 0/9] KEYS: Blacklisting & UEFI database load
On 11/16/2016, 07:10 PM, David Howells wrote: > Here are two sets of patches. Firstly, the first three patches provide a > blacklist, making the following changes: ... > Secondly, the remaining patches allow the UEFI database to be used to load > the system keyrings: ... > Dave Howells (2): > efi: Add EFI signature data types > efi: Add an EFI signature blob parser > > David Howells (5): > KEYS: Add a system blacklist keyring > X.509: Allow X.509 certs to be blacklisted > PKCS#7: Handle blacklisted certificates > KEYS: Allow unrestricted boot-time addition of keys to secondary keyring > efi: Add SHIM and image security database GUID definitions > > Josh Boyer (2): > MODSIGN: Import certificates from UEFI Secure Boot > MODSIGN: Allow the "db" UEFI variable to be suppressed Hi, what's the status of this please? Distributors (I checked SUSE, RedHat and Ubuntu) have to carry these patches and every of them have to forward-port the patches to new kernels. So are you going to resend the PR to have this merged? thanks, -- js suse labs
