Message ID | 20221118040343.2958-2-linux@weissschuh.net |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp767263wrr; Thu, 17 Nov 2022 20:11:54 -0800 (PST) X-Google-Smtp-Source: AA0mqf6Iv6WS7F/Q6npbOinTCNi1Vo9fzraCRJHCRRlmotvnuJII+1Y/k1xtLb4z39yEbNBsik+C X-Received: by 2002:a17:906:8a6d:b0:7ad:d18f:c2d6 with SMTP id hy13-20020a1709068a6d00b007add18fc2d6mr4579794ejc.271.1668744714366; Thu, 17 Nov 2022 20:11:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668744714; cv=none; d=google.com; s=arc-20160816; b=FRWMFdIRHKMDHlTwye34td2lv46zYBm6gh++l42nDSVHV4YvII8Ukfkhw3RWdieV1w rckiRLu3lwREERiyZxoMDjwTBY2EqsQbf6VtQPlSuYlVj2v8cTWTIcbyOgLF+EkwrN6F GAEoNgvBvusbfoM4nazOLquLUl5aefXzodR/LVAtOTTL8e0YmHfAGmCEqtJ6piHpnOyY W+mjen7ToLchzG//ZDxEN1ylHJO3skKSaCMJVE0l+sB7xBJ7gcjVpdwZ1HdJsxF0vIbZ wNnQDJUNjg1YppmpVDfxPp4feu2T8VirgbCEnmqp1zeq21doVGuaEVoW8V0p5dfnIUpG ejHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:dkim-signature :from; bh=6HI/uGGRJj9B1sWInzLCe7m/kL5/v/quC4iAG/wSBQs=; b=czu+KrSF8VsZo9pWiKM8p721/AD7NjeVMWyOR7/Gkk2wUh5bJQXgcpTqAl5dJLIRi2 dTSi/R/Sloga+R5PLLByjYxE1hg803WnVOdLGoh6G3ZTOwhTTcIxgXXfWMjdC7fhlgqX 7EafvLX9PMME8Y4+LnzH4c0s0J58Qo+aZ17ZY468h1aujoIHZoi/ZkL2znjsXRx2ZPEL fIPOj+ufmiL97WR88OJVsp0ppoLEKMYdRSX4zLh7n4C2tJw1hWN+GF+FVYjt0mFD41ML tJAKkxgIB1U0e9wp+YoFjRdrSbhpQspL7kvT2ttnXOM0YSUpCqQy5Vp3pbCEVT4qJxWq BONg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=LGhsJnfL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id g40-20020a056402322800b004591f959c3bsi2112655eda.427.2022.11.17.20.11.29; Thu, 17 Nov 2022 20:11:54 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=LGhsJnfL; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241021AbiKREFo (ORCPT <rfc822;a1648639935@gmail.com> + 99 others); Thu, 17 Nov 2022 23:05:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241081AbiKREEt (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 17 Nov 2022 23:04:49 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [IPv6:2a01:4f8:c010:41de::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DBAFD326F5 for <linux-kernel@vger.kernel.org>; Thu, 17 Nov 2022 20:04:37 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= <linux@weissschuh.net> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1668744275; bh=P/SxYrzIDdEyGtP2C7/8aV4gnstE9Djts92CSEamDqg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LGhsJnfLe8kJSopHA7/MaHb4q5Q8CqAWSKTSOkQQE9L/WlUY2AaPzncPaEJsdc/0G LFynYr1APxAyOrYQxvJKeqg2Y9dciSqUq15c0yGo/QEk28P2VXX/EJxngwSMBATS+0 +jmug/2mV1tZC4mAKwoRLS8YuZjCDrRRQm9VSezo= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= <mic@digikod.net>, David Howells <dhowells@redhat.com>, David Woodhouse <dwmw2@infradead.org>, Jarkko Sakkinen <jarkko@kernel.org>, Eric Snowberg <eric.snowberg@oracle.com> Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= <linux@weissschuh.net>, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson <markpearson@lenovo.com>, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v3 1/3] certs: log hash value on blacklist error Date: Fri, 18 Nov 2022 05:03:41 +0100 Message-Id: <20221118040343.2958-2-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221118040343.2958-1-linux@weissschuh.net> References: <20221118040343.2958-1-linux@weissschuh.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Developer-Signature: v=1; a=ed25519-sha256; t=1668744217; l=1006; i=linux@weissschuh.net; s=20211113; h=from:subject; bh=P/SxYrzIDdEyGtP2C7/8aV4gnstE9Djts92CSEamDqg=; b=wAaNSCu5g8hAafN2wCdcLQkehdyg+hECJ2kV43YgMZiDa+w0E7D8Jpy4P/iIuBZvrEBflMpL7Y9L ZSI0/RSAB4PmKBJpq/2dgHHR9Ia9MwKDzHfd9EUajCiWN6brQCAG X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749805657556659620?= X-GMAIL-MSGID: =?utf-8?q?1749805657556659620?= |
Series |
certs: Prevent spurious errors on repeated blacklisting
|
|
Commit Message
Thomas Weißschuh
Nov. 18, 2022, 4:03 a.m. UTC
Without this information these logs are not actionable.
For example on duplicate blacklisted hashes reported by the system
firmware users should be able to report the erroneous hashes to their
system vendors.
While we are at it use the dedicated format string for ERR_PTR.
Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring")
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
---
certs/blacklist.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
"Make blacklisted hash available in klog" On Fri, Nov 18, 2022 at 05:03:41AM +0100, Thomas Weißschuh wrote: > Without this information these logs are not actionable. Without blacklisted hash? > For example on duplicate blacklisted hashes reported by the system > firmware users should be able to report the erroneous hashes to their > system vendors. > > While we are at it use the dedicated format string for ERR_PTR. Lacks the beef so saying "while we are at it" makes no sense. > Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring") Why does this count as a bug? > Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> > --- > certs/blacklist.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/certs/blacklist.c b/certs/blacklist.c > index 41f10601cc72..6e260c4b6a19 100644 > --- a/certs/blacklist.c > +++ b/certs/blacklist.c > @@ -192,7 +192,7 @@ static int mark_raw_hash_blacklisted(const char *hash) > KEY_ALLOC_NOT_IN_QUOTA | > KEY_ALLOC_BUILT_IN); > if (IS_ERR(key)) { > - pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); > + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); > return PTR_ERR(key); > } > return 0; > -- > 2.38.1 > BR, Jarkko
On 2022-11-28 03:11+0200, Jarkko Sakkinen wrote: > "Make blacklisted hash available in klog" > > On Fri, Nov 18, 2022 at 05:03:41AM +0100, Thomas Weißschuh wrote: > > Without this information these logs are not actionable. > > Without blacklisted hash? > > > For example on duplicate blacklisted hashes reported by the system > > firmware users should be able to report the erroneous hashes to their > > system vendors. > > > > While we are at it use the dedicated format string for ERR_PTR. > > Lacks the beef so saying "while we are at it" makes no sense. What about this: [PATCH] certs: make blacklisted hash available in klog One common situation triggering this log statement are duplicate hashes reported by the system firmware. These duplicates should be removed from the firmware. Without logging the blacklisted hash triggering the issue however the users can not report it properly to the firmware vendors and the firmware vendors can not easily see which specific hash is duplicated. While changing the log message also use the dedicated ERR_PTR format placeholder for the returned error value. > > Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring") > > Why does this count as a bug? These error logs are confusing to users, prompting them to waste time investigating them and even mess with their firmware settings. (As indicated in the threads linked from the cover letter) The most correct fix would be patches 2 and 3 from this series. I was not sure if patch 2 would be acceptable for stable as it introduces new infrastructure code. So patch 1 enables users to report the issue to their firmware vendors and get the spurious logs resolved that way. If these assumptions are incorrect I can fold patch 1 into patch 3. But are patch 2 and 3 material for stable? > > Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> > > --- > > certs/blacklist.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/certs/blacklist.c b/certs/blacklist.c > > index 41f10601cc72..6e260c4b6a19 100644 > > --- a/certs/blacklist.c > > +++ b/certs/blacklist.c > > @@ -192,7 +192,7 @@ static int mark_raw_hash_blacklisted(const char *hash) > > KEY_ALLOC_NOT_IN_QUOTA | > > KEY_ALLOC_BUILT_IN); > > if (IS_ERR(key)) { > > - pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); > > + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); > > return PTR_ERR(key); > > } > > return 0; > > -- > > 2.38.1 > > > > BR, Jarkko
On Mon, Nov 28, 2022 at 02:59:20AM +0100, Thomas Weißschuh wrote: > On 2022-11-28 03:11+0200, Jarkko Sakkinen wrote: > > "Make blacklisted hash available in klog" > > > > On Fri, Nov 18, 2022 at 05:03:41AM +0100, Thomas Weißschuh wrote: > > > Without this information these logs are not actionable. > > > > Without blacklisted hash? > > > > > For example on duplicate blacklisted hashes reported by the system > > > firmware users should be able to report the erroneous hashes to their > > > system vendors. > > > > > > While we are at it use the dedicated format string for ERR_PTR. > > > > Lacks the beef so saying "while we are at it" makes no sense. > > What about this: > > [PATCH] certs: make blacklisted hash available in klog > > One common situation triggering this log statement are duplicate hashes > reported by the system firmware. > > These duplicates should be removed from the firmware. > > Without logging the blacklisted hash triggering the issue however the users > can not report it properly to the firmware vendors and the firmware vendors > can not easily see which specific hash is duplicated. > > While changing the log message also use the dedicated ERR_PTR format > placeholder for the returned error value. Looks looks a lot better thank you! > > > Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring") > > > > Why does this count as a bug? > > These error logs are confusing to users, prompting them to waste time > investigating them and even mess with their firmware settings. > (As indicated in the threads linked from the cover letter) > > The most correct fix would be patches 2 and 3 from this series. > > I was not sure if patch 2 would be acceptable for stable as it introduces new > infrastructure code. > So patch 1 enables users to report the issue to their firmware vendors and get > the spurious logs resolved that way. > > If these assumptions are incorrect I can fold patch 1 into patch 3. > > But are patch 2 and 3 material for stable? I cannot say anything conclusive to this before seeing updated version of the patch set. BR, Jarkko
diff --git a/certs/blacklist.c b/certs/blacklist.c index 41f10601cc72..6e260c4b6a19 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -192,7 +192,7 @@ static int mark_raw_hash_blacklisted(const char *hash) KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_BUILT_IN); if (IS_ERR(key)) { - pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); return PTR_ERR(key); } return 0;