Message ID | 20221118040343.2958-1-linux@weissschuh.net |
---|---|
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp766751wrr; Thu, 17 Nov 2022 20:09:50 -0800 (PST) X-Google-Smtp-Source: AA0mqf645DXuLZBcAaaXV/F+sT7rH5WOIIvdoG3ZgNstFmYp/oJxqAqDh/l0edSyJLPhSMUoLUiR X-Received: by 2002:a17:907:382:b0:78d:a30f:3f46 with SMTP id ss2-20020a170907038200b0078da30f3f46mr4298407ejb.681.1668744590342; Thu, 17 Nov 2022 20:09:50 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668744590; cv=none; d=google.com; s=arc-20160816; b=b4GiwjU2HrEy2se6UFdF2YxGwUBo9tx/YxPAhtpICOLSjxal7Wy8FatacXxQw815DC 3WnKEDfcgfOG8BXzH+LydYKT/bc/GEYte0irp2ZX76JwlRD+oQsZ+/glcbarz7hFHR0I 1SfGaX1+HRqcgOT5wWAGjCngWLdC8SfCKER85FAAMIwJTDxGHYOtxunWIGmy1sW4dFIh klI5OoELH8SMInlAAYP/CEouYqS6WG4ePIjy62YBmkPzHqIuYDdfJG15FgOc1q5FcQ0j ALp55o79NOP89xKCqivbEW5kypvNvBgR/xTyxHqjSsHL9ajv8mKeDHMuVuAGVkrVPu5c MdxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:dkim-signature:from; bh=bvxgATRWvWjFI+DgkN/cQgqoLp9w8C1mkOkSTfA8Vu8=; b=NV/Fj1+qoihasCgsICfsMo19ZM0C0FcNqHZXHrmaP24YjAfLZbBngok3DIrlF2yhRo fIEFQTfKM1C7X/h6p8NRqkgelIhxLNsgoIhYj5Lt7io6ILoNp9iJIq6fBs/OqJgpaIzq 1kCuf7+DcA0eJJi+lBZYKABKdR/62hffEOwUfon1aa4o2nylmqlwCfsQB6MUlQzLzDX5 G/WbSXGDNsPwWiTPZTeYO7+9h5kJ1bcpnqyzqFsBuv9XWRxkMViLnYvsrnWXZTgn+N3h 0w+W8p+Fr7iWfSgVyxign4igDgaOgfb4WexJxktC/lih9lhehevYk0PvdLG9WjMCI0kT Bapg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=EgvqcFBy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y8-20020a056402270800b00461f44d7bfcsi2226181edd.573.2022.11.17.20.09.24; Thu, 17 Nov 2022 20:09:50 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=EgvqcFBy; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241107AbiKREFk (ORCPT <rfc822;a1648639935@gmail.com> + 99 others); Thu, 17 Nov 2022 23:05:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240874AbiKREEt (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 17 Nov 2022 23:04:49 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [IPv6:2a01:4f8:c010:41de::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DDE1097AA1 for <linux-kernel@vger.kernel.org>; Thu, 17 Nov 2022 20:04:36 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= <linux@weissschuh.net> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1668744275; bh=fAGK24L9+iydhX7H00KM/0PHDgztpBEk6tzt350ufR8=; h=From:To:Cc:Subject:Date:From; b=EgvqcFByBaYQgQOf+1WfzijlC9DG05S7F8J3ZT/Edz7WiO1FqTSga1Tjz4wD8rRGn RSX5plpFbjBhsplqVCY7DU/OgCRViSPnO+8/JRThIvpWhBIdpOHHePCiS2TzlIUPfY epdVFSgZOqIhjXckrT7LAUDVEyviHdKa0Jhpi/kE= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= <mic@digikod.net>, David Howells <dhowells@redhat.com>, David Woodhouse <dwmw2@infradead.org>, Jarkko Sakkinen <jarkko@kernel.org>, Eric Snowberg <eric.snowberg@oracle.com> Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= <linux@weissschuh.net>, keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson <markpearson@lenovo.com>, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v3 0/3] certs: Prevent spurious errors on repeated blacklisting Date: Fri, 18 Nov 2022 05:03:40 +0100 Message-Id: <20221118040343.2958-1-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Developer-Signature: v=1; a=ed25519-sha256; t=1668744217; l=1889; i=linux@weissschuh.net; s=20211113; h=from:subject; bh=fAGK24L9+iydhX7H00KM/0PHDgztpBEk6tzt350ufR8=; b=3O0IBdZlVc6afEe2yx3amLABDPmdlKOQ0y6Q1NdHBkNU7gqi3rWClo0U7FTRwF/FLxB0ldCATBYB TuAwo1R4B98AXFpXj1OhL9UhDl1AFmBytmhkd6jvpCP119VmKIF+ X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749805527534086927?= X-GMAIL-MSGID: =?utf-8?q?1749805527534086927?= |
Series |
certs: Prevent spurious errors on repeated blacklisting
|
|
Message
Thomas Weißschuh
Nov. 18, 2022, 4:03 a.m. UTC
When the blacklist keyring was changed to allow updates from the root user it gained an ->update() function that disallows all updates. When the a hash is blacklisted multiple times from the builtin or firmware-provided blacklist this spams prominent logs during boot: [ 0.890814] blacklist: Problem blacklisting hash (-13) This affects the firmware of various vendors. Reported have been at least: * Samsung: https://askubuntu.com/questions/1436856/ * Acer: https://ubuntuforums.org/showthread.php?t=2478840 * MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7 * Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860 * Lenovo: https://lore.kernel.org/lkml/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/ Changelog: v1: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/ v1 -> v2: * Improve logging message to include the failed hash * Add key_create() function without update semantics * Use key_create() from mark_raw_hash_blacklisted() and log specific message on -EEXIST v2: https://lore.kernel.org/lkml/20221109025019.1855-1-linux@weissschuh.net/ v2 -> v3: * Clarify commit titles and messages * Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact of some obsolete version of the patch and not needed Only the first patch has been marked for stable as otherwise the whole of key_create() would need to be applied to stable. Thomas Weißschuh (3): certs: log hash value on blacklist error KEYS: Add key_create() certs: don't try to update blacklist keys certs/blacklist.c | 21 ++++--- include/linux/key.h | 8 +++ security/keys/key.c | 149 +++++++++++++++++++++++++++++++++----------- 3 files changed, 132 insertions(+), 46 deletions(-) base-commit: 84368d882b9688bfac77ce48d33b1e20a4e4a787
Comments
Dear Thomas, Am 18.11.22 um 05:03 schrieb Thomas Weißschuh: > [ 0.890814] blacklist: Problem blacklisting hash (-13) After updating the UEFI firmware of the MSI B350M-MORTAR [1] from BIOS 1.MV 06/23/2020 to BIOS 1.O6 07/13/2022 (7A37v1O6 (Beta version)), the same (uninformative) errors were logged by Linux. With your patches, the errors are gone. Tested-by: Paul Menzel <pmenzel@molgen.mpg.de> Kind regards, Paul [1]: https://de.msi.com/Motherboard/B350M-MORTAR/support