From patchwork Wed Nov 9 02:50:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Patchwork-Id: 17322 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp103354wru; Tue, 8 Nov 2022 18:54:43 -0800 (PST) X-Google-Smtp-Source: AA0mqf6EIXulsNOZK2bC7GZ+MQ23L0nqqqPYQFelfdN3ZuszyCPBsatHEA8p5H8hjfvB7yhjaQ4u X-Received: by 2002:a65:6556:0:b0:470:5b0c:1de2 with SMTP id a22-20020a656556000000b004705b0c1de2mr16192547pgw.286.1667962483182; Tue, 08 Nov 2022 18:54:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1667962483; cv=none; d=google.com; s=arc-20160816; b=r1d1k2YQdfQZVqcvq383bkFSDqKPtkATZBCtqF5KC9IWG6lXVYz78Z5KO2Vlq2X6BX GiKJ7x5pDA9sD65T6skVaeXR7ZuHChnifVH9H5mUk9MOI/flXzt6YPIyZjbh5Vwkfvau HZgfjC11IkO0bkH9P8OfFmSGmdVT8TQOuc+Ht9yAHjMItlTS0NK1HxzuKlagdFgvZGRo 2mIlwB1UqQm8/sEhHVMw0kuM7Bp/m2iUDX68VfKJMMtqv8Kvop47SX6odItlBVqQMp9I RiasYt9JT/OQwRpXsJ3Q/8upfjq6ACxGrxLrEWyxMSFYbFMrBt0oolf3t9FEHwjFI/v5 vpUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:dkim-signature :from; bh=pThIV6ZJIePPLNUvG+CmMKKFXYuBGFqXUhLnpagIMu0=; b=bj47ziuArVKl5FaanOVZJ2MLzp0UViJp2aBrU1ac316N5JXywUhOlCyQE8XJX1c1y6 fpBp/7SZtcQF8x8fx1uxWpPKGBoYPNrm7/sovRDHZIQPHCDsuku0OPXFTwOlbWDhREaW +SGfo23YVMcnSuJ5AeNsK8V1+GN3FfHedG57pMrFv1ouPFbUBgZW7Q6y1yuI6NQq39lg Wg6x+Lv+YnC9MOedkDJ4HM/mvQJTbwHLeLgEi74MqeDCXQ1xhYf7kYcqDOMww0QHtkmH uNBARKDQWC0fTq7ehRd5zkuuy/EoOhf1eSBmtg52KW7uUC95n+f+xYmKDCMBPUwtn0DG D1Pg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=S4RyJ1wz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ng16-20020a17090b1a9000b0020d5c5e1660si30307pjb.190.2022.11.08.18.54.30; Tue, 08 Nov 2022 18:54:43 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=S4RyJ1wz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229470AbiKICui (ORCPT + 99 others); Tue, 8 Nov 2022 21:50:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229705AbiKICue (ORCPT ); Tue, 8 Nov 2022 21:50:34 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [159.69.126.157]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AFCFA1F62F; Tue, 8 Nov 2022 18:50:32 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1667962230; bh=5ie3Yn8WEIYoQFT16uM/WFQsRiA4aQakHFCHCuSu24o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S4RyJ1wzsu+CpZMBbNLMM2Rag3TXO+Xb3KPkzsImCQFf5lvbhoyLEXMvCLg+y4W4P s5eZT9wXxoZDpGbOcLoHawu1teXnAudH1mwzGMMXEy1x3Gm9jXVBZh0duYW9j9jTQj x4kZPMShWc4wEdNpenaPh88pLrVCr8Ta8dsMZghY= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , David Howells , David Woodhouse , Jarkko Sakkinen , Eric Snowberg Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= , keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 3/3] certs: don't try to update blacklist keys Date: Wed, 9 Nov 2022 03:50:19 +0100 Message-Id: <20221109025019.1855-4-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221109025019.1855-1-linux@weissschuh.net> References: <20221109025019.1855-1-linux@weissschuh.net> MIME-Version: 1.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1667962214; l=1899; s=20211113; h=from:subject; bh=5ie3Yn8WEIYoQFT16uM/WFQsRiA4aQakHFCHCuSu24o=; b=OUVFxglzNA9V+JeUq6PfXkiyi8NjbHyOn/P067eIM9yuQtAu1elOs+T/uDNnoy72YvI6yHQrLyma IEfj5nx7Dt2CnrEBvK0SE2q0NTMjoP3maKxCmE9wV84O9Uf12dvH X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748985428374297262?= X-GMAIL-MSGID: =?utf-8?q?1748985428374297262?= When the same key is blacklisted repeatedly we don't want to log an error. These duplicates can be provided by buggy firmware. Instead of spamming the bootlog with errors we use a warning that can still be seen by OEMs when testing. Also extend BLACKLIST_KEY_PERM as otherwise the EACCES will shadow the EEXIST. Link: https://lore.kernel.org/all/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/ Link: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/ Signed-off-by: Thomas Weißschuh --- certs/blacklist.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/certs/blacklist.c b/certs/blacklist.c index 6e260c4b6a19..ac8e3166b6d7 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -26,7 +26,7 @@ */ #define MAX_HASH_LEN 128 -#define BLACKLIST_KEY_PERM (KEY_POS_SEARCH | KEY_POS_VIEW | \ +#define BLACKLIST_KEY_PERM (KEY_POS_WRITE | KEY_POS_SEARCH | KEY_POS_VIEW | \ KEY_USR_SEARCH | KEY_USR_VIEW) static const char tbs_prefix[] = "tbs"; @@ -183,16 +183,19 @@ static int mark_raw_hash_blacklisted(const char *hash) { key_ref_t key; - key = key_create_or_update(make_key_ref(blacklist_keyring, true), - "blacklist", - hash, - NULL, - 0, - BLACKLIST_KEY_PERM, - KEY_ALLOC_NOT_IN_QUOTA | - KEY_ALLOC_BUILT_IN); + key = key_create(make_key_ref(blacklist_keyring, true), + "blacklist", + hash, + NULL, + 0, + BLACKLIST_KEY_PERM, + KEY_ALLOC_NOT_IN_QUOTA | + KEY_ALLOC_BUILT_IN); if (IS_ERR(key)) { - pr_err("Problem blacklisting hash %s: %pe\n", hash, key); + if (PTR_ERR(key) == -EEXIST) + pr_warn("Duplicate blacklisted hash %s\n", hash); + else + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); return PTR_ERR(key); } return 0;