From patchwork Wed Nov 9 02:50:17 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Patchwork-Id: 17324 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp105701wru; Tue, 8 Nov 2022 19:02:06 -0800 (PST) X-Google-Smtp-Source: AMsMyM4S3lY3Q8/pi0nl2y4txx7H9kyEi6q34Yc7LZ0kIs8V3MDXACFrhCBePxEjwr/fTlFE+xBO X-Received: by 2002:a17:90b:3b44:b0:213:34f7:facb with SMTP id ot4-20020a17090b3b4400b0021334f7facbmr78522410pjb.150.1667962926061; Tue, 08 Nov 2022 19:02:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1667962926; cv=none; d=google.com; s=arc-20160816; b=sfSqNQQvc5Sro9TvUMEPwZfvVkVoyElgJ3fv7zWqYrh+96r8zKPHF2iVr2oweAsBwk pnz7EzmtKOz+tVaB8ptQUcvFjCdueJ2JpygCtVpzTi+d3r02+sMc+l83VdGJ3l+nV1tj 3hzgCzakfIhS+1Lo6OiKWHhTWaqoPSg48DjPGDqnVopbUm5yA8mrxvPe+4laHIzXvrGO 4ks2hxxpiuV7uJL75NXobZlxotMAo0TGk7/xjwV7WRVFMRNOJZYfsLohttaffN11Vk6Y Y8t5rnSxqawq91uVzNOIxthBcjF6xOVaKQUpNyN1opbEgE3yIzPw1yGmAURWOueKHXQd ITvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:dkim-signature :from; bh=mg8/bHYa+/IfZ5sz/GzGGJbcLE18sRWdGW/pDYF26pQ=; b=BsWBydEJvh8voyoT1SbpNDHtSPye+Er5cLzJzX2zl9qe+sK2pq00nxY3Rn2keX/SmP LPK3vn8C2usdnrwK4zc8YJhjyJzaHVV33LZFP+OSyBIjb8bCotSQxgMRta+1h50f+/Lb nKJkWICpHpTIZkpqC7oY4XMb48nfsmOADV5EwFmX7HuQqwpzvWs6aS29l48ibaujJdai teFnpURZXXvr33bsW8AMO3LRjKtyP6ibE8sUVsikh6j3m63qYt+5ga1Wce8+AApagALM DJqxI7dezWyNUJ2M07JWQf1J0fHXprB+hdEjsbqCIVSA98KFLqdVcS33QJ/mki6Wntgz 1ysg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b="RFw/Vm2E"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f189-20020a636ac6000000b004701ea564desi15618151pgc.783.2022.11.08.19.01.50; Tue, 08 Nov 2022 19:02:06 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b="RFw/Vm2E"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230075AbiKICuf (ORCPT + 99 others); Tue, 8 Nov 2022 21:50:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229667AbiKICue (ORCPT ); Tue, 8 Nov 2022 21:50:34 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [159.69.126.157]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AFC381F61A; Tue, 8 Nov 2022 18:50:32 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1667962230; bh=COwXzoOJifc0kBYkrsDthoC7PqTOtSdi1o8MWvrZGvg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RFw/Vm2E83YIgHtWCxE5pbYZhS4CloQ/BWpqQZOVwojSlxti2713CWbtT7DfN5yex g+GGsYBsuKhOCeD7QxLbnztD1C/IDyi5+pGFTD9AtpIONjJbQEGJyO1z11FSBTMNjk uEi8dEEMGzSajlt2uIl9vEakOIORMif0rUAKe1AA= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , David Howells , David Woodhouse , Jarkko Sakkinen , Eric Snowberg Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= , keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 1/3] certs: log more information on blacklist error Date: Wed, 9 Nov 2022 03:50:17 +0100 Message-Id: <20221109025019.1855-2-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221109025019.1855-1-linux@weissschuh.net> References: <20221109025019.1855-1-linux@weissschuh.net> MIME-Version: 1.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1667962214; l=781; s=20211113; h=from:subject; bh=COwXzoOJifc0kBYkrsDthoC7PqTOtSdi1o8MWvrZGvg=; b=9x5DbFNV4IeM4Iy0DtoCRUoozHmclKCE+cEgSF4HGqidC0TEXqxiB6lTgA07FCcRuKVcFFgwwsn5 B8EN0PttAwXE0P3l+2gc7DGNn+b1Zq+W6/XVyg0ViLI7WWqXymfn X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748985892743730665?= X-GMAIL-MSGID: =?utf-8?q?1748985892743730665?= Without this information these logs are not actionable. Fixes: 6364d106e041 ("certs: Allow root user to append signed hashes to the blacklist keyring") Signed-off-by: Thomas Weißschuh --- certs/blacklist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/certs/blacklist.c b/certs/blacklist.c index 41f10601cc72..6e260c4b6a19 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -192,7 +192,7 @@ static int mark_raw_hash_blacklisted(const char *hash) KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_BUILT_IN); if (IS_ERR(key)) { - pr_err("Problem blacklisting hash (%ld)\n", PTR_ERR(key)); + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); return PTR_ERR(key); } return 0; From patchwork Wed Nov 9 02:50:18 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Patchwork-Id: 17326 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp108807wru; Tue, 8 Nov 2022 19:11:07 -0800 (PST) X-Google-Smtp-Source: AMsMyM7TaatB3r5IyU1fc1diwY8UKTaElHSgQhZp2bv151PWa2ELCNj75Fb3bzE2KSnp1FH4/sVR X-Received: by 2002:a17:907:d093:b0:7ae:108:9728 with SMTP id vc19-20020a170907d09300b007ae01089728mr35416100ejc.484.1667963467467; Tue, 08 Nov 2022 19:11:07 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1667963467; cv=none; d=google.com; s=arc-20160816; b=EZTXn3fuSldyNw79Bp0uYGyjixgL4lHauscowJS/oV+rwEqIibw/vuov5PjxpT4/VO cYNoObTfMOt8+C4FzuybS0WeRjxSYsY4JhA1H+bhiWP7t3ri6+/+ATDGX5XMEVQtwkcr Jy5LA0ayCsaovbQYG2jopk5Rq0Eu3wuMvJ+gQl+gbXMrlz7y/VfJNegz6ZdgA7fZAcz8 Zgv7xNqa6p5pFUihfddqZlVyi13sQIS2rXU4hFtpsEVsnWHyUfRcfIQiyod0KYCjuXM8 /4BRzHHK8WC+MfvkIhXPZ2sZ/cKdCJTo42bNM+NAFxaUiBUhOIoozrmCB2vfYPvSUTcz Zk+w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:dkim-signature :from; bh=ya1zovisKvGxwdE30qdfPbXplkEg71aoqOhCSqPxTQk=; b=BIfIvYuhW6Zw3PAszfIsm2JyNs4n3+97tyatjiPg/2UWwJ6n2/JBa1/A4c5ZEyZEvU snAFLo87TI2mz8qjPEkeZn0HgK8E8C2Kxx9fG2TfaFGLKMxoJWUBtrC87j287HIn11vQ TIex9SSV0tihaxD8+VGdmrCw2ApeMLfwaQ+Kc4zkDwC1r4bwpEMIc5QhYXHwJDiy1qH8 7vPynLFPi5mWl6+NwqGdSIZnQdYivtc8V0Ggw1xNhRoqUXeDj9XupP+MI8Ct1s2kcIc/ QfV/Rje7+ihjRrEs5jY+x8tOhRkdwTKbcFY18mGEZJT4Sch+Oq9lSoRWgmA85i1LBWt3 sbpg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=gvg2aRUl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id cw14-20020a170906478e00b007707ab4be28si7209502ejc.972.2022.11.08.19.10.44; Tue, 08 Nov 2022 19:11:07 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=gvg2aRUl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230089AbiKICul (ORCPT + 99 others); Tue, 8 Nov 2022 21:50:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230041AbiKICuf (ORCPT ); Tue, 8 Nov 2022 21:50:35 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [159.69.126.157]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 253B51F9E0; Tue, 8 Nov 2022 18:50:34 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1667962230; bh=233BTp1qcjOzql0dhORHYGs7Wq5WOY1ovusjn60vP/A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gvg2aRUlRtnPD1ft+cXSUo/Zs8u/wtM3kR2n4ZjvrLYTOaf+eQr3478AXBgfgtcbZ jBzcLoXgYwAFD7y71goq75WkjvW4HUsRxNsq5esZUWpYw8sp2KCGt0Ivk3+Ps+Tox1 y4OPNTxjB6F5tYGsCZ7y5452+e9ZUjkPczgz2ev8= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , David Howells , David Woodhouse , Jarkko Sakkinen , Eric Snowberg Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= , keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 2/3] KEYS: Add key_create() Date: Wed, 9 Nov 2022 03:50:18 +0100 Message-Id: <20221109025019.1855-3-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221109025019.1855-1-linux@weissschuh.net> References: <20221109025019.1855-1-linux@weissschuh.net> MIME-Version: 1.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1667962214; l=7478; s=20211113; h=from:subject; bh=233BTp1qcjOzql0dhORHYGs7Wq5WOY1ovusjn60vP/A=; b=M29uzVeJh9KDc+GsHlHkuBqH80ld+ZcrMEUOp0kpS7GWmStL1oLs4Ylh5Kw/qgjZDJbP5jHzBKCl dNVBRqy7CotdiIxIBKPjDfbNUN8yzxCvz/ITfDz23Fvd8me1dqIY X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748986460804944323?= X-GMAIL-MSGID: =?utf-8?q?1748986460804944323?= This function works like key_create_or_update() but does not allow updating an existing key instead returning -EEXIST. This new function will be used by the blacklist keyring. Signed-off-by: Thomas Weißschuh --- include/linux/key.h | 8 +++ security/keys/key.c | 149 +++++++++++++++++++++++++++++++++----------- 2 files changed, 120 insertions(+), 37 deletions(-) diff --git a/include/linux/key.h b/include/linux/key.h index d27477faf00d..8dc7f7c3088b 100644 --- a/include/linux/key.h +++ b/include/linux/key.h @@ -386,6 +386,14 @@ extern int wait_for_key_construction(struct key *key, bool intr); extern int key_validate(const struct key *key); +extern key_ref_t key_create(key_ref_t keyring, + const char *type, + const char *description, + const void *payload, + size_t plen, + key_perm_t perm, + unsigned long flags); + extern key_ref_t key_create_or_update(key_ref_t keyring, const char *type, const char *description, diff --git a/security/keys/key.c b/security/keys/key.c index c45afdd1dfbb..f84bcd8457f4 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -788,38 +788,18 @@ static inline key_ref_t __key_update(key_ref_t key_ref, goto out; } -/** - * key_create_or_update - Update or create and instantiate a key. - * @keyring_ref: A pointer to the destination keyring with possession flag. - * @type: The type of key. - * @description: The searchable description for the key. - * @payload: The data to use to instantiate or update the key. - * @plen: The length of @payload. - * @perm: The permissions mask for a new key. - * @flags: The quota flags for a new key. - * - * Search the destination keyring for a key of the same description and if one - * is found, update it, otherwise create and instantiate a new one and create a - * link to it from that keyring. - * - * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be - * concocted. - * - * Returns a pointer to the new key if successful, -ENODEV if the key type - * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the - * caller isn't permitted to modify the keyring or the LSM did not permit - * creation of the key. - * - * On success, the possession flag from the keyring ref will be tacked on to - * the key ref before it is returned. +/* + * Create or potentially update a key. The combined logic behind + * key_create_or_update() and key_create() */ -key_ref_t key_create_or_update(key_ref_t keyring_ref, - const char *type, - const char *description, - const void *payload, - size_t plen, - key_perm_t perm, - unsigned long flags) +static key_ref_t __key_create_or_update(key_ref_t keyring_ref, + const char *type, + const char *description, + const void *payload, + size_t plen, + key_perm_t perm, + unsigned long flags, + bool allow_update) { struct keyring_index_key index_key = { .description = description, @@ -906,14 +886,23 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, goto error_link_end; } - /* if it's possible to update this type of key, search for an existing - * key of the same type and description in the destination keyring and - * update that instead if possible + /* if it's requested and possible to update this type of key, search + * for an existing key of the same type and description in the + * destination keyring and update that instead if possible */ - if (index_key.type->update) { + if (allow_update) { + if (index_key.type->update) { + key_ref = find_key_to_update(keyring_ref, &index_key); + if (key_ref) + goto found_matching_key; + } + } else { key_ref = find_key_to_update(keyring_ref, &index_key); - if (key_ref) - goto found_matching_key; + if (key_ref) { + key_ref_put(key_ref); + key_ref = ERR_PTR(-EEXIST); + goto error_link_end; + } } /* if the client doesn't provide, decide on the permissions we want */ @@ -985,8 +974,94 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, goto error_free_prep; } + +/** + * key_create_or_update - Update or create and instantiate a key. + * @keyring_ref: A pointer to the destination keyring with possession flag. + * @type: The type of key. + * @description: The searchable description for the key. + * @payload: The data to use to instantiate or update the key. + * @plen: The length of @payload. + * @perm: The permissions mask for a new key. + * @flags: The quota flags for a new key. + * + * Search the destination keyring for a key of the same description and if one + * is found, update it, otherwise create and instantiate a new one and create a + * link to it from that keyring. + * + * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be + * concocted. + * + * Returns a pointer to the new key if successful, -ENODEV if the key type + * wasn't available, -ENOTDIR if the keyring wasn't a keyring, -EACCES if the + * caller isn't permitted to modify the keyring or the LSM did not permit + * creation of the key. + * + * On success, the possession flag from the keyring ref will be tacked on to + * the key ref before it is returned. + */ +key_ref_t key_create_or_update(key_ref_t keyring_ref, + const char *type, + const char *description, + const void *payload, + size_t plen, + key_perm_t perm, + unsigned long flags) +{ + return __key_create_or_update(keyring_ref, + type, + description, + payload, + plen, + perm, + flags, + true); +} EXPORT_SYMBOL(key_create_or_update); +/** + * key_create - Create and instantiate a key. + * @keyring_ref: A pointer to the destination keyring with possession flag. + * @type: The type of key. + * @description: The searchable description for the key. + * @payload: The data to use to instantiate or update the key. + * @plen: The length of @payload. + * @perm: The permissions mask for a new key. + * @flags: The quota flags for a new key. + * + * Create and instantiate a new key and link to it from the destination keyring. + * + * If perm is KEY_PERM_UNDEF then an appropriate key permissions mask will be + * concocted. + * + * Returns a pointer to the new key if successful, -EEXIST if a key with the + * same description already exists, -ENODEV if the key type wasn't available, + * -ENOTDIR if the keyring wasn't a keyring, -EACCES if the caller isn't + * permitted to modify the keyring or the LSM did not permit creation of the + * key. + * + * On success, the possession flag from the keyring ref will be tacked on to + * the key ref before it is returned. + */ +key_ref_t key_create(key_ref_t keyring_ref, + const char *type, + const char *description, + const void *payload, + size_t plen, + key_perm_t perm, + unsigned long flags) +{ + return __key_create_or_update(keyring_ref, + type, + description, + payload, + plen, + perm, + flags, + false); +} +EXPORT_SYMBOL(key_create); + /** * key_update - Update a key's contents. * @key_ref: The pointer (plus possession flag) to the key. From patchwork Wed Nov 9 02:50:19 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= X-Patchwork-Id: 17322 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp103354wru; Tue, 8 Nov 2022 18:54:43 -0800 (PST) X-Google-Smtp-Source: AA0mqf6EIXulsNOZK2bC7GZ+MQ23L0nqqqPYQFelfdN3ZuszyCPBsatHEA8p5H8hjfvB7yhjaQ4u X-Received: by 2002:a65:6556:0:b0:470:5b0c:1de2 with SMTP id a22-20020a656556000000b004705b0c1de2mr16192547pgw.286.1667962483182; Tue, 08 Nov 2022 18:54:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1667962483; cv=none; d=google.com; s=arc-20160816; b=r1d1k2YQdfQZVqcvq383bkFSDqKPtkATZBCtqF5KC9IWG6lXVYz78Z5KO2Vlq2X6BX GiKJ7x5pDA9sD65T6skVaeXR7ZuHChnifVH9H5mUk9MOI/flXzt6YPIyZjbh5Vwkfvau HZgfjC11IkO0bkH9P8OfFmSGmdVT8TQOuc+Ht9yAHjMItlTS0NK1HxzuKlagdFgvZGRo 2mIlwB1UqQm8/sEhHVMw0kuM7Bp/m2iUDX68VfKJMMtqv8Kvop47SX6odItlBVqQMp9I RiasYt9JT/OQwRpXsJ3Q/8upfjq6ACxGrxLrEWyxMSFYbFMrBt0oolf3t9FEHwjFI/v5 vpUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:dkim-signature :from; bh=pThIV6ZJIePPLNUvG+CmMKKFXYuBGFqXUhLnpagIMu0=; b=bj47ziuArVKl5FaanOVZJ2MLzp0UViJp2aBrU1ac316N5JXywUhOlCyQE8XJX1c1y6 fpBp/7SZtcQF8x8fx1uxWpPKGBoYPNrm7/sovRDHZIQPHCDsuku0OPXFTwOlbWDhREaW +SGfo23YVMcnSuJ5AeNsK8V1+GN3FfHedG57pMrFv1ouPFbUBgZW7Q6y1yuI6NQq39lg Wg6x+Lv+YnC9MOedkDJ4HM/mvQJTbwHLeLgEi74MqeDCXQ1xhYf7kYcqDOMww0QHtkmH uNBARKDQWC0fTq7ehRd5zkuuy/EoOhf1eSBmtg52KW7uUC95n+f+xYmKDCMBPUwtn0DG D1Pg== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=S4RyJ1wz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id ng16-20020a17090b1a9000b0020d5c5e1660si30307pjb.190.2022.11.08.18.54.30; Tue, 08 Nov 2022 18:54:43 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=fail header.i=@weissschuh.net header.s=mail header.b=S4RyJ1wz; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229470AbiKICui (ORCPT + 99 others); Tue, 8 Nov 2022 21:50:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229705AbiKICue (ORCPT ); Tue, 8 Nov 2022 21:50:34 -0500 Received: from todd.t-8ch.de (todd.t-8ch.de [159.69.126.157]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AFCFA1F62F; Tue, 8 Nov 2022 18:50:32 -0800 (PST) From: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=weissschuh.net; s=mail; t=1667962230; bh=5ie3Yn8WEIYoQFT16uM/WFQsRiA4aQakHFCHCuSu24o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S4RyJ1wzsu+CpZMBbNLMM2Rag3TXO+Xb3KPkzsImCQFf5lvbhoyLEXMvCLg+y4W4P s5eZT9wXxoZDpGbOcLoHawu1teXnAudH1mwzGMMXEy1x3Gm9jXVBZh0duYW9j9jTQj x4kZPMShWc4wEdNpenaPh88pLrVCr8Ta8dsMZghY= To: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , David Howells , David Woodhouse , Jarkko Sakkinen , Eric Snowberg Cc: =?utf-8?q?Thomas_Wei=C3=9Fschuh?= , keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, Mark Pearson , linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org Subject: [PATCH v2 3/3] certs: don't try to update blacklist keys Date: Wed, 9 Nov 2022 03:50:19 +0100 Message-Id: <20221109025019.1855-4-linux@weissschuh.net> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221109025019.1855-1-linux@weissschuh.net> References: <20221109025019.1855-1-linux@weissschuh.net> MIME-Version: 1.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1667962214; l=1899; s=20211113; h=from:subject; bh=5ie3Yn8WEIYoQFT16uM/WFQsRiA4aQakHFCHCuSu24o=; b=OUVFxglzNA9V+JeUq6PfXkiyi8NjbHyOn/P067eIM9yuQtAu1elOs+T/uDNnoy72YvI6yHQrLyma IEfj5nx7Dt2CnrEBvK0SE2q0NTMjoP3maKxCmE9wV84O9Uf12dvH X-Developer-Key: i=linux@weissschuh.net; a=ed25519; pk=9LP6KM4vD/8CwHW7nouRBhWLyQLcK1MkP6aTZbzUlj4= X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748985428374297262?= X-GMAIL-MSGID: =?utf-8?q?1748985428374297262?= When the same key is blacklisted repeatedly we don't want to log an error. These duplicates can be provided by buggy firmware. Instead of spamming the bootlog with errors we use a warning that can still be seen by OEMs when testing. Also extend BLACKLIST_KEY_PERM as otherwise the EACCES will shadow the EEXIST. Link: https://lore.kernel.org/all/c8c65713-5cda-43ad-8018-20f2e32e4432@t-8ch.de/ Link: https://lore.kernel.org/all/20221104014704.3469-1-linux@weissschuh.net/ Signed-off-by: Thomas Weißschuh --- certs/blacklist.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/certs/blacklist.c b/certs/blacklist.c index 6e260c4b6a19..ac8e3166b6d7 100644 --- a/certs/blacklist.c +++ b/certs/blacklist.c @@ -26,7 +26,7 @@ */ #define MAX_HASH_LEN 128 -#define BLACKLIST_KEY_PERM (KEY_POS_SEARCH | KEY_POS_VIEW | \ +#define BLACKLIST_KEY_PERM (KEY_POS_WRITE | KEY_POS_SEARCH | KEY_POS_VIEW | \ KEY_USR_SEARCH | KEY_USR_VIEW) static const char tbs_prefix[] = "tbs"; @@ -183,16 +183,19 @@ static int mark_raw_hash_blacklisted(const char *hash) { key_ref_t key; - key = key_create_or_update(make_key_ref(blacklist_keyring, true), - "blacklist", - hash, - NULL, - 0, - BLACKLIST_KEY_PERM, - KEY_ALLOC_NOT_IN_QUOTA | - KEY_ALLOC_BUILT_IN); + key = key_create(make_key_ref(blacklist_keyring, true), + "blacklist", + hash, + NULL, + 0, + BLACKLIST_KEY_PERM, + KEY_ALLOC_NOT_IN_QUOTA | + KEY_ALLOC_BUILT_IN); if (IS_ERR(key)) { - pr_err("Problem blacklisting hash %s: %pe\n", hash, key); + if (PTR_ERR(key) == -EEXIST) + pr_warn("Duplicate blacklisted hash %s\n", hash); + else + pr_err("Problem blacklisting hash %s: %pe\n", hash, key); return PTR_ERR(key); } return 0;