Mimi Zohar <[email protected]> wrote:
> > (3) The ability to configure a list of blacklisted hashes into the kernel
> > at build time. This is done by setting
> > CONFIG_SYSTEM_BLACKLIST_HASH_LIST to the filename of a list of hashes
> > that are in the form:
> >
> > "<hash>", "<hash>", ..., "<hash>"
> >
> > where each <hash> is a hex string representation of the hash and must
> > include all necessary leading zeros to pad the hash to the right size.
>
> Is the output of "keyctl print" the hex string representation?
No, there is no payload and no read method. "keyctl desc" will return the hex
string representation.
> Update keys documentation?
Not a bad idea, but it should probably go in a separate document, along with
info about asymmetric keys.
> > The blacklist cannot currently be modified by userspace, but it will be
> > possible to load it, for example, from the UEFI blacklist database.
>
> When loading the UEFI blacklist database is enabled, it should be
> configurable.
Probably. That patch isn't added yet though.
> > In the future, it should also be made possible to load blacklisted
> > asymmetric keys in here too.
>
> Please update to reflect patch 3/20 "X.509: Allow X.509 certs to be
> blacklisted" adds this support.
Changed to:
A later commit will make it possible to load blacklisted asymmetric
keys in here too.
David
