Here's my take on v5 of Eric Snowberg's patches[1]:
This series of patches adds support for EFI_CERT_X509_GUID entries [2]. It has
been expanded to not only include dbx entries but also entries in the mokx.
Additionally Eric included his patches to preload these certificate [3].
The patches can be found on the following branch:
https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-cve-2020-26541-branch
Changes:
ver #3:
- Rolled in changes from Eric to fix conditional building issues[7].
ver #2:
- Rolled in a fix to the second patch to include certs/common.h in
certs/common.c[6].
ver #1:
- I've modified the first patch in the series to fix a configuration
problem[4][5], to move the added functions to a more logical place
within thefile and to add kerneldoc comments.
Link: https://lore.kernel.org/r/[email protected]
[1]
Link:
https://patchwork.kernel.org/project/linux-security-module/patch/[email protected]/
[2]
Link: https://lore.kernel.org/patchwork/cover/1315485/ [3]
Link:
https://lore.kernel.org/r/[email protected]/
[4]
Link: https://lore.kernel.org/r/[email protected]/ [5]
Link:
https://lore.kernel.org/r/[email protected]/ [6]
Link:
https://lore.kernel.org/r/161428671215.677100.6372209948022011988.st...@warthog.procyon.org.uk/
# v1 posting
Link:
https://lore.kernel.org/r/161433310139.902181.11787442834918634133.st...@warthog.procyon.org.uk/
# v2 posting
Link:
https://lore.kernel.org/r/[email protected]/ [7]
David
---
Eric Snowberg (4):
certs: Add EFI_CERT_X509_GUID support for dbx entries
certs: Move load_system_certificate_list to a common function
certs: Add ability to preload revocation certs
integrity: Load mokx variables into the blacklist keyring
certs/Kconfig | 8 +++
certs/Makefile | 21 ++++++-
certs/blacklist.c | 21 +++++++
certs/common.c | 57 +++++++++++++++++++
certs/common.h | 9 +++
certs/revocation_certificates.S | 21 +++++++
certs/system_keyring.c | 49 +---------------
scripts/Makefile | 1 +
security/integrity/platform_certs/load_uefi.c | 20 ++++++-
9 files changed, 156 insertions(+), 51 deletions(-)
create mode 100644 certs/common.c
create mode 100644 certs/common.h
create mode 100644 certs/revocation_certificates.S
