Eric Snowberg 56c5812623 certs: Add EFI_CERT_X509_GUID support for dbx entries ... This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currently when EFI_CERT_X509_GUID are contained in the dbx, the entries are skipped. Add support for EFI_CERT_X509_GUID dbx entries. When a EFI_CERT_X509_GUID is found, it is added as an asymmetrical key to the .blacklist keyring. Anytime the .platform keyring is used, the keys in the .blacklist keyring are referenced, if a matching key is found, the key will be rejected. [DH: Made the following changes: - Added to have a config option to enable the facility. This allows a Kconfig solution to make sure that pkcs7_validate_trust() is enabled.[1][2] - Moved the functions out from the middle of the blacklist functions. - Added kerneldoc comments.] Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Randy Dunlap <rdunlap@infradead.org> cc: Mickaël Salaün <mic@digikod.net> cc: Arnd Bergmann <arnd@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20200901165143.10295-1-eric.snowberg@oracle.com/ # rfc Link: https://lore.kernel.org/r/20200909172736.73003-1-eric.snowberg@oracle.com/ # v2 Link: https://lore.kernel.org/r/20200911182230.62266-1-eric.snowberg@oracle.com/ # v3 Link: https://lore.kernel.org/r/20200916004927.64276-1-eric.snowberg@oracle.com/ # v4 Link: https://lore.kernel.org/r/20210122181054.32635-2-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428672051.677100.11064981943343605138.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433310942.902181.4901864302675874242.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529605075.163428.14625520893961300757.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/bc2c24e3-ed68-2521-0bf4-a1f6be4a895d@infradead.org/ [1] Link: https://lore.kernel.org/r/20210225125638.1841436-1-arnd@kernel.org/ [2]		2021-03-11 16:31:28 +00:00
..
apparmor	apparmor: remove duplicate macro list_entry_is_head()	2020-12-15 22:46:19 -08:00
bpf	bpf: Implement task local storage	2020-11-06 08:08:37 -08:00
integrity	certs: Add EFI_CERT_X509_GUID support for dbx entries	2021-03-11 16:31:28 +00:00
keys	certs: Fix blacklist flag type confusion	2021-01-21 16:16:10 +00:00
loadpin	LSM: Add "contents" flag to kernel_read_file hook	2020-10-05 13:37:03 +02:00
lockdown	Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2020-06-02 17:36:24 -07:00
safesetid	LSM: SafeSetID: Fix warnings reported by test bot	2020-10-13 09:17:36 -07:00
selinux	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00
smack	Provide a fix for the incorrect handling of privilege	2020-12-24 14:08:43 -08:00
tomoyo	tomoyo: Fix typo in comments.	2020-12-06 13:44:57 +09:00
yama	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
Kconfig	Replace HTTP links with HTTPS ones: security	2020-08-06 12:00:05 -07:00
Kconfig.hardening	security: allow using Clang's zero initialization for stack variables	2020-06-16 02:06:23 -07:00
Makefile	device_cgroup: Cleanup cgroup eBPF device filter code	2020-04-13 14:41:54 -04:00
commoncap.c	vfs: move cap_convert_nscap() call into vfs_setxattr()	2020-12-14 15:26:13 +01:00
device_cgroup.c	device_cgroup: Fix RCU list debugging warning	2020-08-20 11:25:03 -07:00
inode.c	Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-07-19 10:42:02 -07:00
lsm_audit.c	dump_common_audit_data(): fix racy accesses to ->d_name	2021-01-16 15:11:35 -05:00
min_addr.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
security.c	selinux/stable-5.11 PR 20201214	2020-12-16 11:01:04 -08:00