Eric Snowberg 45109066f6 certs: Add EFI_CERT_X509_GUID support for dbx entries ... [ Upstream commit 56c5812623 ] This fixes CVE-2020-26541. The Secure Boot Forbidden Signature Database, dbx, contains a list of now revoked signatures and keys previously approved to boot with UEFI Secure Boot enabled. The dbx is capable of containing any number of EFI_CERT_X509_SHA256_GUID, EFI_CERT_SHA256_GUID, and EFI_CERT_X509_GUID entries. Currently when EFI_CERT_X509_GUID are contained in the dbx, the entries are skipped. Add support for EFI_CERT_X509_GUID dbx entries. When a EFI_CERT_X509_GUID is found, it is added as an asymmetrical key to the .blacklist keyring. Anytime the .platform keyring is used, the keys in the .blacklist keyring are referenced, if a matching key is found, the key will be rejected. [DH: Made the following changes: - Added to have a config option to enable the facility. This allows a Kconfig solution to make sure that pkcs7_validate_trust() is enabled.[1][2] - Moved the functions out from the middle of the blacklist functions. - Added kerneldoc comments.] Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Randy Dunlap <rdunlap@infradead.org> cc: Mickaël Salaün <mic@digikod.net> cc: Arnd Bergmann <arnd@kernel.org> cc: keyrings@vger.kernel.org Link: https://lore.kernel.org/r/20200901165143.10295-1-eric.snowberg@oracle.com/ # rfc Link: https://lore.kernel.org/r/20200909172736.73003-1-eric.snowberg@oracle.com/ # v2 Link: https://lore.kernel.org/r/20200911182230.62266-1-eric.snowberg@oracle.com/ # v3 Link: https://lore.kernel.org/r/20200916004927.64276-1-eric.snowberg@oracle.com/ # v4 Link: https://lore.kernel.org/r/20210122181054.32635-2-eric.snowberg@oracle.com/ # v5 Link: https://lore.kernel.org/r/161428672051.677100.11064981943343605138.stgit@warthog.procyon.org.uk/ Link: https://lore.kernel.org/r/161433310942.902181.4901864302675874242.stgit@warthog.procyon.org.uk/ # v2 Link: https://lore.kernel.org/r/161529605075.163428.14625520893961300757.stgit@warthog.procyon.org.uk/ # v3 Link: https://lore.kernel.org/r/bc2c24e3-ed68-2521-0bf4-a1f6be4a895d@infradead.org/ [1] Link: https://lore.kernel.org/r/20210225125638.1841436-1-arnd@kernel.org/ [2] Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-06-30 08:47:30 -04:00
..
acpi	ACPI: scan: Use unique number for instance_no	2021-03-30 14:32:06 +02:00
asm-generic	vmlinux.lds.h: Avoid orphan section with !SMP	2021-06-16 12:01:45 +02:00
clocksource
crypto	crypto: poly1305 - fix poly1305_core_setkey() declaration	2021-05-14 09:50:13 +02:00
drm	drm/dp/mst: Export drm_dp_get_vc_payload_bw()	2021-02-10 09:29:18 +01:00
dt-bindings	ASoC: dt-bindings: lpass: Fix and common up lpass dai ids	2021-02-03 23:28:46 +01:00
keys	certs: Add EFI_CERT_X509_GUID support for dbx entries	2021-06-30 08:47:30 -04:00
kunit
kvm
linux	mm, futex: fix shared futex pgoff on shmem huge page	2021-06-30 08:47:29 -04:00
math-emu
media	media: v4l2-ctrls: fix reference to freed memory	2021-05-11 14:47:39 +02:00
memory
misc
net	inet: annotate date races around sk->sk_txhash	2021-06-30 08:47:21 -04:00
pcmcia
ras
rdma	RDMA: Lift ibdev_to_node from rds to common code	2021-02-26 10:12:59 +01:00
scsi	Fix misc new gcc warnings	2021-05-11 14:47:36 +02:00
soc	net: dsa: felix: implement port flushing on .phylink_mac_link_down	2021-02-17 11:02:27 +01:00
sound	ALSA: hda: intel-nhlt: verify config type	2021-03-09 11:11:14 +01:00
target	scsi: target: core: Add cmd length set before cmd complete	2021-03-17 17:06:25 +01:00
trace	SUNRPC: Remove trace_xprt_transmit_queued	2021-05-19 10:13:03 +02:00
uapi	icmp: don't send out ICMP messages with a source address of 0.0.0.0	2021-06-23 14:42:47 +02:00
vdso
video
xen	Xen/gntdev: correct error checking in gntdev_map_grant_pages()	2021-02-23 15:53:24 +01:00