[RESEND,v6,0/3] certs: Prevent spurious errors on repeated blacklisting

Message

Thomas Weißschuh Jan. 9, 2023, 11:59 p.m. UTC

When the blacklist keyring was changed to allow updates from the root
user it gained an ->update() function that disallows all updates.
When the a hash is blacklisted multiple times from the builtin or
firmware-provided blacklist this spams prominent logs during boot:

[    0.890814] blacklist: Problem blacklisting hash (-13)

This affects the firmware of various vendors. Reported have been at least:
* Samsung: https://askubuntu.com/questions/1436856/
* Acer: https://ubuntuforums.org/showthread.php?t=2478840
* MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7
* Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860
* Lenovo: https://lore.kernel.org/lkml/[e-mail]/

Note: In the meantime I lost access to the machine exhibiting the
problematic behavior. If larger changes are required to this series
somebody else would have to validate them or take over the series.

Changelog:

v1: https://lore.kernel.org/all/[e-mail]/
v1 -> v2:
 * Improve logging message to include the failed hash
 * Add key_create() function without update semantics
 * Use key_create() from mark_raw_hash_blacklisted() and log specific message
   on -EEXIST

v2: https://lore.kernel.org/lkml/[e-mail]/
v2 -> v3:
 * Clarify commit titles and messages
 * Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact
   of some obsolete version of the patch and not needed

v3: https://lore.kernel.org/lkml/[e-mail]/
v3 -> v4:
 * Drop Fixes-tag from first patch
 * Flesh out commit descriptions and messages

v4: https://lore.kernel.org/r/[e-mail]
v4 -> v5:
 * Reduce lines needed by function calls in key.c
 * Add Reviewed-by from Jarkko

v5: https://lore.kernel.org/r/[e-mail]
v5 -> v6:
 * Correct Jarkkos email in Reviewed-by tags
 * Resend to hopefully reach @kernel.org recipients

Thomas Weißschuh (3):
  certs: log hash value on blacklist error
  KEYS: Add key_create()
  certs: don't try to update blacklist keys

 certs/blacklist.c   |  21 ++++---
 include/linux/key.h |   8 +++
 security/keys/key.c | 149 +++++++++++++++++++++++++++++++++-----------
 3 files changed, 132 insertions(+), 46 deletions(-)

--
2.38.1

To: David Howells <[e-mail]>
To: David Woodhouse <[e-mail]>
To: Jarkko Sakkinen <[e-mail]>
To: Paul Moore <[e-mail]>
To: James Morris <[e-mail]>
To: "Serge E. Hallyn" <[e-mail]>
To: "Mickaël Salaün" <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Cc: [e-mail]
Cc: Paul Menzel <[e-mail]>
Signed-off-by: Thomas Weißschuh <[e-mail]>
Cc: Mark Pearson <[e-mail]>

---
Thomas Weißschuh (3):
      certs: make blacklisted hash available in klog
      KEYS: Add new function key_create()
      certs: don't try to update blacklist keys

 certs/blacklist.c   |  21 ++++----
 include/linux/key.h |   8 +++
 security/keys/key.c | 137 ++++++++++++++++++++++++++++++++++++++--------------
 3 files changed, 120 insertions(+), 46 deletions(-)
---
base-commit: 512dee0c00ad9e9c7ae9f11fc6743702ea40caff
change-id: 20221212-keys-blacklist-2c79a64667c9

Best regards,

Comments

Jarkko Sakkinen Jan. 20, 2023, 9:10 p.m. UTC | #1

On Mon, Jan 09, 2023 at 11:59:41PM +0000, Thomas Weißschuh wrote:
> When the blacklist keyring was changed to allow updates from the root
> user it gained an ->update() function that disallows all updates.
> When the a hash is blacklisted multiple times from the builtin or
> firmware-provided blacklist this spams prominent logs during boot:
> 
> [    0.890814] blacklist: Problem blacklisting hash (-13)
> 
> This affects the firmware of various vendors. Reported have been at least:
> * Samsung: https://askubuntu.com/questions/1436856/
> * Acer: https://ubuntuforums.org/showthread.php?t=2478840
> * MSI: https://forum.archlabslinux.com/t/blacklist-problem-blacklisting-hash-13-errors-on-boot/6674/7
> * Micro-Star: https://bbs.archlinux.org/viewtopic.php?id=278860
> * Lenovo: https://lore.kernel.org/lkml/[e-mail]/
> 
> Note: In the meantime I lost access to the machine exhibiting the
> problematic behavior. If larger changes are required to this series
> somebody else would have to validate them or take over the series.
> 
> Changelog:
> 
> v1: https://lore.kernel.org/all/[e-mail]/
> v1 -> v2:
>  * Improve logging message to include the failed hash
>  * Add key_create() function without update semantics
>  * Use key_create() from mark_raw_hash_blacklisted() and log specific message
>    on -EEXIST
> 
> v2: https://lore.kernel.org/lkml/[e-mail]/
> v2 -> v3:
>  * Clarify commit titles and messages
>  * Drop the change to BLACKLIST_KEY_PERM from patch 3, as it was an artifact
>    of some obsolete version of the patch and not needed
> 
> v3: https://lore.kernel.org/lkml/[e-mail]/
> v3 -> v4:
>  * Drop Fixes-tag from first patch
>  * Flesh out commit descriptions and messages
> 
> v4: https://lore.kernel.org/r/[e-mail]
> v4 -> v5:
>  * Reduce lines needed by function calls in key.c
>  * Add Reviewed-by from Jarkko
> 
> v5: https://lore.kernel.org/r/[e-mail]
> v5 -> v6:
>  * Correct Jarkkos email in Reviewed-by tags
>  * Resend to hopefully reach @kernel.org recipients
> 
> Thomas Weißschuh (3):
>   certs: log hash value on blacklist error
>   KEYS: Add key_create()
>   certs: don't try to update blacklist keys
> 
>  certs/blacklist.c   |  21 ++++---
>  include/linux/key.h |   8 +++
>  security/keys/key.c | 149 +++++++++++++++++++++++++++++++++-----------
>  3 files changed, 132 insertions(+), 46 deletions(-)
> 
> --
> 2.38.1
> 
> To: David Howells <[e-mail]>
> To: David Woodhouse <[e-mail]>
> To: Jarkko Sakkinen <[e-mail]>
> To: Paul Moore <[e-mail]>
> To: James Morris <[e-mail]>
> To: "Serge E. Hallyn" <[e-mail]>
> To: "Mickaël Salaün" <[e-mail]>
> Cc: [e-mail]
> Cc: [e-mail]
> Cc: [e-mail]
> Cc: Paul Menzel <[e-mail]>
> Signed-off-by: Thomas Weißschuh <[e-mail]>
> Cc: Mark Pearson <[e-mail]>
> 
> ---
> Thomas Weißschuh (3):
>       certs: make blacklisted hash available in klog
>       KEYS: Add new function key_create()
>       certs: don't try to update blacklist keys
> 
>  certs/blacklist.c   |  21 ++++----
>  include/linux/key.h |   8 +++
>  security/keys/key.c | 137 ++++++++++++++++++++++++++++++++++++++--------------
>  3 files changed, 120 insertions(+), 46 deletions(-)
> ---
> base-commit: 512dee0c00ad9e9c7ae9f11fc6743702ea40caff
> change-id: 20221212-keys-blacklist-2c79a64667c9
> 
> Best regards,
> -- 
> Thomas Weißschuh <[e-mail]>

Hi, I'e applied and pushed this now. Thank you.

BR, Jarkko