How to add additional blacklist entries?

[David Howells]

Mimi Zohar <zohar@xxxxxxxxxxxxxxxxxx> wrote:

> Right, this patch makes the system blacklist keyring writable by
> userspace and removes the IMA blacklist.  What I don't understand is how
> to add a key that is currently on the IMA keyring to the system
> blacklist? 

You can do this from userspace with "keyctl link".  Admittedly, this attaches
the entire key to the blacklist keyring, not just the ID.  But that's
basically what you're doing at the moment, right.

To simply list the SKID of the key you want to blacklist, another patch will
be required, but the question is as to what the interface should look like.

Let's start at the beginning.  First of all, let me ask the following:

 (1) How is the key-to-be-blacklisted specified?  A copy of the X.509 cert to
     be blocked?  A signed list of SKIDs to be blocked?  A CRL?

 (2) How is the blacklist addition to be verified?

David