Groups > linux.kernel > #1193927

Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures

From	David Howells <dhowells@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures
Date	2015-07-28 11:30 +0200
Message-ID	<pR9mV-521-11@gated-at.bofh.it> (permalink)
References	<pR9dg-4Rk-11@gated-at.bofh.it> <pQXvr-4Ff-1@gated-at.bofh.it> <pQWpI-329-11@gated-at.bofh.it> <pQZnA-7lN-11@gated-at.bofh.it> <pR9dg-4Rk-11@gated-at.bofh.it>
Organization	Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903

Show all headers | View raw

David Woodhouse <dwmw2@infradead.org> wrote:

> As part of the firmware signatures, if we are asked to check the
> filename then yes we should require it to be present *and* match. But
> if we aren't checking (which we can't for modules since we don't know
> what's being loaded), why require it to be present at all?

For firmware, that's in the next set of patches, at the tag
fwsign-pkcs7-20150720.

For modules we could require it not to be present since, as you say, there's
no way generally for the kernel check the module name requested.  The only
thing it could really do is to extract the expected name from the PKCS#7 and
compare it against the name in the modinfo structure *after* checking the
signature.  This would require passing the module name to sign-file too.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 00:50 +0200
  Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures Andy Lutomirski <luto@amacapital.net> - 2015-07-28 01:20 +0200
    Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 11:10 +0200
  Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Woodhouse <dwmw2@infradead.org> - 2015-07-28 11:20 +0200
    Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures David Howells <dhowells@redhat.com> - 2015-07-28 11:30 +0200

csiph-web