Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1215064 > unrolled thread
| Started by | Valdis Kletnieks <Valdis.Kletnieks@vt.edu> |
|---|---|
| First post | 2015-08-28 04:40 +0200 |
| Last post | 2015-08-28 23:10 +0200 |
| Articles | 4 — 3 participants |
Back to article view | Back to linux.kernel
Module signing broken after SYSTEM_DATA_VERIFICATION commit? Valdis Kletnieks <Valdis.Kletnieks@vt.edu> - 2015-08-28 04:40 +0200
Re: Module signing broken after SYSTEM_DATA_VERIFICATION commit? David Howells <dhowells@redhat.com> - 2015-08-28 12:20 +0200
Re: Module signing broken after SYSTEM_DATA_VERIFICATION commit? David Howells <dhowells@redhat.com> - 2015-08-28 12:30 +0200
Re: Module signing broken after SYSTEM_DATA_VERIFICATION commit? Valdis.Kletnieks@vt.edu - 2015-08-28 23:10 +0200
| From | Valdis Kletnieks <Valdis.Kletnieks@vt.edu> |
|---|---|
| Date | 2015-08-28 04:40 +0200 |
| Subject | Module signing broken after SYSTEM_DATA_VERIFICATION commit? |
| Message-ID | <q2hK9-6Hs-1@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
I build kernels with MODULE_SIG=y, MODULE_SIG_FORCE=n (for build and run
coverage, but it shouldn't dork my system if it breaks). next-20150810
works just fine, but next-20150826 breaks modprobe - all calls to it
drop this in the dmesg:
[ 31.829322] PKCS7: Unknown OID: [32] 2.16.840.1.101.3.4.2.3
[ 31.829328] PKCS7: Unknown OID: [180] 2.16.840.1.101.3.4.2.3
[ 31.829330] Unsupported digest algo: 55
and the modprobe fails.
This looks like the most suspicious commit in the area:
commit 091f6e26eb326adbd718f406e440c838bed8ebb6
Author: David Howells <dhowells@redhat.com>
Date: Mon Jul 20 21:16:28 2015 +0100
MODSIGN: Extract the blob PKCS#7 signature verifier from module signing
though it could be something else equally recent. Is this ringing any
bells, or should I go bisect it?
[toc] | [next] | [standalone]
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Date | 2015-08-28 12:20 +0200 |
| Message-ID | <q2oVj-hx-9@gated-at.bofh.it> |
| In reply to | #1215064 |
Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote: > I build kernels with MODULE_SIG=y, MODULE_SIG_FORCE=n (for build and run > coverage, but it shouldn't dork my system if it breaks). next-20150810 > works just fine, but next-20150826 breaks modprobe - all calls to it > drop this in the dmesg: Could I have a look at your .config? David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Date | 2015-08-28 12:30 +0200 |
| Message-ID | <q2p51-t4-21@gated-at.bofh.it> |
| In reply to | #1215064 |
Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:
> [ 31.829322] PKCS7: Unknown OID: [32] 2.16.840.1.101.3.4.2.3
> [ 31.829328] PKCS7: Unknown OID: [180] 2.16.840.1.101.3.4.2.3
OID_sha1, /* 1.3.14.3.2.26 */
OID_sha256, /* 2.16.840.1.101.3.4.2.1 */
I suspect I'm missing something here in oid_registry.h. Looking online, I
see:
id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 }
id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 }
id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 }
id-sha224 OBJECT IDENTIFIER ::= { hashAlgs 4 }
id-sha512-224 OBJECT IDENTIFIER ::= { hashAlgs 5 }
id-sha512-256 OBJECT IDENTIFIER ::= { hashAlgs 6 }
Are you perchance using sha512 hashes in your signatures?
David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Valdis.Kletnieks@vt.edu |
|---|---|
| Date | 2015-08-28 23:10 +0200 |
| Message-ID | <q2z4l-6rs-1@gated-at.bofh.it> |
| In reply to | #1215263 |
[Multipart message — attachments visible in raw view] — view raw
On Fri, 28 Aug 2015 11:23:54 +0100, David Howells said:
> Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:
>
> > [ 31.829322] PKCS7: Unknown OID: [32] 2.16.840.1.101.3.4.2.3
> > [ 31.829328] PKCS7: Unknown OID: [180] 2.16.840.1.101.3.4.2.3
>
> OID_sha1, /* 1.3.14.3.2.26 */
> OID_sha256, /* 2.16.840.1.101.3.4.2.1 */
>
> I suspect I'm missing something here in oid_registry.h. Looking online, I
> see:
>
> id-sha256 OBJECT IDENTIFIER ::= { hashAlgs 1 }
> id-sha384 OBJECT IDENTIFIER ::= { hashAlgs 2 }
> id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 }
> id-sha224 OBJECT IDENTIFIER ::= { hashAlgs 4 }
> id-sha512-224 OBJECT IDENTIFIER ::= { hashAlgs 5 }
> id-sha512-256 OBJECT IDENTIFIER ::= { hashAlgs 6 }
>
> Are you perchance using sha512 hashes in your signatures?
% grep MODULE_SIG /usr/src/linux-next/.config
CONFIG_MODULE_SIG=y
# CONFIG_MODULE_SIG_FORCE is not set
CONFIG_MODULE_SIG_ALL=y
# CONFIG_MODULE_SIG_SHA1 is not set
# CONFIG_MODULE_SIG_SHA224 is not set
# CONFIG_MODULE_SIG_SHA256 is not set
# CONFIG_MODULE_SIG_SHA384 is not set
CONFIG_MODULE_SIG_SHA512=y
CONFIG_MODULE_SIG_HASH="sha512"
CONFIG_MODULE_SIG_KEY="signing_key.pem"
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web