From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754546Ab2JVNmN (ORCPT ); Mon, 22 Oct 2012 09:42:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:31614 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753734Ab2JVNmM (ORCPT ); Mon, 22 Oct 2012 09:42:12 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <874nlnjowo.fsf@rustcorp.com.au> References: <874nlnjowo.fsf@rustcorp.com.au> <20121020001928.24141.30477.stgit@warthog.procyon.org.uk> To: Rusty Russell Cc: dhowells@redhat.com, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] MODSIGN: Move the magic string to the end of a module and eliminate the search Date: Mon, 22 Oct 2012 14:42:06 +0100 Message-ID: <17155.1350913326@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Rusty Russell wrote: > Meh, I really wanted to separate the module signature locating (my > problem) from the decoding and checking (your problem). You could split mod_verify_sig() at the: /* For the moment, only support RSA and X.509 identifiers */ comment. At that point we have verified the size fields of the module_signature struct and we have determined mod, modlen and sig. Assuming a detached signature is going to look the same as an attached signature, just without the magic number[1], then you can duplicate the first part of mod_verify_sig() with the size checks. [1] The signature may need to be kept small to make sure it will fit within an xattr, just in case the host fs has limits. > If we're going to require such a header, we can simplify further (untested!). Do we want to require that a detached signature be exactly the same as an appended signature, structure, magic string and all? I'm also slightly against copying the magic string to the stack if we can avoid it as the compiler can't recover the space before calling mod_verify_sig(). Besides, there's no particular need to copy the magic string. > BTW, I'm not convinced your use of bitfields here is portable; it may be > portable enough for Linux though. I consulted a gcc engineer and he suggested that it's arch dependent, so I should probably use u8. Since the enums are basically int-sized types, the compiler might reorder them depending on endianness and might insert a byte of padding. It's just that I prefer the enums for documentary sake. David