From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932074AbbG1J27 (ORCPT ); Tue, 28 Jul 2015 05:28:59 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60765 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754956AbbG1J24 (ORCPT ); Tue, 28 Jul 2015 05:28:56 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <1438074741.26913.96.camel@infradead.org> References: <1438074741.26913.96.camel@infradead.org> <55B6988D.4060805@kernel.org> <5299.1438025624@warthog.procyon.org.uk> <17310.1438036987@warthog.procyon.org.uk> To: David Woodhouse Cc: dhowells@redhat.com, Andy Lutomirski , jmorris@namei.org, mcgrof@gmail.com, keyrings@linux-nfs.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <6783.1438075731.1@warthog.procyon.org.uk> Date: Tue, 28 Jul 2015 10:28:51 +0100 Message-ID: <6784.1438075731@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org David Woodhouse wrote: > As part of the firmware signatures, if we are asked to check the > filename then yes we should require it to be present *and* match. But > if we aren't checking (which we can't for modules since we don't know > what's being loaded), why require it to be present at all? For firmware, that's in the next set of patches, at the tag fwsign-pkcs7-20150720. For modules we could require it not to be present since, as you say, there's no way generally for the kernel check the module name requested. The only thing it could really do is to extract the expected name from the PKCS#7 and compare it against the name in the modinfo structure *after* checking the signature. This would require passing the module name to sign-file too. David