lkml.org 
[lkml]   [2012]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [GIT PULL] Asymmetric keys and module signing
On Sat, Sep 29, 2012 at 08:13:25AM +0100, David Howells wrote:
> Rusty Russell <rusty@rustcorp.com.au> wrote:
>
> > [ 2.808075] Loading module verification certificates
> > [ 2.809331] X.509: Cert 6e03943da0f3b015ba6ed7f5e0cac4fe48680994 has expired
> > [ 2.810500] MODSIGN: Problem loading in-kernel X.509 certificate (-127)
>
> Hmmm... Other people have seen that.
>
> Ahhhhh!
>
> I wonder if the problem is that the certificate is valid for 100 years....
> That might well cause an overflow on a 32-bit system.

That does seem quite plausible. The comparisons are done with time_t,
which boils down to 'long' and 100 years in seconds would overflow
LONG_MAX.

> Could you try changing the '36500' in kernel/Makefile to something shorter,
> like 365?

I tried two values today. One close to LONG_MAX (24800 or ~68 years),
and 10 years (3650). The former still seemed to overflow, but
specifying a 10yr lifetime appears to have worked.

josh


\
 
 \ /
  Last update: 2012-10-01 23:41    [W:1.666 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site