lkml.org 
[lkml]   [2012]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH RFC 0/4] Add firmware signature file check
    From
    On Mon, Nov 5, 2012 at 12:18 PM, Takashi Iwai <tiwai@suse.de> wrote:
    > Hi,
    >
    > this is a patch series to add the support for firmware signature
    > check. At this time, the kernel checks extra signature file (*.sig)
    > for each firmware, instead of embedded signature.
    > It's just a quick hack using the existing module signing mechanism,
    > thus provided only as a proof of concept for now.
    >
    > To be noted, it doesn't support the firmwares via udev but only the
    > direct loading, and the check for built-in firmware is missing, too.

    Just to make sure I'm reading this correctly, it will sign any of the
    firwmare files installed directly from the kernel tree if the option is
    set. So for the firmware in the linux-firmware tree we'd need to
    either copy that into the kernel tree during build time, or duplicate the
    signing bits in the linux-firmware tree itself. However if we do the
    latter, we'd probably need to use the same keys as the per-build kernel
    key which means copying keys (ew) or tell the kernel to include a
    separate firmware key in the extra list.

    I feel like I'm rambling a bit, but I'm trying to work out how signed
    firmware would look from a distro perspective. A significant amount of
    work has been done to decouple linux-firmware from the kernel tree and
    if signed firmware is used it seems to couple them together one way or
    another. At the moment, using generated per-build keys to come up with
    the firmware signatures seems a bit suboptimal in that regard.

    josh


    \
     
     \ /
      Last update: 2012-11-05 22:21    [W:4.330 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site