Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 00/23] Crypto keys and module signing | Date | Fri, 25 May 2012 12:37:59 +0100 |
| |
Kasatkin, Dmitry <dmitry.kasatkin@intel.com> wrote:
> > In some ways that is cleaner, but it's also nice to avoid adding another > > syscall. > > There is no additional syscall. > signature is passed is 'ima=' parameter to init_module() > like
Exactly what I was thinking of, though I wouldn't call it "ima=" as that doesn't seem specific enough.
You could also append it to the binary image and have the kernel extract it from there as if the module file had had the signature attached during the build.
I don't particularly favour holding the signature in an xattr, though, as that assumes that underlying fs has the capability to hold it and means that the package installation mechanism must know how to fill in xattrs.
David
| |