Messages in this thread | | | Subject | Re: [PATCH 3/5] PKCS#7: Allow detached data to be supplied for signature checking purposes | From | Mimi Zohar <> | Date | Mon, 24 Nov 2014 09:59:25 -0500 |
| |
On Mon, 2014-11-24 at 14:41 +0000, David Howells wrote: > Mimi Zohar <zohar@linux.vnet.ibm.com> wrote: > > > > > Ok, PCKS#7 supports detached data. I assume this is not needed for > > > > kernel modules. What is the motivation for adding this support to the > > > > kernel? > > > > > > See patch #5. I should probably note that in the commit message. > > > > This patch set does not change the syscall. The signature is still > > appended to the kernel module. > > Ummm, yes, so? > > > In fact, the call from kernel/module_signing.c: mod_verify_pkcs7() calls > > pkcs7_supply_detached_data() with a pointer to the module and the module > > length to set the data field. pkcs7_supply_detached_data() would not be > > defined or exported, unless it was going to be called elsewhere. How else > > are you planning on using pkcs7_supply_detached_data()? > > Is your point that I exported it unnecessarily? That I have now fixed.
No, it was more a comment on the function name pkcs7_supply_detached_data() being a bit weird, as the signature is appended to the data.
Mimi
| |