lkml.org 
[lkml]   [2014]   [Jul]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v2] crypto/fips: only panic on bad/missing crypto mod signatures
Date
Am Donnerstag, 3. Juli 2014, 07:18:06 schrieb Neil Horman:
>On Wed, Jul 02, 2014 at 03:37:30PM -0400, Jarod Wilson wrote:
>> Per further discussion with NIST, the requirements for FIPS state
>> that
>> we only need to panic the system on failed kernel module signature
>> checks for crypto subsystem modules. This moves the fips-mode-only
>> module signature check out of the generic module loading code, into
>> the crypto subsystem, at points where we can catch both algorithm
>> module loads and mode module loads. At the same time, make
>> CONFIG_CRYPTO_FIPS dependent on CONFIG_MODULE_SIG, as this is
>> entirely necessary for FIPS mode.
>>
>> v2: remove extraneous blank line, perform checks in static inline
>> function, drop no longer necessary fips.h include.
>>
>> CC: Herbert Xu <herbert@gondor.apana.org.au>
>> CC: "David S. Miller" <davem@davemloft.net>
>> CC: Rusty Russell <rusty@rustcorp.com.au>
>> CC: Stephan Mueller <stephan.mueller@atsec.com>
>> CC: linux-crypto@vger.kernel.org
>> Signed-off-by: Jarod Wilson <jarod@redhat.com>
>
>Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Stephan Mueller <stephan.mueller@atsec.com>



\
 
 \ /
  Last update: 2014-07-03 17:01    [W:0.085 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site