lkml.org 
[lkml]   [2018]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 04/30] Enforce module signatures if the kernel is locked down
On Thu, Feb 22, 2018 at 01:07:57PM +0000, David Howells wrote:
> I'm considering folding the attached changes into this patch.
>
> It adjusts the errors generated:
>
> (1) If there's no signature (ENODATA) or we can't check it (ENOPKG, ENOKEY),
> then:
>
> (a) If signatures are enforced then EKEYREJECTED is returned.
>
> (b) If IMA will have validated the image, return 0 (okay).
>
> (c) If there's no signature or we can't check it, but the kernel is
> locked down then EPERM is returned (this is then consistent with
> other lockdown cases).
>
> (2) If the signature is unparseable (EBADMSG, EINVAL), the signature fails
> the check (EKEYREJECTED) or a system error occurs (eg. ENOMEM), we return
> the error we got.
>
> Note that the X.509 code doesn't check for key expiry as the RTC might not be
> valid or might not have been transferred to the kernel's clock yet.

Looks good.

Reviewed-by: Jiri Bohac <jbohac@suse.cz>

--
Jiri Bohac <jbohac@suse.cz>
SUSE Labs, Prague, Czechia

\
 
 \ /
  Last update: 2018-02-22 19:44    [W:0.359 / U:0.680 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site