lkml.org 
[lkml]   [2023]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [RFC PATCH 1/2] Modules: Introduce boot-time module signature flexibility
On Thu, Sep 14, 2023 at 11:27:38AM +0000, Alessandro Carminati (Red Hat) wrote:
> This commit introduces a novel boot argument parameter that provides an
> advanced level of control over the verification of module signatures
> during the initial stages of booting. With this enhancement, we gain the
> capability to postpone the verification of module signatures to after
> intrd stage is finished.
>
> Given that bootloader-provided artifacts are commonly employed
> post-verification,

Is such a thing expressed with a kernel config? If so then shouldn't
this be default for those uses cases?

> Signed-off-by: Alessandro Carminati (Red Hat) <alessandro.carminati@gmail.com>
> ---
> include/linux/module.h | 4 +++
> kernel/module/main.c | 14 ++++++-----
> kernel/module/signing.c | 56 +++++++++++++++++++++++++++++++++++++++++
> 3 files changed, 68 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/module.h b/include/linux/module.h
> index a98e188cf37b..9899aeac43b0 100644
> --- a/include/linux/module.h
> +++ b/include/linux/module.h
> @@ -34,6 +34,10 @@
>
> #define MODULE_NAME_LEN MAX_PARAM_PREFIX_LEN
>
> +#ifdef CONFIG_MODULE_SIG
> +extern int module_sig_check_wait;
> +#endif

Please add under is_module_sig_enforced. That's one new line Vs 3 new ones.

I see the code which skips module signature verification and the knobs
but I don't see the code which complete the promise to do the actual
signature verification post initrd / initramfs state. What gives?

Luis

\
 
 \ /
  Last update: 2023-11-20 14:01    [W:0.174 / U:0.168 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site