Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932852Ab2KESMk (ORCPT ); Mon, 5 Nov 2012 13:12:40 -0500 Received: from cantor2.suse.de ([195.135.220.15]:39542 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754191Ab2KESMi (ORCPT ); Mon, 5 Nov 2012 13:12:38 -0500 Date: Mon, 05 Nov 2012 19:12:36 +0100 Message-ID: From: Takashi Iwai To: Matthew Garrett Cc: Alan Cox , joeyli , Jiri Kosina , David Howells , Rusty Russell , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org Subject: Re: [PATCH RFC 0/4] Add firmware signature file check In-Reply-To: References: <1348152065-31353-1-git-send-email-mjg@redhat.com> <20121029174131.GC7580@srcf.ucam.org> <20121031173728.GA18615@srcf.ucam.org> <1351743715.21227.95.camel@linux-s257.site> <20121101131849.752df6fd@pyramind.ukuu.org.uk> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/24.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1043 Lines: 26 At Mon, 05 Nov 2012 18:18:24 +0100, Takashi Iwai wrote: > > Hi, > > this is a patch series to add the support for firmware signature > check. At this time, the kernel checks extra signature file (*.sig) > for each firmware, instead of embedded signature. > It's just a quick hack using the existing module signing mechanism, > thus provided only as a proof of concept for now. > > To be noted, it doesn't support the firmwares via udev but only the > direct loading, and the check for built-in firmware is missing, too. On the second thought, checking the signature for builtin firmwares is superfluous. And udev usage for firmware loading should be pretty rare with 3.7 kernel. So, locking down the udev loading case when sig_enforce = true should suffice in most cases, I guess. Takashi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/