Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752254Ab2KFHDS (ORCPT ); Tue, 6 Nov 2012 02:03:18 -0500 Received: from cantor2.suse.de ([195.135.220.15]:60266 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751578Ab2KFHDR (ORCPT ); Tue, 6 Nov 2012 02:03:17 -0500 Date: Tue, 06 Nov 2012 08:03:16 +0100 Message-ID: From: Takashi Iwai To: Ming Lei Cc: Matthew Garrett , Alan Cox , joeyli , Jiri Kosina , David Howells , Rusty Russell , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org Subject: Re: [PATCH RFC 0/4] Add firmware signature file check In-Reply-To: References: <1348152065-31353-1-git-send-email-mjg@redhat.com> <20121029174131.GC7580@srcf.ucam.org> <20121031173728.GA18615@srcf.ucam.org> <1351743715.21227.95.camel@linux-s257.site> <20121101131849.752df6fd@pyramind.ukuu.org.uk> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/24.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1510 Lines: 46 At Tue, 6 Nov 2012 10:30:26 +0800, Ming Lei wrote: > > On Tue, Nov 6, 2012 at 1:18 AM, Takashi Iwai wrote: > > > > To be noted, it doesn't support the firmwares via udev but only the > > direct loading, and the check for built-in firmware is missing, too. > > Generally, both direct loading and udev may request one same firmware > image. And after check failed, current firmware load will fallback on udev > to complete loading, so looks a check-failed firmware still can be loaded > into kernel no matter if there is firmware signature check or not. Yeah, it's just uncovered in the patch. As a easy solution, apply the patch like below to disallow the udev fw loading when signature check is enforced. thanks, Takashi --- diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index 575bc4c..93121c3 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -912,6 +912,13 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent, goto handle_fw; } + /* signature check isn't handled via udev fw loading */ + if (sig_enforce) { + fw_load_abort(fw_priv); + direct_load = 1; + goto handle_fw; + } + /* fall back on userspace loading */ buf->fmt = PAGE_BUF; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/