Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753162Ab2KFHQs (ORCPT ); Tue, 6 Nov 2012 02:16:48 -0500 Received: from mail-ee0-f46.google.com ([74.125.83.46]:51148 "EHLO mail-ee0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752068Ab2KFHQp (ORCPT ); Tue, 6 Nov 2012 02:16:45 -0500 MIME-Version: 1.0 In-Reply-To: References: <1348152065-31353-1-git-send-email-mjg@redhat.com> <20121029174131.GC7580@srcf.ucam.org> <20121031173728.GA18615@srcf.ucam.org> <1351743715.21227.95.camel@linux-s257.site> <20121101131849.752df6fd@pyramind.ukuu.org.uk> Date: Tue, 6 Nov 2012 15:16:43 +0800 Message-ID: Subject: Re: [PATCH RFC 0/4] Add firmware signature file check From: Ming Lei To: Takashi Iwai Cc: Matthew Garrett , Alan Cox , joeyli , Jiri Kosina , David Howells , Rusty Russell , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1439 Lines: 46 On Tue, Nov 6, 2012 at 3:03 PM, Takashi Iwai wrote: > > Yeah, it's just uncovered in the patch. As a easy solution, apply the > patch like below to disallow the udev fw loading when signature check > is enforced. > > > thanks, > > Takashi > > --- > diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c > index 575bc4c..93121c3 100644 > --- a/drivers/base/firmware_class.c > +++ b/drivers/base/firmware_class.c > @@ -912,6 +912,13 @@ static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent, > goto handle_fw; > } > > + /* signature check isn't handled via udev fw loading */ > + if (sig_enforce) { > + fw_load_abort(fw_priv); > + direct_load = 1; > + goto handle_fw; > + } > + The above might be wrong if the firmware file doesn't exist in default search paths. You should skip loading from user space only if verify_signature() returns false. And the udev loading should be resorted to if there is no such firmware file in default search paths. > /* fall back on userspace loading */ > buf->fmt = PAGE_BUF; > Thanks, -- Ming Lei -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/