Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756937AbbESPTT (ORCPT ); Tue, 19 May 2015 11:19:19 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:44126 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756858AbbESPTM (ORCPT ); Tue, 19 May 2015 11:19:12 -0400 Message-ID: <1432048742.3277.57.camel@infradead.org> Subject: Re: [PATCH] MODSIGN: Change default key details [ver #2] From: David Woodhouse To: David Howells Cc: Michal Marek , Linus Torvalds , Abelardo Ricart III , Linux Kernel Mailing List , Sedat Dilek , keyrings@linux-nfs.org, Rusty Russell , LSM List , James Morris , Greg Kroah-Hartman Date: Tue, 19 May 2015 16:19:02 +0100 In-Reply-To: <18833.1432044859@warthog.procyon.org.uk> References: <5551BF1B.3020108@suse.cz> <20150507122445.GB4912@sepie.suse.cz> <1430516505-4812-1-git-send-email-aricart@memnix.com> <1430559977.5803.12.camel@memnix.com> <5548E02A.5050006@suse.cz> <9365.1430996458@warthog.procyon.org.uk> <20150507121546.GA4912@sepie.suse.cz> <25251.1431090354@warthog.procyon.org.uk> <18833.1432044859@warthog.procyon.org.uk> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.12.11 (3.12.11-1.fc21) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org See http://www.infradead.org/rpr.html Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1634 Lines: 40 On Tue, 2015-05-19 at 15:14 +0100, David Howells wrote: > > > Right. In this very thread :-). But are you fine with using *.auto for > > the generated files? I'll send a rebased series. > > Can you send me your patches and I'll add them to this: > > http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=modsign-pkcs7 > > Then I can integrate them with David Woodhouse's patches in the same > area and pass the branch on to James Morris. We're talking about these three patches, yes? https://lkml.org/lkml/2015/2/20/546 https://lkml.org/lkml/2015/5/4/614 https://lkml.org/lkml/2015/5/7/488 I think the third is obsolete now that we allow the user to provide their own certificate + key by setting CONFIG_MODULE_SIG_KEY, because the in-tree signing_key.{priv,x509} are *always* autogenerated. The first two I don't think go far enough. I dislike automatically picking up files that were lying around in the tree, and it's still going to break if there's a file with a space in its name. Let's just introduce a new Kconfig option for 'extra certificates' which takes the filename of a PEM-format file. We can process that into DER form with some fairly trivial modifications to scripts/extract-cert.c. -- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/