Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752561AbbH0KjP (ORCPT ); Thu, 27 Aug 2015 06:39:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33610 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751694AbbH0KjM convert rfc822-to-8bit (ORCPT ); Thu, 27 Aug 2015 06:39:12 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20150826232622.GC8051@wotan.suse.de> References: <20150826232622.GC8051@wotan.suse.de> <20150824210234.GI8051@wotan.suse.de> <476DC76E7D1DF2438D32BFADF679FC5601057D32@ORSMSX103.amr.corp.intel.com> <20150824225713.GJ8051@wotan.suse.de> <476DC76E7D1DF2438D32BFADF679FC5601058E78@ORSMSX103.amr.corp.intel.com> <1440462367.2737.4.camel@linux.vnet.ibm.com> <1440464705.2737.36.camel@linux.vnet.ibm.com> <14540.1440599584@warthog.procyon.org.uk> To: "Luis R. Rodriguez" Cc: dhowells@redhat.com, Mimi Zohar , Andy Lutomirski , Kees Cook , "Roberts, William C" , "linux-security-module@vger.kernel.org" , linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, "james.l.morris@oracle.com" , "serge@hallyn.com" , Vitaly Kuznetsov , Paul Moore , Eric Paris , selinux@tycho.nsa.gov, Stephen Smalley , "Schaufler, Casey" , "Luis R. Rodriguez" , Dmitry Kasatkin , Greg Kroah-Hartman , Peter Jones , Takashi Iwai , dwmw2@infradead.org, Ming Lei , Joey Lee , =?utf-8?Q?Vojt=C4=9Bch_Pavl=C3=ADk?= , Kyle McMartin , Seth Forshee , Matthew Garrett , Johannes Berg Subject: Re: Linux Firmware Signing MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <31227.1440671938.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Thu, 27 Aug 2015 11:38:58 +0100 Message-ID: <31228.1440671938@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1508 Lines: 35 Luis R. Rodriguez wrote: > "PKCS#7: Add an optional authenticated attribute to hold firmware name" > https://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/commit/?h=fwsign-pkcs7&id=1448377a369993f864915743cfb34772e730213good > > 1.3.6.1.4.1.2312.16 Linux kernel > 1.3.6.1.4.1.2312.16.2 - PKCS#7/CMS SignerInfo attribute types > 1.3.6.1.4.1.2312.16.2.1 - firmwareName > > I take it you are referring to this? Yes. > If we follow this model we'd then need something like: > > 1.3.6.1.4.1.2312.16.2.2 - seLinuxPolicyName > > That should mean each OID that has different file names would need to be > explicit about and have a similar entry on the registry. I find that pretty > redundant and would like to avoid that if possible. firmwareName is easy for people to understand - it's the name the kernel asks for and the filename of the blob. seLinuxPolicyName is, I think, a lot more tricky since a lot of people don't use SELinux, and most that do don't understand it (most people that use it aren't even really aware of it). If you can use the firmwareName as the SELinux/LSM key, I would suggest doing so - even if you dress it up as a path (/lib/firmware/). David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/