Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 10.1 \(3246\))
Subject: Re: [PATCH 1/4] KEYS: Insert incompressible bytes to reserve space in
 bzImage
From: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com>
In-Reply-To: <14475.1480064784@warthog.procyon.org.uk>
Date: Fri, 25 Nov 2016 14:49:17 -0500
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>,
        Stefan Berger <stefanb@linux.vnet.ibm.com>,
        George Wilson <gcwilson@us.ibm.com>,
        LSM <linux-security-module@vger.kernel.org>, keyrings@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 8BIT
References: <1479787880-31811-2-git-send-email-mkayaalp@linux.vnet.ibm.com>
 <1479787880-31811-1-git-send-email-mkayaalp@linux.vnet.ibm.com>
 <14475.1480064784@warthog.procyon.org.uk>
To: David Howells <dhowells@redhat.com>
Message-Id: <FC2E387E-55A7-4AD8-AA0A-8BAD9F0B5FC9@linux.vnet.ibm.com>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1156
Lines: 30


> On Nov 25, 2016, at 4:06 AM, David Howells <dhowells@redhat.com> wrote:
> 
> Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> wrote:
> 
>> Include a random filled binary in vmlinux at the space reserved with
>> CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved
>> area inside the bzImage as well, so that it can be replaced with an actual
>> certificate later (after the bzImage is distributed).
> 
> You haven't said *why* you need an incompressible buffer.  I presume it's
> something to do with the decompression wrapper.
> 

After you replace zeroes with a certificate and compress again, the image size
increases. Then, repackaging the bzImage becomes difficult.

>From the commit message of 3/4:

> This patch adds the capability of extracting the
> vmlinux, inserting the certificate, and repackaging the result into a
> bzImage.
> 
> It only works if the resulting compressed vmlinux is smaller than the
> original. Otherwise re-linking would be required. To make the reserved
> space allocate actual space in bzImage, incompressible bytes are
> inserted into the vmlinux as a placeholder for the extra certificate.

Mehmet