Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1425609AbdDUTrl (ORCPT ); Fri, 21 Apr 2017 15:47:41 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:55007 "EHLO out1-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1425526AbdDUTrh (ORCPT ); Fri, 21 Apr 2017 15:47:37 -0400 X-ME-Sender: X-Sasl-enc: /ip5QLkfb/bKjj9VxsLu/uVHH0AJS2RvH2fgbd8homxA 1492804055 Date: Fri, 21 Apr 2017 16:47:32 -0300 From: Henrique de Moraes Holschuh To: Mehmet Kayaalp Cc: David Howells , David Woodhouse , keyrings , LSM , kernel , Mimi Zohar , Stefan Berger , George Wilson Subject: Re: [PATCH v4 1/4] KEYS: Insert incompressible bytes to reserve space in bzImage Message-ID: <20170421194732.GB23671@khazad-dum.debian.net> References: <1492727320-26194-1-git-send-email-mkayaalp@linux.vnet.ibm.com> <1492727320-26194-2-git-send-email-mkayaalp@linux.vnet.ibm.com> <20170420231332.GA10262@khazad-dum.debian.net> <34372BAD-2FE2-458D-9331-AA277B1764C7@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <34372BAD-2FE2-458D-9331-AA277B1764C7@linux.vnet.ibm.com> X-GPG-Fingerprint1: 4096R/0x0BD9E81139CB4807: C467 A717 507B BAFE D3C1 6092 0BD9 E811 39CB 4807 User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1362 Lines: 29 On Thu, 20 Apr 2017, Mehmet Kayaalp wrote: > > On Apr 20, 2017, at 7:13 PM, Henrique de Moraes Holschuh wrote: > > On Thu, 20 Apr 2017, Mehmet Kayaalp wrote: > >> Include a random filled binary in vmlinux at the space reserved with > >> CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved ... > > Alternatively, you could ship a static file with random data that has > > been tested to be uncompressible "enough" for every currently supported > > compression engine, maybe with a bit of a safety margin just in case a > > future compression engine does somewhat better... > > The seed makes it static for a given size, and I tested it to be > incompressible. But I don't know about the safety margin. Even without the If you tested the result to be incompressible enough, it is fine with me. > compression, the reserved size is not accurate. If you reserve 4096 bytes, > the DER encoded certificate inserted is not going to be exactly 4096 either > (for reference, the built-in certificate is 1346 bytes). Compression makes it > a little more inaccurate, but is over-provisioning several hundreds of bytes > a concern when the bzImage is several megabytes? Maybe for embedded, but in that case any overprovisioning would already be too much, and one has to fix the issue in some other way. -- Henrique Holschuh