Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751594AbdFIVT4 (ORCPT ); Fri, 9 Jun 2017 17:19:56 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:37078 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751545AbdFIVTy (ORCPT ); Fri, 9 Jun 2017 17:19:54 -0400 References: <1496886555-10082-1-git-send-email-bauerman@linux.vnet.ibm.com> <87d1adihhk.fsf@concordia.ellerman.id.au> From: Thiago Jung Bauermann To: Michael Ellerman Cc: linux-security-module@vger.kernel.org, Jessica Yu , linuxppc-dev@lists.ozlabs.org, Rusty Russell , linux-kernel@vger.kernel.org, "David S. Miller" , David Howells , "AKASHI\, Takahiro" , keyrings@vger.kernel.org, linux-crypto@vger.kernel.org, James Morris , Dmitry Kasatkin , linux-ima-devel@lists.sourceforge.net, Herbert Xu , Mimi Zohar , David Woodhouse , "Serge E. Hallyn" Subject: Re: [PATCH v2 0/6] Appended signatures support for IMA appraisal In-reply-to: <87d1adihhk.fsf@concordia.ellerman.id.au> Date: Fri, 09 Jun 2017 18:19:19 -0300 MIME-Version: 1.0 Content-Type: text/plain X-TM-AS-MML: disable x-cbid: 17060921-0032-0000-0000-00000568D537 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17060921-0033-0000-0000-000011EEEE11 Message-Id: <87efusyi3s.fsf@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-06-09_09:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1706090367 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 785 Lines: 22 Michael Ellerman writes: > Thiago Jung Bauermann writes: > >> On the OpenPOWER platform, secure boot and trusted boot are being >> implemented using IMA for taking measurements and verifying signatures. > > I still want you to implement arch_kexec_kernel_verify_sig() as well :) Yes, I will implement it! We are still working on loading the public keys for kernel signing from the firmware into a kernel keyring, so there's not much point in implementing arch_kexec_kernel_verify_sig without having that first. The same problem also affects IMA: even with these patches, new code still neededs to be added to make IMA use the platform keys for kernel signature verification. -- Thiago Jung Bauermann IBM Linux Technology Center