Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3057444imu; Fri, 18 Jan 2019 04:09:06 -0800 (PST) X-Google-Smtp-Source: ALg8bN5KT0xMQ7g6sI8MfZcTtz6Rpkd8oczlnrQ87rKnMDd8A8vDll/j3jg1S+3RY4hjKYFiLV8x X-Received: by 2002:a63:1c09:: with SMTP id c9mr17176534pgc.200.1547813346748; Fri, 18 Jan 2019 04:09:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1547813346; cv=none; d=google.com; s=arc-20160816; b=AzlUpe+LQ1tnWy1u7mI7jPQMG7gHZnnnm2iP3UaREO6n0aBHcl35h19A/pvzhQGFqB 1XyQo3F1cC4kimzEz5iDRCRMP2qH8RO0O1xdHjTyiuXwApvHgGFL0hdyCD2Q5mW8J5MV 9sIt2xn6WbXyN6veuGIaqR8TXimAvs19rqeitZBFVCemXsiztLs+It5ZpmVhFBuouT4h Q6Yu9FBXlAu88z3JuAa8y4M52d4yuSeAKhG3N8xVkA53HEEe09G5zUymwdsxsg7XpmnC aDoyJilG9Srx+50sIo3blUZTTAjafzcXdqAyxFFeoizLMmsbxDKxXYY2vRvQ5wnaZ+Ni DP3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version; bh=efRhbMu40jc01doE6dk+XxasVG9OQ61RtTN2y4dxMGQ=; b=ZtNRNkj6Cgbkr3GcsyXkvjd1xZjxrG0pitVs+/vzJjTKkkVtZiWlrIXDDmBMac6g+w N0ridirFa40K/F0wiMn3HL433r0F42wBVThORbfJl+76y0QlF1Xnj67G1s50VswjWc6c ITU9XbV4zl7ZQmUP5upzAUCr3/Gc0tQKjmz1urGj6jTWOwC6m69IqfdRZaFGCeTvR9by DeokUDynkk0xfVzohWSPkqqeYEIVdgKtv/xJLaZA48WspjpGrr2BGHpzq9+J9L/Fsi83 +rWQSQXh7fmJpbCOUmMGL8D4nKgE/uW1WpBPgUsQBB55i9hs/wlrf9c9gSNZYvklOnay 6Ntg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id j7si4517763plb.91.2019.01.18.04.08.50; Fri, 18 Jan 2019 04:09:06 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727342AbfARMHm (ORCPT + 99 others); Fri, 18 Jan 2019 07:07:42 -0500 Received: from mail-it1-f196.google.com ([209.85.166.196]:38782 "EHLO mail-it1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727230AbfARMHm (ORCPT ); Fri, 18 Jan 2019 07:07:42 -0500 Received: by mail-it1-f196.google.com with SMTP id h65so5464226ith.3 for ; Fri, 18 Jan 2019 04:07:42 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=efRhbMu40jc01doE6dk+XxasVG9OQ61RtTN2y4dxMGQ=; b=kHXvPGwK+IhrJ6bNQ/zPtoZMm9Wz6y2gt8YjasNb1+WzjvnG4ItcaWj/ZE/mrD35B1 BN1JMkClsU0PPq7zqAEkqeJVoS9MkB+0T1hX8TOu+xMoXinmnndd374QCyYTuCTg1lLk dsXm83nnYeQxOqX15egSaor7Lu2JLiSODlUvmhdt/g1sudyqAashDO3VkCkliucBrEy2 NoDdD9HsqU8NmyE9HkiCo+9jcz+OA3EjHTnRb9Jyu402M1fbR+jkkI7kpUULgWD+DDXe 5SofT0jcPss9Tg0quOKGRFcIojSv7aOafsDisIaH3PXAWGHAd5wnGFotvScn9xOB01Tc vaRw== X-Gm-Message-State: AJcUukd8/Ab4NcT/RyRK5Qyz9j76jsrsx6ZeHJbiFeYQ6piP/K2jfPJT NnuxXKch2Ny/5RTE51tii9NpnkfHdNw0J35oRAIzI1pa7VLVXA== X-Received: by 2002:a24:4d05:: with SMTP id l5mr2029393itb.147.1547813261576; Fri, 18 Jan 2019 04:07:41 -0800 (PST) MIME-Version: 1.0 References: <20190118091733.29940-1-kasong@redhat.com> <1547812432.3982.55.camel@linux.ibm.com> In-Reply-To: <1547812432.3982.55.camel@linux.ibm.com> From: Kairui Song Date: Fri, 18 Jan 2019 20:07:30 +0800 Message-ID: Subject: Re: [PATCH v4 0/2] let kexec_file_load use platform keyring to verify the kernel image To: Mimi Zohar Cc: Linux Kernel Mailing List , David Howells , David Woodhouse , jwboyer@fedoraproject.org, keyrings@vger.kernel.org, jmorris@namei.org, serge@hallyn.com, bauerman@linux.ibm.com, Eric Biggers , nayna@linux.ibm.com, Dave Young , linux-integrity , kexec@lists.infradead.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jan 18, 2019, 19:54 Mimi Zohar > On Fri, 2019-01-18 at 17:17 +0800, Kairui Song wrote: > > This patch series adds a .platform_trusted_keys in system_keyring as the > > reference to .platform keyring in integrity subsystem, when platform > > keyring is being initialized it will be updated. So other component could > > use this keyring as well. > > Kairui, when people review patches, the comments could be specific, > but are normally generic. My review included a couple of generic > suggestions - not to use "#ifdef" in C code (eg. is_enabled), use the > term "preboot" keys, and remove any references to "other components". > > After all the wording suggestions I've made, you are still saying, "So > other components could use this keyring as well". Really?! How the > platform keyring will be used in the future, is up to you and others > to convince Linus. At least for now, please limit its usage to > verifying the PE signed kernel image. If this patch set needs to be > reposted, please remove all references to "other components". > > Dave/David, are you ok with Kairui's usage of "#ifdef's"? Dave, you > Acked the original post. Can I include it? Can we get some > additional Ack's on these patches? > > thanks! > > Mimi > Hi, Mimi, thanks for your feedback. My bad I reused the old cover letter without checking it carefully, hopefully, the commit messages should have a proper wording now. If the cover letter needs to be updated I can resend the patch, let me just hold a while before update again.