Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220621163757.760304-1-roberto.sassu@huawei.com>
 <20220621163757.760304-6-roberto.sassu@huawei.com> <20220621223135.puwe3m55yznaevm5@macbook-pro-3.dhcp.thefacebook.com>
 <76c319d5ad1e4ac69ae5d3f71e9d62f7@huawei.com>
In-Reply-To: <76c319d5ad1e4ac69ae5d3f71e9d62f7@huawei.com>
From:   Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date:   Wed, 22 Jun 2022 11:16:33 -0700
Message-ID: <CAADnVQLLMOfXOchNqcTOR9_-ReXrTmNjMf40HD_ZtN+BO3J3fw@mail.gmail.com>
Subject: Re: [PATCH v5 5/5] selftests/bpf: Add test for bpf_verify_pkcs7_signature()
 helper
To:     Roberto Sassu <roberto.sassu@huawei.com>
Cc:     "ast@kernel.org" <ast@kernel.org>,
        "daniel@iogearbox.net" <daniel@iogearbox.net>,
        "andrii@kernel.org" <andrii@kernel.org>,
        "kpsingh@kernel.org" <kpsingh@kernel.org>,
        "john.fastabend@gmail.com" <john.fastabend@gmail.com>,
        "songliubraving@fb.com" <songliubraving@fb.com>,
        "kafai@fb.com" <kafai@fb.com>, "yhs@fb.com" <yhs@fb.com>,
        "dhowells@redhat.com" <dhowells@redhat.com>,
        "keyrings@vger.kernel.org" <keyrings@vger.kernel.org>,
        "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kselftest@vger.kernel.org" <linux-kselftest@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Wed, Jun 22, 2022 at 12:06 AM Roberto Sassu <roberto.sassu@huawei.com> wrote:
>
> > From: Alexei Starovoitov [mailto:alexei.starovoitov@gmail.com]
> > Sent: Wednesday, June 22, 2022 12:32 AM
> > On Tue, Jun 21, 2022 at 06:37:57PM +0200, Roberto Sassu wrote:
> > > +   if (child_pid == 0) {
> > > +           snprintf(path, sizeof(path), "%s/signing_key.pem", tmp_dir);
> > > +
> > > +           return execlp("./sign-file", "./sign-file", "-d", "sha256",
> > > +                         path, path, data_template, NULL);
> >
> > Did you miss my earlier reply requesting not to do this module_signature append
> > and use signature directly?
>
> I didn't miss. sign-file is producing the raw PKCS#7 signature here (-d).
>
> I'm doing something slightly different, to test the keyring ID part.
> I'm retrieving an existing kernel module (actually this does not work
> in the CI), parsing it to extract the raw signature, and passing it to the
> eBPF program for verification.

We don't have signed modules in CI.
When you make changes like this you have to explain that in the commit log.

> Since the kernel module is signed with a key in the built-in keyring,
> passing 1 or 0 as ID should work.
>
> Roberto
>
> (sorry, I have to keep the email signature by German law)

I don't believe that's the case since plenty of people
work from Germany and regularly contribute patches without
such banners.

> HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063
> Managing Director: Li Peng, Yang Xi, Li He