Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759683Ab2JaSx4 (ORCPT ); Wed, 31 Oct 2012 14:53:56 -0400 Received: from cantor2.suse.de ([195.135.220.15]:36184 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752503Ab2JaSxy (ORCPT ); Wed, 31 Oct 2012 14:53:54 -0400 Date: Wed, 31 Oct 2012 19:53:52 +0100 Message-ID: From: Takashi Iwai To: Matthew Garrett Cc: Jiri Kosina , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-efi@vger.kernel.org Subject: Re: [RFC] Second attempt at kernel secure boot support In-Reply-To: <20121031173728.GA18615@srcf.ucam.org> References: <1348152065-31353-1-git-send-email-mjg@redhat.com> <20121029174131.GC7580@srcf.ucam.org> <20121031173728.GA18615@srcf.ucam.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/24.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1192 Lines: 31 At Wed, 31 Oct 2012 17:37:28 +0000, Matthew Garrett wrote: > > On Wed, Oct 31, 2012 at 06:28:16PM +0100, Takashi Iwai wrote: > > > request_firmware() is used for microcode loading, too, so it's fairly > > a core part to cover, I'm afraid. > > > > I played a bit about this yesterday. The patch below is a proof of > > concept to (ab)use the module signing mechanism for firmware loading > > too. Sign firmware files via scripts/sign-file, and put to > > /lib/firmware/signed directory. > > That does still leave me a little uneasy as far as the microcode > licenses go. I don't know that we can distribute signed copies of some > of them, and we obviously can't sign at the user end. Yeah, that's a concern. Although this is a sort of "container" and keeping the original data as is, it might be regarded as a modification. Another approach would be to a signature in a separate file, but I'm not sure whether it makes sense. Takashi -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/