Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [RFC PATCH 2/2] PKCS#7: Check codeSigning EKU for kernel module
 and kexec pe verification
To:     list.lkml.keyrings@me.benboeckel.net,
        "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
Cc:     David Howells <dhowells@redhat.com>,
        Herbert Xu <herbert@gondor.apana.org.au>,
        "David S . Miller" <davem@davemloft.net>, keyrings@vger.kernel.org,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        "Lee, Chun-Yi" <jlee@suse.com>
References: <20201020065001.13836-1-jlee@suse.com>
 <20201020065001.13836-3-jlee@suse.com>
 <20201020134208.GA297878@erythro.dev.benboeckel.internal>
From:   Randy Dunlap <rdunlap@infradead.org>
Message-ID: <885f1b81-6141-a3be-1dc0-92c1fc825e3c@infradead.org>
Date:   Tue, 20 Oct 2020 07:56:29 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.12.0
MIME-Version: 1.0
In-Reply-To: <20201020134208.GA297878@erythro.dev.benboeckel.internal>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 10/20/20 6:42 AM, Ben Boeckel wrote:
> On Tue, Oct 20, 2020 at 14:50:01 +0800, Lee, Chun-Yi wrote:
>> +config CHECK_CODESIGN_EKU
>> +	bool "Check codeSigning extended key usage"
>> +	depends on PKCS7_MESSAGE_PARSER=y
>> +	depends on SYSTEM_DATA_VERIFICATION
>> +	help
>> +	  This option provides support for checking the codeSigning extended
>> +	  key usage extension when verifying the signature in PKCS#7. It

	  extended ... extension.
Can we drop one of those or reword it?

>> +	  affects kernel module verification and kexec PE binary verification
>> +	  now.
> 
> Is the "now" necessary? Isn't it implied by the option's existence?


-- 
~Randy