lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAMw=ZnQUmeOWQkMM9Kn5iYaT4dyDQ3j1K=dUgk9jFNcHPxxHrg@mail.gmail.com> Date: Thu, 8 Dec 2022 20:42:56 +0000 From: Luca Boccassi <bluca@...ian.org> To: Eric Biggers <ebiggers@...nel.org> Cc: linux-fscrypt@...r.kernel.org, linux-ext4@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net, linux-btrfs@...r.kernel.org, linux-integrity@...r.kernel.org, stable@...r.kernel.org Subject: Re: [PATCH] fsverity: don't check builtin signatures when require_signatures=0 On Thu, 8 Dec 2022 at 03:35, Eric Biggers <ebiggers@...nel.org> wrote: > > From: Eric Biggers <ebiggers@...gle.com> > > An issue that arises when migrating from builtin signatures to userspace > signatures is that existing files that have builtin signatures cannot be > opened unless either CONFIG_FS_VERITY_BUILTIN_SIGNATURES is disabled or > the signing certificate is left in the .fs-verity keyring. > > Since builtin signatures provide no security benefit when > fs.verity.require_signatures=0 anyway, let's just skip the signature > verification in this case. > > Fixes: 432434c9f8e1 ("fs-verity: support builtin file signatures") > Cc: <stable@...r.kernel.org> # v5.4+ > Signed-off-by: Eric Biggers <ebiggers@...gle.com> > --- > fs/verity/signature.c | 18 ++++++++++++++++-- > 1 file changed, 16 insertions(+), 2 deletions(-) Acked-by: Luca Boccassi <bluca@...ian.org>
Powered by blists - more mailing lists