linux-kernel - Re: [PATCH 00/23] Crypto keys and module signing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 25 May 2012 13:18:23 +0100
From:	David Howells <dhowells@...hat.com>
To:	rusty@...tcorp.com.au
Cc:	dhowells@...hat.com, kyle@...artin.ca,
	linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org, keyrings@...ux-nfs.org
Subject: Re: [PATCH 00/23] Crypto keys and module signing


I've posted a new version with Tetsuo's comments fixed and
module_verify_signature() reduced to:

static int module_verify_signature(const void *data, size_t size)
{
	struct crypto_key_verify_context *mod_sig;
	const char *cp, *sig;
	char *end;
	size_t magic_size, sig_size, mod_size;
	int ret;

	magic_size = sizeof(modsign_magic) - 1;
	if (size <= 5 + magic_size)
		return 1;

	if (memcmp(data + size - magic_size, modsign_magic, magic_size) != 0)
		return 1;
	size -= 5 + magic_size;

	cp = data + size;
	sig_size = simple_strtoul(cp, &end, 10);
	if (sig_size >= size || (*end != ' ' && *end != 'T'))
		return -ELIBBAD;

	mod_size = size - sig_size;
	sig = data + mod_size;

	/* Find the crypto key for the module signature
	 * - !!! if this tries to load the required hash algorithm module,
	 *       we will deadlock!!!
	 */
	mod_sig = verify_sig_begin(modsign_keyring, sig, sig_size);
	if (IS_ERR(mod_sig)) {
		pr_err("Couldn't initiate module signature verification: %ld\n",
		       PTR_ERR(mod_sig));
		return PTR_ERR(mod_sig);
	}

	/* Load the module contents into the digest */
	ret = verify_sig_add_data(mod_sig, data, mod_size);
	if (ret < 0) {
		verify_sig_cancel(mod_sig);
		return ret;
	}

	/* Do the actual signature verification */
	ret = verify_sig_end(mod_sig, sig, sig_size);
	pr_devel("verify-sig : %d\n", ret);
	return ret;
}

See:

http://git.kernel.org/?p=linux/kernel/git/dhowells/linux-modsign.git;a=shortlog;h=refs/heads/modsign-rusty

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/