lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 31 May 2012 11:35:23 -0400 From: Josh Boyer <jwboyer@...il.com> To: Rusty Russell <rusty@...tcorp.com.au> Cc: David Howells <dhowells@...hat.com>, kyle@...artin.ca, linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org, keyrings@...ux-nfs.org Subject: Re: [PATCH 00/23] Crypto keys and module signing On Sun, May 27, 2012 at 1:41 AM, Rusty Russell <rusty@...tcorp.com.au> wrote: > On Thu, 24 May 2012 15:00:51 +0100, David Howells <dhowells@...hat.com> wrote: >> > > Why would you want multiple signatures? That just complicates things. >> > >> > The code above stays pretty simple; if the signature fails, you set size >> > to i, and loop again. As I said, if you know exactly how you're going >> > to strip the modules, you can avoid storing the stripped module and >> > simply append both signatures. >> >> You still haven't justified it. One of your arguments about rejecting the ELF >> parsing version was that it was too big for no useful extra value that I could >> justify. Supporting multiple signatures adds extra size and complexity for no >> obvious value. > > One loop is a lot easier to justify that the ELF-parsing mess. And it > can be done in a backwards compatible way tomorrow: old kernels will > only check the last signature. > > I had assumed you'd rather maintain a stable strip util which you can > use on kernel modules than rework your module builds. I guess not. Could you elaborate on this part a bit? Do you mean integrate a standalone strip utility in the kernel sources and maintain that for use during module builds? Or am I misunderstanding and you meant something else? I can see how that sounds simple and desirable from one aspect, but it seems somewhat odd to me to duplicate the existing (or create from scratch) strip utilities. josh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists