linux-kernel - FIPS-mode panic? (was Re: [PULL] modules)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15269.1350287454@warthog.procyon.org.uk>
Date:	Mon, 15 Oct 2012 08:50:54 +0100
From:	David Howells <dhowells@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Stephan Mueller <stephan.mueller@...ec.com>
Cc:	dhowells@...hat.com, Rusty Russell <rusty@...tcorp.com.au>,
	LKML <linux-kernel@...r.kernel.org>,
	Alex Lyashkov <umka@...udlinux.com>,
	Arnd Bergmann <arnd@...db.com>,
	Dan Carpenter <dan.carpenter@...cle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Dmitry Kasatkin <dmitry.kasatkin@...el.com>,
	Herbert Xu <herbert@...dor.hengli.com.au>,
	Josh Boyer <jwboyer@...hat.com>, linux-crypto@...r.kernel.org,
	Lucas De Marchi <lucas.demarchi@...fusion.mobi>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	Milan Broz <mbroz@...hat.com>,
	Ralf Baechle <ralf@...ux-mips.org>,
	Randy Dunlap <rdunlap@...otime.net>,
	Sam Ravnborg <sam@...nborg.org>
Subject: FIPS-mode panic? (was Re: [PULL] modules)

Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> Hmm. So this thing makes me wonder:
> 
>         /* Not having a signature is only an error if we're strict. */
>         if (err < 0 && fips_enabled)
>                 panic("Module verification failed with error %d in FIPS mode\n",
>                       err);
> 
> do we really want to panic (even in fips_enabled mode)?

That's what the FIPS people want.  As I understand it, if there's some
indication that the crypto stuff is compromised, the box should be shut down
immediately.

I've added Stephan Mueller to see if he can illuminate further.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/