lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Thu, 23 Nov 2017 06:55:36 -0500
From:   Mimi Zohar <>
To:     "Luis R. Rodriguez" <>
Cc:     Matthew Garrett <>,
        David Howells <>,
        One Thousand Gnomes <>,
        Marcus Meissner <>, Joey Lee <>,
        Jeff Mahoney <>, Jiri Kosina <>,
        Linus Torvalds <>,
        "AKASHI, Takahiro" <>,
        Johannes Berg <>,
        James Bottomley <>,
        Kees Cook <>,
        Stephen Boyd <>,
        Vikram Mulukutla <>,,
        linux-security-module <>,
        James Morris <>
Subject: Re: [RFC PATCH v2] fw_lockdown: new micro LSM module to prevent
 loading unsigned firmware

On Wed, 2017-11-22 at 19:58 +0100, Luis R. Rodriguez wrote:

> I've frankly have grown tired of pushing firmware signing just for the sake of
> the fact that I needed it for cfg80211, but now that its out of the way and
> we open coded it, its no longer a requirement on my part. 

As the keys CFG80211_REQUIRE_SIGNED_REGDB are built into the kernel
image, they would be included in the kernel image signature.

As I previously asked, how are
the keys located in the CFG80211_EXTRA_REGDB_KEYDIR keyring trusted?
 The keyring does not validate the certificate signatures, before
loading the keys on the firmware keyring.  It explicitly bypasses the
certificate signature validation.


Powered by blists - more mailing lists