linux-kernel - Re: [RFC PATCH 2/2] PKCS#7: Check codeSigning EKU for kernel module and kexec pe verification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <885f1b81-6141-a3be-1dc0-92c1fc825e3c@infradead.org>
Date:   Tue, 20 Oct 2020 07:56:29 -0700
From:   Randy Dunlap <rdunlap@...radead.org>
To:     list.lkml.keyrings@...benboeckel.net,
        "Lee, Chun-Yi" <joeyli.kernel@...il.com>
Cc:     David Howells <dhowells@...hat.com>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        "David S . Miller" <davem@...emloft.net>, keyrings@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
        "Lee, Chun-Yi" <jlee@...e.com>
Subject: Re: [RFC PATCH 2/2] PKCS#7: Check codeSigning EKU for kernel module
 and kexec pe verification

On 10/20/20 6:42 AM, Ben Boeckel wrote:
> On Tue, Oct 20, 2020 at 14:50:01 +0800, Lee, Chun-Yi wrote:
>> +config CHECK_CODESIGN_EKU
>> +	bool "Check codeSigning extended key usage"
>> +	depends on PKCS7_MESSAGE_PARSER=y
>> +	depends on SYSTEM_DATA_VERIFICATION
>> +	help
>> +	  This option provides support for checking the codeSigning extended
>> +	  key usage extension when verifying the signature in PKCS#7. It

	  extended ... extension.
Can we drop one of those or reword it?

>> +	  affects kernel module verification and kexec PE binary verification
>> +	  now.
> 
> Is the "now" necessary? Isn't it implied by the option's existence?


-- 
~Randy