linux-kernel - Re: [GIT PULL] integrity subsystem updates for v5.13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wjBSomE81D=dXN5Z1r_qTLDeKfOzXH4T+mPK6AeSWhW0w@mail.gmail.com>
Date:   Sat, 1 May 2021 15:49:43 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Mimi Zohar <zohar@...ux.ibm.com>
Cc:     linux-integrity <linux-integrity@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] integrity subsystem updates for v5.13

On Wed, Apr 28, 2021 at 6:47 AM Mimi Zohar <zohar@...ux.ibm.com> wrote:
>
> In addition to loading the kernel module signing key onto the builtin
> keyring, load it onto the IMA keyring as well.

This clashed pretty badly with the other cert changes.

I think the end result looks nice and clean (the cert updates mesh
well with the _intention_ of your code, just not with the
implementation), but you should really double-check that I didn't mess
anything up in the merge and whatever test-case you have for IMA still
works.

I only verified that the kernel module signing key still works for
modules - no IMA test-case.

              Linus