From: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> To: David Howells <dhowells@redhat.com> Cc: David Woodhouse <dwmw2@infradead.org>, keyrings <keyrings@vger.kernel.org>, LSM <linux-security-module@vger.kernel.org>, kernel <linux-kernel@vger.kernel.org>, Mimi Zohar <zohar@linux.vnet.ibm.com>, Stefan Berger <stefanb@linux.vnet.ibm.com>, George Wilson <gcwilson@us.ibm.com>, Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> Subject: [PATCH v5 0/4] Certificate insertion support for x86 bzImages Date: Wed, 10 May 2017 14:20:52 -0400 [thread overview] Message-ID: <1494440456-28671-1-git-send-email-mkayaalp@linux.vnet.ibm.com> (raw) These patches add support for modifying the reserved space for extra certificates in a compressed bzImage in x86. This allows separating the system keyring certificate from the kernel build process. After the kernel image is distributed, the insert-sys-cert script can be used to insert the certificate for x86. Changes: v5: * Added CRC fixing (3/4) v4: * Applied checkpatch.pl suggestions (2/4, 3/4) * Cleaned up the commit messages (1/4, 2/4) * Added the build file to .gitignore (1/4) v3: * Rewrote 1/4 to insert incompressible bytes are at build time. Previous solution required changes to <arch>/boot/Makefile's for modifying the vmlinux file after linking, and did not work well with cross compilation. * Added 2/4 for ELF class-independent processing of vmlinux file, in case the script was compiled for 64-bit and the kernel was compiled for 32-bit. * Reordered 3/4, added x86 bzImage boot version (>=2.08) verification. v2: * Rebased arch/boot/x86/Makefile patch (removed in v3) Mehmet Kayaalp (4): KEYS: Insert incompressible bytes to reserve space in bzImage KEYS: Add ELF class-independent certificate insertion support KEYS: Support for inserting a certificate into x86 bzImage KEYS: Print insert-sys-cert information to stdout instead of stderr certs/.gitignore | 1 + certs/Makefile | 21 +- certs/system_certificates.S | 2 +- scripts/Makefile | 1 + scripts/insert-sys-cert.c | 473 +++++++++++++++++++++++++++++++++----------- 5 files changed, 381 insertions(+), 117 deletions(-) -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: mkayaalp@linux.vnet.ibm.com (Mehmet Kayaalp) To: linux-security-module@vger.kernel.org Subject: [PATCH v5 0/4] Certificate insertion support for x86 bzImages Date: Wed, 10 May 2017 14:20:52 -0400 [thread overview] Message-ID: <1494440456-28671-1-git-send-email-mkayaalp@linux.vnet.ibm.com> (raw) These patches add support for modifying the reserved space for extra certificates in a compressed bzImage in x86. This allows separating the system keyring certificate from the kernel build process. After the kernel image is distributed, the insert-sys-cert script can be used to insert the certificate for x86. Changes: v5: * Added CRC fixing (3/4) v4: * Applied checkpatch.pl suggestions (2/4, 3/4) * Cleaned up the commit messages (1/4, 2/4) * Added the build file to .gitignore (1/4) v3: * Rewrote 1/4 to insert incompressible bytes are at build time. Previous solution required changes to <arch>/boot/Makefile's for modifying the vmlinux file after linking, and did not work well with cross compilation. * Added 2/4 for ELF class-independent processing of vmlinux file, in case the script was compiled for 64-bit and the kernel was compiled for 32-bit. * Reordered 3/4, added x86 bzImage boot version (>=2.08) verification. v2: * Rebased arch/boot/x86/Makefile patch (removed in v3) Mehmet Kayaalp (4): KEYS: Insert incompressible bytes to reserve space in bzImage KEYS: Add ELF class-independent certificate insertion support KEYS: Support for inserting a certificate into x86 bzImage KEYS: Print insert-sys-cert information to stdout instead of stderr certs/.gitignore | 1 + certs/Makefile | 21 +- certs/system_certificates.S | 2 +- scripts/Makefile | 1 + scripts/insert-sys-cert.c | 473 +++++++++++++++++++++++++++++++++----------- 5 files changed, 381 insertions(+), 117 deletions(-) -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next reply other threads:[~2017-05-10 18:21 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-05-10 18:20 Mehmet Kayaalp [this message] 2017-05-10 18:20 ` [PATCH v5 0/4] Certificate insertion support for x86 bzImages Mehmet Kayaalp 2017-05-10 18:20 ` [PATCH v5 1/4] KEYS: Insert incompressible bytes to reserve space in bzImage Mehmet Kayaalp 2017-05-10 18:20 ` Mehmet Kayaalp 2017-05-10 18:20 ` [PATCH v5 2/4] KEYS: Add ELF class-independent certificate insertion support Mehmet Kayaalp 2017-05-10 18:20 ` Mehmet Kayaalp 2017-05-10 18:20 ` [PATCH v5 3/4] KEYS: Support for inserting a certificate into x86 bzImage Mehmet Kayaalp 2017-05-10 18:20 ` Mehmet Kayaalp 2017-05-10 18:20 ` [PATCH v5 4/4] KEYS: Print insert-sys-cert information to stdout instead of stderr Mehmet Kayaalp 2017-05-10 18:20 ` Mehmet Kayaalp 2017-09-25 6:12 ` [PATCH v5 0/4] Certificate insertion support for x86 bzImages Mike Rapoport 2017-09-25 6:12 ` Mike Rapoport 2017-09-25 6:12 ` Mike Rapoport 2017-11-08 13:30 ` [PATCH v5 2/4] KEYS: Add ELF class-independent certificate insertion support David Howells 2017-11-08 13:30 ` David Howells 2017-11-08 13:30 ` David Howells
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1494440456-28671-1-git-send-email-mkayaalp@linux.vnet.ibm.com \ --to=mkayaalp@linux.vnet.ibm.com \ --cc=dhowells@redhat.com \ --cc=dwmw2@infradead.org \ --cc=gcwilson@us.ibm.com \ --cc=keyrings@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=stefanb@linux.vnet.ibm.com \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.