All of lore.kernel.org
 help / color / mirror / Atom feed
From: Matthew Garrett <mjg59@google.com>
To: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: linux-integrity <linux-integrity@vger.kernel.org>, wangjunwen@baidu.com
Subject: Re: [PATCH V4] evm: Allow non-SHA1 digital signatures
Date: Tue, 29 May 2018 11:26:20 -0700	[thread overview]
Message-ID: <CACdnJuvd8Y9N1Bds474BXiikc5R8c41gaHGpJEUO2z_vkXG-XQ@mail.gmail.com> (raw)
In-Reply-To: <1526659412.3404.32.camel@linux.vnet.ibm.com>

On Fri, May 18, 2018 at 9:03 AM Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:

> On Thu, 2018-05-17 at 15:09 -0700, Matthew Garrett wrote:
> > Oh bother - I think I see what's wrong. Does this version work better?
> > I'm afraid I only tested against signatures rather than HMACs, and I was
> > generating a raw SHA1 rather than an HMAC :(

> That's a lot better!

> FYI, Wang Junwen reported a problem with enabling EVM with just the
> immutable and portable keys.  Without trusted keys enabled, SHA1 isn't
> being built into the kernel.  Loading the SHA1 kernel module fails.
>   Without knowing apriori which hash algorithms need to be builtin is a
> problem.

It looks like Kconfig is selecting CRYPTO_SHA1 when EVM is enabled, and
since that's a bool it should be forcing it to be built-in? I can't see a
good way of extending that generally, unfortunately. Is the problem with
loading the module that you're enforcing an IMA policy before loading it?

  reply	other threads:[~2018-05-29 18:26 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-15 17:53 [PATCH V4] evm: Allow non-SHA1 digital signatures Matthew Garrett
2018-05-16 22:12 ` Mimi Zohar
2018-05-17 22:09   ` Matthew Garrett
2018-05-18 16:03     ` Mimi Zohar
2018-05-29 18:26       ` Matthew Garrett [this message]
     [not found]         ` <15252CF8C1B4384C8CE16D7D55C66479011414E7BF@BC-MAIL-M04.internal.baidu.com>
2018-05-30 18:29           ` Matthew Garrett
2018-05-30 20:28             ` [PATCH] evm: Don't deadlock if a crypto algorithm is unavailable Matthew Garrett
     [not found]               ` <15252CF8C1B4384C8CE16D7D55C66479011414E83B@BC-MAIL-M04.internal.baidu.com>
2018-05-31 19:30                 ` Matthew Garrett
2018-05-31 19:55                   ` Mimi Zohar
2018-05-31 20:07                     ` Matthew Garrett
2018-05-31 20:32                       ` Mimi Zohar
2018-05-31 21:06                         ` Matthew Garrett
2018-06-01 11:21                           ` Mimi Zohar
2018-06-01 20:52                             ` Matthew Garrett
2018-06-01 22:26                               ` Mimi Zohar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CACdnJuvd8Y9N1Bds474BXiikc5R8c41gaHGpJEUO2z_vkXG-XQ@mail.gmail.com \
    --to=mjg59@google.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=wangjunwen@baidu.com \
    --cc=zohar@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.