Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

[David Howells]

Yihao Wu <wuyihao@linux.alibaba.com> wrote:

> Signed-off-by: Yihao Wu <wuyihao@xxxxxxxxxxxxxxxxx>

xxxxxxxxxxxxxxxxx?  Can I substitute your actual domain name for that?

David

Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

[David Howells]

Yihao Wu <wuyihao@linux.alibaba.com> wrote:

> +    prep->expiry = cert->valid_to;

Note that this patch has whitespace breakage, but I can fix that up by hand.

David

Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

[Jia Zhang]

On 2019/8/30 下午11:25, David Howells wrote:
> Yihao Wu <wuyihao@linux.alibaba.com> wrote:
> 
>> Signed-off-by: Yihao Wu <wuyihao@xxxxxxxxxxxxxxxxx>
> 
> xxxxxxxxxxxxxxxxx?  Can I substitute your actual domain name for that?

Yes you can. Yihao just went on vacation.

Thanks,
Jia

> 
> David
> 

Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

[Yihao Wu]

On 2019/8/30 11:54 PM, David Howells wrote:
> Yihao Wu <wuyihao@linux.alibaba.com> wrote:
> 
>> +    prep->expiry = cert->valid_to;
> 
> Note that this patch has whitespace breakage, but I can fix that up by hand.
> 
> David
> 

Thanks!

Yihao

Re: [PATCH RESEND] KEYS: pass expiry from X.509 cert to key structure

[David Howells]

Yihao Wu <wuyihao@linux.alibaba.com> wrote:

> Expiry time is not utilized by X.509 cert yet. This patch reads expiry
> from X.509 cert into key_preparsed_payload. Then it is passed to key
> structure when the key is being instantiated.

Thinking on it again, it's more complicated than you think: Unless you can
guarantee that the system clock is correct at time of boot, this may cause the
system to fail to boot.  The certs used for module signing and suchlike may
appear to be expired because the clock is wrong and thus not be usable.

David