linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Vivek Goyal <vgoyal@redhat.com>
To: Dave Young <dyoung@redhat.com>
Cc: Yannik Sembritzki <yannik@sembritzki.me>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	David Howells <dhowells@redhat.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Peter Anvin <hpa@zytor.com>,
	the arch/x86 maintainers <x86@kernel.org>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Baoquan He <bhe@redhat.com>, Justin Forbes <jforbes@redhat.com>,
	Peter Jones <pjones@redhat.com>,
	James Bottomley <James.Bottomley@hansenpartnership.com>,
	Matthew Garrett <mjg59@google.com>
Subject: Re: [PATCH 2/2] [FIXED v2] Replace magic for trusting the secondary keyring with #define
Date: Thu, 16 Aug 2018 08:46:32 -0400	[thread overview]
Message-ID: <20180816124632.GA24061@redhat.com> (raw)
In-Reply-To: <20180816011106.GC5915@dhcp-128-65.nay.redhat.com>

On Thu, Aug 16, 2018 at 09:11:06AM +0800, Dave Young wrote:
> On 08/16/18 at 12:07am, Yannik Sembritzki wrote:
> > Signed-off-by: Yannik Sembritzki <yannik@sembritzki.me>
> > ---
> >  arch/x86/kernel/kexec-bzimage64.c       | 2 +-
> >  certs/system_keyring.c                  | 3 ++-
> >  crypto/asymmetric_keys/pkcs7_key_type.c | 2 +-
> >  include/linux/verification.h            | 3 +++
> >  4 files changed, 7 insertions(+), 3 deletions(-)
> > 
> > diff --git a/arch/x86/kernel/kexec-bzimage64.c
> > b/arch/x86/kernel/kexec-bzimage64.c
> > index 74628275..97d199a3 100644
> > --- a/arch/x86/kernel/kexec-bzimage64.c
> > +++ b/arch/x86/kernel/kexec-bzimage64.c
> > @@ -532,7 +532,7 @@ static int bzImage64_cleanup(void *loader_data)
> >  static int bzImage64_verify_sig(const char *kernel, unsigned long
> > kernel_len)
> >  {
> >      return verify_pefile_signature(kernel, kernel_len,
> > -                       ((struct key *)1UL),
> > +                       TRUST_SECONDARY_KEYRING,
> 
> Instead of fix your 1st patch in 2nd patch, I would suggest to
> switch the patch order.  In 1st patch change the common code to use
> the new macro and in 2nd patch you can directly fix the kexec code
> with TRUST_SECONDARY_KEYRING.

I agree. It looks cleaner that first patch change the common code and
introduce the macro to replace 1UL. And second patch makes use of that
macro in kexec bzImage64 verification.

Thanks
Vivek

      parent reply	other threads:[~2018-08-16 12:46 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-08-15 10:00 [PATCH] Fix kexec forbidding kernels signed with custom platform keys to boot Yannik Sembritzki
2018-08-15 16:54 ` Linus Torvalds
2018-08-15 17:27   ` Yannik Sembritzki
2018-08-15 17:37     ` Yannik Sembritzki
2018-08-15 17:42     ` Vivek Goyal
2018-08-15 18:44       ` Yannik Sembritzki
2018-08-15 18:58       ` Vivek Goyal
2018-08-15 19:06         ` Yannik Sembritzki
2018-08-15 19:49           ` Vivek Goyal
2018-08-15 20:47             ` Linus Torvalds
2018-08-15 20:53               ` James Bottomley
2018-08-15 21:08               ` Yannik Sembritzki
2018-08-15 21:13                 ` James Bottomley
2018-08-15 21:31                   ` Yannik Sembritzki
2018-08-15 21:40                     ` James Bottomley
2018-08-15 21:50                       ` Yannik Sembritzki
2018-08-15 21:57                     ` Vivek Goyal
2018-08-15 22:14                       ` Yannik Sembritzki
2018-08-15 21:52                   ` Vivek Goyal
2018-08-15 21:57                     ` James Bottomley
2018-08-15 21:14                 ` Linus Torvalds
2018-08-16 13:51             ` David Howells
2018-08-16 15:16               ` James Bottomley
2018-08-16 15:42                 ` James Bottomley
2018-08-16 15:49               ` David Howells
2018-08-16 15:56                 ` James Bottomley
2018-08-16 16:56                   ` David Laight
2018-08-16 17:15                     ` James Bottomley
2018-08-16 20:31                 ` David Howells
2018-08-17  0:07                   ` James Bottomley
2018-08-17  8:24                   ` David Howells
2018-08-17 14:58                     ` James Bottomley
2018-08-17 15:42                       ` Justin Forbes
2018-08-17 16:02                         ` James Bottomley
2018-08-16  0:52       ` Dave Young
2018-08-16  0:55         ` Dave Young
2018-08-16 12:13       ` David Howells
2018-08-16 14:22         ` James Bottomley
2018-08-16 14:43         ` David Howells
2018-08-16 14:59           ` James Bottomley
2018-08-17 17:00             ` Alan Cox
2018-08-15 17:45     ` Linus Torvalds
2018-08-15 18:19       ` Yannik Sembritzki
2018-08-15 18:22         ` Linus Torvalds
2018-08-15 19:42           ` [PATCH 0/2] Fix kexec forbidding kernels signed with keys in the secondary keyring " Yannik Sembritzki
2018-08-16 18:02             ` Linus Torvalds
2018-08-15 19:42           ` [PATCH 1/2] " Yannik Sembritzki
2018-08-15 19:42           ` [PATCH 2/2] Replace magic for trusting the secondary keyring with #define Yannik Sembritzki
2018-08-15 21:14             ` kbuild test robot
2018-08-15 21:19               ` [PATCH 2/2] [FIXED] " Yannik Sembritzki
2018-08-15 22:01                 ` Linus Torvalds
2018-08-15 22:07                   ` [PATCH 2/2] [FIXED v2] " Yannik Sembritzki
2018-08-16  1:11                     ` Dave Young
2018-08-16  7:43                       ` Yannik Sembritzki
2018-08-16  8:02                         ` Dave Young
2018-08-16  8:20                           ` Greg Kroah-Hartman
2018-08-16 12:46                       ` Vivek Goyal [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180816124632.GA24061@redhat.com \
    --to=vgoyal@redhat.com \
    --cc=James.Bottomley@hansenpartnership.com \
    --cc=bhe@redhat.com \
    --cc=dhowells@redhat.com \
    --cc=dyoung@redhat.com \
    --cc=hpa@zytor.com \
    --cc=jforbes@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=mjg59@google.com \
    --cc=pjones@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=x86@kernel.org \
    --cc=yannik@sembritzki.me \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).