Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-08-13 Thread Jaskaran Singh Khurana
Hello Mike, On Tue, 25 Jun 2019, Mike Snitzer wrote: On Wed, Jun 19 2019 at 3:10pm -0400, Jaskaran Khurana wrote: The verification is to support cases where the roothash is not secured by Trusted Boot, UEFI Secureboot or similar technologies. One of the use cases for this is for dm-verity

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-28 Thread Jaskaran Singh Khurana
Hello Eric/Milan, On Fri, 28 Jun 2019, Milan Broz wrote: On 28/06/2019 05:00, Eric Biggers wrote: Hello Eric, This started with a config (see V4). We didnot want scripts that pass this parameter to suddenly stop working if for some reason the verification is turned off so the optional param

Re: [dm-devel] [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-28 Thread Jaskaran Singh Khurana
On Thu, 27 Jun 2019, Milan Broz wrote: Hi, I tried to test test the patch, two comments below. On 19/06/2019 21:10, Jaskaran Khurana wrote: The verification is to support cases where the roothash is not secured by Trusted Boot, UEFI Secureboot or similar technologies. One of the use cases

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-27 Thread Milan Broz
On 28/06/2019 05:00, Eric Biggers wrote: >> Hello Eric, >> >> This started with a config (see V4). We didnot want scripts that pass this >> parameter to suddenly stop working if for some reason the verification is >> turned off so the optional parameter was just parsed and no validation >> happened

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-27 Thread Eric Biggers
Hi Jaskaran, On Thu, Jun 27, 2019 at 06:49:58PM -0700, Jaskaran Singh Khurana wrote: > > > On Thu, 27 Jun 2019, Eric Biggers wrote: > > > Hi Jaskaran, one comment (I haven't reviewed this in detail): > > > > On Wed, Jun 19, 2019 at 12:10:48PM -0700, Jaskaran Khurana wrote: > > > diff --git a/d

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-27 Thread Jaskaran Singh Khurana
On Thu, 27 Jun 2019, Eric Biggers wrote: Hi Jaskaran, one comment (I haven't reviewed this in detail): On Wed, Jun 19, 2019 at 12:10:48PM -0700, Jaskaran Khurana wrote: diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig index db269a348b20..2d658a3512cb 100644 --- a/drivers/md/Kconfig +++

Re: [dm-devel] [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-27 Thread Eric Biggers
Hi Jaskaran, one comment (I haven't reviewed this in detail): On Wed, Jun 19, 2019 at 12:10:48PM -0700, Jaskaran Khurana wrote: > diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig > index db269a348b20..2d658a3512cb 100644 > --- a/drivers/md/Kconfig > +++ b/drivers/md/Kconfig > @@ -475,6 +475,7

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-27 Thread Milan Broz
Hi, I tried to test test the patch, two comments below. On 19/06/2019 21:10, Jaskaran Khurana wrote: > The verification is to support cases where the roothash is not secured by > Trusted Boot, UEFI Secureboot or similar technologies. > One of the use cases for this is for dm-verity volumes mounte

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-25 Thread Milan Broz
On 25/06/2019 20:20, Mike Snitzer wrote: > On Wed, Jun 19 2019 at 3:10pm -0400, > Jaskaran Khurana wrote: > >> The verification is to support cases where the roothash is not secured by >> Trusted Boot, UEFI Secureboot or similar technologies. >> One of the use cases for this is for dm-verity vol

Re: [RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-25 Thread Mike Snitzer
On Wed, Jun 19 2019 at 3:10pm -0400, Jaskaran Khurana wrote: > The verification is to support cases where the roothash is not secured by > Trusted Boot, UEFI Secureboot or similar technologies. > One of the use cases for this is for dm-verity volumes mounted after boot, > the root hash provided

[RFC PATCH v5 1/1] Add dm verity root hash pkcs7 sig validation.

2019-06-19 Thread Jaskaran Khurana
The verification is to support cases where the roothash is not secured by Trusted Boot, UEFI Secureboot or similar technologies. One of the use cases for this is for dm-verity volumes mounted after boot, the root hash provided during the creation of the dm-verity volume has to be secure and thus in