Re: security/loadpin: Allow to exclude specific file types

I sent out a new patch according to your last suggestion. Please take a look. Thanks! On Fri, May 31, 2019 at 1:33 PM Kees Cook wrote: > > On Fri, May 31, 2019 at 11:03:17AM -0700, Ke Wu wrote: > > I think Coverity is correct. Note that it's the size of > > kernel_rea

Re: security/loadpin: Allow to exclude specific file types

; Static analysis with Coverity on linux-next has found a potential issue > >> with the following commit: > >> > >> commit 1633a4f04cc171fc638deb5c95af96032d3c591b > >> Author: Ke Wu > >> Date: Thu May 30 12:22:08 2019 -0700 > >> > >

Re: [PATCH v2] modsign: use all trusted keys to verify module signature

Thanks for the comment! I switched to use VERIFY_USE_SECONDARY_KEYRING, please take a look. On Tue, Nov 6, 2018 at 3:21 PM Ke Wu wrote: > > Make mod_verify_sig to use all trusted keys. This allows keys in > secondary_trusted_keys to be used to verify PKCS#7 signature on a > k

[PATCH v2] modsign: use all trusted keys to verify module signature

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module. Signed-off-by: Ke Wu --- Changelog since v1: - Use VERIFY_USE_SECONDARY_KEYRING rather than (void *)1UL kernel/module_signing.c | 3 ++- 1 file

Re: [PATCH] modsign: use all trusted keys to verify module signature

Hi, I'm wondering if there is any update for the patch. Thanks! On Wed, Oct 31, 2018 at 2:36 AM Jessica Yu wrote: > > +++ Ke Wu [22/10/18 15:26 -0700]: > >Make mod_verify_sig to use all trusted keys. This allows keys in > >secondary_trusted_keys to be used to verif

Re: [PATCH] modsign: use all trusted keys to verify module signature

Friendly ping. On Mon, Oct 22, 2018 at 3:26 PM Ke Wu wrote: > > Make mod_verify_sig to use all trusted keys. This allows keys in > secondary_trusted_keys to be used to verify PKCS#7 signature on a > kernel module. > > Signed-off-by: Ke Wu > --- > kernel/module_si

[PATCH] modsign: use all trusted keys to verify module signature

Make mod_verify_sig to use all trusted keys. This allows keys in secondary_trusted_keys to be used to verify PKCS#7 signature on a kernel module. Signed-off-by: Ke Wu --- kernel/module_signing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/module_signing.c b/kernel