diff for duplicates of <1547767501.3931.60.camel@linux.ibm.com> diff --git a/a/1.txt b/N1/1.txt index 0665288..8a77b7e 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -17,7 +17,7 @@ func=KEXEC_KERNEL_CHECK" rule in their custom policy. > kexec_file_load to verify the image against keys in .platform keyring. There's no need to introduce the concept of "third party" or "firmware -keys" here. Referring to them as the "preboot" keys, can simplify the +keys" here.  Referring to them as the "preboot" keys, can simplify the above paragraph. > @@ -53,7 +53,7 @@ Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com> > + ret = verify_pefile_signature(kernel, kernel_len, > + VERIFY_USE_SECONDARY_KEYRING, > + VERIFYING_KEXEC_PE_SIGNATURE); -> + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { +> + if (ret = -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { > + ret = verify_pefile_signature(kernel, kernel_len, > + VERIFY_USE_PLATFORM_KEYRING, > + VERIFYING_KEXEC_PE_SIGNATURE); @@ -70,7 +70,7 @@ Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com> > #else > trusted_keys = builtin_trusted_keys; > #endif -> + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) { +> + } else if (trusted_keys = VERIFY_USE_PLATFORM_KEYRING) { > +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING > + trusted_keys = platform_trusted_keys; > +#else @@ -84,7 +84,7 @@ Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com> > } > ret = pkcs7_validate_trust(pkcs7, trusted_keys); > if (ret < 0) { -> if (ret == -ENOKEY) +> if (ret = -ENOKEY) > - pr_err("PKCS#7 signature not signed with a trusted key\n"); > + pr_devel("PKCS#7 signature not signed with a trusted key\n"); > goto error; @@ -102,9 +102,3 @@ Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com> > > /* > * The use to which an asymmetric key is being put. - - -_______________________________________________ -kexec mailing list -kexec@lists.infradead.org -http://lists.infradead.org/mailman/listinfo/kexec diff --git a/a/content_digest b/N1/content_digest index 4b41f79..2149441 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -2,21 +2,21 @@ "ref\020190116101654.7288-3-kasong@redhat.com\0" "From\0Mimi Zohar <zohar@linux.ibm.com>\0" "Subject\0Re: [PATCH v3 2/2] kexec, KEYS: Make use of platform keyring for signature verify\0" - "Date\0Thu, 17 Jan 2019 18:25:01 -0500\0" + "Date\0Thu, 17 Jan 2019 23:25:01 +0000\0" "To\0Kairui Song <kasong@redhat.com>" " linux-kernel@vger.kernel.org\0" - "Cc\0jwboyer@fedoraproject.org" + "Cc\0dhowells@redhat.com" + dwmw2@infradead.org + jwboyer@fedoraproject.org + keyrings@vger.kernel.org + jmorris@namei.org + serge@hallyn.com + bauerman@linux.ibm.com ebiggers@google.com - dyoung@redhat.com nayna@linux.ibm.com - kexec@lists.infradead.org - jmorris@namei.org - dhowells@redhat.com - keyrings@vger.kernel.org + dyoung@redhat.com linux-integrity@vger.kernel.org - dwmw2@infradead.org - bauerman@linux.ibm.com - " serge@hallyn.com\0" + " kexec@lists.infradead.org\0" "\00:1\0" "b\0" "On Wed, 2019-01-16 at 18:16 +0800, Kairui Song wrote:\n" @@ -38,7 +38,7 @@ "> kexec_file_load to verify the image against keys in .platform keyring.\n" "\n" "There's no need to introduce the concept of \"third party\" or \"firmware\n" - "keys\" here. \302\240Referring to them as the \"preboot\" keys, can simplify the\n" + "keys\" here. \342\224\254\303\241Referring to them as the \"preboot\" keys, can simplify the\n" "above paragraph.\n" "\n" "> \n" @@ -74,7 +74,7 @@ "> +\tret = verify_pefile_signature(kernel, kernel_len,\n" "> +\t\t\t\t VERIFY_USE_SECONDARY_KEYRING,\n" "> +\t\t\t\t VERIFYING_KEXEC_PE_SIGNATURE);\n" - "> +\tif (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {\n" + "> +\tif (ret = -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {\n" "> +\t\tret = verify_pefile_signature(kernel, kernel_len,\n" "> +\t\t\t\t\t VERIFY_USE_PLATFORM_KEYRING,\n" "> +\t\t\t\t\t VERIFYING_KEXEC_PE_SIGNATURE);\n" @@ -91,7 +91,7 @@ "> #else\n" "> \t\ttrusted_keys = builtin_trusted_keys;\n" "> #endif\n" - "> +\t} else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) {\n" + "> +\t} else if (trusted_keys = VERIFY_USE_PLATFORM_KEYRING) {\n" "> +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING\n" "> +\t\ttrusted_keys = platform_trusted_keys;\n" "> +#else\n" @@ -105,7 +105,7 @@ "> \t}\n" "> \tret = pkcs7_validate_trust(pkcs7, trusted_keys);\n" "> \tif (ret < 0) {\n" - "> \t\tif (ret == -ENOKEY)\n" + "> \t\tif (ret = -ENOKEY)\n" "> -\t\t\tpr_err(\"PKCS#7 signature not signed with a trusted key\\n\");\n" "> +\t\t\tpr_devel(\"PKCS#7 signature not signed with a trusted key\\n\");\n" "> \t\tgoto error;\n" @@ -122,12 +122,6 @@ "> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)\n" "> \n" "> /*\n" - "> * The use to which an asymmetric key is being put.\n" - "\n" - "\n" - "_______________________________________________\n" - "kexec mailing list\n" - "kexec@lists.infradead.org\n" - http://lists.infradead.org/mailman/listinfo/kexec + > * The use to which an asymmetric key is being put. -c0827be3dcdf9c35a7cd869f8a42d7ec9cb8333bf18565ca64e68f4ef3cff211 +ec9f2c3c36a552bfd1ce1e8fdc05a1adbd26712586e17c76db924cbdd3d982c3
diff --git a/a/1.txt b/N2/1.txt index 0665288..3e2cc46 100644 --- a/a/1.txt +++ b/N2/1.txt @@ -102,9 +102,3 @@ Reviewed/Tested-by: Mimi Zohar <zohar@linux.ibm.com> > > /* > * The use to which an asymmetric key is being put. - - -_______________________________________________ -kexec mailing list -kexec@lists.infradead.org -http://lists.infradead.org/mailman/listinfo/kexec diff --git a/a/content_digest b/N2/content_digest index 4b41f79..ee7e91d 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -5,18 +5,18 @@ "Date\0Thu, 17 Jan 2019 18:25:01 -0500\0" "To\0Kairui Song <kasong@redhat.com>" " linux-kernel@vger.kernel.org\0" - "Cc\0jwboyer@fedoraproject.org" + "Cc\0dhowells@redhat.com" + dwmw2@infradead.org + jwboyer@fedoraproject.org + keyrings@vger.kernel.org + jmorris@namei.org + serge@hallyn.com + bauerman@linux.ibm.com ebiggers@google.com - dyoung@redhat.com nayna@linux.ibm.com - kexec@lists.infradead.org - jmorris@namei.org - dhowells@redhat.com - keyrings@vger.kernel.org + dyoung@redhat.com linux-integrity@vger.kernel.org - dwmw2@infradead.org - bauerman@linux.ibm.com - " serge@hallyn.com\0" + " kexec@lists.infradead.org\0" "\00:1\0" "b\0" "On Wed, 2019-01-16 at 18:16 +0800, Kairui Song wrote:\n" @@ -122,12 +122,6 @@ "> +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL)\n" "> \n" "> /*\n" - "> * The use to which an asymmetric key is being put.\n" - "\n" - "\n" - "_______________________________________________\n" - "kexec mailing list\n" - "kexec@lists.infradead.org\n" - http://lists.infradead.org/mailman/listinfo/kexec + > * The use to which an asymmetric key is being put. -c0827be3dcdf9c35a7cd869f8a42d7ec9cb8333bf18565ca64e68f4ef3cff211 +cabb017499d579ff21e97ca3854dd99d26e3471d7d3fb4bf485abf4152935164
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.