Re: [PATCH] integrity: prevent deadlock during digsig verification.

Re: [PATCH] integrity: prevent deadlock during digsig verification.

[Lukas Wunner]

On Wed, Jun 27, 2018 at 04:33:42PM +0300, Mikhail Kurinnoi wrote:
> +int integrity_kernel_module_request(char *kmod_name)
> +{
> +	if (strncmp(kmod_name, "crypto-pkcs1pad(rsa,", 20) == 0)
> +		return -EINVAL;
> +
> +	return 0;
> +}

Just a heads-up:  The above was applied as commit 6eb864c1d9dd
("integrity: prevent deadlock during digsig verification.") in 2018.

In 2021 the kernel gained support for ECDSA signatures,
in 2019 for ECRDSA (GOST) signatures.

If kernel modules are signed with ECDSA or ECRDSA, you may once again
see the deadlock addressed by the above-quoted patch and you may need
additional string comparisons to avoid it.

There's a (stalled) effort to support RSA PSS, this may likewise
require yet another string comparison:
https://lore.kernel.org/all/20210420114124.9684-1-varad.gautam@suse.com/

You may have to come up with a solution that doesn't require adding
new string comparisons as this isn't scalable and it's easy to forget
amending the string comparisons when new algorithms or encodings are
added to the crypto subsystem.

Thanks,

Lukas