Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures

[David Howells <dhowells@redhat.com>]

David Woodhouse <dwmw2@infradead.org> wrote:

> As part of the firmware signatures, if we are asked to check the
> filename then yes we should require it to be present *and* match. But
> if we aren't checking (which we can't for modules since we don't know
> what's being loaded), why require it to be present at all?

For firmware, that's in the next set of patches, at the tag
fwsign-pkcs7-20150720.

For modules we could require it not to be present since, as you say, there's
no way generally for the kernel check the module name requested.  The only
thing it could really do is to extract the expected name from the PKCS#7 and
compare it against the name in the modinfo structure *after* checking the
signature.  This would require passing the module name to sign-file too.

David