d1b6f8c7af
* Thu Apr 23 2020 CKI@GitLab <cki-project@redhat.com> [5.7.0-0.rc2.20200423git7adc4b399952.1]
- 7adc4b399952 rebase
- Match template format in kernel.spec.template ("Justin M. Forbes")
- Break out the Patches into individual files for dist-git ("Justin M. Forbes")
- Break the Red Hat patch into individual commits (Jeremy Cline)
- Adjust module filtering so CONFIG_DRM_DP_CEC can be set (Jeremy Cline)
- Add a script to generate release tags and branches (Jeremy Cline)
- Set CONFIG_VDPA for fedora ("Justin M. Forbes")
- Provide defaults in ark-rebase-patches.sh (Jeremy Cline)
- Default ark-rebase-patches.sh to not report issues (Jeremy Cline)
Resolves: rhbz#
Signed-off-by: Jeremy Cline <jcline@redhat.com>
45 lines
1.5 KiB
Diff
45 lines
1.5 KiB
Diff
From 0e4630025e6155b15d2a1226e86b701eeb57e7f1 Mon Sep 17 00:00:00 2001
|
|
From: Robert Holmes <robeholmes@gmail.com>
|
|
Date: Tue, 23 Apr 2019 07:39:29 +0000
|
|
Subject: [PATCH] KEYS: Make use of platform keyring for module signature
|
|
verify
|
|
|
|
This patch completes commit 278311e417be ("kexec, KEYS: Make use of
|
|
platform keyring for signature verify") which, while adding the
|
|
platform keyring for bzImage verification, neglected to also add
|
|
this keyring for module verification.
|
|
|
|
As such, kernel modules signed with keys from the MokList variable
|
|
were not successfully verified.
|
|
|
|
Signed-off-by: Robert Holmes <robeholmes@gmail.com>
|
|
Signed-off-by: Jeremy Cline <jcline@redhat.com>
|
|
---
|
|
kernel/module_signing.c | 9 ++++++++-
|
|
1 file changed, 8 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/kernel/module_signing.c b/kernel/module_signing.c
|
|
index 9d9fc678c91d..84ad75a53c83 100644
|
|
--- a/kernel/module_signing.c
|
|
+++ b/kernel/module_signing.c
|
|
@@ -38,8 +38,15 @@ int mod_verify_sig(const void *mod, struct load_info *info)
|
|
modlen -= sig_len + sizeof(ms);
|
|
info->len = modlen;
|
|
|
|
- return verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
|
+ ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
|
VERIFY_USE_SECONDARY_KEYRING,
|
|
VERIFYING_MODULE_SIGNATURE,
|
|
NULL, NULL);
|
|
+ if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) {
|
|
+ ret = verify_pkcs7_signature(mod, modlen, mod + modlen, sig_len,
|
|
+ VERIFY_USE_PLATFORM_KEYRING,
|
|
+ VERIFYING_MODULE_SIGNATURE,
|
|
+ NULL, NULL);
|
|
+ }
|
|
+ return ret;
|
|
}
|
|
--
|
|
2.26.0
|
|
|