lkml.org 
[lkml]   [2021]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH v8 03/17] integrity: Introduce a Linux keyring called machine
Date


> On Nov 24, 2021, at 7:49 PM, Mimi Zohar <zohar@linux.ibm.com> wrote:
> On Tue, 2021-11-23 at 23:41 -0500, Eric Snowberg wrote:
>> +config INTEGRITY_MACHINE_KEYRING
>> + bool "Provide a keyring to which CA Machine Owner Keys may be added"
>> + depends on SECONDARY_TRUSTED_KEYRING
>> + depends on INTEGRITY_ASYMMETRIC_KEYS
>
> Shouldn't this be "ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y"? With this
> change, is "KEYS: Create static version of
> public_key_verify_signature" trusted needed?

I believe it is still needed. If someone were to use the same config as the build bot,
where ASYMMETRIC_PUBLIC_KEY_SUBTYPE is not defined and
INTEGRITY_MACHINE_KEYRING is not defined, they would still hit the problem that
has now been fixed in "KEYS: Create static version of public_key_verify_signature”.

I wish the first two patches in this series would be accepted, since I’m only carrying
them to get past the build bot.

\
 
 \ /
  Last update: 2021-11-29 23:55    [W:0.135 / U:0.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site