[PATCH v4 0/2] Add support for ECDSA-signed kernel modules
jarkko at kernel.org
Tue Apr 27 23:47:49 UTC 2021
On Fri, Apr 23, 2021 at 11:12:45AM -0400, Stefan Berger wrote:
> This series adds support for ECDSA-signed kernel modules. It also
> attempts to address a kbuild issue where a developer created an ECDSA
> key for signing kernel modules and then builds an older version of the
> kernel, when bisecting the kernel for example, that does not support
> ECDSA keys.
> The first patch addresses the kbuild issue of needing to delete that
> ECDSA key if it is in certs/signing_key.pem and trigger the creation
> of an RSA key. However, for this to work this patch would have to be
> backported to previous versions of the kernel but would also only work
> for the developer if he/she used a stable version of the kernel to which
> this patch was applied. So whether this patch actually achieves the
> wanted effect is not always guaranteed.
> The 2nd patch adds the support for the ECSDA-signed kernel modules.
> This patch depends on the ECDSA support series currently queued here:
> - extending 'depends on' with MODULES to (IMA_APPRAISE_MODSIG && MODULES)
> - added missing OIDs for ECDSA signed hashes to pkcs7_sig_note_pkey_algo
> - added recommendation to use string hash to Kconfig help text
> - Adjustment to ECDSA key detector string in 2/2
> - Rephrased cover letter and patch descriptions with Mimi
> Stefan Berger (2):
> certs: Trigger creation of RSA module signing key if it's not an RSA
> certs: Add support for using elliptic curve keys for signing modules
> certs/Kconfig | 26 ++++++++++++++++++++++++++
> certs/Makefile | 14 ++++++++++++++
> crypto/asymmetric_keys/pkcs7_parser.c | 8 ++++++++
> 3 files changed, 48 insertions(+)
I just went through v3. My tags apply also to this version.
More information about the Linux-security-module-archive