Re: [PATCH 00/23] Crypto keys and module signing

[David Howells]

Kasatkin, Dmitry <dmitry.kasatkin@xxxxxxxxx> wrote:

> > In some ways that is cleaner, but it's also nice to avoid adding another
> > syscall.
> 
> There is no additional syscall.
> signature is passed is 'ima=' parameter to init_module()
> like

Exactly what I was thinking of, though I wouldn't call it "ima=" as that
doesn't seem specific enough.

You could also append it to the binary image and have the kernel extract it
from there as if the module file had had the signature attached during the
build.

I don't particularly favour holding the signature in an xattr, though, as that
assumes that underlying fs has the capability to hold it and means that the
package installation mechanism must know how to fill in xattrs.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/