Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-06 Thread Ming Lei
On Tue, Nov 6, 2012 at 4:18 PM, Takashi Iwai ti...@suse.de wrote: Right, and it's intentionally dropped so. For the non-default fw path, it can be added via proc dynamically or via kconfig statically. If the firmware is generated via udev, then it doesn't make sense to check a static

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-06 Thread Ming Lei
On Tue, Nov 6, 2012 at 6:17 PM, Takashi Iwai ti...@suse.de wrote: At Tue, 6 Nov 2012 18:04:36 +0800, Ming Lei wrote: On Tue, Nov 6, 2012 at 4:18 PM, Takashi Iwai ti...@suse.de wrote: Right, and it's intentionally dropped so. For the non-default fw path, it can be added via proc

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread Takashi Iwai
At Mon, 05 Nov 2012 18:18:24 +0100, Takashi Iwai wrote: Hi, this is a patch series to add the support for firmware signature check. At this time, the kernel checks extra signature file (*.sig) for each firmware, instead of embedded signature. It's just a quick hack using the existing

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread Josh Boyer
On Mon, Nov 5, 2012 at 12:18 PM, Takashi Iwai ti...@suse.de wrote: Hi, this is a patch series to add the support for firmware signature check. At this time, the kernel checks extra signature file (*.sig) for each firmware, instead of embedded signature. It's just a quick hack using the

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread David Howells
Takashi Iwai ti...@suse.de wrote: this is a patch series to add the support for firmware signature check. At this time, the kernel checks extra signature file (*.sig) for each firmware, instead of embedded signature. It's just a quick hack using the existing module signing mechanism, thus

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread David Howells
David Howells dhowe...@redhat.com wrote: Takashi Iwai ti...@suse.de wrote: this is a patch series to add the support for firmware signature check. At this time, the kernel checks extra signature file (*.sig) for each firmware, instead of embedded signature. It's just a quick hack

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread Ming Lei
On Tue, Nov 6, 2012 at 1:18 AM, Takashi Iwai ti...@suse.de wrote: To be noted, it doesn't support the firmwares via udev but only the direct loading, and the check for built-in firmware is missing, too. Generally, both direct loading and udev may request one same firmware image. And after

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread lee joey
2012/11/6 Ming Lei tom.leim...@gmail.com: On Tue, Nov 6, 2012 at 1:18 AM, Takashi Iwai ti...@suse.de wrote: To be noted, it doesn't support the firmwares via udev but only the direct loading, and the check for built-in firmware is missing, too. Generally, both direct loading and udev may

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread Takashi Iwai
At Tue, 06 Nov 2012 00:01:52 +, David Howells wrote: Takashi Iwai ti...@suse.de wrote: this is a patch series to add the support for firmware signature check. At this time, the kernel checks extra signature file (*.sig) for each firmware, instead of embedded signature. It's just

Re: [PATCH RFC 0/4] Add firmware signature file check

2012-11-05 Thread Takashi Iwai
At Tue, 6 Nov 2012 15:16:43 +0800, Ming Lei wrote: On Tue, Nov 6, 2012 at 3:03 PM, Takashi Iwai ti...@suse.de wrote: Yeah, it's just uncovered in the patch. As a easy solution, apply the patch like below to disallow the udev fw loading when signature check is enforced. thanks,