lkml.org 
[lkml]   [2017]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Firmware signing -- Re: [PATCH 00/27] security, efi: Add kernel lockdown
From
Date
On Thu, 2017-11-02 at 22:04 +0000, David Howells wrote:
> Mimi Zohar <zohar@linux.vnet.ibm.com> wrote:
>
> > > Only validly signed device firmware may be loaded.
> >
> > fw_get_filesystem_firmware() calls kernel_read_file_from_path() to
> > read the firmware, which calls into the security hooks. Is there
> > another place that validates the firmware signatures.  I'm not seeing
> > which patch requires firmware to be signed?
>
> Luis has a set of patches for this. However, I'm not sure if that's going
> anywhere at the moment. Possibly I should remove this from the manpage for
> the moment.

Or reflect that IMA-appraisal, if enabled, will enforce firmware being
validly signed.

Mimi

\
 
 \ /
  Last update: 2017-11-02 23:11    [W:0.556 / U:1.652 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site