assignment
if ((cmd == DM_DEV_CREATE_CMD)) {
^~
=
Also remove another double parentheses that don't cause a warning.
Signed-off-by: Matthias Kaehlcke
---
drivers/md/dm-ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/
uide/device-mapper/verity.html
Matthias Kaehlcke (3):
dm: Add verity helpers for LoadPin
LoadPin: Enable loading from trusted dm-verity devices
dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional
compilation
drivers/md/Makefile | 1 +
drivers/m
Hi Kees,
On Mon, Apr 18, 2022 at 03:14:14PM -0700, Kees Cook wrote:
> [oops, resending to actual CC list]
>
> On Mon, Apr 18, 2022 at 02:15:56PM -0700, Matthias Kaehlcke wrote:
> > This series extends LoadPin to allow loading of kernel files
> > from trusted dm-verity
atform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
---
security/loadpin/Kconfig | 11 +++
security/loadpin/loadpin.c | 168 -
2 files changed, 178 insertions(+), 1 deletion(-)
diff --git a/security/loadpin/Kconfig b/security/load
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
---
drivers/md/Makefile | 6 +++
drivers/md/dm-verity-loadpin.c| 80 +++
drivers/md/dm-veri
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
---
drivers/md/Makefile | 7 +--
include
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
---
Changes in v2:
- none
drivers/md/Makefile | 6 +++
drivers/md/dm-verity-loadpin.c| 80 +++
drivers/m
om/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
---
I'm still doubting what would be the best way to configure
the list of trusted digests. The approach in v2 of writing
a path through sysctl is flexible, but it also feels a bit
odd. I did some experim
test/admin-guide/device-mapper/verity.html
(no changes since v1)
Matthias Kaehlcke (3):
dm: Add verity helpers for LoadPin
LoadPin: Enable loading from trusted dm-verity devices
dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional
compilation
drivers/md/Makefile
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
---
Changes in v2:
- none
drivers/md/Makefile
On Sat, Apr 30, 2022 at 11:21:54PM -0700, Kees Cook wrote:
> On Tue, Apr 26, 2022 at 02:31:09PM -0700, Matthias Kaehlcke wrote:
> > I'm still doubting what would be the best way to configure
> > the list of trusted digests. The approach in v2 of writing
> > a path throu
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
---
Changes in v3:
- none
Changes in v2:
- none
drivers/md
uide/device-mapper/verity.html
[2]
https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
---
Changes in v3:
- added securityfs for LoadPin (currently only populated when
CONFIG_SECURITY_LOADPIN_VERITY=y)
- added uapi inc
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
---
Changes in v3:
- none
Changes in v2:
- none
drivers/md/Makefile | 6 +++
drivers/md/dm-verity-loadpin.c| 80 +++
ace now passes the path of the file with the verity digests
via systcl, instead of the digests themselves
- renamed sysctl file to 'trusted_verity_root_digests_path'
- have CONFIG_SECURITY_LOADPIN_VERITY depend on CONFIG_SYSCTL
- updated Kconfig doc
- updated commit message
Matthias Ka
Alasdar/Mike, I'd be interested in your take on adding these functions
to verity/DM, to get an idea whether this series has a path forward to
landing upstream.
Thanks
Matthias
On Wed, May 04, 2022 at 12:54:17PM -0700, Matthias Kaehlcke wrote:
> LoadPin limits loading of kernel modules,
Hi Mike,
On Thu, May 12, 2022 at 01:19:12PM -0400, Mike Snitzer wrote:
> On Wed, May 11 2022 at 4:54P -0400,
> Matthias Kaehlcke wrote:
>
> > Alasdar/Mike, I'd be interested in your take on adding these functions
> > to verity/DM, to get an idea whether this se
On Thu, May 12, 2022 at 01:19:12PM -0400, Mike Snitzer wrote:
> On Wed, May 11 2022 at 4:54P -0400,
> Matthias Kaehlcke wrote:
>
> > Alasdar/Mike, I'd be interested in your take on adding these functions
> > to verity/DM, to get an idea whether this series has a p
On Fri, May 13, 2022 at 12:29:29PM -0400, Mike Snitzer wrote:
> On Thu, May 12 2022 at 4:44P -0400,
> Matthias Kaehlcke wrote:
>
> > On Thu, May 12, 2022 at 01:19:12PM -0400, Mike Snitzer wrote:
> > > On Wed, May 11 2022 at 4:54P -0400,
> > > Matthias Kaehlc
On Fri, May 13, 2022 at 12:32:12PM -0400, Mike Snitzer wrote:
> On Wed, May 04 2022 at 3:54P -0400,
> Matthias Kaehlcke wrote:
>
> > Extend LoadPin to allow loading of kernel files from trusted dm-verity [1]
> > devices.
> >
> > This change adds the concept of
Hi Kees,
thanks for the review!
On Fri, May 13, 2022 at 03:36:26PM -0700, Kees Cook wrote:
>
>
> On May 4, 2022 12:54:18 PM PDT, Matthias Kaehlcke wrote:
> >Extend LoadPin to allow loading of kernel files from trusted dm-verity [1]
> >devices.
> >
> >This c
On Fri, May 13, 2022 at 03:15:53PM -0700, Kees Cook wrote:
>
>
> On May 4, 2022 12:54:17 PM PDT, Matthias Kaehlcke wrote:
> >LoadPin limits loading of kernel modules, firmware and certain
> >other files to a 'pinned' file system (typically a read-only
> >
On Mon, May 16, 2022 at 08:44:37PM -0700, Kees Cook wrote:
> On Mon, May 16, 2022 at 11:17:44AM -0700, Matthias Kaehlcke wrote:
> > On Fri, May 13, 2022 at 03:36:26PM -0700, Kees Cook wrote:
> > >
> > >
> > > On May 4, 2022 12:54:18 PM PDT, Matthias Kaehlcke
[1] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
[2]
https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
---
Changes in v4:
- use newline as separator in digest file instead of comma
- af
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
---
Changes in v4:
- a trusted verity device must have a single target of
type 'verity'
- share list of verity
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
---
Changes in v4:
- none
Changes in v3:
- none
Changes in
d on CONFIG_SYSCTL
- updated Kconfig doc
- updated commit message
Matthias Kaehlcke (3):
dm: Add verity helpers for LoadPin
LoadPin: Enable loading from trusted dm-verity devices
dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional
compilation
drivers/md/Makefile
aster
> v5.18-rc7 next-20220517]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch]
>
> url:
> https://github.com/intel-lab-l
Hi Milan,
On Wed, May 18, 2022 at 09:57:43AM +0200, Milan Broz wrote:
> On 18/05/2022 01:34, Matthias Kaehlcke wrote:
> > LoadPin limits loading of kernel modules, firmware and certain
> > other files to a 'pinned' file system (typically a read-only
> > rootf
On Wed, May 18, 2022 at 04:03:44PM -0400, Mike Snitzer wrote:
> On Wed, May 18 2022 at 11:13P -0400,
> Matthias Kaehlcke wrote:
>
> > Hi Milan,
> >
> > On Wed, May 18, 2022 at 09:57:43AM +0200, Milan Broz wrote:
> > > On 18/05/2022 01:34, Matthias Kaehlcke w
On Wed, May 18, 2022 at 03:52:21PM -0400, Mike Snitzer wrote:
> On Tue, May 17 2022 at 7:34P -0400,
> Matthias Kaehlcke wrote:
>
> > LoadPin limits loading of kernel modules, firmware and certain
> > other files to a 'pinned' file system (typically a read-on
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v5:
- changed dm_verity_loadpin_is_sb_trusted() to
dm_verity_loadpin_is_bdev_trusted()
- bumped version number to
_digests()
- updated commit message
Changes in v2:
- userspace now passes the path of the file with the verity digests
via systcl, instead of the digests themselves
- renamed sysctl file to 'trusted_verity_root_digests_path'
- have CONFIG_SECURITY_LOADPIN_VERITY depend on CONFIG_SYSCTL
- update
[1] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
[2]
https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v5:
- call dm_verity_load
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v5:
- added 'Ack
On Thu, May 19, 2022 at 12:39:14PM -0400, Mike Snitzer wrote:
> On Wed, May 18 2022 at 8:47P -0400,
> Matthias Kaehlcke wrote:
>
> > LoadPin limits loading of kernel modules, firmware and certain
> > other files to a 'pinned' file system (typically a read-on
ted commit message
Changes in v2:
- userspace now passes the path of the file with the verity digests
via systcl, instead of the digests themselves
- renamed sysctl file to 'trusted_verity_root_digests_path'
- have CONFIG_SECURITY_LOADPIN_VERITY depend on CONFIG_SYSCTL
- updated Kconfig do
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v6:
- s/loadpin_trusted_verity_root_digests/dm_verity_loadpin_trusted_root_digests/
- s
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v6:
- none
Changes in v5
[1] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
[2]
https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v6:
- added missing dependency
Mike, does this look good to you or are any further changes needed
to get this landed?
Thanks
Matthias
On Mon, May 23, 2022 at 02:13:58PM -0700, Matthias Kaehlcke wrote:
> LoadPin limits loading of kernel modules, firmware and certain
> other files to a 'pinned' file system (
[1] https://www.kernel.org/doc/html/latest/admin-guide/device-mapper/verity.html
[2]
https://chromium.googlesource.com/chromiumos/platform2/+/HEAD/dlcservice/docs/developer.md
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v7:
- none
Changes in v6:
- added missing depende
The verity glue for LoadPin is only needed when CONFIG_SECURITY_LOADPIN_VERITY
is set, use this option for conditional compilation instead of the combo of
CONFIG_DM_VERITY and CONFIG_SECURITY_LOADPIN.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v7:
- none
Changes in v6
the 'glue' between
LoadPin and verity. The new file dm-verity-loadpin.c contains
the glue functions.
Signed-off-by: Matthias Kaehlcke
Acked-by: Kees Cook
---
Changes in v7:
- rebased on v5.19-rc4
Changes in v6:
- s/loadpin_trusted_verity_root_digests/dm_verity_loadpin_trust
pend on CONFIG_SYSCTL
- updated Kconfig doc
- updated commit message
Matthias Kaehlcke (3):
dm: Add verity helpers for LoadPin
LoadPin: Enable loading from trusted dm-verity devices
dm: verity-loadpin: Use CONFIG_SECURITY_LOADPIN_VERITY for conditional
compilation
drivers/md/Makefile
Add verity helpers for LoadPin")
Reported-by: Stephen Rothwell
Signed-off-by: Matthias Kaehlcke
---
drivers/md/dm-verity-loadpin.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm-verity-loadpin.c b/drivers/md/dm-verity-loadpin.c
index 10c18bc1652c..38
: Add verity helpers for LoadPin")
Reported-by: Sarthak Kukreti
Signed-off-by: Matthias Kaehlcke
---
drivers/md/dm-verity-loadpin.c | 8
drivers/md/dm-verity-target.c | 16
drivers/md/dm-verity.h | 1 +
3 files changed, 25 insertions(+)
diff --git a/dri
assignment
if ((cmd == DM_DEV_CREATE_CMD)) {
^~
=
Also remove another double parentheses that don't cause a warning.
Signed-off-by: Matthias Kaehlcke
---
drivers/md/dm-ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/
El Thu, Mar 16, 2017 at 09:48:30AM -0700 Matthias Kaehlcke ha dit:
> The extra pair of parantheses is not needed and causes clang to generate
> the following warning:
>
> drivers/md/dm-ioctl.c:1776:11: error: equality comparison with extraneous
> parentheses [-Werror,-Wparen
Hi Joe,
El Fri, Mar 31, 2017 at 07:07:33PM -0700 Joe Perches ha dit:
> On Fri, 2017-03-31 at 18:50 -0700, Matthias Kaehlcke wrote:
> > El Thu, Mar 16, 2017 at 09:48:30AM -0700 Matthias Kaehlcke ha dit:
> >
> > > The extra pair of parantheses is not needed and causes cla
associated block device, however that is not always the
case (e.g. tmpfs).
Cc: sta...@vger.kernel.org # v6.0+
Fixes: b6c1c5745ccc ("dm: Add verity helpers for LoadPin")
Signed-off-by: Matthias Kaehlcke
---
drivers/md/dm-verity-loadpin.c | 3 +++
1 file changed, 3 insertions(+)
diff -
51 matches
Mail list logo
