Re: [PATCH v2] crypto/fips: only panic on bad/missing crypto mod signatures

[Stephan Mueller]

Am Donnerstag, 3. Juli 2014, 07:18:06 schrieb Neil Horman:
>On Wed, Jul 02, 2014 at 03:37:30PM -0400, Jarod Wilson wrote:
>> Per further discussion with NIST, the requirements for FIPS state
>> that
>> we only need to panic the system on failed kernel module signature
>> checks for crypto subsystem modules. This moves the fips-mode-only
>> module signature check out of the generic module loading code, into
>> the crypto subsystem, at points where we can catch both algorithm
>> module loads and mode module loads. At the same time, make
>> CONFIG_CRYPTO_FIPS dependent on CONFIG_MODULE_SIG, as this is
>> entirely necessary for FIPS mode.
>> 
>> v2: remove extraneous blank line, perform checks in static inline
>> function, drop no longer necessary fips.h include.
>> 
>> CC: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
>> CC: "David S. Miller" <davem@xxxxxxxxxxxxx>
>> CC: Rusty Russell <rusty@xxxxxxxxxxxxxxx>
>> CC: Stephan Mueller <stephan.mueller@xxxxxxxxx>
>> CC: linux-crypto@xxxxxxxxxxxxxxx
>> Signed-off-by: Jarod Wilson <jarod@xxxxxxxxxx>
>
>Acked-by: Neil Horman <nhorman@xxxxxxxxxxxxx>
Acked-by: Stephan Mueller <stephan.mueller@xxxxxxxxx>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/