Commit 2ae4ea2d authored by Thomas Weißschuh's avatar Thomas Weißschuh Committed by Sami Tolvanen
Browse files

module: Give MODULE_SIG_STRING a more descriptive name 



The purpose of the constant it is not entirely clear from its name.

As this constant is going to be exposed in a UAPI header, give it a more
specific name for clarity. As all its users call it 'marker', use that
wording in the constant itself.

Signed-off-by: default avatarThomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: default avatarPetr Pavlu <petr.pavlu@suse.com>
Reviewed-by: default avatarNicolas Schier <nsc@kernel.org>
Signed-off-by: default avatarSami Tolvanen <samitolvanen@google.com>
parent acd87264

arch/s390/kernel/machine_kexec_file.c

+2 −2
Original line number Diff line number Diff line
@@ -28,7 +28,7 @@ const struct kexec_file_ops * const kexec_file_loaders[] = { 
#ifdef CONFIG_KEXEC_SIG

int s390_verify_sig(const char *kernel, unsigned long kernel_len)

{

	const unsigned long marker_len = sizeof(MODULE_SIG_STRING) - 1;

	const unsigned long marker_len = sizeof(MODULE_SIGNATURE_MARKER) - 1;

	struct module_signature *ms;

	unsigned long sig_len;

	int ret;
@@ -40,7 +40,7 @@ int s390_verify_sig(const char *kernel, unsigned long kernel_len) 
	if (marker_len > kernel_len)

		return -EKEYREJECTED;



	if (memcmp(kernel + kernel_len - marker_len, MODULE_SIG_STRING,

	if (memcmp(kernel + kernel_len - marker_len, MODULE_SIGNATURE_MARKER,

		   marker_len))

		return -EKEYREJECTED;

	kernel_len -= marker_len;

include/linux/module_signature.h

+1 −1
Original line number Diff line number Diff line
@@ -12,7 +12,7 @@ 
#include <linux/types.h>



/* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */

#define MODULE_SIG_STRING "~Module signature appended~\n"

#define MODULE_SIGNATURE_MARKER "~Module signature appended~\n"



enum module_signature_type {

	MODULE_SIGNATURE_TYPE_PKCS7 = 2,	/* Signature in PKCS#7 message */

kernel/module/signing.c

+2 −2
Original line number Diff line number Diff line
@@ -70,7 +70,7 @@ int mod_verify_sig(const void *mod, struct load_info *info) 
int module_sig_check(struct load_info *info, int flags)

{

	int err = -ENODATA;

	const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;

	const unsigned long markerlen = sizeof(MODULE_SIGNATURE_MARKER) - 1;

	const char *reason;

	const void *mod = info->hdr;

	bool mangled_module = flags & (MODULE_INIT_IGNORE_MODVERSIONS |
@@ -81,7 +81,7 @@ int module_sig_check(struct load_info *info, int flags) 
	 */

	if (!mangled_module &&

	    info->len > markerlen &&

	    memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {

	    memcmp(mod + info->len - markerlen, MODULE_SIGNATURE_MARKER, markerlen) == 0) {

		/* We truncate the module to discard the signature */

		info->len -= markerlen;

		err = mod_verify_sig(mod, info);

security/integrity/ima/ima_modsig.c

+3 −3
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ struct modsig { 
int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len,

		    struct modsig **modsig)

{

	const size_t marker_len = strlen(MODULE_SIG_STRING);

	const size_t marker_len = strlen(MODULE_SIGNATURE_MARKER);

	const struct module_signature *sig;

	struct modsig *hdr;

	size_t sig_len;
@@ -51,7 +51,7 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, 
		return -ENOENT;



	p = buf + buf_len - marker_len;

	if (memcmp(p, MODULE_SIG_STRING, marker_len))

	if (memcmp(p, MODULE_SIGNATURE_MARKER, marker_len))

		return -ENOENT;



	buf_len -= marker_len;
@@ -105,7 +105,7 @@ void ima_collect_modsig(struct modsig *modsig, const void *buf, loff_t size) 
	 * Provide the file contents (minus the appended sig) so that the PKCS7

	 * code can calculate the file hash.

	 */

	size -= modsig->raw_pkcs7_len + strlen(MODULE_SIG_STRING) +

	size -= modsig->raw_pkcs7_len + strlen(MODULE_SIGNATURE_MARKER) +

		sizeof(struct module_signature);

	rc = pkcs7_supply_detached_data(modsig->pkcs7_msg, buf, size);

	if (rc)