On Wed, Jun 22, 2022 at 12:06 AM Roberto Sassu <roberto.sassu@xxxxxxxxxx> wrote: > > > From: Alexei Starovoitov [mailto:alexei.starovoitov@xxxxxxxxx] > > Sent: Wednesday, June 22, 2022 12:32 AM > > On Tue, Jun 21, 2022 at 06:37:57PM +0200, Roberto Sassu wrote: > > > + if (child_pid == 0) { > > > + snprintf(path, sizeof(path), "%s/signing_key.pem", tmp_dir); > > > + > > > + return execlp("./sign-file", "./sign-file", "-d", "sha256", > > > + path, path, data_template, NULL); > > > > Did you miss my earlier reply requesting not to do this module_signature append > > and use signature directly? > > I didn't miss. sign-file is producing the raw PKCS#7 signature here (-d). > > I'm doing something slightly different, to test the keyring ID part. > I'm retrieving an existing kernel module (actually this does not work > in the CI), parsing it to extract the raw signature, and passing it to the > eBPF program for verification. We don't have signed modules in CI. When you make changes like this you have to explain that in the commit log. > Since the kernel module is signed with a key in the built-in keyring, > passing 1 or 0 as ID should work. > > Roberto > > (sorry, I have to keep the email signature by German law) I don't believe that's the case since plenty of people work from Germany and regularly contribute patches without such banners. > HUAWEI TECHNOLOGIES Duesseldorf GmbH, HRB 56063 > Managing Director: Li Peng, Yang Xi, Li He
