KEYS: revert requiring signature "encoding"

Attempting to verify IMA signatures fail causing the system to hang.

       function [ver #2]")

---
 crypto/asymmetric_keys/public_key.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

index f5d85b47fcc6..f90360122090 100644
@@ -239,9 +239,17 @@ int public_key_verify_signature(const struct public_key *pkey,
 	BUG_ON(!sig);
 	BUG_ON(!sig->s);
 
-	ret = software_key_determine_akcipher(sig->encoding,
-					      sig->hash_algo,
-					      pkey, alg_name);
+	if (!sig->digest)
+		return -ENOPKG;
+
+	if (!(sig->encoding) && strcmp(pkey->pkey_algo, "rsa") = 0)
+		ret = software_key_determine_akcipher("pkcs1",
+						      sig->hash_algo,
+						      pkey, alg_name);
+	else
+		ret = software_key_determine_akcipher(sig->encoding,
+						      sig->hash_algo,
+						      pkey, alg_name);
 	if (ret < 0)
 		return ret;
 

2.7.5

Can you say why?

Btw, no word "commit" after Fixes:.

David

On systems with IMA-appraisal enabled with a policy requiring file signatures, the "good" signature values are stored on the filesystem as extended attributes (security.ima).  Signature verification failure would normally be limited to just a particular file (eg. executable), but during boot signature verification failure could result in a system hang.

Removing existing signature formats breaks existing systems.  This patch adds support for RSA signatures without an explicit "pkcs1" sig-

Ok.

Looking the patch over again, do you prefer the duplicate call or defining a local variable and using the ternary conditional operator ("?:") like this:

	bool rsa = false;

	if (!(sig->encoding) && strcmp(pkey->pkey_algo, "rsa") = 0)
                rsa = true;

        ret = software_key_determine_akcipher(rsa ? "pkcs1" : sig->encoding,
                                              sig->hash_algo,
                                              pkey, alg_name);

Mimi

Might be better to do:

	const char *encoding = sig->encoding;

	if (!encoding && strcmp(pkey->pkey_algo, "rsa") = 0)
		encoding = "pkcs1";

	ret = software_key_determine_akcipher(encoding, ...

David

And can you cc: Denis Kenzior <[email protected]> too?

David

Actually, a better solution would be to set the encoding in the caller, say in asymmetric_verify() in digsig_asymmetric.c.

David