On Thu, Nov 9, 2023 at 8:29 AM Josh Boyer <jwboyer(a)fedoraproject.org> wrote:
On Thu, Nov 9, 2023 at 8:23 AM Prarit Bhargava <prarit(a)redhat.com> wrote:
>
> On 11/9/23 08:13, Josh Boyer wrote:
> > On Thu, Nov 9, 2023 at 8:03 AM Prarit Bhargava <prarit(a)redhat.com>
wrote:
> >>
> >> On 11/8/23 08:33, Prarit Bhargava wrote:
> >>> Hey everyone,
> >>>
> >>> The current kernel configs generate
> >>>
> >>> # CONFIG_MODULE_SIG_FORCE is not set
> >>> CONFIG_MODULE_SIG_ALL=y
> >>> # CONFIG_MODULE_SIG_SHA256 is not set
> >>> # CONFIG_MODULE_SIG_SHA384 is not set
> >>> CONFIG_MODULE_SIG_SHA512=y
> >>> # CONFIG_MODULE_SIG_SHA3_256 is not set
> >>> # CONFIG_MODULE_SIG_SHA3_384 is not set
> >>> # CONFIG_MODULE_SIG_SHA3_512 is not set
> >>> CONFIG_MODULE_SIG_HASH="sha512"
> >>>
> >>> With
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2802
> >>>
> >>> we can strengthen the module signing algorithm to
> >>> CONFIG_MODULE_SIG_SHA3_512.
> >>>
> >>> I'd like to do this before Fedora40, as it will be the basis of
> >>> centos-stream-10 and RHEL10.
> >>>
> >>> Thoughts or concerns?
> >>>
> >>> P.
> >>
> >> I took a closer look at this and there doesn't appear to be an issue
> >> with doing this in the kernel. Build times and boot times seem
> >> consistent before and after the change.
> >>
> >> However, depmod (from kmod) needs an update if we make this change. The
> >> current fedora version of kmod, -31, segfaults in the modules_install
> >> target. I ran the latest upstream version of kmod and AFAICT that works.
> >>
> >> I will wait for kmod to be updated to at least version -32 and then
> >> request that we change the module signing algorithm to SHA3_512, unless
> >> there any objections.
> >
> > The latest kmod in fedora is -30. I was just looking at packaging -31
> > today. Are the above version numbers typos, or did you get kmod from
> > somewhere else?
> >
>
> Whoops. Yep, typos. Sorry, off by one in my brain.
OK, thanks. I might look at the commits beyond -31 and see about
adding them if they aren't too much of a departure from the release.