[lkml]   [2004]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Fw: signed kernel modules?
    On Mon, 2004-10-11 at 16:11 +0100, David Howells wrote:
    > > Sign the whole thing. Use a signature format which doesn't suck (ASN1
    > > parsing in the kernel? Hmm...). Have your build system spit out two
    > > RPMs, one with full debug modules, and one without. This is not rocket
    > > science.
    > You make it sound so simple...
    > I've adapted my patches to sign the whole thing

    Why on earth would you want to sign the whole thing? As you've observed,
    that means the signature gets broken when the debug info is stripped,
    etc. Sign just what the kernel actually _looks_ at, nothing more.

    Signing the whole thing is just silly. If you're going to include random
    extra irrelevant stuff like comment sections and debug info, then you
    might as well include the inode number and device on which the .ko file
    is stored too -- so it breaks when you 'cp' it.

    > 'cos I know you're just going to fight it otherwise[*]:-)


    > [*] You're still wrong, of course, but that's your prerogative:-)

    That doesn't mean you have to pander to him.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:06    [W:0.043 / U:6.708 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site