[lkml]   [2004]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Fw: signed kernel modules?
On Mon, 2004-10-11 at 16:11 +0100, David Howells wrote:
> > Sign the whole thing. Use a signature format which doesn't suck (ASN1
> > parsing in the kernel? Hmm...). Have your build system spit out two
> > RPMs, one with full debug modules, and one without. This is not rocket
> > science.
> You make it sound so simple...
> I've adapted my patches to sign the whole thing

Why on earth would you want to sign the whole thing? As you've observed,
that means the signature gets broken when the debug info is stripped,
etc. Sign just what the kernel actually _looks_ at, nothing more.

Signing the whole thing is just silly. If you're going to include random
extra irrelevant stuff like comment sections and debug info, then you
might as well include the inode number and device on which the .ko file
is stored too -- so it breaks when you 'cp' it.

> 'cos I know you're just going to fight it otherwise[*]:-)


> [*] You're still wrong, of course, but that's your prerogative:-)

That doesn't mean you have to pander to him.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:06    [W:0.140 / U:49.128 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site