[lkml]   [2004]   [Oct]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Fw: signed kernel modules?

    > Write the code. Then come back and tell me it "isn't that hard".

    It isn't that hard.

    > Let me make this clear: I refuse to include any solution which doesn't
    > protect against accidental, as well as deliberate, corruption. This
    > means your "canonicalization" code has to be very, very paranoid about
    > not trusting the data until the signature is verified. The current code
    > does very simple checks then completely trusts the module contents,
    > especially the section headers: to make signatures worth anything, your
    > code must not do this.

    I've made a patch available to permit module signing in the kernel.

    I've also put up some example keys:

    The first two need to go into your kernel root dir; the third needs to go into

    key.h can be generated by something like:

    gpg --homedir /tmp --export --keyring ./ Red |
    scripts/bin2c ksign_def_public_key __initdata >crypto/signature/key.h

    You'll need to build the module extractor manually:

    make -C scripts/modsign mod-extract

    And sign modules manually:

    scripts/modsign/ net/rxrpc/rxrpc.ko

    I'd like to automate this in the kernel build process, but it's not
    immediately obvious how to do this with the kernel's current Makefile

    There's also the problem of how to get the keys in the first place. In the
    Fedora RPMs the spec file generates a single new key pair for every build and
    discards it later after generating key.h, but that may not be appropriate in
    all cases (you can have multiple keys, and you may want to get them from a GPG
    keyring somewhere).

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:07    [W:0.020 / U:52.372 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site