[lkml]   [2012]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [RFC v2 7/7] modsig: build rules and scripts to generate keys and sign modules
    On Wed, Aug 15, 2012 at 2:43 PM, Dmitry Kasatkin
    <> wrote:
    > This patch adds build rules and scripts to generate keys and sign modules.
    > Two scripts has been added. is used to generate private and
    > public keys. is used to sign kernel modules. Both scripts
    > use only standard utilites from coreutils and additionally requires
    > openssl tool for RSA keys creation and signing.
    > The patch modifies 'modules_install' target and adds two new targets to
    > the main kernel Makefile.
    > 1. signed_modules_install
    > This target creates an ephemeral key pair, signs the kernel modules with
    > the private key, destroys the private key, and embeds the public key in
    > the kernel. (Thanks to Dave Hansen for the target name.)

    This requires CONFIG_INTEGRITY_MODULES to be enabled to actually do
    anything useful with the signed modules, correct?

    > 2. modules_install
    > When CONFIG_INTEGRITY_MODULES is enabled, this target uses an existing
    > private key to sign kernel modules.

    If the answer to the above question is yes, then why can't we stick
    with a single modules_install command for signing? It would seem to me
    that calling signed_modules_install could use an existing key or
    generate an ephemeral key in the absence of one and install the signed
    modules, and modules_install would simply install unsigned modules.

    Or, alternatively, just make modules_install sign or not sign depending
    on whether CONFIG_INTEGRITY_MODULES is enabled. I don't see why you
    would overload a target or create two different ones when both depend
    on that option.

    Could you explain the reasoning behind that a bit more?


     \ /
      Last update: 2012-08-16 21:41    [W:0.029 / U:24.176 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site