Messages in this thread | | | Subject | Re: Allow automatic kernel taint on unsigned module load to be disabled | From | Ben Hutchings <> | Date | Tue, 29 Aug 2017 23:02:02 +0100 |
| |
On Tue, 2017-08-29 at 13:22 -0700, Matthew Garrett wrote: > > On Tue, Aug 29, 2017 at 10:56 AM, Jessica Yu <jeyu@kernel.org> wrote: > > I understand what the patch is doing, what I don't yet understand is > > _why_ you would want to remove the unsigned module taint when > > CONFIG_MODULE_SIG is enabled. Which distributions are asking for this > > exactly, and for what use cases? I find it a bit contradictory to have > > CONFIG_MODULE_SIG enabled and at the same time expect the kernel to > > behave as if the option wasn't enabled. > > Debian disable CONFIG_MODULE_SIG because of this additional taint > (I've Cc:ed Ben who made this change).
The current state of affairs is that Debian doesn't have the mechanism in place to sign modules with a trusted key. If we were to allow third parties to add signatures in some way (I think that's what Matthew's interested in doing) we would have to enabled CONFIG_MODULE_SIG, but that would cause modules to be tainted by default.
> > I would really prefer not to add extra code to remove what is cosmetic > > and still has informational/debug value. If the unsigned module taint > > is for whatever reason that bothersome, why can't distro(s) carry a > > 2-line patch removing the message and taint for those particular > > setups where signatures are considered "irrelevant" even with > > CONFIG_MODULE_SIG=y? > > If it's functionality that distributions want to patch out, it makes > sense to provide them with a config option rather than forcing them to > maintain a patch separately.
We could use this in Debian. It would likely be a temporary stage until we do our own centralised module signing (or someone implements a Merkle tree for in-tree modules).
Ben.
-- Ben Hutchings Teamwork is essential - it allows you to blame someone else.
[unhandled content-type:application/pgp-signature] | |