lkml.org 
[lkml]   [2011]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 21/21] MODSIGN: Apply signature checking to modules on module load [ver #3]
> 
> Yes, there may be more than stripped and unstripped. You may need to
> do fancy things. But now, adding a signature is so easy that it's
> not a real problem. And we can always have a hook, like:
>
> if VARIANTS=`make-module-variants $MOD`; then
> for m in $VARIANTS; do sign $m >> $MOD; rm $m; done
> fi

but that requires you to keep the key around.
the most simple and common deployment of this is to generate a key,
build the public key into the kernel, sign the modules as you build the
kernel, and then destroy the key.
And THEN it gets deployed.


\
 
 \ /
  Last update: 2011-12-10 19:39    [W:0.077 / U:0.744 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site