lkml.org 
[lkml]   [2012]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: RFC: sign the modules at install time
On Wed, Oct 17, 2012 at 5:54 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
>>
>> One of the main sane use-cases for module signing is:
>>
>> - CONFIG_CHECK_SIGNATURE=y
>> - randomly generated one-time key
>> - "make modules_install; make install"
>> - "make clean" to get rid of the keys.
>> - reboot.
>
> I want that too, but right now 'make clean' leaves the keys around,
> which seems a bit dangerous to me.

Oh, yes, we should make sure the key file gets cleaned up at "make clean".

I have to admit that I never do the whole "make clean/distclean" any
more, I have gotten so used to just going

git clean -dqfx

to get rid of all generated files in a git directory that I no longer
depend on the makefile getting it right for me.

Linus


\
 
 \ /
  Last update: 2012-10-18 06:01    [W:0.113 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site