Messages in this thread | | | From | Rusty Russell <> | Subject | Re: RFC: sign the modules at install time | Date | Thu, 18 Oct 2012 15:04:26 +1030 |
| |
Linus Torvalds <torvalds@linux-foundation.org> writes: > On Wed, Oct 17, 2012 at 5:54 PM, Greg KH <gregkh@linuxfoundation.org> wrote: >>> >>> One of the main sane use-cases for module signing is: >>> >>> - CONFIG_CHECK_SIGNATURE=y >>> - randomly generated one-time key >>> - "make modules_install; make install" >>> - "make clean" to get rid of the keys. >>> - reboot. >> >> I want that too, but right now 'make clean' leaves the keys around, >> which seems a bit dangerous to me. > > Oh, yes, we should make sure the key file gets cleaned up at "make clean".
I left it at distclean, figuring the temporary key is a bit like the .config. But it's trivial to change if people think that's unnatural.
Cheers, Rusty.
| |