[lkml]   [2013]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC 2/2] initramfs with digital signature protection
On Tue, Feb 05, 2013 at 11:55:09PM +0200, Kasatkin, Dmitry wrote:

> > Also I am assuming that from signed initramfs, keys will be loaded in
> > appropriate keyrings and then keyring will be locked so that any
> > tools from unsigned initramfs can not load additional keys.
> >
> Exactly like that.


[ Following up on this thread after a very long time ]

I was thinking about this point that keys can be loaded from signed
initramfs. But how is it better than embedding the keys in kernel the
way we do for module signing and lock down ima keyring before control
is passed to initramfs.

Reason being, that anyway a user can not put its own keys in signed
initramfs. Signed initramfs will be shipped by distribution. So then
it does not matter whether distribution's keys are embedded in the
kernel or are loaded from signed initramfs.


 \ /
  Last update: 2013-04-05 16:41    [W:0.171 / U:2.608 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site