Messages in this thread | | | From | Andy Lutomirski <> | Date | Tue, 19 May 2015 11:49:42 -0700 | Subject | Re: Should we automatically generate a module signing key at all? |
| |
On Tue, May 19, 2015 at 11:38 AM, David Woodhouse <dwmw2@infradead.org> wrote: > On Tue, 2015-05-19 at 11:12 -0700, Andy Lutomirski wrote: >> With your proposal, I need to trust that whoever built the actual >> running kernel image really did throw away the key. > > Ah right, that makes sense. > > So it might make sense to use the LSM hook for checking hashes then. > It's kind of orthogonal to the *signing* discussion though.
I think it's very much related. Quoting the original discussion that prompted this:
On 05/18/2015 09:20 AM, Linus Torvalds wrote: > On Mon, May 18, 2015 at 9:04 AM, David Howells <dhowells@redhat.com> wrote: >> >> Should we instead provide a script: >> >> ./scripts/generate-key >> >> That generates a key if run and make it so that the build fails if you turn on >> module signing and there's no key. > > That would just be stupid. > > I'm not ever applying a patch like that. That would absolutely destroy > the sane "git clean + rebuild" model. > > Why the hell would you want to make the sane case that people actually > *use* be harder to use. > > Nobody sane bothers with long-term keys. They are inconvenient and less secure. > > Put the onus on making it inconvenient on those people who actually > have special keys, not on normal people. >
If we use hashes instead of signatures on in-tree modules (at least in the case where no long-term key is provided), then generation of the temporary signing key stops being an issue because there is no longer a temporary signing key.
Two birds, one stone :)
--Andy
| |