lkml.org 
[lkml]   [2015]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Should we automatically generate a module signing key at all?
On Tue, May 19, 2015 at 11:38 AM, David Woodhouse <dwmw2@infradead.org> wrote:
> On Tue, 2015-05-19 at 11:12 -0700, Andy Lutomirski wrote:
>> With your proposal, I need to trust that whoever built the actual
>> running kernel image really did throw away the key.
>
> Ah right, that makes sense.
>
> So it might make sense to use the LSM hook for checking hashes then.
> It's kind of orthogonal to the *signing* discussion though.

I think it's very much related. Quoting the original discussion that
prompted this:

On 05/18/2015 09:20 AM, Linus Torvalds wrote:
> On Mon, May 18, 2015 at 9:04 AM, David Howells <dhowells@redhat.com> wrote:
>>
>> Should we instead provide a script:
>>
>> ./scripts/generate-key
>>
>> That generates a key if run and make it so that the build fails if you turn on
>> module signing and there's no key.
>
> That would just be stupid.
>
> I'm not ever applying a patch like that. That would absolutely destroy
> the sane "git clean + rebuild" model.
>
> Why the hell would you want to make the sane case that people actually
> *use* be harder to use.
>
> Nobody sane bothers with long-term keys. They are inconvenient and less secure.
>
> Put the onus on making it inconvenient on those people who actually
> have special keys, not on normal people.
>

If we use hashes instead of signatures on in-tree modules (at least in
the case where no long-term key is provided), then generation of the
temporary signing key stops being an issue because there is no longer
a temporary signing key.

Two birds, one stone :)

--Andy


\
 
 \ /
  Last update: 2015-05-19 21:21    [W:2.361 / U:0.456 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site