On 15.08.2018 22:47, Linus Torvalds wrote: > It basically says: we don't allow modules that weren't built with the > kernel. Adding a new key later and signing a module with it violates > that premise.
Considering the following scenario: A user is running a distro kernel, which is built by the distro, and has the distro signing key builtin (i.e. fedora). Now, the user has taken ownership of their system and provisioned their own platform key. Accordingly, the user signs the distro kernel with their own key. If I understand you correctly, modules signed by the users own key, but not signed with the distro key, will stop working in this case? IMO, this is not okay. The layer of trust should extend from the bottom (user-provisioned platform key) up. Only trusting the kernel builtin key later on (wrt. kernel modules) contradicts this principal. Yannik
