On Tue, May 19, 2015 at 11:38 AM, David Woodhouse <[email protected]> wrote: > On Tue, 2015-05-19 at 11:12 -0700, Andy Lutomirski wrote: >> With your proposal, I need to trust that whoever built the actual >> running kernel image really did throw away the key. > > Ah right, that makes sense. > > So it might make sense to use the LSM hook for checking hashes then. > It's kind of orthogonal to the *signing* discussion though.
I think it's very much related. Quoting the original discussion that prompted this: On 05/18/2015 09:20 AM, Linus Torvalds wrote: > On Mon, May 18, 2015 at 9:04 AM, David Howells <[email protected]> wrote: >> >> Should we instead provide a script: >> >> ./scripts/generate-key >> >> That generates a key if run and make it so that the build fails if you turn >> on >> module signing and there's no key. > > That would just be stupid. > > I'm not ever applying a patch like that. That would absolutely destroy > the sane "git clean + rebuild" model. > > Why the hell would you want to make the sane case that people actually > *use* be harder to use. > > Nobody sane bothers with long-term keys. They are inconvenient and less > secure. > > Put the onus on making it inconvenient on those people who actually > have special keys, not on normal people. > If we use hashes instead of signatures on in-tree modules (at least in the case where no long-term key is provided), then generation of the temporary signing key stops being an issue because there is no longer a temporary signing key. Two birds, one stone :) --Andy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
