Messages in this thread | | | Date | Wed, 17 Oct 2012 17:54:32 -0700 | From | Greg KH <> | Subject | Re: RFC: sign the modules at install time |
| |
On Wed, Oct 17, 2012 at 03:44:28PM -0700, Linus Torvalds wrote: > On Wed, Oct 17, 2012 at 3:19 PM, David Howells <dhowells@redhat.com> wrote: > > > > It's probably even better to just get rid of all the automatic module signing > > stuff completely and leave the sign-file script for the builder to use > > manually. The module verification code will still be present. > > That's just disgusting crazy talk. > > Christ, David, get a grip on yourself. You seem to dismiss the "people > want to build their own kernel" people entirely. > > One of the main sane use-cases for module signing is: > > - CONFIG_CHECK_SIGNATURE=y > - randomly generated one-time key > - "make modules_install; make install" > - "make clean" to get rid of the keys. > - reboot.
I want that too, but right now 'make clean' leaves the keys around, which seems a bit dangerous to me.
David, why aren't the keys cleaned up as well? Was that on purpose or just an oversight?
thanks,
greg k-h
| |