Messages in this thread | | | From | David Howells <> | Subject | Re: Should we automatically generate a module signing key at all? | Date | Tue, 19 May 2015 17:23:19 +0100 |
| |
Theodore Ts'o <tytso@mit.edu> wrote:
> Is module signing really meant for distro kernels, or would anyone > besides people creating distro kernels care about this?
I think this is mainly for distro kernels where we need to provide certainty and security.
Fedora and RHEL make good use of this for their kernel modules and are now making use of it for kexec too. Kernel images are EFI objects - ie. signed PE files using Microsoft's spec.
Firmware validation isn't a consideration yet, but UEFI interaction is (UEFI keys, blacklists).
For my own purposes when running kernels on my test machines, I build kernels with all the necessary drivers built in and boot them directly out of the build tree by PXE. Then I copy any modules I'm testing by scp and use them. I don't generally use signed modules anymore because the modules aren't signed during the build phase but rather during the module installation phase (which isn't of any use to me). I'm not too worried about being attacked on those machines though as they're rebooted (or powered off) regularly and are crashed a lot.
> If not, maybe it's simpler just make things easy for people who will be > storing the key in some external hardware device, and just be done with it.
Did you mean make it possible to only use external hardware for storing the key? That wouldn't very convenient for building our kernels in our build farm - we have a lot of machines and all of them would have to be equiped with the key. Besides, we *want* to discard the private key where possible as soon as possible because then we can't leak it and we can't be forced to disclose it.
David
| |