Messages in this thread | | | Date | Tue, 19 May 2015 10:44:47 -0700 | Subject | Re: Should we automatically generate a module signing key at all? | From | Linus Torvalds <> |
| |
On Mon, May 18, 2015 at 5:51 PM, Andy Lutomirski <luto@kernel.org> wrote: > > I think we should get rid of the idea of automatically generated signing > keys entirely. Instead I think we should generate, at build time, a list of > all the module hashes and link that into vmlinux.
Ugh. I think that would be a mistake. It doesn't add any new security (it's 100% equivalent to just using a throw-away key), and it adds new complexity and a new ordering dependency.
Yes, yes, "throwing away the key" is a somewhat gray area, and just unlinking the key-file without any secure erase in theory makes it recoverable. In practice, though, it is fine. If you have an attacker that has raw access to your disk and almost infinite resources, they have easier ways to make your life miserable.
Even a non-secure unlinking of the temporary key file is going to make things like rootkit authors give up on trying to recover it. Really.
So creating a whole new infrastructure that is more inconvenient than just key signing and cannot be used to handle cases that key signing *does* handle is definitely not worth it. It's technically the inferior solution, and it's more work.
Linus
| |