Messages in this thread | | | Date | Tue, 19 May 2015 10:53:19 -0700 | Subject | Re: Should we automatically generate a module signing key at all? | From | Linus Torvalds <> |
| |
On Tue, May 19, 2015 at 10:43 AM, Andy Lutomirski <luto@amacapital.net> wrote: > > If it weren't a giant PITA, I would consider enabling module signing, > but I don't see much point on my system since I don't have secure boot > and I think it's misguided that kernel mode code should be considered > more important to protect than fully privileged user-space code.
What PITA?
Do this:
CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_FORCE=y CONFIG_MODULE_SIG_ALL=y
and you're done. You don't need to do anythign else. There's no PITA. It just works. I do this in my /etc/kernel-config, so *all* the kernels I build and boot hjave this, and I never even have think about it, much less have to do anything special. I don't even bother removing the key consciously, because I end up doing "git clean -dqfx ; make allmodconfig ; make -j16" so many times a day during the merge window anyway that it doesn't last.
Enabling those three config options makes the build generate the key for you, and assuming you just remove the key after the build/install (incidentally like I do, or consciously like you *should* do it), it makes your kernel as secure as if you were to just build everything into the kernel.
Is it going to fix any *other* security issues? No. But it does mean that if you somehow have a security issue, the attacker is going to have a *much* harder time to install a rootkit kernel module that actively hides the attack from you.
And that is not some theoretical concern. There's been multiple cases of that.
Linus
| |