Messages in this thread | | | From | Andy Lutomirski <> | Date | Tue, 19 May 2015 10:58:06 -0700 | Subject | Re: Should we automatically generate a module signing key at all? |
| |
On Tue, May 19, 2015 at 10:44 AM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > On Mon, May 18, 2015 at 5:51 PM, Andy Lutomirski <luto@kernel.org> wrote: >> >> I think we should get rid of the idea of automatically generated signing >> keys entirely. Instead I think we should generate, at build time, a list of >> all the module hashes and link that into vmlinux. > > Ugh. I think that would be a mistake. It doesn't add any new security > (it's 100% equivalent to just using a throw-away key), and it adds new > complexity and a new ordering dependency. > > Yes, yes, "throwing away the key" is a somewhat gray area, and just > unlinking the key-file without any secure erase in theory makes it > recoverable. In practice, though, it is fine. If you have an attacker > that has raw access to your disk and almost infinite resources, they > have easier ways to make your life miserable.
Throwing away the key is outright impossible in some contexts.
https://wiki.debian.org/ReproducibleBuilds
--Andy
| |