Messages in this thread | | | Subject | Re: Should we automatically generate a module signing key at all? | From | David Woodhouse <> | Date | Tue, 19 May 2015 21:25:05 +0100 |
| |
On Tue, 2015-05-19 at 13:05 -0700, Andy Lutomirski wrote: > > I appreciate why that's a problem in your scenario, but it's a valid and > > useful feature of signatures, and I don't think we can just abandon it. > > True, but I'd consider that use case (running a kernel built on a > development machine) to be more in line with unsigned use or long-term > (maybe medium-term) signing keys. > > IOW, for this use case, running scripts/generate_module_signing_key or > whatever and configuring accordingly seems entirely reasonable to me. > Or you could just turn off forced module signature verification since > keeping the signing key in plaintext on your machine mostly negates > any benefit of verifying signatures on that machine at runtime.
Perhaps so (although it's ignoring use cases where the build tree is somewhere secure and internal and I'm deploying to a server which is more accessible).
But we already *fixed* the problem of generating the signing key automatically. The in-tree signing_key.{priv,x509} are always transient auto-generated files now, and the ambiguity is gone. As a side-effect of what I was already doing to enable PKCS#11. It was mostly just a documentation change.
So I'm not sure I see the point of ditching it, now that it's working.
-- David Woodhouse Open Source Technology Centre David.Woodhouse@intel.com Intel Corporation
| |