lkml.org 
[lkml]   [2015]   [May]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [RFD] linux-firmware key arrangement for firmware signing
Date
On Thu, 2015-05-21 at 10:02 -0700, gregkh@linuxfoundation.org wrote:
>
> Again, why have a detached signature and not just part of the firmware
> blob? The device needs to be caring about this, not the kernel.
>
> Do other operating systems have this type of "feature"?

Yes. Windows effectively does by virtue of the fact that it ships he
firmware *with* the driver and even if it's in a separate file (which
it often isn't), the signed manifest covers it all together.

Look at it this way: If you don't have an IOMMU, then signing modules
is *utterly* pointless unless you also sign firmware. A rogue device
can do *anything*.

We really do want firmware signing for the *OS*, not just for
regulatory issues and other vendor-interest stuff which was Luis's
original focus.

--
David Woodhouse Open Source Technology Centre
David.Woodhouse@intel.com Intel Corporation
[unhandled content-type:application/x-pkcs7-signature]
\
 
 \ /
  Last update: 2015-05-21 21:41    [W:0.066 / U:0.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site