linux-kernel - Re: Should we automatically generate a module signing key at all?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+55aFxuSOdTXO4RNc48etA22dWttUumuPBm8YW_qyYHxLQpiQ@mail.gmail.com>
Date:	Tue, 19 May 2015 10:44:47 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Andy Lutomirski <luto@...nel.org>
Cc:	David Howells <dhowells@...hat.com>, Michal Marek <mmarek@...e.cz>,
	David Woodhouse <dwmw2@...radead.org>,
	Abelardo Ricart III <aricart@...nix.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Sedat Dilek <sedat.dilek@...il.com>, keyrings@...ux-nfs.org,
	Rusty Russell <rusty@...tcorp.com.au>,
	LSM List <linux-security-module@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>
Subject: Re: Should we automatically generate a module signing key at all?

On Mon, May 18, 2015 at 5:51 PM, Andy Lutomirski <luto@...nel.org> wrote:
>
> I think we should get rid of the idea of automatically generated signing
> keys entirely.  Instead I think we should generate, at build time, a list of
> all the module hashes and link that into vmlinux.

Ugh. I think that would be a mistake. It doesn't add any new security
(it's 100% equivalent to just using a throw-away key), and it adds new
complexity and a new ordering dependency.

Yes, yes, "throwing away the key" is a somewhat gray area, and just
unlinking the key-file without any secure erase in theory makes it
recoverable. In practice, though, it is fine. If you have an attacker
that has raw access to your disk and almost infinite resources, they
have easier ways to make your life miserable.

Even a non-secure unlinking of the temporary key file is going to make
things like rootkit authors give up on trying to recover it. Really.

So creating a whole new infrastructure that is more inconvenient than
just key signing and cannot be used to handle cases that key signing
*does* handle is definitely not worth it. It's technically the
inferior solution, and it's more work.

                Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/