[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALCETrVBwmVncxf_SA84gKfYtSbPp+7yhh2Z_oxtTZ7MbywbMw@mail.gmail.com>
Date: Tue, 19 May 2015 11:49:42 -0700
From: Andy Lutomirski <luto@...capital.net>
To: David Woodhouse <dwmw2@...radead.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
Andy Lutomirski <luto@...nel.org>,
David Howells <dhowells@...hat.com>,
Michal Marek <mmarek@...e.cz>,
Abelardo Ricart III <aricart@...nix.com>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Sedat Dilek <sedat.dilek@...il.com>, keyrings@...ux-nfs.org,
Rusty Russell <rusty@...tcorp.com.au>,
LSM List <linux-security-module@...r.kernel.org>,
Borislav Petkov <bp@...en8.de>, Jiri Kosina <jkosina@...e.cz>
Subject: Re: Should we automatically generate a module signing key at all?
On Tue, May 19, 2015 at 11:38 AM, David Woodhouse <dwmw2@...radead.org> wrote:
> On Tue, 2015-05-19 at 11:12 -0700, Andy Lutomirski wrote:
>> With your proposal, I need to trust that whoever built the actual
>> running kernel image really did throw away the key.
>
> Ah right, that makes sense.
>
> So it might make sense to use the LSM hook for checking hashes then.
> It's kind of orthogonal to the *signing* discussion though.
I think it's very much related. Quoting the original discussion that
prompted this:
On 05/18/2015 09:20 AM, Linus Torvalds wrote:
> On Mon, May 18, 2015 at 9:04 AM, David Howells <dhowells@...hat.com> wrote:
>>
>> Should we instead provide a script:
>>
>> ./scripts/generate-key
>>
>> That generates a key if run and make it so that the build fails if you turn on
>> module signing and there's no key.
>
> That would just be stupid.
>
> I'm not ever applying a patch like that. That would absolutely destroy
> the sane "git clean + rebuild" model.
>
> Why the hell would you want to make the sane case that people actually
> *use* be harder to use.
>
> Nobody sane bothers with long-term keys. They are inconvenient and less secure.
>
> Put the onus on making it inconvenient on those people who actually
> have special keys, not on normal people.
>
If we use hashes instead of signatures on in-tree modules (at least in
the case where no long-term key is provided), then generation of the
temporary signing key stops being an issue because there is no longer
a temporary signing key.
Two birds, one stone :)
--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists